@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/resources/models/custom-service-implementations.backend.definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom-service-implementations.backend.definition.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/custom-service-implementations.backend.definition.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AA0DxK,eAAO,MAAM,2CAA2C,EAAG,0CAA0C,EAuGpG,CAAA"}
+{"version":3,"file":"custom-service-implementations.backend.definition.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/custom-service-implementations.backend.definition.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AA+DxK,eAAO,MAAM,2CAA2C,EAAG,0CAA0C,EAgHpG,CAAA"}

package/dist/esm/resources/models/custom-service-implementations.backend.definition.js

@@ -6,6 +6,8 @@ import { authCustomImplementations } from '../../security/authentications/servic
 import { createAuditLogsExportFactories } from '../../compliance/audit-trails/audit-logs.custom-impl.backend.service.js';
 import { createOrganizationCreateFactories, createOrganizationLifecycleFactories } from '../../organizations/services/organization-custom-implementation.backend.service.js';
 import { createOrganizationDeletionAuditFactories } from '../../organizations/services/organization-deletion-audit.custom-impl.backend.service.js';
+import { createOrganizationProviderCredentialFactories } from '../../security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.js';
+import { createUserProviderCredentialFactories } from '../../security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.js';
 import { createEngineResourceStatusTransitionFactories } from '../../base-classes/services/services/resource-status-transition.definitions.backend.js';
 import { createOrganizationMemberCreateFactories } from '../../organizations/services/organization-member-custom-implementation.backend.service.js';
 import { createPlatformAccessGrantFactories } from '../../security/authorizations/platform-access-grant-custom-implementation.backend.service.js';
@@ -14,10 +16,11 @@ import { createOrganizationUnitMemberCreateFactories, createOrganizationUnitMemb
 import { createInboundContactCreateFactories } from '../../users/services/inbound-contact-custom-implementation.backend.service.js';
 import { createUserCoreRoleCeilingFactories, createUserRoleSetOperationFactories, } from '../../users/services/user-role-administration.custom-impl.backend.service.js';
 import { createUserForcePasswordResetFactories } from '../../users/services/user-force-password-reset.custom-impl.backend.service.js';
+import { createUserReadRetainedFactories } from '../../users/services/user-read-retained.custom-impl.backend.service.js';
 import { createUserDeletionAuditFactories } from '../../users/services/user-deletion-audit.custom-impl.backend.service.js';
 import { createUserSuperAdminFloorFactories } from '../../users/services/user-super-admin-floor.custom-impl.backend.service.js';
-import { createApiKeyCreateFactories, createApiKeyRotateFactories, createApiKeyRegenerateFactories, createApiKeyExtendExpiryFactories, createApiKeyUsageStatsFactories, createApiKeyDeactivateFactories, createApiKeyReactivateFactories, } from '../../security/api-keys/api-keys.custom-impl.backend.service.js';
-import { createOAuthClientCreateFactories, createOAuthClientRotateFactories, createOAuthClientRegenerateFactories, } from '../../security/oauth-clients/oauth-clients.custom-impl.backend.service.js';
+import { createApiKeyCreateFactories, createApiKeyRotateFactories, createApiKeyRegenerateFactories, createApiKeyExtendExpiryFactories, createApiKeyUsageStatsFactories, createApiKeyDeactivateFactories, createApiKeyExpireFactories, createApiKeyReactivateFactories, } from '../../security/api-keys/api-keys.custom-impl.backend.service.js';
+import { createOAuthClientCreateFactories, createOAuthClientRotateFactories, createOAuthClientExpireFactories, createOAuthClientRegenerateFactories, } from '../../security/oauth-clients/oauth-clients.custom-impl.backend.service.js';
 import { createScopeFeaturesCacheInvalidationFactories } from '../../features/services/scope-features-cache-invalidation.custom-impl.backend.service.js';
 import { createSiemExportConfigCacheInvalidationFactories } from '../../compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js';
 import { createOrganizationFeaturesAdminWritePathFactories } from '../../features/services/organization-features-admin-write-path.custom-impl.backend.service.js';
@@ -43,6 +46,10 @@ export const CoreBackend_ServiceImplementationsFactories = [
     // the privileged cross-tenant route unaudited. Post-commit by construction; reads the pre-deletion
     // snapshot because `name` / `slug` are unrecoverable once the row is gone.
     ...createOrganizationDeletionAuditFactories(),
+    // Seals every organization provider credential on write, and audits the grant lifecycle. Without
+    // this registration the resource stores plaintext secrets behind a route that still answers 200.
+    ...createOrganizationProviderCredentialFactories(),
+    ...createUserProviderCredentialFactories(),
     ...createOrganizationMemberCreateFactories(),
     // PLATFORM_ACCESS_GRANTS — the four lifecycle transitions. Every field that carries the
     // time-bound/justified/tenant-scoped guarantee (`operatorUserId`, `status`, `expiresAt`,
@@ -91,6 +98,8 @@ export const CoreBackend_ServiceImplementationsFactories = [
     // and the declared `{ resetToken, resetUrl }` response could never be produced (that handback
     // is now gone — it was an account-takeover primitive).
     ...createUserForcePasswordResetFactories(),
+    // #490 — the operator surface for the audited see-through read of a RETAINED user row.
+    ...createUserReadRetainedFactories(),
     // USERS DELETE — emits USER_DELETED. The event type and its SIEM classification existed from the
     // start but NOTHING produced them, so identity destruction left no evidence at all. Post-commit
     // by construction; reads the pre-deletion snapshot because `email` / `appRoles` are unrecoverable
@@ -108,10 +117,13 @@ export const CoreBackend_ServiceImplementationsFactories = [
     ...createApiKeyUsageStatsFactories(),
     ...createApiKeyDeactivateFactories(),
     ...createApiKeyReactivateFactories(),
+    // ACTIVE → EXPIRED, dispatched only by the credential-expiry sweep (#413).
+    ...createApiKeyExpireFactories(),
     // OAuth Clients (registered client-credentials front — mirrors API Keys mint pipeline)
     ...createOAuthClientCreateFactories(),
     ...createOAuthClientRotateFactories(),
     ...createOAuthClientRegenerateFactories(),
+    ...createOAuthClientExpireFactories(),
     ...createOrganizationFeaturesAdminWritePathFactories(),
     ...createApplicationFeaturesAdminWritePathFactories(),
     ...createScopeFeaturesCacheInvalidationFactories(),

package/dist/esm/resources/models/custom-service-implementations.backend.definition.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-service-implementations.backend.definition.js","sourceRoot":"","sources":["../../../../../src/resources/models/custom-service-implementations.backend.definition.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4EAA4E,CAAC;AAC3H,OAAO,EAAE,4BAA4B,EAAE,MAAM,wFAAwF,CAAC;AACtI,OAAO,EAAE,8BAA8B,EAAE,MAAM,+EAA+E,CAAC;AAC/H,OAAO,EAAE,oCAAoC,EAAE,MAAM,uFAAuF,CAAC;AAC7I,OAAO,EAAE,yBAAyB,EAAE,MAAM,uGAAuG,CAAC;AAClJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,mFAAmF,CAAC;AACnI,OAAO,EAAE,iCAAiC,EAAE,oCAAoC,EAAE,MAAM,8FAA8F,CAAC;AACvL,OAAO,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAC7J,OAAO,EAAE,6CAA6C,EAAE,MAAM,kGAAkG,CAAC;AACjK,OAAO,EAAE,uCAAuC,EAAE,MAAM,qGAAqG,CAAC;AAC9J,OAAO,EAAE,kCAAkC,EAAE,MAAM,wGAAwG,CAAC;AAC5J,OAAO,EACL,yCAAyC,EACzC,oDAAoD,EACpD,mCAAmC,EACnC,+CAA+C,EAC/C,qCAAqC,GACtC,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EACL,2CAA2C,EAC3C,2CAA2C,EAC3C,2CAA2C,GAC5C,MAAM,0GAA0G,CAAC;AAClH,OAAO,EAAE,mCAAmC,EAAE,MAAM,yFAAyF,CAAC;AAC9I,OAAO,EACL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,wFAAwF,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,yFAAyF,CAAC;AAChJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,mFAAmF,CAAC;AACrI,OAAO,EAAE,kCAAkC,EAAE,MAAM,sFAAsF,CAAC;AAC1I,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,2EAA2E,CAAC;AACnF,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,qFAAqF,CAAC;AAC7F,OAAO,EAAE,6CAA6C,EAAE,MAAM,oGAAoG,CAAC;AACnK,OAAO,EAAE,gDAAgD,EAAE,MAAM,uHAAuH,CAAC;AACzL,OAAO,EAAE,iDAAiD,EAAE,MAAM,yGAAyG,CAAC;AAC5K,OAAO,EAAE,gDAAgD,EAAE,MAAM,wGAAwG,CAAC;AAC1K,OAAO,EAAE,yCAAyC,EAAE,MAAM,mHAAmH,CAAC;AAC9K,OAAO,EACL,yCAAyC,EACzC,4CAA4C,GAC7C,MAAM,kHAAkH,CAAC;AAC1H,OAAO,EAAE,wCAAwC,EAAE,MAAM,sHAAsH,CAAC;AAGhL,MAAM,CAAC,MAAM,2CAA2C,GAAkD;IACxG,GAAG,6BAA6B;IAChC,GAAG,4BAA4B;IAC/B,GAAG,oCAAoC;IACvC,GAAG,8BAA8B;IACjC,GAAG,yBAAyB;IAC5B,GAAG,iCAAiC,EAAE;IACtC,iGAAiG;IACjG,uEAAuE;IACvE,GAAG,oCAAoC,EAAE;IACzC,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;IAC5F,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,2EAA2E;IAC3E,GAAG,wCAAwC,EAAE;IAC7C,GAAG,uCAAuC,EAAE;IAC5C,wFAAwF;IACxF,yFAAyF;IACzF,mGAAmG;IACnG,sFAAsF;IACtF,GAAG,kCAAkC,EAAE;IACvC,2FAA2F;IAC3F,6DAA6D;IAC7D,GAAG,oDAAoD,EAAE;IACzD,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,GAAG,yCAAyC,EAAE;IAC9C,GAAG,qCAAqC,EAAE;IAC1C,GAAG,mCAAmC,EAAE;IACxC,GAAG,+CAA+C,EAAE;IACpD,yFAAyF;IACzF,8FAA8F;IAC9F,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,gGAAgG;IAChG,iEAAiE;IACjE,GAAG,2CAA2C,EAAE;IAChD,GAAG,2CAA2C,EAAE;IAChD,GAAG,2CAA2C,EAAE;IAChD,iGAAiG;IACjG,0DAA0D;IAC1D,wFAAwF;IACxF,8DAA8D;IAC9D,GAAG,6CAA6C,EAAE;IAClD,4EAA4E;IAC5E,8EAA8E;IAC9E,GAAG,mCAAmC,EAAE;IACxC,iGAAiG;IACjG,iGAAiG;IACjG,iGAAiG;IACjG,mFAAmF;IACnF,GAAG,mCAAmC,EAAE;IACxC,GAAG,kCAAkC,EAAE;IACvC,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,8FAA8F;IAC9F,uDAAuD;IACvD,GAAG,qCAAqC,EAAE;IAC1C,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,wBAAwB;IACxB,GAAG,gCAAgC,EAAE;IACrC,6FAA6F;IAC7F,mGAAmG;IACnG,mGAAmG;IACnG,iFAAiF;IACjF,GAAG,kCAAkC,EAAE;IACvC,GAAG,2BAA2B,EAAE;IAChC,GAAG,2BAA2B,EAAE;IAChC,GAAG,+BAA+B,EAAE;IACpC,GAAG,iCAAiC,EAAE;IACtC,GAAG,+BAA+B,EAAE;IACpC,GAAG,+BAA+B,EAAE;IACpC,GAAG,+BAA+B,EAAE;IACpC,uFAAuF;IACvF,GAAG,gCAAgC,EAAE;IACrC,GAAG,gCAAgC,EAAE;IACrC,GAAG,oCAAoC,EAAE;IACzC,GAAG,iDAAiD,EAAE;IACtD,GAAG,gDAAgD,EAAE;IACrD,GAAG,6CAA6C,EAAE;IAClD,GAAG,gDAAgD,EAAE;IACrD,GAAG,8BAA8B,EAAE;IACnC,8EAA8E;IAC9E,uEAAuE;IACvE,wEAAwE;IACxE,GAAG,yCAAyC,EAAE;IAC9C,GAAG,yCAAyC,EAAE;IAC9C,GAAG,4CAA4C,EAAE;IACjD,qFAAqF;IACrF,yFAAyF;IACzF,0FAA0F;IAC1F,oBAAoB;IACpB,GAAG,wCAAwC,EAAE;CAC9C,CAAA","sourcesContent":["import { z } from 'zod';\nimport type { ResourceConfiguration_Operation } from '@wildo-ai/saas-models';\nimport type { ResourceOperationCustomImplementationBase } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { userSelfCustomImplementations } from '~wildo-backend-lib/users/services/user-self-custom-implementations.backend';\nimport { billingCustomImplementations } from '~wildo-backend-lib/billing/services/custom-impl/billing-custom-implementations.backend';\nimport { lifecycleCustomImplementations } from '~wildo-backend-lib/guidance/services/lifecycle-custom-implementations.backend';\nimport { scopedStateReadCustomImplementations } from '~wildo-backend-lib/guidance/services/scoped-state-read-custom-implementations.backend';\nimport { authCustomImplementations } from '~wildo-backend-lib/security/authentications/services/custom-impls/auth-custom-implementations.backend';\nimport { createAuditLogsExportFactories } from '~wildo-backend-lib/compliance/audit-trails/audit-logs.custom-impl.backend.service';\nimport { createOrganizationCreateFactories, createOrganizationLifecycleFactories } from '~wildo-backend-lib/organizations/services/organization-custom-implementation.backend.service';\nimport { createOrganizationDeletionAuditFactories } from '~wildo-backend-lib/organizations/services/organization-deletion-audit.custom-impl.backend.service';\nimport { createEngineResourceStatusTransitionFactories } from '~wildo-backend-lib/base-classes/services/services/resource-status-transition.definitions.backend';\nimport { createOrganizationMemberCreateFactories } from '~wildo-backend-lib/organizations/services/organization-member-custom-implementation.backend.service';\nimport { createPlatformAccessGrantFactories } from '~wildo-backend-lib/security/authorizations/platform-access-grant-custom-implementation.backend.service';\nimport {\n  createOrganizationUnitCreatePathFactories,\n  createOrganizationUnitDeleteDependentsGuardFactories,\n  createOrganizationUnitMoveFactories,\n  createOrganizationUnitStatusTransitionFactories,\n  createOrganizationUnitUpdateFactories,\n} from '~wildo-backend-lib/organizations/services/organization-unit-custom-implementation.backend.service';\nimport {\n  createOrganizationUnitMemberCreateFactories,\n  createOrganizationUnitMemberDeleteFactories,\n  createOrganizationUnitMemberUpdateFactories,\n} from '~wildo-backend-lib/organizations/services/organization-unit-member-custom-implementation.backend.service';\nimport { createInboundContactCreateFactories } from '~wildo-backend-lib/users/services/inbound-contact-custom-implementation.backend.service';\nimport {\n  createUserCoreRoleCeilingFactories,\n  createUserRoleSetOperationFactories,\n} from '~wildo-backend-lib/users/services/user-role-administration.custom-impl.backend.service';\nimport { createUserForcePasswordResetFactories } from '~wildo-backend-lib/users/services/user-force-password-reset.custom-impl.backend.service';\nimport { createUserDeletionAuditFactories } from '~wildo-backend-lib/users/services/user-deletion-audit.custom-impl.backend.service';\nimport { createUserSuperAdminFloorFactories } from '~wildo-backend-lib/users/services/user-super-admin-floor.custom-impl.backend.service';\nimport {\n  createApiKeyCreateFactories,\n  createApiKeyRotateFactories,\n  createApiKeyRegenerateFactories,\n  createApiKeyExtendExpiryFactories,\n  createApiKeyUsageStatsFactories,\n  createApiKeyDeactivateFactories,\n  createApiKeyReactivateFactories,\n} from '~wildo-backend-lib/security/api-keys/api-keys.custom-impl.backend.service';\nimport {\n  createOAuthClientCreateFactories,\n  createOAuthClientRotateFactories,\n  createOAuthClientRegenerateFactories,\n} from '~wildo-backend-lib/security/oauth-clients/oauth-clients.custom-impl.backend.service';\nimport { createScopeFeaturesCacheInvalidationFactories } from '~wildo-backend-lib/features/services/scope-features-cache-invalidation.custom-impl.backend.service';\nimport { createSiemExportConfigCacheInvalidationFactories } from '~wildo-backend-lib/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service';\nimport { createOrganizationFeaturesAdminWritePathFactories } from '~wildo-backend-lib/features/services/organization-features-admin-write-path.custom-impl.backend.service';\nimport { createApplicationFeaturesAdminWritePathFactories } from '~wildo-backend-lib/features/services/application-features-admin-write-path.custom-impl.backend.service';\nimport { createWebhookConfigReadPublicKeyFactories } from '~wildo-backend-lib/notifications/webhooks/outbound/services/webhook-config-public-key.custom-impl.backend.service';\nimport {\n  createM2MWebhookDeliveryLogRetryFactories,\n  createM2MWebhookDeliveryLogPurgeOldFactories,\n} from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.custom-impl.backend.service';\nimport { createWebhookConfigTestEndpointFactories } from '~wildo-backend-lib/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service';\n\n\nexport const CoreBackend_ServiceImplementationsFactories : ResourceCustomServiceImplementationFactory[] = [\n  ...userSelfCustomImplementations,\n  ...billingCustomImplementations,\n  ...scopedStateReadCustomImplementations,\n  ...lifecycleCustomImplementations,\n  ...authCustomImplementations,\n  ...createOrganizationCreateFactories(),\n  // Tenant lifecycle transitions (WS-A): `request_deletion` on both declared variants + `restore`.\n  // These own `Organization.status`, which generic UPDATE may not write.\n  ...createOrganizationLifecycleFactories(),\n  // ORGANIZATIONS DELETE — emits ORGANIZATION_DELETED. The event type, its typed event-data schema\n  // and its SIEM classification all existed from the start but NOTHING produced them, so destroying\n  // a whole tenant left no evidence at all (the exact sibling of the USER_DELETED gap below).\n  // Registered on BOTH declared doors — the org-admin default AND the super-admin `admin` variant —\n  // because custom impls resolve by an exact operation-path key; one registration would have left\n  // the privileged cross-tenant route unaudited. Post-commit by construction; reads the pre-deletion\n  // snapshot because `name` / `slug` are unrecoverable once the row is gone.\n  ...createOrganizationDeletionAuditFactories(),\n  ...createOrganizationMemberCreateFactories(),\n  // PLATFORM_ACCESS_GRANTS — the four lifecycle transitions. Every field that carries the\n  // time-bound/justified/tenant-scoped guarantee (`operatorUserId`, `status`, `expiresAt`,\n  // `approvedByUserId`) is server-authored here; the resource exposes no generic CREATE/UPDATE door,\n  // so these prefixes are the only way a grant can come into existence or change state.\n  ...createPlatformAccessGrantFactories(),\n  // ORGANIZATION_UNITS DELETE prefix — refuses to strand a subtree behind a deleted interior\n  // node (the unit tree self-edge declares no delete cascade).\n  ...createOrganizationUnitDeleteDependentsGuardFactories(),\n  // ORGANIZATION_UNITS tree mechanics. CREATE materializes the hierarchy `path` on the inserting\n  // write (it was previously never written by anything); MOVE re-parents and re-homes the whole\n  // subtree; ARCHIVE/RESTORE own the node-only status transitions. Before these, all three custom\n  // operations were declared with no implementation and succeeded while changing nothing.\n  ...createOrganizationUnitCreatePathFactories(),\n  ...createOrganizationUnitUpdateFactories(),\n  ...createOrganizationUnitMoveFactories(),\n  ...createOrganizationUnitStatusTransitionFactories(),\n  // ORGANIZATION_UNIT_MEMBERS — a unit assignment is a role grant (its `role` is read into\n  // `initiatorRoles` as a unit-narrowed entry), so both write paths carry the role-ceiling gate\n  // explicitly (custom impls resolve by exact operation path; neither inherits the other's gate).\n  // CREATE additionally proves the target unit is in the caller's tenant. All three paths emit the\n  // matching audit event: grant and re-grade via ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED, revocation\n  // via ORGANIZATION_UNIT_MEMBER_REMOVED — without the last one an authorization-filtered trail\n  // would show unit privileges granted and never removed. DELETE must capture the revoked role in\n  // its PREFIX: a delete postfix cannot read the deleted document.\n  ...createOrganizationUnitMemberCreateFactories(),\n  ...createOrganizationUnitMemberUpdateFactories(),\n  ...createOrganizationUnitMemberDeleteFactories(),\n  // Account/entity lifecycle transitions (SUSPEND / REACTIVATE / DEACTIVATE_ACCOUNT …). One shared\n  // implementation across resources, declared as data — see\n  // `resource-status-transition.definitions.backend.ts` for the state machine and for why\n  // `organizations | activate|suspend` are not in the list yet.\n  ...createEngineResourceStatusTransitionFactories(),\n  // INBOUND_CONTACTS CREATE prefix — stamps the backend-only `emailUserMatch`\n  // triage signal (does the lead email match an existing active/inactive user).\n  ...createInboundContactCreateFactories(),\n  // USERS application-role administration. `assign_roles` / `revoke_roles` translate their `roles`\n  // request contract into set algebra over the persisted `appRoles` (they previously named a field\n  // that is not a schema path and wrote nothing); CREATE/UPDATE carry the role-ceiling gate on the\n  // same field, which nothing measured before. All four emit USER_APP_ROLES_CHANGED.\n  ...createUserRoleSetOperationFactories(),\n  ...createUserCoreRoleCeilingFactories(),\n  // USERS force_password_reset — mints a single-use reset token for the TARGET, mails it to\n  // them, evicts their live sessions, and records the acting administrator plus their reason.\n  // Previously declared UPDATE-like with no handler, so it answered 200 while minting nothing\n  // and the declared `{ resetToken, resetUrl }` response could never be produced (that handback\n  // is now gone — it was an account-takeover primitive).\n  ...createUserForcePasswordResetFactories(),\n  // USERS DELETE — emits USER_DELETED. The event type and its SIEM classification existed from the\n  // start but NOTHING produced them, so identity destruction left no evidence at all. Post-commit\n  // by construction; reads the pre-deletion snapshot because `email` / `appRoles` are unrecoverable\n  // once the row is gone.\n  ...createUserDeletionAuditFactories(),\n  // USERS DELETE — the last-super-administrator floor. Registered at priority 50 so it refuses\n  // BEFORE the deletion-audit registration above (default 100) prepares anything: destroying the row\n  // that holds the last application authority is the same unrecoverable lockout as revoking the role\n  // off it, which the role-administration registrations refuse on their own paths.\n  ...createUserSuperAdminFloorFactories(),\n  ...createApiKeyCreateFactories(),\n  ...createApiKeyRotateFactories(),\n  ...createApiKeyRegenerateFactories(),\n  ...createApiKeyExtendExpiryFactories(),\n  ...createApiKeyUsageStatsFactories(),\n  ...createApiKeyDeactivateFactories(),\n  ...createApiKeyReactivateFactories(),\n  // OAuth Clients (registered client-credentials front — mirrors API Keys mint pipeline)\n  ...createOAuthClientCreateFactories(),\n  ...createOAuthClientRotateFactories(),\n  ...createOAuthClientRegenerateFactories(),\n  ...createOrganizationFeaturesAdminWritePathFactories(),\n  ...createApplicationFeaturesAdminWritePathFactories(),\n  ...createScopeFeaturesCacheInvalidationFactories(),\n  ...createSiemExportConfigCacheInvalidationFactories(),\n  ...createAuditLogsExportFactories(),\n  // Webhook (M2M outbound) domain — the public-key READ postfix existed but was\n  // never registered (the `applicationPublicKeyPem` field silently never\n  // surfaced); registered here together with the RETRY / PURGE_OLD impls.\n  ...createWebhookConfigReadPublicKeyFactories(),\n  ...createM2MWebhookDeliveryLogRetryFactories(),\n  ...createM2MWebhookDeliveryLogPurgeOldFactories(),\n  // TEST_ENDPOINT — fires one signed synthetic delivery through the SAME transport the\n  // delivery worker uses and returns the diagnostic. Previously declared READ-like with no\n  // handler, so the core read answered 200 with the config row and an unreachable URL still\n  // reported success.\n  ...createWebhookConfigTestEndpointFactories(),\n]\n"]}
+{"version":3,"file":"custom-service-implementations.backend.definition.js","sourceRoot":"","sources":["../../../../../src/resources/models/custom-service-implementations.backend.definition.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4EAA4E,CAAC;AAC3H,OAAO,EAAE,4BAA4B,EAAE,MAAM,wFAAwF,CAAC;AACtI,OAAO,EAAE,8BAA8B,EAAE,MAAM,+EAA+E,CAAC;AAC/H,OAAO,EAAE,oCAAoC,EAAE,MAAM,uFAAuF,CAAC;AAC7I,OAAO,EAAE,yBAAyB,EAAE,MAAM,uGAAuG,CAAC;AAClJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,mFAAmF,CAAC;AACnI,OAAO,EAAE,iCAAiC,EAAE,oCAAoC,EAAE,MAAM,8FAA8F,CAAC;AACvL,OAAO,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAC7J,OAAO,EAAE,6CAA6C,EAAE,MAAM,uHAAuH,CAAC;AACtL,OAAO,EAAE,qCAAqC,EAAE,MAAM,+GAA+G,CAAC;AACtK,OAAO,EAAE,6CAA6C,EAAE,MAAM,kGAAkG,CAAC;AACjK,OAAO,EAAE,uCAAuC,EAAE,MAAM,qGAAqG,CAAC;AAC9J,OAAO,EAAE,kCAAkC,EAAE,MAAM,wGAAwG,CAAC;AAC5J,OAAO,EACL,yCAAyC,EACzC,oDAAoD,EACpD,mCAAmC,EACnC,+CAA+C,EAC/C,qCAAqC,GACtC,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EACL,2CAA2C,EAC3C,2CAA2C,EAC3C,2CAA2C,GAC5C,MAAM,0GAA0G,CAAC;AAClH,OAAO,EAAE,mCAAmC,EAAE,MAAM,yFAAyF,CAAC;AAC9I,OAAO,EACL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,wFAAwF,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,yFAAyF,CAAC;AAChJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,kFAAkF,CAAC;AACnI,OAAO,EAAE,gCAAgC,EAAE,MAAM,mFAAmF,CAAC;AACrI,OAAO,EAAE,kCAAkC,EAAE,MAAM,sFAAsF,CAAC;AAC1I,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,2EAA2E,CAAC;AACnF,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,qFAAqF,CAAC;AAC7F,OAAO,EAAE,6CAA6C,EAAE,MAAM,oGAAoG,CAAC;AACnK,OAAO,EAAE,gDAAgD,EAAE,MAAM,uHAAuH,CAAC;AACzL,OAAO,EAAE,iDAAiD,EAAE,MAAM,yGAAyG,CAAC;AAC5K,OAAO,EAAE,gDAAgD,EAAE,MAAM,wGAAwG,CAAC;AAC1K,OAAO,EAAE,yCAAyC,EAAE,MAAM,mHAAmH,CAAC;AAC9K,OAAO,EACL,yCAAyC,EACzC,4CAA4C,GAC7C,MAAM,kHAAkH,CAAC;AAC1H,OAAO,EAAE,wCAAwC,EAAE,MAAM,sHAAsH,CAAC;AAGhL,MAAM,CAAC,MAAM,2CAA2C,GAAkD;IACxG,GAAG,6BAA6B;IAChC,GAAG,4BAA4B;IAC/B,GAAG,oCAAoC;IACvC,GAAG,8BAA8B;IACjC,GAAG,yBAAyB;IAC5B,GAAG,iCAAiC,EAAE;IACtC,iGAAiG;IACjG,uEAAuE;IACvE,GAAG,oCAAoC,EAAE;IACzC,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;IAC5F,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,2EAA2E;IAC3E,GAAG,wCAAwC,EAAE;IAC7C,iGAAiG;IACjG,iGAAiG;IACjG,GAAG,6CAA6C,EAAE;IAClD,GAAG,qCAAqC,EAAE;IAC1C,GAAG,uCAAuC,EAAE;IAC5C,wFAAwF;IACxF,yFAAyF;IACzF,mGAAmG;IACnG,sFAAsF;IACtF,GAAG,kCAAkC,EAAE;IACvC,2FAA2F;IAC3F,6DAA6D;IAC7D,GAAG,oDAAoD,EAAE;IACzD,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,GAAG,yCAAyC,EAAE;IAC9C,GAAG,qCAAqC,EAAE;IAC1C,GAAG,mCAAmC,EAAE;IACxC,GAAG,+CAA+C,EAAE;IACpD,yFAAyF;IACzF,8FAA8F;IAC9F,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,gGAAgG;IAChG,iEAAiE;IACjE,GAAG,2CAA2C,EAAE;IAChD,GAAG,2CAA2C,EAAE;IAChD,GAAG,2CAA2C,EAAE;IAChD,iGAAiG;IACjG,0DAA0D;IAC1D,wFAAwF;IACxF,8DAA8D;IAC9D,GAAG,6CAA6C,EAAE;IAClD,4EAA4E;IAC5E,8EAA8E;IAC9E,GAAG,mCAAmC,EAAE;IACxC,iGAAiG;IACjG,iGAAiG;IACjG,iGAAiG;IACjG,mFAAmF;IACnF,GAAG,mCAAmC,EAAE;IACxC,GAAG,kCAAkC,EAAE;IACvC,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,8FAA8F;IAC9F,uDAAuD;IACvD,GAAG,qCAAqC,EAAE;IAC1C,uFAAuF;IACvF,GAAG,+BAA+B,EAAE;IACpC,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,wBAAwB;IACxB,GAAG,gCAAgC,EAAE;IACrC,6FAA6F;IAC7F,mGAAmG;IACnG,mGAAmG;IACnG,iFAAiF;IACjF,GAAG,kCAAkC,EAAE;IACvC,GAAG,2BAA2B,EAAE;IAChC,GAAG,2BAA2B,EAAE;IAChC,GAAG,+BAA+B,EAAE;IACpC,GAAG,iCAAiC,EAAE;IACtC,GAAG,+BAA+B,EAAE;IACpC,GAAG,+BAA+B,EAAE;IACpC,GAAG,+BAA+B,EAAE;IACpC,2EAA2E;IAC3E,GAAG,2BAA2B,EAAE;IAChC,uFAAuF;IACvF,GAAG,gCAAgC,EAAE;IACrC,GAAG,gCAAgC,EAAE;IACrC,GAAG,oCAAoC,EAAE;IACzC,GAAG,gCAAgC,EAAE;IACrC,GAAG,iDAAiD,EAAE;IACtD,GAAG,gDAAgD,EAAE;IACrD,GAAG,6CAA6C,EAAE;IAClD,GAAG,gDAAgD,EAAE;IACrD,GAAG,8BAA8B,EAAE;IACnC,8EAA8E;IAC9E,uEAAuE;IACvE,wEAAwE;IACxE,GAAG,yCAAyC,EAAE;IAC9C,GAAG,yCAAyC,EAAE;IAC9C,GAAG,4CAA4C,EAAE;IACjD,qFAAqF;IACrF,yFAAyF;IACzF,0FAA0F;IAC1F,oBAAoB;IACpB,GAAG,wCAAwC,EAAE;CAC9C,CAAA","sourcesContent":["import { z } from 'zod';\nimport type { ResourceConfiguration_Operation } from '@wildo-ai/saas-models';\nimport type { ResourceOperationCustomImplementationBase } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { userSelfCustomImplementations } from '~wildo-backend-lib/users/services/user-self-custom-implementations.backend';\nimport { billingCustomImplementations } from '~wildo-backend-lib/billing/services/custom-impl/billing-custom-implementations.backend';\nimport { lifecycleCustomImplementations } from '~wildo-backend-lib/guidance/services/lifecycle-custom-implementations.backend';\nimport { scopedStateReadCustomImplementations } from '~wildo-backend-lib/guidance/services/scoped-state-read-custom-implementations.backend';\nimport { authCustomImplementations } from '~wildo-backend-lib/security/authentications/services/custom-impls/auth-custom-implementations.backend';\nimport { createAuditLogsExportFactories } from '~wildo-backend-lib/compliance/audit-trails/audit-logs.custom-impl.backend.service';\nimport { createOrganizationCreateFactories, createOrganizationLifecycleFactories } from '~wildo-backend-lib/organizations/services/organization-custom-implementation.backend.service';\nimport { createOrganizationDeletionAuditFactories } from '~wildo-backend-lib/organizations/services/organization-deletion-audit.custom-impl.backend.service';\nimport { createOrganizationProviderCredentialFactories } from '~wildo-backend-lib/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service';\nimport { createUserProviderCredentialFactories } from '~wildo-backend-lib/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service';\nimport { createEngineResourceStatusTransitionFactories } from '~wildo-backend-lib/base-classes/services/services/resource-status-transition.definitions.backend';\nimport { createOrganizationMemberCreateFactories } from '~wildo-backend-lib/organizations/services/organization-member-custom-implementation.backend.service';\nimport { createPlatformAccessGrantFactories } from '~wildo-backend-lib/security/authorizations/platform-access-grant-custom-implementation.backend.service';\nimport {\n  createOrganizationUnitCreatePathFactories,\n  createOrganizationUnitDeleteDependentsGuardFactories,\n  createOrganizationUnitMoveFactories,\n  createOrganizationUnitStatusTransitionFactories,\n  createOrganizationUnitUpdateFactories,\n} from '~wildo-backend-lib/organizations/services/organization-unit-custom-implementation.backend.service';\nimport {\n  createOrganizationUnitMemberCreateFactories,\n  createOrganizationUnitMemberDeleteFactories,\n  createOrganizationUnitMemberUpdateFactories,\n} from '~wildo-backend-lib/organizations/services/organization-unit-member-custom-implementation.backend.service';\nimport { createInboundContactCreateFactories } from '~wildo-backend-lib/users/services/inbound-contact-custom-implementation.backend.service';\nimport {\n  createUserCoreRoleCeilingFactories,\n  createUserRoleSetOperationFactories,\n} from '~wildo-backend-lib/users/services/user-role-administration.custom-impl.backend.service';\nimport { createUserForcePasswordResetFactories } from '~wildo-backend-lib/users/services/user-force-password-reset.custom-impl.backend.service';\nimport { createUserReadRetainedFactories } from '~wildo-backend-lib/users/services/user-read-retained.custom-impl.backend.service';\nimport { createUserDeletionAuditFactories } from '~wildo-backend-lib/users/services/user-deletion-audit.custom-impl.backend.service';\nimport { createUserSuperAdminFloorFactories } from '~wildo-backend-lib/users/services/user-super-admin-floor.custom-impl.backend.service';\nimport {\n  createApiKeyCreateFactories,\n  createApiKeyRotateFactories,\n  createApiKeyRegenerateFactories,\n  createApiKeyExtendExpiryFactories,\n  createApiKeyUsageStatsFactories,\n  createApiKeyDeactivateFactories,\n  createApiKeyExpireFactories,\n  createApiKeyReactivateFactories,\n} from '~wildo-backend-lib/security/api-keys/api-keys.custom-impl.backend.service';\nimport {\n  createOAuthClientCreateFactories,\n  createOAuthClientRotateFactories,\n  createOAuthClientExpireFactories,\n  createOAuthClientRegenerateFactories,\n} from '~wildo-backend-lib/security/oauth-clients/oauth-clients.custom-impl.backend.service';\nimport { createScopeFeaturesCacheInvalidationFactories } from '~wildo-backend-lib/features/services/scope-features-cache-invalidation.custom-impl.backend.service';\nimport { createSiemExportConfigCacheInvalidationFactories } from '~wildo-backend-lib/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service';\nimport { createOrganizationFeaturesAdminWritePathFactories } from '~wildo-backend-lib/features/services/organization-features-admin-write-path.custom-impl.backend.service';\nimport { createApplicationFeaturesAdminWritePathFactories } from '~wildo-backend-lib/features/services/application-features-admin-write-path.custom-impl.backend.service';\nimport { createWebhookConfigReadPublicKeyFactories } from '~wildo-backend-lib/notifications/webhooks/outbound/services/webhook-config-public-key.custom-impl.backend.service';\nimport {\n  createM2MWebhookDeliveryLogRetryFactories,\n  createM2MWebhookDeliveryLogPurgeOldFactories,\n} from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.custom-impl.backend.service';\nimport { createWebhookConfigTestEndpointFactories } from '~wildo-backend-lib/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service';\n\n\nexport const CoreBackend_ServiceImplementationsFactories : ResourceCustomServiceImplementationFactory[] = [\n  ...userSelfCustomImplementations,\n  ...billingCustomImplementations,\n  ...scopedStateReadCustomImplementations,\n  ...lifecycleCustomImplementations,\n  ...authCustomImplementations,\n  ...createOrganizationCreateFactories(),\n  // Tenant lifecycle transitions (WS-A): `request_deletion` on both declared variants + `restore`.\n  // These own `Organization.status`, which generic UPDATE may not write.\n  ...createOrganizationLifecycleFactories(),\n  // ORGANIZATIONS DELETE — emits ORGANIZATION_DELETED. The event type, its typed event-data schema\n  // and its SIEM classification all existed from the start but NOTHING produced them, so destroying\n  // a whole tenant left no evidence at all (the exact sibling of the USER_DELETED gap below).\n  // Registered on BOTH declared doors — the org-admin default AND the super-admin `admin` variant —\n  // because custom impls resolve by an exact operation-path key; one registration would have left\n  // the privileged cross-tenant route unaudited. Post-commit by construction; reads the pre-deletion\n  // snapshot because `name` / `slug` are unrecoverable once the row is gone.\n  ...createOrganizationDeletionAuditFactories(),\n  // Seals every organization provider credential on write, and audits the grant lifecycle. Without\n  // this registration the resource stores plaintext secrets behind a route that still answers 200.\n  ...createOrganizationProviderCredentialFactories(),\n  ...createUserProviderCredentialFactories(),\n  ...createOrganizationMemberCreateFactories(),\n  // PLATFORM_ACCESS_GRANTS — the four lifecycle transitions. Every field that carries the\n  // time-bound/justified/tenant-scoped guarantee (`operatorUserId`, `status`, `expiresAt`,\n  // `approvedByUserId`) is server-authored here; the resource exposes no generic CREATE/UPDATE door,\n  // so these prefixes are the only way a grant can come into existence or change state.\n  ...createPlatformAccessGrantFactories(),\n  // ORGANIZATION_UNITS DELETE prefix — refuses to strand a subtree behind a deleted interior\n  // node (the unit tree self-edge declares no delete cascade).\n  ...createOrganizationUnitDeleteDependentsGuardFactories(),\n  // ORGANIZATION_UNITS tree mechanics. CREATE materializes the hierarchy `path` on the inserting\n  // write (it was previously never written by anything); MOVE re-parents and re-homes the whole\n  // subtree; ARCHIVE/RESTORE own the node-only status transitions. Before these, all three custom\n  // operations were declared with no implementation and succeeded while changing nothing.\n  ...createOrganizationUnitCreatePathFactories(),\n  ...createOrganizationUnitUpdateFactories(),\n  ...createOrganizationUnitMoveFactories(),\n  ...createOrganizationUnitStatusTransitionFactories(),\n  // ORGANIZATION_UNIT_MEMBERS — a unit assignment is a role grant (its `role` is read into\n  // `initiatorRoles` as a unit-narrowed entry), so both write paths carry the role-ceiling gate\n  // explicitly (custom impls resolve by exact operation path; neither inherits the other's gate).\n  // CREATE additionally proves the target unit is in the caller's tenant. All three paths emit the\n  // matching audit event: grant and re-grade via ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED, revocation\n  // via ORGANIZATION_UNIT_MEMBER_REMOVED — without the last one an authorization-filtered trail\n  // would show unit privileges granted and never removed. DELETE must capture the revoked role in\n  // its PREFIX: a delete postfix cannot read the deleted document.\n  ...createOrganizationUnitMemberCreateFactories(),\n  ...createOrganizationUnitMemberUpdateFactories(),\n  ...createOrganizationUnitMemberDeleteFactories(),\n  // Account/entity lifecycle transitions (SUSPEND / REACTIVATE / DEACTIVATE_ACCOUNT …). One shared\n  // implementation across resources, declared as data — see\n  // `resource-status-transition.definitions.backend.ts` for the state machine and for why\n  // `organizations | activate|suspend` are not in the list yet.\n  ...createEngineResourceStatusTransitionFactories(),\n  // INBOUND_CONTACTS CREATE prefix — stamps the backend-only `emailUserMatch`\n  // triage signal (does the lead email match an existing active/inactive user).\n  ...createInboundContactCreateFactories(),\n  // USERS application-role administration. `assign_roles` / `revoke_roles` translate their `roles`\n  // request contract into set algebra over the persisted `appRoles` (they previously named a field\n  // that is not a schema path and wrote nothing); CREATE/UPDATE carry the role-ceiling gate on the\n  // same field, which nothing measured before. All four emit USER_APP_ROLES_CHANGED.\n  ...createUserRoleSetOperationFactories(),\n  ...createUserCoreRoleCeilingFactories(),\n  // USERS force_password_reset — mints a single-use reset token for the TARGET, mails it to\n  // them, evicts their live sessions, and records the acting administrator plus their reason.\n  // Previously declared UPDATE-like with no handler, so it answered 200 while minting nothing\n  // and the declared `{ resetToken, resetUrl }` response could never be produced (that handback\n  // is now gone — it was an account-takeover primitive).\n  ...createUserForcePasswordResetFactories(),\n  // #490 — the operator surface for the audited see-through read of a RETAINED user row.\n  ...createUserReadRetainedFactories(),\n  // USERS DELETE — emits USER_DELETED. The event type and its SIEM classification existed from the\n  // start but NOTHING produced them, so identity destruction left no evidence at all. Post-commit\n  // by construction; reads the pre-deletion snapshot because `email` / `appRoles` are unrecoverable\n  // once the row is gone.\n  ...createUserDeletionAuditFactories(),\n  // USERS DELETE — the last-super-administrator floor. Registered at priority 50 so it refuses\n  // BEFORE the deletion-audit registration above (default 100) prepares anything: destroying the row\n  // that holds the last application authority is the same unrecoverable lockout as revoking the role\n  // off it, which the role-administration registrations refuse on their own paths.\n  ...createUserSuperAdminFloorFactories(),\n  ...createApiKeyCreateFactories(),\n  ...createApiKeyRotateFactories(),\n  ...createApiKeyRegenerateFactories(),\n  ...createApiKeyExtendExpiryFactories(),\n  ...createApiKeyUsageStatsFactories(),\n  ...createApiKeyDeactivateFactories(),\n  ...createApiKeyReactivateFactories(),\n  // ACTIVE → EXPIRED, dispatched only by the credential-expiry sweep (#413).\n  ...createApiKeyExpireFactories(),\n  // OAuth Clients (registered client-credentials front — mirrors API Keys mint pipeline)\n  ...createOAuthClientCreateFactories(),\n  ...createOAuthClientRotateFactories(),\n  ...createOAuthClientRegenerateFactories(),\n  ...createOAuthClientExpireFactories(),\n  ...createOrganizationFeaturesAdminWritePathFactories(),\n  ...createApplicationFeaturesAdminWritePathFactories(),\n  ...createScopeFeaturesCacheInvalidationFactories(),\n  ...createSiemExportConfigCacheInvalidationFactories(),\n  ...createAuditLogsExportFactories(),\n  // Webhook (M2M outbound) domain — the public-key READ postfix existed but was\n  // never registered (the `applicationPublicKeyPem` field silently never\n  // surfaced); registered here together with the RETRY / PURGE_OLD impls.\n  ...createWebhookConfigReadPublicKeyFactories(),\n  ...createM2MWebhookDeliveryLogRetryFactories(),\n  ...createM2MWebhookDeliveryLogPurgeOldFactories(),\n  // TEST_ENDPOINT — fires one signed synthetic delivery through the SAME transport the\n  // delivery worker uses and returns the diagnostic. Previously declared READ-like with no\n  // handler, so the core read answered 200 with the config row and an unreachable URL still\n  // reported success.\n  ...createWebhookConfigTestEndpointFactories(),\n]\n"]}

package/dist/esm/resources/models/resources-operations.backend.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-operations.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-operations.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,8CAA8C,EAAE,MAAM,uBAAuB,CAAC;AACvI,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAOxE,eAAO,MAAM,wCAAwC,EAAE,8CAA8C,CAAC,mBAAmB,CAIxH,CAAC"}
+{"version":3,"file":"resources-operations.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-operations.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,8CAA8C,EAAE,MAAM,uBAAuB,CAAC;AACvI,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAQxE,eAAO,MAAM,wCAAwC,EAAE,8CAA8C,CAAC,mBAAmB,CAKxH,CAAC"}

package/dist/esm/resources/models/resources-operations.backend.definitions.js

@@ -3,9 +3,11 @@ import { BackendResourceType } from './resources-types.backend.schemas.js';
 import { consumableTokens_ResourceConfiguration_InitializationFactory } from '../../security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.js';
 import { dataSeedRunResourceConfiguration_InitializationFactory } from '../../data-seeding/models/data-seed-run.shared.resources-config.schemas.js';
 import { externalDataPipelineStateResourceConfiguration_InitializationFactory } from '../../external-data/models/external-data-pipeline-state.backend.schemas.js';
+import { billingProviderEventSettlementResourceConfiguration_InitializationFactory } from '../../billing/models/billing-provider-event-settlement.backend.schemas.js';
 export const backendResourcesConfigurationsFactoryMap = {
     [BackendResourceType.CONSUMABLE_TOKENS]: consumableTokens_ResourceConfiguration_InitializationFactory,
     [BackendResourceType.DATA_SEED_RUN]: dataSeedRunResourceConfiguration_InitializationFactory,
     [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: externalDataPipelineStateResourceConfiguration_InitializationFactory,
+    [BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS]: billingProviderEventSettlementResourceConfiguration_InitializationFactory,
 };
 //# sourceMappingURL=resources-operations.backend.definitions.js.map

package/dist/esm/resources/models/resources-operations.backend.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-operations.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-operations.backend.definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,iCAAiC;AACjC,OAAO,EAAE,4DAA4D,EAAE,MAAM,yGAAyG,CAAC;AACvL,OAAO,EAAE,sDAAsD,EAAE,MAAM,sFAAsF,CAAC;AAC9J,OAAO,EAAE,oEAAoE,EAAE,MAAM,sFAAsF,CAAC;AAE5K,MAAM,CAAC,MAAM,wCAAwC,GAAwE;IAC3H,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,4DAA4D;IACrG,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,sDAAsD;IAC3F,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,oEAAoE;CACzH,CAAC","sourcesContent":["import { AnyResourceConfiguration, ResourceRelationship, ResourceConfiguration_InitializationFactoryMap } from '@wildo-ai/saas-models';\nimport { BackendResourceType } from './resources-types.backend.schemas';\n\n// import resource config schemas\nimport { consumableTokens_ResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas';\nimport { dataSeedRunResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/data-seeding/models/data-seed-run.shared.resources-config.schemas';\nimport { externalDataPipelineStateResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/external-data/models/external-data-pipeline-state.backend.schemas';\n\nexport const backendResourcesConfigurationsFactoryMap: ResourceConfiguration_InitializationFactoryMap<BackendResourceType> = {\n  [BackendResourceType.CONSUMABLE_TOKENS]: consumableTokens_ResourceConfiguration_InitializationFactory,\n  [BackendResourceType.DATA_SEED_RUN]: dataSeedRunResourceConfiguration_InitializationFactory,\n  [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: externalDataPipelineStateResourceConfiguration_InitializationFactory,\n};\n"]}
+{"version":3,"file":"resources-operations.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-operations.backend.definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,iCAAiC;AACjC,OAAO,EAAE,4DAA4D,EAAE,MAAM,yGAAyG,CAAC;AACvL,OAAO,EAAE,sDAAsD,EAAE,MAAM,sFAAsF,CAAC;AAC9J,OAAO,EAAE,oEAAoE,EAAE,MAAM,sFAAsF,CAAC;AAC5K,OAAO,EAAE,yEAAyE,EAAE,MAAM,qFAAqF,CAAC;AAEhL,MAAM,CAAC,MAAM,wCAAwC,GAAwE;IAC3H,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,4DAA4D;IACrG,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,sDAAsD;IAC3F,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,oEAAoE;IACxH,CAAC,mBAAmB,CAAC,kCAAkC,CAAC,EAAE,yEAAyE;CACpI,CAAC","sourcesContent":["import { AnyResourceConfiguration, ResourceRelationship, ResourceConfiguration_InitializationFactoryMap } from '@wildo-ai/saas-models';\nimport { BackendResourceType } from './resources-types.backend.schemas';\n\n// import resource config schemas\nimport { consumableTokens_ResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas';\nimport { dataSeedRunResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/data-seeding/models/data-seed-run.shared.resources-config.schemas';\nimport { externalDataPipelineStateResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/external-data/models/external-data-pipeline-state.backend.schemas';\nimport { billingProviderEventSettlementResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/billing/models/billing-provider-event-settlement.backend.schemas';\n\nexport const backendResourcesConfigurationsFactoryMap: ResourceConfiguration_InitializationFactoryMap<BackendResourceType> = {\n  [BackendResourceType.CONSUMABLE_TOKENS]: consumableTokens_ResourceConfiguration_InitializationFactory,\n  [BackendResourceType.DATA_SEED_RUN]: dataSeedRunResourceConfiguration_InitializationFactory,\n  [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: externalDataPipelineStateResourceConfiguration_InitializationFactory,\n  [BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS]: billingProviderEventSettlementResourceConfiguration_InitializationFactory,\n};\n"]}

package/dist/esm/resources/models/resources-relationships.backend.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-relationships.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-relationships.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4F,oBAAoB,EAAwF,MAAM,uBAAuB,CAAC;AAG7O,eAAO,MAAM,6BAA6B,EAAE,oBAAoB,EA2D/D,CAAC"}
+{"version":3,"file":"resources-relationships.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-relationships.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4F,oBAAoB,EAAwF,MAAM,uBAAuB,CAAC;AAG7O,eAAO,MAAM,6BAA6B,EAAE,oBAAoB,EA8E/D,CAAC"}

package/dist/esm/resources/models/resources-relationships.backend.definitions.js

@@ -38,5 +38,19 @@ export const backendResourcesRelationships = [
         nature: RelationshipNature.REFERENCE,
         contextPolicy: { enabled: false }
     }),
+    // BillingProviderEventSettlement scope anchor — same posture as the two above: internal
+    // bookkeeping, APPLICATION-tier, STANDALONE to stay off the URL surface.
+    //
+    // APPLICATION rather than the billing account's own scope, deliberately. The claim must be
+    // takeable BEFORE the handler knows which pool it will credit — that is the whole point of
+    // claiming before the money write — and it is keyed by the PROVIDER's event identity, which is
+    // unique across the deployment rather than within one tenant. Anchoring it under an organization
+    // would make the ledger's uniqueness tenant-relative for a key that is not.
+    createResourcesRelationship(CoreResourceType.APPLICATION, BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false }
+    }),
 ];
 //# sourceMappingURL=resources-relationships.backend.definitions.js.map

package/dist/esm/resources/models/resources-relationships.backend.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-relationships.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-relationships.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,uCAAuC,EAAwB,+BAA+B,EAAE,gBAAgB,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC7O,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAA2B;IAEnE,iCAAiC;IACjC,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,iBAAiB,EACnE,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,sEAAsE;QACtE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,2BAA2B,CACzB,gBAAgB,CAAC,aAAa,EAAE,mBAAmB,CAAC,iBAAiB,EACrE,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;QACrE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,sEAAsE;QACtE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,aAAa,EAC/D,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,iFAAiF;IACjF,8DAA8D;IAC9D,gEAAgE;IAChE,yDAAyD;IACzD,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,4BAA4B,EAC9E,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;CAEF,CAAC","sourcesContent":["import { createResourcesRelationship, RelationshipNature, ResourceRelationshipAccessScopeStrategy, ResourceRelationship, ResourceRelationshipCardinality, CoreResourceType, ResourceParentResourceRequirement } from \"@wildo-ai/saas-models\";\nimport { BackendResourceType } from \"./resources-types.backend.schemas\";\n\nexport const backendResourcesRelationships: ResourceRelationship[] = [\n  \n  // ConsumableTokens relationships\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.CONSUMABLE_TOKENS, \n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    { \n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      // SECURITY: Consumable tokens are sensitive - never fetch via context\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  createResourcesRelationship(\n    CoreResourceType.ORGANIZATIONS, BackendResourceType.CONSUMABLE_TOKENS, \n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    { \n      parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      nature: RelationshipNature.REFERENCE,\n      // SECURITY: Consumable tokens are sensitive - never fetch via context\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // DataSeedRuns scope anchor — internal idempotency ledger, APPLICATION-tier.\n  // STANDALONE keeps the rel off the URL surface (data-seeding is administered\n  // through dedicated controllers, not parent-scoped routes); `isPrimaryScope`\n  // anchors the resource's `resourcePrimaryScope` enum to APPLICATION so the\n  // registry-layer factory's no-fallback throw stays satisfied. See\n  // `resources-relationships.shared.factory.ts` Guard 1 for the orthogonal\n  // ownership-vs-routing rationale.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.DATA_SEED_RUN,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // ExternalDataPipelineState scope anchor — same posture as DataSeedRun: internal\n  // pipeline bookkeeping, APPLICATION-tier (slice 1 admits only\n  // SINGLE_TENANT_BINDING pipelines, so a pipeline is app-wide by\n  // construction), STANDALONE to stay off the URL surface.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n];\n"]}
+{"version":3,"file":"resources-relationships.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-relationships.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,uCAAuC,EAAwB,+BAA+B,EAAE,gBAAgB,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC7O,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAA2B;IAEnE,iCAAiC;IACjC,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,iBAAiB,EACnE,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,sEAAsE;QACtE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,2BAA2B,CACzB,gBAAgB,CAAC,aAAa,EAAE,mBAAmB,CAAC,iBAAiB,EACrE,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;QACrE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,sEAAsE;QACtE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,aAAa,EAC/D,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,iFAAiF;IACjF,8DAA8D;IAC9D,gEAAgE;IAChE,yDAAyD;IACzD,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,4BAA4B,EAC9E,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,wFAAwF;IACxF,yEAAyE;IACzE,EAAE;IACF,2FAA2F;IAC3F,2FAA2F;IAC3F,+FAA+F;IAC/F,iGAAiG;IACjG,4EAA4E;IAC5E,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,kCAAkC,EACpF,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;CAEF,CAAC","sourcesContent":["import { createResourcesRelationship, RelationshipNature, ResourceRelationshipAccessScopeStrategy, ResourceRelationship, ResourceRelationshipCardinality, CoreResourceType, ResourceParentResourceRequirement } from \"@wildo-ai/saas-models\";\nimport { BackendResourceType } from \"./resources-types.backend.schemas\";\n\nexport const backendResourcesRelationships: ResourceRelationship[] = [\n  \n  // ConsumableTokens relationships\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.CONSUMABLE_TOKENS, \n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    { \n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      // SECURITY: Consumable tokens are sensitive - never fetch via context\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  createResourcesRelationship(\n    CoreResourceType.ORGANIZATIONS, BackendResourceType.CONSUMABLE_TOKENS, \n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    { \n      parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      nature: RelationshipNature.REFERENCE,\n      // SECURITY: Consumable tokens are sensitive - never fetch via context\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // DataSeedRuns scope anchor — internal idempotency ledger, APPLICATION-tier.\n  // STANDALONE keeps the rel off the URL surface (data-seeding is administered\n  // through dedicated controllers, not parent-scoped routes); `isPrimaryScope`\n  // anchors the resource's `resourcePrimaryScope` enum to APPLICATION so the\n  // registry-layer factory's no-fallback throw stays satisfied. See\n  // `resources-relationships.shared.factory.ts` Guard 1 for the orthogonal\n  // ownership-vs-routing rationale.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.DATA_SEED_RUN,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // ExternalDataPipelineState scope anchor — same posture as DataSeedRun: internal\n  // pipeline bookkeeping, APPLICATION-tier (slice 1 admits only\n  // SINGLE_TENANT_BINDING pipelines, so a pipeline is app-wide by\n  // construction), STANDALONE to stay off the URL surface.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // BillingProviderEventSettlement scope anchor — same posture as the two above: internal\n  // bookkeeping, APPLICATION-tier, STANDALONE to stay off the URL surface.\n  //\n  // APPLICATION rather than the billing account's own scope, deliberately. The claim must be\n  // takeable BEFORE the handler knows which pool it will credit — that is the whole point of\n  // claiming before the money write — and it is keyed by the PROVIDER's event identity, which is\n  // unique across the deployment rather than within one tenant. Anchoring it under an organization\n  // would make the ledger's uniqueness tenant-relative for a key that is not.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n];\n"]}

package/dist/esm/resources/models/resources-types.backend.schemas.d.ts

@@ -8,7 +8,8 @@
 export declare enum BackendResourceType {
     CONSUMABLE_TOKENS = "consumableTokens",
     DATA_SEED_RUN = "dataSeedRuns",
-    EXTERNAL_DATA_PIPELINE_STATE = "etlPipelineStates"
+    EXTERNAL_DATA_PIPELINE_STATE = "etlPipelineStates",
+    BILLING_PROVIDER_EVENT_SETTLEMENTS = "billingProviderEventSettlements"
 }
 export declare const BackendResourceFieldIdentifier: {
     [key in BackendResourceType]: string;

package/dist/esm/resources/models/resources-types.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-types.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-types.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,oBAAY,mBAAmB;IAC7B,iBAAiB,qBAAqB;IAMtC,aAAa,iBAAiB;IAgB9B,4BAA4B,sBAAsB;CACnD;AAED,eAAO,MAAM,8BAA8B,EAAE;KAAG,GAAG,IAAI,mBAAmB,GAAG,MAAM;CAIlF,CAAC"}
+{"version":3,"file":"resources-types.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-types.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,oBAAY,mBAAmB;IAC7B,iBAAiB,qBAAqB;IAMtC,aAAa,iBAAiB;IAgB9B,4BAA4B,sBAAsB;IAQlD,kCAAkC,oCAAoC;CACvE;AAED,eAAO,MAAM,8BAA8B,EAAE;KAAG,GAAG,IAAI,mBAAmB,GAAG,MAAM;CAKlF,CAAC"}

package/dist/esm/resources/models/resources-types.backend.schemas.js

@@ -28,10 +28,18 @@ export var BackendResourceType;
     // both lanes. Code vocabulary and storage identity are allowed to differ; what is NOT allowed
     // is changing this value without the migration that goes with it.
     BackendResourceType["EXTERNAL_DATA_PIPELINE_STATE"] = "etlPipelineStates";
+    // Billing webhook idempotency ledger — system resource. ONE row per money-affecting provider
+    // event, whose PRIMARY KEY is derived from the event's own identity, so a retry delivered to a
+    // second replica collides at the store instead of granting the credits a second time. The
+    // process-local `Set` this replaced could not see another replica, could not survive a restart,
+    // and evicted its own entries after 10 000 sessions.
+    // See `engine/saas-backend-lib/src/billing/models/billing-provider-event-settlement.backend.schemas.ts`.
+    BackendResourceType["BILLING_PROVIDER_EVENT_SETTLEMENTS"] = "billingProviderEventSettlements";
 })(BackendResourceType || (BackendResourceType = {}));
 export const BackendResourceFieldIdentifier = {
     [BackendResourceType.CONSUMABLE_TOKENS]: 'consumableTokenId',
     [BackendResourceType.DATA_SEED_RUN]: 'dataSeedRunId',
     [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: 'etlPipelineStateId',
+    [BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS]: 'billingProviderEventSettlementId',
 };
 //# sourceMappingURL=resources-types.backend.schemas.js.map

package/dist/esm/resources/models/resources-types.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-types.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-types.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAN,IAAY,mBAwBX;AAxBD,WAAY,mBAAmB;IAC7B,6DAAsC,CAAA;IAEtC,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,yFAAyF;IACzF,qDAA8B,CAAA;IAE9B,uFAAuF;IACvF,8FAA8F;IAC9F,+FAA+F;IAC/F,0DAA0D;IAC1D,0GAA0G;IAC1G,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,uFAAuF;IACvF,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,8FAA8F;IAC9F,kEAAkE;IAClE,yEAAkD,CAAA;AACpD,CAAC,EAxBW,mBAAmB,KAAnB,mBAAmB,QAwB9B;AAED,MAAM,CAAC,MAAM,8BAA8B,GAA6C;IACtF,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC5D,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,eAAe;IACpD,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,oBAAoB;CACzE,CAAC","sourcesContent":["/**\n * Backend Resource Types\n *\n * Resource type definitions for SaaS backend infrastructure components.\n * These are backend-specific resources used for internal operations and are\n * never surfaced to frontend bundles (kept out of `@wildo-ai/saas-models`).\n */\n\nexport enum BackendResourceType {\n  CONSUMABLE_TOKENS = 'consumableTokens',\n\n  // Data Seeding Tracking — system resource (Phase 2 of seeding-first-class).\n  // Single source of truth for \"has this seed already run for this scope at\n  // this version?\". Written by DataSeedDispatcher before/after every pass.\n  // See `engine/saas-backend-lib/src/data-seeding/models/data-seed-run.shared.schemas.ts`.\n  DATA_SEED_RUN = 'dataSeedRuns',\n\n  // External-data pipeline state — system resource (partial-resource coverage v3, PR-9).\n  // ONE row per declared `externalDataPipeline`: the persisted extraction cursor (a pass larger\n  // than `maxRowsPerRun` continues across runs and process restarts), plus last-run bookkeeping.\n  // Written only by the external-data pipeline run service.\n  // See `engine/saas-backend-lib/src/external-data/models/external-data-pipeline-state.backend.schemas.ts`.\n  //\n  // ⚠ The VALUE stays `etlPipelineStates` while the member speaks the current vocabulary, and the\n  // divergence is deliberate: this string is a PERSISTED IDENTITY — it is the PostgreSQL table\n  // name, and two generated migrations (app-side `backend-api/migrations`, platform-side\n  // `platform-apps-manager/migrations`) are already committed against it. Renaming a table is a\n  // migration event, not a rename: the runner freezes an applied migration's bytes in its\n  // SHA-256 ledger, so it belongs on the machine that has PostgreSQL and can regenerate + apply\n  // both lanes. Code vocabulary and storage identity are allowed to differ; what is NOT allowed\n  // is changing this value without the migration that goes with it.\n  EXTERNAL_DATA_PIPELINE_STATE = 'etlPipelineStates',\n}\n\nexport const BackendResourceFieldIdentifier: { [key in BackendResourceType]: string } = {\n  [BackendResourceType.CONSUMABLE_TOKENS]: 'consumableTokenId',\n  [BackendResourceType.DATA_SEED_RUN]: 'dataSeedRunId',\n  [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: 'etlPipelineStateId',\n};\n"]}
+{"version":3,"file":"resources-types.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-types.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAN,IAAY,mBAgCX;AAhCD,WAAY,mBAAmB;IAC7B,6DAAsC,CAAA;IAEtC,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,yFAAyF;IACzF,qDAA8B,CAAA;IAE9B,uFAAuF;IACvF,8FAA8F;IAC9F,+FAA+F;IAC/F,0DAA0D;IAC1D,0GAA0G;IAC1G,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,uFAAuF;IACvF,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,8FAA8F;IAC9F,kEAAkE;IAClE,yEAAkD,CAAA;IAElD,6FAA6F;IAC7F,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,qDAAqD;IACrD,yGAAyG;IACzG,6FAAsE,CAAA;AACxE,CAAC,EAhCW,mBAAmB,KAAnB,mBAAmB,QAgC9B;AAED,MAAM,CAAC,MAAM,8BAA8B,GAA6C;IACtF,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC5D,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,eAAe;IACpD,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,oBAAoB;IACxE,CAAC,mBAAmB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;CAC7F,CAAC","sourcesContent":["/**\n * Backend Resource Types\n *\n * Resource type definitions for SaaS backend infrastructure components.\n * These are backend-specific resources used for internal operations and are\n * never surfaced to frontend bundles (kept out of `@wildo-ai/saas-models`).\n */\n\nexport enum BackendResourceType {\n  CONSUMABLE_TOKENS = 'consumableTokens',\n\n  // Data Seeding Tracking — system resource (Phase 2 of seeding-first-class).\n  // Single source of truth for \"has this seed already run for this scope at\n  // this version?\". Written by DataSeedDispatcher before/after every pass.\n  // See `engine/saas-backend-lib/src/data-seeding/models/data-seed-run.shared.schemas.ts`.\n  DATA_SEED_RUN = 'dataSeedRuns',\n\n  // External-data pipeline state — system resource (partial-resource coverage v3, PR-9).\n  // ONE row per declared `externalDataPipeline`: the persisted extraction cursor (a pass larger\n  // than `maxRowsPerRun` continues across runs and process restarts), plus last-run bookkeeping.\n  // Written only by the external-data pipeline run service.\n  // See `engine/saas-backend-lib/src/external-data/models/external-data-pipeline-state.backend.schemas.ts`.\n  //\n  // ⚠ The VALUE stays `etlPipelineStates` while the member speaks the current vocabulary, and the\n  // divergence is deliberate: this string is a PERSISTED IDENTITY — it is the PostgreSQL table\n  // name, and two generated migrations (app-side `backend-api/migrations`, platform-side\n  // `platform-apps-manager/migrations`) are already committed against it. Renaming a table is a\n  // migration event, not a rename: the runner freezes an applied migration's bytes in its\n  // SHA-256 ledger, so it belongs on the machine that has PostgreSQL and can regenerate + apply\n  // both lanes. Code vocabulary and storage identity are allowed to differ; what is NOT allowed\n  // is changing this value without the migration that goes with it.\n  EXTERNAL_DATA_PIPELINE_STATE = 'etlPipelineStates',\n\n  // Billing webhook idempotency ledger — system resource. ONE row per money-affecting provider\n  // event, whose PRIMARY KEY is derived from the event's own identity, so a retry delivered to a\n  // second replica collides at the store instead of granting the credits a second time. The\n  // process-local `Set` this replaced could not see another replica, could not survive a restart,\n  // and evicted its own entries after 10 000 sessions.\n  // See `engine/saas-backend-lib/src/billing/models/billing-provider-event-settlement.backend.schemas.ts`.\n  BILLING_PROVIDER_EVENT_SETTLEMENTS = 'billingProviderEventSettlements',\n}\n\nexport const BackendResourceFieldIdentifier: { [key in BackendResourceType]: string } = {\n  [BackendResourceType.CONSUMABLE_TOKENS]: 'consumableTokenId',\n  [BackendResourceType.DATA_SEED_RUN]: 'dataSeedRunId',\n  [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: 'etlPipelineStateId',\n  [BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS]: 'billingProviderEventSettlementId',\n};\n"]}

package/dist/esm/resources/services/resources-registry.backend.service.d.ts

@@ -174,11 +174,36 @@ export declare class ResourcesRegistryBackendService {
      * Resolution is INTERNAL-preferred, then URL-bearing:
      *  1. If the operation declares an `INTERNAL_CALL` default, return it. This
      *     honours author intent for resources whose default for this operation
-     *     is internal-only (`userIdentityLinks.list`) AND for resources that
-     *     declare BOTH an internal and a URL default for the same operation
-     *     (`users.list`, `inboundContacts.update`) — the internal variant is the
-     *     one trusted callers must use; the URL variant is the public/admin
-     *     surface reached via its keyed/route path.
+     *     is internal-only (`userIdentityLinks.list`, `users.list`,
+     *     `inboundContacts.update`) AND for the one resource that declares BOTH
+     *     an internal and a URL default for the same operation — the internal
+     *     variant is the one trusted callers must use; the URL variant is the
+     *     public/admin surface reached via its keyed/route path.
+     *
+     *     **That "BOTH" population is exactly ONE operation: `organizations`
+     *     CREATE.** Measured 2026-09-08 over all 106 non-test
+     *     `*resources-config*.ts` files (653 variant blocks), replicating
+     *     `determineOperationVariantDefault` per variant-type group.
+     *
+     *     This paragraph previously cited `users.list` and `inboundContacts.update`
+     *     as further both-default examples and BOTH were wrong: the former's
+     *     `API_CALL` is `isDefault: false, variantKey: "admin"`, and the latter
+     *     declares no `API_CALL` at all — so neither has a URL-bearing DEFAULT and
+     *     neither is a case where this method chooses between transports. The
+     *     correction is recorded rather than silently applied because the false
+     *     plural made the preference look like a broad, well-trodden policy when it
+     *     decides exactly one operation — which is what made the agent function-tool
+     *     plane's blast radius read as unbounded when it was a single, and severe,
+     *     case (see `9594526e`).
+     *
+     *     ⚠️ **A caller that FACES AN EXTERNAL PRINCIPAL must not use this method.**
+     *     It answers "which variant does a TRUSTED internal caller want", and for
+     *     `organizations` CREATE that is the registration-owned path, which skips the
+     *     creation-policy guard and writes no founding owner. A surface that
+     *     advertises a public operation to an outside caller owes
+     *     {@link getOperationPathDefault} instead, so the operation it authorized and
+     *     advertised is the operation it executes — the invariant the MCP tool plane
+     *     and the agent function-tool factories both keep.
      *  2. Otherwise return the URL-bearing default (`API_CALL` /
      *     `API_CALL_WITH_CALLBACK`) for resources exposed only over HTTP.
      *  3. Otherwise throw `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`.
@@ -348,6 +373,36 @@ export declare class ResourcesRegistryBackendService {
     protected normalizeResourceConfigurationRelationships(allResourceConfigurations: {
         [key: string]: AnyResourceConfiguration;
     }, allResourceFieldIdentifiers: Record<string, string>): void;
+    /**
+     * Refuse to start on an incoherent notification-badge declaration.
+     *
+     * ## What this catches, and why the runtime could not
+     *
+     * A badge write used to be addressed by a bare `identifier`, resolved against nothing. Two
+     * declarations were therefore unfalsifiable:
+     *
+     * - an operation naming a badge NO definition declares — the write materialized a counter row
+     *   that no definition described and no screen could render, silently, forever;
+     * - two definitions sharing one `(scope, identifier)` — every lookup answers the first, so the
+     *   second is unreachable while sharing the first's count.
+     *
+     * Neither produces an error at runtime. The write succeeds; the render finds nothing; nobody is
+     * told. So the check belongs where the DECLARATION is, not where the write is, and it fails
+     * CLOSED for the same reason the organization-unit narrowing containment above does: a
+     * misconfiguration that only manifests as a missing number is one nobody chases.
+     *
+     * **What a misconfigured application experiences:** the backend does not come up. Startup throws
+     * a `CONFIGURATION` error naming every violation — the resource and operation that declared the
+     * unresolvable ref, or the duplicated key — beside the keys that ARE registered, so the author
+     * reads the fix off the message rather than deriving it. A typo in a `badgeRef` is a refusal at
+     * the moment it is authored instead of a badge that never appears in production.
+     *
+     * The enumeration is TOTAL over both populations rather than sampled: every registered
+     * definition, and every `notificationBadgeOperations` entry on every operation of every resource
+     * configuration — which is the merged core + application map, so an engine-declared badge is
+     * checked on the same terms as an application-declared one.
+     */
+    protected validateNotificationBadgeDeclarations(notificationBadgeDefinitions: NotificationBadgeDefinition[], allResourceConfigurations: Record<string, AnyResourceConfiguration>): void;
     /**
      * Validate that all relationships can resolve their FK fields at startup.
      * This catches configuration errors early (e.g., missing resourceFieldIdentifier).

package/dist/esm/resources/services/resources-registry.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/resources/services/resources-registry.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EACH,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,EAE3B,0BAA0B,EAC1B,+BAA+B,EAC/B,mCAAmC,EACnC,wBAAwB,EACxB,8CAA8C,EAK9C,YAAY,EAgBZ,KAAK,oCAAoC,EAYzC,QAAQ,EAGX,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAcpH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,qBACa,+BAA+B;IAOD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IAC9B,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,uBAAuB;IACtD,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,0BAA0B;IAR/G,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjF,SAAS,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAEpD,SAAS,CAAC,aAAa,UAAS;gBAG0B,MAAM,EAAE,aAAa,EACX,aAAa,EAAE,uBAAuB,EACnC,YAAY,EAAE,0BAA0B;IAQ/G;;;;OAIG;IACI,0BAA0B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAMxE;;;OAGG;IACI,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAMhE;;;;;;;;;OASG;IACI,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAUrD,UAAU,CACnB,yBAAyB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACtE,0BAA0B,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EAEvE,8CAA8C,EAAG,8CAA8C,CAAC,yBAAyB,CAAC,EAC1H,oCAAoC,EAAE;QAAE,CAAE,GAAG,EAAE,MAAM,GAAI,MAAM,CAAA;KAAE,GAAG,SAAS,EAC7E,mCAAmC,EAAE,oBAAoB,EAAE,EAC3D,+CAA+C,EAAG,8CAA8C,CAAC,0BAA0B,CAAC,EAC5H,qCAAqC,EAAE;QAAE,CAAE,GAAG,EAAE,MAAM,GAAI,MAAM,CAAA;KAAE,GAAG,SAAS,EAC9E,oCAAoC,EAAE,oBAAoB,EAAE,EAC5D,kCAAkC,CAAC,EAAE,2BAA2B,EAAE,EAClE,2CAA2C,CAAC,EAAE,0BAA0B,EAAE,EAC1E,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAC3C;;;;;;;;OAQG;IACH,+BAA+B,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAC1G,OAAO,CAAC,IAAI,CAAC;IAgTT,oBAAoB,IAAI,iBAAiB;IAKhD;;;;;;;;;;;;;;;;OAgBG;IACI,kDAAkD,IAAI,IAAI;IAQ1D,gBAAgB,IAAI,YAAY,EAAE;IAKzC;;;;;;;;;;OAUG;IACI,kDAAkD,IAAI,IAAI;IAejE;;;;;OAKG;IACI,8BAA8B,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;IAKrE;;;;;;;;;;;OAWG;IACI,sBAAsB,CAAC,YAAY,EAAE;QAAE,aAAa,EAAE,YAAY,CAAC;QAAC,aAAa,CAAC,EAAE,YAAY,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IA4B5I;;;;;OAKG;IACI,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;IAKvE;;;;;OAKG;IACI,sCAAsC,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAKxF;;;;;;;;;;;;;;;;;OAiBG;IACI,uBAAuB,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IAoDtI;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,uBAAuB,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO;IAahG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACI,8BAA8B,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IA4D7I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,iCAAiC,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IAoDhJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACI,yCAAyC,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IAcxJ;;;;;OAKG;IACI,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IAwDnJ;;;;;;;;;;;;;;;;OAgBG;IACI,uBAAuB,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IA+D1J;;;;;;;;;;;;OAYG;IACI,qBAAqB,CAAE,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS;IAgEjJ,oBAAoB,CAAE,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IA4B3I;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,uBAAuB,CAC1B,aAAa,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC7D,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC/B,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAiC1C,qBAAqB,CAAC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,CAAC,CAAC,UAAU;IAMlG,sBAAsB,CAAC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,CAAC,CAAC,UAAU;IAMnG,qBAAqB,CAAC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,CAAC,CAAC,UAAU;IAMlG,yBAAyB,CAAC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,CAAC,CAAC,UAAU;IAOtG,wBAAwB,CAAC,YAAY,EAAE,YAAY,GAAG,wBAAwB;IAWrF;;;OAGG;IACI,2BAA2B,CAAC,YAAY,EAAE,YAAY,GAAG,wBAAwB,GAAG,SAAS;IASpG,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAMnC,SAAS,CAAC,2CAA2C,CACjD,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,EACtE,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpD,IAAI;IAyBP;;;OAGG;IACH,SAAS,CAAC,oCAAoC,CAC1C,wBAAwB,EAAE,oBAAoB,EAAE,EAChD,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpD,IAAI;IAmCP;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,yBAAyB,CAAC,wBAAwB,EAAE,oBAAoB,EAAE,GAAG,IAAI;IAwG3F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,SAAS,CAAC,0CAA0C,CAChD,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,GACvE,IAAI;IAuBP;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,uCAAuC,CAC7C,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,EACtE,OAAO,CAAC,EAAE;QACN;;;;;;WAMG;QACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;KAC5C,GACF,IAAI;IA4pBP,SAAS,CAAC,wCAAwC,CAC9C,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,EACtE,QAAQ,EAAE,iBAAiB,EAC3B,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpD,IAAI;IA4CP;;QAEI;IACJ,SAAS,CAAC,uCAAuC,CAC7C,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,EACtE,QAAQ,EAAE,iBAAiB,EAC3B,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpD,IAAI;IAwCA,yBAAyB,IAAI,IAAI;IAqFjC,wBAAwB,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI;IA6D1D,yBAAyB,CAAC,cAAc,GAAE,YAAY,EAAO,GAAG,IAAI;IAW3E;;;;;;;;;;;;;OAaG;IACI,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;CA0E7E"}
+{"version":3,"file":"resources-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/resources/services/resources-registry.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EACH,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,EAK3B,0BAA0B,EAC1B,+BAA+B,EAC/B,mCAAmC,EACnC,wBAAwB,EACxB,8CAA8C,EAK9C,YAAY,EAgBZ,KAAK,oCAAoC,EAYzC,QAAQ,EAGX,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAcpH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,qBACa,+BAA+B;IAOD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IAC9B,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,uBAAuB;IACtD,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,0BAA0B;IAR/G,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjF,SAAS,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAEpD,SAAS,CAAC,aAAa,UAAS;gBAG0B,MAAM,EAAE,aAAa,EACX,aAAa,EAAE,uBAAuB,EACnC,YAAY,EAAE,0BAA0B;IAQ/G;;;;OAIG;IACI,0BAA0B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAMxE;;;OAGG;IACI,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAMhE;;;;;;;;;OASG;IACI,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAUrD,UAAU,CACnB,yBAAyB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACtE,0BAA0B,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EAEvE,8CAA8C,EAAG,8CAA8C,CAAC,yBAAyB,CAAC,EAC1H,oCAAoC,EAAE;QAAE,CAAE,GAAG,EAAE,MAAM,GAAI,MAAM,CAAA;KAAE,GAAG,SAAS,EAC7E,mCAAmC,EAAE,oBAAoB,EAAE,EAC3D,+CAA+C,EAAG,8CAA8C,CAAC,0BAA0B,CAAC,EAC5H,qCAAqC,EAAE;QAAE,CAAE,GAAG,EAAE,MAAM,GAAI,MAAM,CAAA;KAAE,GAAG,SAAS,EAC9E,oCAAoC,EAAE,oBAAoB,EAAE,EAC5D,kCAAkC,CAAC,EAAE,2BAA2B,EAAE,EAClE,2CAA2C,CAAC,EAAE,0BAA0B,EAAE,EAC1E,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAC3C;;;;;;;;OAQG;IACH,+BAA+B,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAC1G,OAAO,CAAC,IAAI,CAAC;IAoTT,oBAAoB,IAAI,iBAAiB;IAKhD;;;;;;;;;;;;;;;;OAgBG;IACI,kDAAkD,IAAI,IAAI;IAQ1D,gBAAgB,IAAI,YAAY,EAAE;IAKzC;;;;;;;;;;OAUG;IACI,kDAAkD,IAAI,IAAI;IAejE;;;;;OAKG;IACI,8BAA8B,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;IAKrE;;;;;;;;;;;OAWG;IACI,sBAAsB,CAAC,YAAY,EAAE;QAAE,aAAa,EAAE,YAAY,CAAC;QAAC,aAAa,CAAC,EAAE,YAAY,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IA4B5I;;;;;OAKG;IACI,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;IAKvE;;;;;OAKG;IACI,sCAAsC,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAKxF;;;;;;;;;;;;;;;;;OAiBG;IACI,uBAAuB,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IAoDtI;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,uBAAuB,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO;IAahG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8DG;IACI,8BAA8B,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IA4D7I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,iCAAiC,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IAoDhJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACI,yCAAyC,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IAcxJ;;;;;OAKG;IACI,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IAwDnJ;;;;;;;;;;;;;;;;OAgBG;IACI,uBAAuB,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC;IA+D1J;;;;;;;;;;;;OAYG;IACI,qBAAqB,CAAE,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS;IAgEjJ,oBAAoB,CAAE,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IA4B3I;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,uBAAuB,CAC1B,aAAa,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC7D,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC/B,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAiC1C,qBAAqB,CAAC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,CAAC,CAAC,UAAU;IAMlG,sBAAsB,CAAC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,CAAC,CAAC,UAAU;IAMnG,qBAAqB,CAAC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,CAAC,CAAC,UAAU;IAMlG,yBAAyB,CAAC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAI,CAAC,CAAC,UAAU;IAOtG,wBAAwB,CAAC,YAAY,EAAE,YAAY,GAAG,wBAAwB;IAWrF;;;OAGG;IACI,2BAA2B,CAAC,YAAY,EAAE,YAAY,GAAG,wBAAwB,GAAG,SAAS;IASpG,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAMnC,SAAS,CAAC,2CAA2C,CACjD,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,EACtE,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpD,IAAI;IAyBP;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,SAAS,CAAC,qCAAqC,CAC3C,4BAA4B,EAAE,2BAA2B,EAAE,EAC3D,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,GACpE,IAAI;IAgCP;;;OAGG;IACH,SAAS,CAAC,oCAAoC,CAC1C,wBAAwB,EAAE,oBAAoB,EAAE,EAChD,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpD,IAAI;IAmCP;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,yBAAyB,CAAC,wBAAwB,EAAE,oBAAoB,EAAE,GAAG,IAAI;IAwG3F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,SAAS,CAAC,0CAA0C,CAChD,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,GACvE,IAAI;IAuBP;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,uCAAuC,CAC7C,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,EACtE,OAAO,CAAC,EAAE;QACN;;;;;;WAMG;QACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;KAC5C,GACF,IAAI;IA4pBP,SAAS,CAAC,wCAAwC,CAC9C,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,EACtE,QAAQ,EAAE,iBAAiB,EAC3B,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpD,IAAI;IA4CP;;QAEI;IACJ,SAAS,CAAC,uCAAuC,CAC7C,yBAAyB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAAA;KAAE,EACtE,QAAQ,EAAE,iBAAiB,EAC3B,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpD,IAAI;IAwCA,yBAAyB,IAAI,IAAI;IAqFjC,wBAAwB,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI;IA6D1D,yBAAyB,CAAC,cAAc,GAAE,YAAY,EAAO,GAAG,IAAI;IAW3E;;;;;;;;;;;;;OAaG;IACI,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;CA0E7E"}

package/dist/esm/resources/services/resources-registry.backend.service.js

@@ -11,7 +11,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject } from 'inversify';
-import { coreNotificationBadgeDefinitions, coreShared_ResourcesConfigurations_FactoryMap, coreResourceShared_FieldIdentifier, coreResourceShared_FieldIdentifierPriority, coreSharedResourceRelationship, ResourcesConfigOperationsUrlsBuilderUtils, ResourcesConfigOperationsDtosBuilderUtils, ResourcesConfig_OperationPathUtils, ResourceOperationVariantType, isDefaultUrlBearingOperation, isServiceResolvableDefaultOperation, SERVICE_NATIVE_OPERATION_VARIANT_TYPES, URL_BEARING_OPERATION_VARIANT_TYPES, findSharedPersistenceCollectionRetentionIncoherences, findSharedPersistenceCollectionAdapterIncoherences, ErrorType, ErrorCustomMessageReference, ENGINE_ORGANIZATION_UNIT_NARROWING, collectOrganizationUnitNarrowingViolations, mergeOrganizationUnitNarrowingDeclarations, DEFAULT_PERSISTENCE_ADAPTER, CoreResourceOperation, ResourceParentResourceRequirement, reconcileGeneratedRelationshipBulkOperations, Resources_SharedUtils, isPersistenceAdapter, selectByPersistenceAdapter, dataModeToVariantKey, findDuplicateRelationshipRegistrations, } from '@wildo-ai/saas-models';
+import { coreNotificationBadgeDefinitions, collectNotificationBadgeDeclarationViolations, notificationBadgeIdentityKey, coreShared_ResourcesConfigurations_FactoryMap, coreResourceShared_FieldIdentifier, coreResourceShared_FieldIdentifierPriority, coreSharedResourceRelationship, ResourcesConfigOperationsUrlsBuilderUtils, ResourcesConfigOperationsDtosBuilderUtils, ResourcesConfig_OperationPathUtils, ResourceOperationVariantType, isDefaultUrlBearingOperation, isServiceResolvableDefaultOperation, SERVICE_NATIVE_OPERATION_VARIANT_TYPES, URL_BEARING_OPERATION_VARIANT_TYPES, findSharedPersistenceCollectionRetentionIncoherences, findSharedPersistenceCollectionAdapterIncoherences, ErrorType, ErrorCustomMessageReference, ENGINE_ORGANIZATION_UNIT_NARROWING, collectOrganizationUnitNarrowingViolations, mergeOrganizationUnitNarrowingDeclarations, DEFAULT_PERSISTENCE_ADAPTER, CoreResourceOperation, ResourceParentResourceRequirement, reconcileGeneratedRelationshipBulkOperations, Resources_SharedUtils, isPersistenceAdapter, selectByPersistenceAdapter, dataModeToVariantKey, findDuplicateRelationshipRegistrations, } from '@wildo-ai/saas-models';
 import { backendResourcesConfigurationsFactoryMap } from '../../resources/models/resources-operations.backend.definitions.js';
 import { backendResourcesRelationships } from '../../resources/models/resources-relationships.backend.definitions.js';
 import { BackendResourceFieldIdentifier } from '../../resources/models/resources-types.backend.schemas.js';
@@ -288,6 +288,9 @@ let ResourcesRegistryBackendService = class ResourcesRegistryBackendService {
             // repositories (which apply) — so they cannot disagree about which resources are narrowed.
             organizationUnitNarrowing,
         };
+        // Validate that every badge declaration is coherent, and refuse to start otherwise.
+        this.logDebug('Validating notification badge declarations');
+        this.validateNotificationBadgeDeclarations(this.registry.notificationBadgeDefinitions, allResourceConfigurations);
         // Validate all relationships can resolve FK fields
         this.logDebug('Validating relationship FK field resolution');
         this.validateRelationshipForeignKeyFields(allResourceRelationships, allResourceFieldIdentifiers);
@@ -534,11 +537,36 @@ let ResourcesRegistryBackendService = class ResourcesRegistryBackendService {
      * Resolution is INTERNAL-preferred, then URL-bearing:
      *  1. If the operation declares an `INTERNAL_CALL` default, return it. This
      *     honours author intent for resources whose default for this operation
-     *     is internal-only (`userIdentityLinks.list`) AND for resources that
-     *     declare BOTH an internal and a URL default for the same operation
-     *     (`users.list`, `inboundContacts.update`) — the internal variant is the
-     *     one trusted callers must use; the URL variant is the public/admin
-     *     surface reached via its keyed/route path.
+     *     is internal-only (`userIdentityLinks.list`, `users.list`,
+     *     `inboundContacts.update`) AND for the one resource that declares BOTH
+     *     an internal and a URL default for the same operation — the internal
+     *     variant is the one trusted callers must use; the URL variant is the
+     *     public/admin surface reached via its keyed/route path.
+     *
+     *     **That "BOTH" population is exactly ONE operation: `organizations`
+     *     CREATE.** Measured 2026-09-08 over all 106 non-test
+     *     `*resources-config*.ts` files (653 variant blocks), replicating
+     *     `determineOperationVariantDefault` per variant-type group.
+     *
+     *     This paragraph previously cited `users.list` and `inboundContacts.update`
+     *     as further both-default examples and BOTH were wrong: the former's
+     *     `API_CALL` is `isDefault: false, variantKey: "admin"`, and the latter
+     *     declares no `API_CALL` at all — so neither has a URL-bearing DEFAULT and
+     *     neither is a case where this method chooses between transports. The
+     *     correction is recorded rather than silently applied because the false
+     *     plural made the preference look like a broad, well-trodden policy when it
+     *     decides exactly one operation — which is what made the agent function-tool
+     *     plane's blast radius read as unbounded when it was a single, and severe,
+     *     case (see `9594526e`).
+     *
+     *     ⚠️ **A caller that FACES AN EXTERNAL PRINCIPAL must not use this method.**
+     *     It answers "which variant does a TRUSTED internal caller want", and for
+     *     `organizations` CREATE that is the registration-owned path, which skips the
+     *     creation-policy guard and writes no founding owner. A surface that
+     *     advertises a public operation to an outside caller owes
+     *     {@link getOperationPathDefault} instead, so the operation it authorized and
+     *     advertised is the operation it executes — the invariant the MCP tool plane
+     *     and the agent function-tool factories both keep.
      *  2. Otherwise return the URL-bearing default (`API_CALL` /
      *     `API_CALL_WITH_CALLBACK`) for resources exposed only over HTTP.
      *  3. Otherwise throw `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`.
@@ -1032,6 +1060,62 @@ let ResourcesRegistryBackendService = class ResourcesRegistryBackendService {
             };
         }
     }
+    /**
+     * Refuse to start on an incoherent notification-badge declaration.
+     *
+     * ## What this catches, and why the runtime could not
+     *
+     * A badge write used to be addressed by a bare `identifier`, resolved against nothing. Two
+     * declarations were therefore unfalsifiable:
+     *
+     * - an operation naming a badge NO definition declares — the write materialized a counter row
+     *   that no definition described and no screen could render, silently, forever;
+     * - two definitions sharing one `(scope, identifier)` — every lookup answers the first, so the
+     *   second is unreachable while sharing the first's count.
+     *
+     * Neither produces an error at runtime. The write succeeds; the render finds nothing; nobody is
+     * told. So the check belongs where the DECLARATION is, not where the write is, and it fails
+     * CLOSED for the same reason the organization-unit narrowing containment above does: a
+     * misconfiguration that only manifests as a missing number is one nobody chases.
+     *
+     * **What a misconfigured application experiences:** the backend does not come up. Startup throws
+     * a `CONFIGURATION` error naming every violation — the resource and operation that declared the
+     * unresolvable ref, or the duplicated key — beside the keys that ARE registered, so the author
+     * reads the fix off the message rather than deriving it. A typo in a `badgeRef` is a refusal at
+     * the moment it is authored instead of a badge that never appears in production.
+     *
+     * The enumeration is TOTAL over both populations rather than sampled: every registered
+     * definition, and every `notificationBadgeOperations` entry on every operation of every resource
+     * configuration — which is the merged core + application map, so an engine-declared badge is
+     * checked on the same terms as an application-declared one.
+     */
+    validateNotificationBadgeDeclarations(notificationBadgeDefinitions, allResourceConfigurations) {
+        const operationSites = [];
+        for (const [resourceType, resourceConfiguration] of Object.entries(allResourceConfigurations)) {
+            const operations = resourceConfiguration?.operations ?? {};
+            for (const [operationIdentifier, operation] of Object.entries(operations)) {
+                const badgeOperations = operation?.notificationBadgeOperations ?? [];
+                for (const badgeOperation of badgeOperations) {
+                    operationSites.push({ resourceType, operationIdentifier, badgeRef: badgeOperation.badgeRef });
+                }
+            }
+        }
+        const violations = collectNotificationBadgeDeclarationViolations(notificationBadgeDefinitions, operationSites);
+        if (violations.length > 0) {
+            this.logger.error('Notification badge declaration validation failed', { violations });
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.CONFIGURATION,
+                context: {
+                    message: 'Notification badge declarations are incoherent',
+                    reason: 'notification_badge_declaration_violation',
+                    violations,
+                    registeredBadgeKeys: notificationBadgeDefinitions.map(notificationBadgeIdentityKey),
+                },
+            });
+        }
+        this.logDebug(`Validated ${notificationBadgeDefinitions.length} notification badge definition(s) `
+            + `and ${operationSites.length} operation badge reference(s)`);
+    }
     /**
      * Validate that all relationships can resolve their FK fields at startup.
      * This catches configuration errors early (e.g., missing resourceFieldIdentifier).