@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/resources/backend-resource-registry.exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-resource-registry.exports.d.ts","sourceRoot":"","sources":["../../../../src/resources/backend-resource-registry.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,mDAAmD,CAAC;AAClE,cAAc,sDAAsD,CAAC;AACrE,cAAc,0CAA0C,CAAC"}
+{"version":3,"file":"backend-resource-registry.exports.d.ts","sourceRoot":"","sources":["../../../src/resources/backend-resource-registry.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,mDAAmD,CAAC;AAClE,cAAc,sDAAsD,CAAC;AACrE,cAAc,0CAA0C,CAAC"}

package/dist/esm/resources/models/custom-service-implementations.backend.definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom-service-implementations.backend.definition.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/custom-service-implementations.backend.definition.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AA0DxK,eAAO,MAAM,2CAA2C,EAAG,0CAA0C,EAuGpG,CAAA"}
+{"version":3,"file":"custom-service-implementations.backend.definition.d.ts","sourceRoot":"","sources":["../../../../src/resources/models/custom-service-implementations.backend.definition.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAgExK,eAAO,MAAM,2CAA2C,EAAG,0CAA0C,EAiHpG,CAAA"}

package/dist/esm/resources/models/custom-service-implementations.backend.definition.js

@@ -6,18 +6,22 @@ import { authCustomImplementations } from '../../security/authentications/servic
 import { createAuditLogsExportFactories } from '../../compliance/audit-trails/audit-logs.custom-impl.backend.service.js';
 import { createOrganizationCreateFactories, createOrganizationLifecycleFactories } from '../../organizations/services/organization-custom-implementation.backend.service.js';
 import { createOrganizationDeletionAuditFactories } from '../../organizations/services/organization-deletion-audit.custom-impl.backend.service.js';
+import { createOrganizationProviderCredentialFactories } from '../../security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.js';
+import { createUserProviderCredentialFactories } from '../../security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.js';
 import { createEngineResourceStatusTransitionFactories } from '../../base-classes/services/services/resource-status-transition.definitions.backend.js';
 import { createOrganizationMemberCreateFactories } from '../../organizations/services/organization-member-custom-implementation.backend.service.js';
 import { createPlatformAccessGrantFactories } from '../../security/authorizations/platform-access-grant-custom-implementation.backend.service.js';
+import { createApplicationAccessGrantFactories } from '../../security/authorizations/application-access-grant-custom-implementation.backend.service.js';
 import { createOrganizationUnitCreatePathFactories, createOrganizationUnitDeleteDependentsGuardFactories, createOrganizationUnitMoveFactories, createOrganizationUnitStatusTransitionFactories, createOrganizationUnitUpdateFactories, } from '../../organizations/services/organization-unit-custom-implementation.backend.service.js';
 import { createOrganizationUnitMemberCreateFactories, createOrganizationUnitMemberDeleteFactories, createOrganizationUnitMemberUpdateFactories, } from '../../organizations/services/organization-unit-member-custom-implementation.backend.service.js';
 import { createInboundContactCreateFactories } from '../../users/services/inbound-contact-custom-implementation.backend.service.js';
 import { createUserCoreRoleCeilingFactories, createUserRoleSetOperationFactories, } from '../../users/services/user-role-administration.custom-impl.backend.service.js';
 import { createUserForcePasswordResetFactories } from '../../users/services/user-force-password-reset.custom-impl.backend.service.js';
+import { createUserReadRetainedFactories } from '../../users/services/user-read-retained.custom-impl.backend.service.js';
 import { createUserDeletionAuditFactories } from '../../users/services/user-deletion-audit.custom-impl.backend.service.js';
 import { createUserSuperAdminFloorFactories } from '../../users/services/user-super-admin-floor.custom-impl.backend.service.js';
-import { createApiKeyCreateFactories, createApiKeyRotateFactories, createApiKeyRegenerateFactories, createApiKeyExtendExpiryFactories, createApiKeyUsageStatsFactories, createApiKeyDeactivateFactories, createApiKeyReactivateFactories, } from '../../security/api-keys/api-keys.custom-impl.backend.service.js';
-import { createOAuthClientCreateFactories, createOAuthClientRotateFactories, createOAuthClientRegenerateFactories, } from '../../security/oauth-clients/oauth-clients.custom-impl.backend.service.js';
+import { createApiKeyCreateFactories, createApiKeyRotateFactories, createApiKeyRegenerateFactories, createApiKeyExtendExpiryFactories, createApiKeyUsageStatsFactories, createApiKeyDeactivateFactories, createApiKeyExpireFactories, createApiKeyReactivateFactories, } from '../../security/api-keys/api-keys.custom-impl.backend.service.js';
+import { createOAuthClientCreateFactories, createOAuthClientRotateFactories, createOAuthClientExpireFactories, createOAuthClientRegenerateFactories, } from '../../security/oauth-clients/oauth-clients.custom-impl.backend.service.js';
 import { createScopeFeaturesCacheInvalidationFactories } from '../../features/services/scope-features-cache-invalidation.custom-impl.backend.service.js';
 import { createSiemExportConfigCacheInvalidationFactories } from '../../compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js';
 import { createOrganizationFeaturesAdminWritePathFactories } from '../../features/services/organization-features-admin-write-path.custom-impl.backend.service.js';
@@ -43,12 +47,17 @@ export const CoreBackend_ServiceImplementationsFactories = [
     // the privileged cross-tenant route unaudited. Post-commit by construction; reads the pre-deletion
     // snapshot because `name` / `slug` are unrecoverable once the row is gone.
     ...createOrganizationDeletionAuditFactories(),
+    // Seals every organization provider credential on write, and audits the grant lifecycle. Without
+    // this registration the resource stores plaintext secrets behind a route that still answers 200.
+    ...createOrganizationProviderCredentialFactories(),
+    ...createUserProviderCredentialFactories(),
     ...createOrganizationMemberCreateFactories(),
     // PLATFORM_ACCESS_GRANTS — the four lifecycle transitions. Every field that carries the
     // time-bound/justified/tenant-scoped guarantee (`operatorUserId`, `status`, `expiresAt`,
     // `approvedByUserId`) is server-authored here; the resource exposes no generic CREATE/UPDATE door,
     // so these prefixes are the only way a grant can come into existence or change state.
     ...createPlatformAccessGrantFactories(),
+    ...createApplicationAccessGrantFactories(),
     // ORGANIZATION_UNITS DELETE prefix — refuses to strand a subtree behind a deleted interior
     // node (the unit tree self-edge declares no delete cascade).
     ...createOrganizationUnitDeleteDependentsGuardFactories(),
@@ -91,6 +100,8 @@ export const CoreBackend_ServiceImplementationsFactories = [
     // and the declared `{ resetToken, resetUrl }` response could never be produced (that handback
     // is now gone — it was an account-takeover primitive).
     ...createUserForcePasswordResetFactories(),
+    // #490 — the operator surface for the audited see-through read of a RETAINED user row.
+    ...createUserReadRetainedFactories(),
     // USERS DELETE — emits USER_DELETED. The event type and its SIEM classification existed from the
     // start but NOTHING produced them, so identity destruction left no evidence at all. Post-commit
     // by construction; reads the pre-deletion snapshot because `email` / `appRoles` are unrecoverable
@@ -108,10 +119,13 @@ export const CoreBackend_ServiceImplementationsFactories = [
     ...createApiKeyUsageStatsFactories(),
     ...createApiKeyDeactivateFactories(),
     ...createApiKeyReactivateFactories(),
+    // ACTIVE → EXPIRED, dispatched only by the credential-expiry sweep (#413).
+    ...createApiKeyExpireFactories(),
     // OAuth Clients (registered client-credentials front — mirrors API Keys mint pipeline)
     ...createOAuthClientCreateFactories(),
     ...createOAuthClientRotateFactories(),
     ...createOAuthClientRegenerateFactories(),
+    ...createOAuthClientExpireFactories(),
     ...createOrganizationFeaturesAdminWritePathFactories(),
     ...createApplicationFeaturesAdminWritePathFactories(),
     ...createScopeFeaturesCacheInvalidationFactories(),

package/dist/esm/resources/models/custom-service-implementations.backend.definition.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-service-implementations.backend.definition.js","sourceRoot":"","sources":["../../../../../src/resources/models/custom-service-implementations.backend.definition.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4EAA4E,CAAC;AAC3H,OAAO,EAAE,4BAA4B,EAAE,MAAM,wFAAwF,CAAC;AACtI,OAAO,EAAE,8BAA8B,EAAE,MAAM,+EAA+E,CAAC;AAC/H,OAAO,EAAE,oCAAoC,EAAE,MAAM,uFAAuF,CAAC;AAC7I,OAAO,EAAE,yBAAyB,EAAE,MAAM,uGAAuG,CAAC;AAClJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,mFAAmF,CAAC;AACnI,OAAO,EAAE,iCAAiC,EAAE,oCAAoC,EAAE,MAAM,8FAA8F,CAAC;AACvL,OAAO,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAC7J,OAAO,EAAE,6CAA6C,EAAE,MAAM,kGAAkG,CAAC;AACjK,OAAO,EAAE,uCAAuC,EAAE,MAAM,qGAAqG,CAAC;AAC9J,OAAO,EAAE,kCAAkC,EAAE,MAAM,wGAAwG,CAAC;AAC5J,OAAO,EACL,yCAAyC,EACzC,oDAAoD,EACpD,mCAAmC,EACnC,+CAA+C,EAC/C,qCAAqC,GACtC,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EACL,2CAA2C,EAC3C,2CAA2C,EAC3C,2CAA2C,GAC5C,MAAM,0GAA0G,CAAC;AAClH,OAAO,EAAE,mCAAmC,EAAE,MAAM,yFAAyF,CAAC;AAC9I,OAAO,EACL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,wFAAwF,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,yFAAyF,CAAC;AAChJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,mFAAmF,CAAC;AACrI,OAAO,EAAE,kCAAkC,EAAE,MAAM,sFAAsF,CAAC;AAC1I,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,2EAA2E,CAAC;AACnF,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,qFAAqF,CAAC;AAC7F,OAAO,EAAE,6CAA6C,EAAE,MAAM,oGAAoG,CAAC;AACnK,OAAO,EAAE,gDAAgD,EAAE,MAAM,uHAAuH,CAAC;AACzL,OAAO,EAAE,iDAAiD,EAAE,MAAM,yGAAyG,CAAC;AAC5K,OAAO,EAAE,gDAAgD,EAAE,MAAM,wGAAwG,CAAC;AAC1K,OAAO,EAAE,yCAAyC,EAAE,MAAM,mHAAmH,CAAC;AAC9K,OAAO,EACL,yCAAyC,EACzC,4CAA4C,GAC7C,MAAM,kHAAkH,CAAC;AAC1H,OAAO,EAAE,wCAAwC,EAAE,MAAM,sHAAsH,CAAC;AAGhL,MAAM,CAAC,MAAM,2CAA2C,GAAkD;IACxG,GAAG,6BAA6B;IAChC,GAAG,4BAA4B;IAC/B,GAAG,oCAAoC;IACvC,GAAG,8BAA8B;IACjC,GAAG,yBAAyB;IAC5B,GAAG,iCAAiC,EAAE;IACtC,iGAAiG;IACjG,uEAAuE;IACvE,GAAG,oCAAoC,EAAE;IACzC,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;IAC5F,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,2EAA2E;IAC3E,GAAG,wCAAwC,EAAE;IAC7C,GAAG,uCAAuC,EAAE;IAC5C,wFAAwF;IACxF,yFAAyF;IACzF,mGAAmG;IACnG,sFAAsF;IACtF,GAAG,kCAAkC,EAAE;IACvC,2FAA2F;IAC3F,6DAA6D;IAC7D,GAAG,oDAAoD,EAAE;IACzD,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,GAAG,yCAAyC,EAAE;IAC9C,GAAG,qCAAqC,EAAE;IAC1C,GAAG,mCAAmC,EAAE;IACxC,GAAG,+CAA+C,EAAE;IACpD,yFAAyF;IACzF,8FAA8F;IAC9F,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,gGAAgG;IAChG,iEAAiE;IACjE,GAAG,2CAA2C,EAAE;IAChD,GAAG,2CAA2C,EAAE;IAChD,GAAG,2CAA2C,EAAE;IAChD,iGAAiG;IACjG,0DAA0D;IAC1D,wFAAwF;IACxF,8DAA8D;IAC9D,GAAG,6CAA6C,EAAE;IAClD,4EAA4E;IAC5E,8EAA8E;IAC9E,GAAG,mCAAmC,EAAE;IACxC,iGAAiG;IACjG,iGAAiG;IACjG,iGAAiG;IACjG,mFAAmF;IACnF,GAAG,mCAAmC,EAAE;IACxC,GAAG,kCAAkC,EAAE;IACvC,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,8FAA8F;IAC9F,uDAAuD;IACvD,GAAG,qCAAqC,EAAE;IAC1C,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,wBAAwB;IACxB,GAAG,gCAAgC,EAAE;IACrC,6FAA6F;IAC7F,mGAAmG;IACnG,mGAAmG;IACnG,iFAAiF;IACjF,GAAG,kCAAkC,EAAE;IACvC,GAAG,2BAA2B,EAAE;IAChC,GAAG,2BAA2B,EAAE;IAChC,GAAG,+BAA+B,EAAE;IACpC,GAAG,iCAAiC,EAAE;IACtC,GAAG,+BAA+B,EAAE;IACpC,GAAG,+BAA+B,EAAE;IACpC,GAAG,+BAA+B,EAAE;IACpC,uFAAuF;IACvF,GAAG,gCAAgC,EAAE;IACrC,GAAG,gCAAgC,EAAE;IACrC,GAAG,oCAAoC,EAAE;IACzC,GAAG,iDAAiD,EAAE;IACtD,GAAG,gDAAgD,EAAE;IACrD,GAAG,6CAA6C,EAAE;IAClD,GAAG,gDAAgD,EAAE;IACrD,GAAG,8BAA8B,EAAE;IACnC,8EAA8E;IAC9E,uEAAuE;IACvE,wEAAwE;IACxE,GAAG,yCAAyC,EAAE;IAC9C,GAAG,yCAAyC,EAAE;IAC9C,GAAG,4CAA4C,EAAE;IACjD,qFAAqF;IACrF,yFAAyF;IACzF,0FAA0F;IAC1F,oBAAoB;IACpB,GAAG,wCAAwC,EAAE;CAC9C,CAAA","sourcesContent":["import { z } from 'zod';\nimport type { ResourceConfiguration_Operation } from '@wildo-ai/saas-models';\nimport type { ResourceOperationCustomImplementationBase } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { userSelfCustomImplementations } from '~wildo-backend-lib/users/services/user-self-custom-implementations.backend';\nimport { billingCustomImplementations } from '~wildo-backend-lib/billing/services/custom-impl/billing-custom-implementations.backend';\nimport { lifecycleCustomImplementations } from '~wildo-backend-lib/guidance/services/lifecycle-custom-implementations.backend';\nimport { scopedStateReadCustomImplementations } from '~wildo-backend-lib/guidance/services/scoped-state-read-custom-implementations.backend';\nimport { authCustomImplementations } from '~wildo-backend-lib/security/authentications/services/custom-impls/auth-custom-implementations.backend';\nimport { createAuditLogsExportFactories } from '~wildo-backend-lib/compliance/audit-trails/audit-logs.custom-impl.backend.service';\nimport { createOrganizationCreateFactories, createOrganizationLifecycleFactories } from '~wildo-backend-lib/organizations/services/organization-custom-implementation.backend.service';\nimport { createOrganizationDeletionAuditFactories } from '~wildo-backend-lib/organizations/services/organization-deletion-audit.custom-impl.backend.service';\nimport { createEngineResourceStatusTransitionFactories } from '~wildo-backend-lib/base-classes/services/services/resource-status-transition.definitions.backend';\nimport { createOrganizationMemberCreateFactories } from '~wildo-backend-lib/organizations/services/organization-member-custom-implementation.backend.service';\nimport { createPlatformAccessGrantFactories } from '~wildo-backend-lib/security/authorizations/platform-access-grant-custom-implementation.backend.service';\nimport {\n  createOrganizationUnitCreatePathFactories,\n  createOrganizationUnitDeleteDependentsGuardFactories,\n  createOrganizationUnitMoveFactories,\n  createOrganizationUnitStatusTransitionFactories,\n  createOrganizationUnitUpdateFactories,\n} from '~wildo-backend-lib/organizations/services/organization-unit-custom-implementation.backend.service';\nimport {\n  createOrganizationUnitMemberCreateFactories,\n  createOrganizationUnitMemberDeleteFactories,\n  createOrganizationUnitMemberUpdateFactories,\n} from '~wildo-backend-lib/organizations/services/organization-unit-member-custom-implementation.backend.service';\nimport { createInboundContactCreateFactories } from '~wildo-backend-lib/users/services/inbound-contact-custom-implementation.backend.service';\nimport {\n  createUserCoreRoleCeilingFactories,\n  createUserRoleSetOperationFactories,\n} from '~wildo-backend-lib/users/services/user-role-administration.custom-impl.backend.service';\nimport { createUserForcePasswordResetFactories } from '~wildo-backend-lib/users/services/user-force-password-reset.custom-impl.backend.service';\nimport { createUserDeletionAuditFactories } from '~wildo-backend-lib/users/services/user-deletion-audit.custom-impl.backend.service';\nimport { createUserSuperAdminFloorFactories } from '~wildo-backend-lib/users/services/user-super-admin-floor.custom-impl.backend.service';\nimport {\n  createApiKeyCreateFactories,\n  createApiKeyRotateFactories,\n  createApiKeyRegenerateFactories,\n  createApiKeyExtendExpiryFactories,\n  createApiKeyUsageStatsFactories,\n  createApiKeyDeactivateFactories,\n  createApiKeyReactivateFactories,\n} from '~wildo-backend-lib/security/api-keys/api-keys.custom-impl.backend.service';\nimport {\n  createOAuthClientCreateFactories,\n  createOAuthClientRotateFactories,\n  createOAuthClientRegenerateFactories,\n} from '~wildo-backend-lib/security/oauth-clients/oauth-clients.custom-impl.backend.service';\nimport { createScopeFeaturesCacheInvalidationFactories } from '~wildo-backend-lib/features/services/scope-features-cache-invalidation.custom-impl.backend.service';\nimport { createSiemExportConfigCacheInvalidationFactories } from '~wildo-backend-lib/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service';\nimport { createOrganizationFeaturesAdminWritePathFactories } from '~wildo-backend-lib/features/services/organization-features-admin-write-path.custom-impl.backend.service';\nimport { createApplicationFeaturesAdminWritePathFactories } from '~wildo-backend-lib/features/services/application-features-admin-write-path.custom-impl.backend.service';\nimport { createWebhookConfigReadPublicKeyFactories } from '~wildo-backend-lib/notifications/webhooks/outbound/services/webhook-config-public-key.custom-impl.backend.service';\nimport {\n  createM2MWebhookDeliveryLogRetryFactories,\n  createM2MWebhookDeliveryLogPurgeOldFactories,\n} from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.custom-impl.backend.service';\nimport { createWebhookConfigTestEndpointFactories } from '~wildo-backend-lib/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service';\n\n\nexport const CoreBackend_ServiceImplementationsFactories : ResourceCustomServiceImplementationFactory[] = [\n  ...userSelfCustomImplementations,\n  ...billingCustomImplementations,\n  ...scopedStateReadCustomImplementations,\n  ...lifecycleCustomImplementations,\n  ...authCustomImplementations,\n  ...createOrganizationCreateFactories(),\n  // Tenant lifecycle transitions (WS-A): `request_deletion` on both declared variants + `restore`.\n  // These own `Organization.status`, which generic UPDATE may not write.\n  ...createOrganizationLifecycleFactories(),\n  // ORGANIZATIONS DELETE — emits ORGANIZATION_DELETED. The event type, its typed event-data schema\n  // and its SIEM classification all existed from the start but NOTHING produced them, so destroying\n  // a whole tenant left no evidence at all (the exact sibling of the USER_DELETED gap below).\n  // Registered on BOTH declared doors — the org-admin default AND the super-admin `admin` variant —\n  // because custom impls resolve by an exact operation-path key; one registration would have left\n  // the privileged cross-tenant route unaudited. Post-commit by construction; reads the pre-deletion\n  // snapshot because `name` / `slug` are unrecoverable once the row is gone.\n  ...createOrganizationDeletionAuditFactories(),\n  ...createOrganizationMemberCreateFactories(),\n  // PLATFORM_ACCESS_GRANTS — the four lifecycle transitions. Every field that carries the\n  // time-bound/justified/tenant-scoped guarantee (`operatorUserId`, `status`, `expiresAt`,\n  // `approvedByUserId`) is server-authored here; the resource exposes no generic CREATE/UPDATE door,\n  // so these prefixes are the only way a grant can come into existence or change state.\n  ...createPlatformAccessGrantFactories(),\n  // ORGANIZATION_UNITS DELETE prefix — refuses to strand a subtree behind a deleted interior\n  // node (the unit tree self-edge declares no delete cascade).\n  ...createOrganizationUnitDeleteDependentsGuardFactories(),\n  // ORGANIZATION_UNITS tree mechanics. CREATE materializes the hierarchy `path` on the inserting\n  // write (it was previously never written by anything); MOVE re-parents and re-homes the whole\n  // subtree; ARCHIVE/RESTORE own the node-only status transitions. Before these, all three custom\n  // operations were declared with no implementation and succeeded while changing nothing.\n  ...createOrganizationUnitCreatePathFactories(),\n  ...createOrganizationUnitUpdateFactories(),\n  ...createOrganizationUnitMoveFactories(),\n  ...createOrganizationUnitStatusTransitionFactories(),\n  // ORGANIZATION_UNIT_MEMBERS — a unit assignment is a role grant (its `role` is read into\n  // `initiatorRoles` as a unit-narrowed entry), so both write paths carry the role-ceiling gate\n  // explicitly (custom impls resolve by exact operation path; neither inherits the other's gate).\n  // CREATE additionally proves the target unit is in the caller's tenant. All three paths emit the\n  // matching audit event: grant and re-grade via ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED, revocation\n  // via ORGANIZATION_UNIT_MEMBER_REMOVED — without the last one an authorization-filtered trail\n  // would show unit privileges granted and never removed. DELETE must capture the revoked role in\n  // its PREFIX: a delete postfix cannot read the deleted document.\n  ...createOrganizationUnitMemberCreateFactories(),\n  ...createOrganizationUnitMemberUpdateFactories(),\n  ...createOrganizationUnitMemberDeleteFactories(),\n  // Account/entity lifecycle transitions (SUSPEND / REACTIVATE / DEACTIVATE_ACCOUNT …). One shared\n  // implementation across resources, declared as data — see\n  // `resource-status-transition.definitions.backend.ts` for the state machine and for why\n  // `organizations | activate|suspend` are not in the list yet.\n  ...createEngineResourceStatusTransitionFactories(),\n  // INBOUND_CONTACTS CREATE prefix — stamps the backend-only `emailUserMatch`\n  // triage signal (does the lead email match an existing active/inactive user).\n  ...createInboundContactCreateFactories(),\n  // USERS application-role administration. `assign_roles` / `revoke_roles` translate their `roles`\n  // request contract into set algebra over the persisted `appRoles` (they previously named a field\n  // that is not a schema path and wrote nothing); CREATE/UPDATE carry the role-ceiling gate on the\n  // same field, which nothing measured before. All four emit USER_APP_ROLES_CHANGED.\n  ...createUserRoleSetOperationFactories(),\n  ...createUserCoreRoleCeilingFactories(),\n  // USERS force_password_reset — mints a single-use reset token for the TARGET, mails it to\n  // them, evicts their live sessions, and records the acting administrator plus their reason.\n  // Previously declared UPDATE-like with no handler, so it answered 200 while minting nothing\n  // and the declared `{ resetToken, resetUrl }` response could never be produced (that handback\n  // is now gone — it was an account-takeover primitive).\n  ...createUserForcePasswordResetFactories(),\n  // USERS DELETE — emits USER_DELETED. The event type and its SIEM classification existed from the\n  // start but NOTHING produced them, so identity destruction left no evidence at all. Post-commit\n  // by construction; reads the pre-deletion snapshot because `email` / `appRoles` are unrecoverable\n  // once the row is gone.\n  ...createUserDeletionAuditFactories(),\n  // USERS DELETE — the last-super-administrator floor. Registered at priority 50 so it refuses\n  // BEFORE the deletion-audit registration above (default 100) prepares anything: destroying the row\n  // that holds the last application authority is the same unrecoverable lockout as revoking the role\n  // off it, which the role-administration registrations refuse on their own paths.\n  ...createUserSuperAdminFloorFactories(),\n  ...createApiKeyCreateFactories(),\n  ...createApiKeyRotateFactories(),\n  ...createApiKeyRegenerateFactories(),\n  ...createApiKeyExtendExpiryFactories(),\n  ...createApiKeyUsageStatsFactories(),\n  ...createApiKeyDeactivateFactories(),\n  ...createApiKeyReactivateFactories(),\n  // OAuth Clients (registered client-credentials front — mirrors API Keys mint pipeline)\n  ...createOAuthClientCreateFactories(),\n  ...createOAuthClientRotateFactories(),\n  ...createOAuthClientRegenerateFactories(),\n  ...createOrganizationFeaturesAdminWritePathFactories(),\n  ...createApplicationFeaturesAdminWritePathFactories(),\n  ...createScopeFeaturesCacheInvalidationFactories(),\n  ...createSiemExportConfigCacheInvalidationFactories(),\n  ...createAuditLogsExportFactories(),\n  // Webhook (M2M outbound) domain — the public-key READ postfix existed but was\n  // never registered (the `applicationPublicKeyPem` field silently never\n  // surfaced); registered here together with the RETRY / PURGE_OLD impls.\n  ...createWebhookConfigReadPublicKeyFactories(),\n  ...createM2MWebhookDeliveryLogRetryFactories(),\n  ...createM2MWebhookDeliveryLogPurgeOldFactories(),\n  // TEST_ENDPOINT — fires one signed synthetic delivery through the SAME transport the\n  // delivery worker uses and returns the diagnostic. Previously declared READ-like with no\n  // handler, so the core read answered 200 with the config row and an unreachable URL still\n  // reported success.\n  ...createWebhookConfigTestEndpointFactories(),\n]\n"]}
+{"version":3,"file":"custom-service-implementations.backend.definition.js","sourceRoot":"","sources":["../../../../src/resources/models/custom-service-implementations.backend.definition.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4EAA4E,CAAC;AAC3H,OAAO,EAAE,4BAA4B,EAAE,MAAM,wFAAwF,CAAC;AACtI,OAAO,EAAE,8BAA8B,EAAE,MAAM,+EAA+E,CAAC;AAC/H,OAAO,EAAE,oCAAoC,EAAE,MAAM,uFAAuF,CAAC;AAC7I,OAAO,EAAE,yBAAyB,EAAE,MAAM,uGAAuG,CAAC;AAClJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,mFAAmF,CAAC;AACnI,OAAO,EAAE,iCAAiC,EAAE,oCAAoC,EAAE,MAAM,8FAA8F,CAAC;AACvL,OAAO,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAC7J,OAAO,EAAE,6CAA6C,EAAE,MAAM,uHAAuH,CAAC;AACtL,OAAO,EAAE,qCAAqC,EAAE,MAAM,+GAA+G,CAAC;AACtK,OAAO,EAAE,6CAA6C,EAAE,MAAM,kGAAkG,CAAC;AACjK,OAAO,EAAE,uCAAuC,EAAE,MAAM,qGAAqG,CAAC;AAC9J,OAAO,EAAE,kCAAkC,EAAE,MAAM,wGAAwG,CAAC;AAC5J,OAAO,EAAE,qCAAqC,EAAE,MAAM,2GAA2G,CAAC;AAClK,OAAO,EACL,yCAAyC,EACzC,oDAAoD,EACpD,mCAAmC,EACnC,+CAA+C,EAC/C,qCAAqC,GACtC,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EACL,2CAA2C,EAC3C,2CAA2C,EAC3C,2CAA2C,GAC5C,MAAM,0GAA0G,CAAC;AAClH,OAAO,EAAE,mCAAmC,EAAE,MAAM,yFAAyF,CAAC;AAC9I,OAAO,EACL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,wFAAwF,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,yFAAyF,CAAC;AAChJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,kFAAkF,CAAC;AACnI,OAAO,EAAE,gCAAgC,EAAE,MAAM,mFAAmF,CAAC;AACrI,OAAO,EAAE,kCAAkC,EAAE,MAAM,sFAAsF,CAAC;AAC1I,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,2EAA2E,CAAC;AACnF,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,qFAAqF,CAAC;AAC7F,OAAO,EAAE,6CAA6C,EAAE,MAAM,oGAAoG,CAAC;AACnK,OAAO,EAAE,gDAAgD,EAAE,MAAM,uHAAuH,CAAC;AACzL,OAAO,EAAE,iDAAiD,EAAE,MAAM,yGAAyG,CAAC;AAC5K,OAAO,EAAE,gDAAgD,EAAE,MAAM,wGAAwG,CAAC;AAC1K,OAAO,EAAE,yCAAyC,EAAE,MAAM,mHAAmH,CAAC;AAC9K,OAAO,EACL,yCAAyC,EACzC,4CAA4C,GAC7C,MAAM,kHAAkH,CAAC;AAC1H,OAAO,EAAE,wCAAwC,EAAE,MAAM,sHAAsH,CAAC;AAGhL,MAAM,CAAC,MAAM,2CAA2C,GAAkD;IACxG,GAAG,6BAA6B;IAChC,GAAG,4BAA4B;IAC/B,GAAG,oCAAoC;IACvC,GAAG,8BAA8B;IACjC,GAAG,yBAAyB;IAC5B,GAAG,iCAAiC,EAAE;IACtC,iGAAiG;IACjG,uEAAuE;IACvE,GAAG,oCAAoC,EAAE;IACzC,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;IAC5F,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,2EAA2E;IAC3E,GAAG,wCAAwC,EAAE;IAC7C,iGAAiG;IACjG,iGAAiG;IACjG,GAAG,6CAA6C,EAAE;IAClD,GAAG,qCAAqC,EAAE;IAC1C,GAAG,uCAAuC,EAAE;IAC5C,wFAAwF;IACxF,yFAAyF;IACzF,mGAAmG;IACnG,sFAAsF;IACtF,GAAG,kCAAkC,EAAE;IACvC,GAAG,qCAAqC,EAAE;IAC1C,2FAA2F;IAC3F,6DAA6D;IAC7D,GAAG,oDAAoD,EAAE;IACzD,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,GAAG,yCAAyC,EAAE;IAC9C,GAAG,qCAAqC,EAAE;IAC1C,GAAG,mCAAmC,EAAE;IACxC,GAAG,+CAA+C,EAAE;IACpD,yFAAyF;IACzF,8FAA8F;IAC9F,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,gGAAgG;IAChG,iEAAiE;IACjE,GAAG,2CAA2C,EAAE;IAChD,GAAG,2CAA2C,EAAE;IAChD,GAAG,2CAA2C,EAAE;IAChD,iGAAiG;IACjG,0DAA0D;IAC1D,wFAAwF;IACxF,8DAA8D;IAC9D,GAAG,6CAA6C,EAAE;IAClD,4EAA4E;IAC5E,8EAA8E;IAC9E,GAAG,mCAAmC,EAAE;IACxC,iGAAiG;IACjG,iGAAiG;IACjG,iGAAiG;IACjG,mFAAmF;IACnF,GAAG,mCAAmC,EAAE;IACxC,GAAG,kCAAkC,EAAE;IACvC,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,8FAA8F;IAC9F,uDAAuD;IACvD,GAAG,qCAAqC,EAAE;IAC1C,uFAAuF;IACvF,GAAG,+BAA+B,EAAE;IACpC,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,wBAAwB;IACxB,GAAG,gCAAgC,EAAE;IACrC,6FAA6F;IAC7F,mGAAmG;IACnG,mGAAmG;IACnG,iFAAiF;IACjF,GAAG,kCAAkC,EAAE;IACvC,GAAG,2BAA2B,EAAE;IAChC,GAAG,2BAA2B,EAAE;IAChC,GAAG,+BAA+B,EAAE;IACpC,GAAG,iCAAiC,EAAE;IACtC,GAAG,+BAA+B,EAAE;IACpC,GAAG,+BAA+B,EAAE;IACpC,GAAG,+BAA+B,EAAE;IACpC,2EAA2E;IAC3E,GAAG,2BAA2B,EAAE;IAChC,uFAAuF;IACvF,GAAG,gCAAgC,EAAE;IACrC,GAAG,gCAAgC,EAAE;IACrC,GAAG,oCAAoC,EAAE;IACzC,GAAG,gCAAgC,EAAE;IACrC,GAAG,iDAAiD,EAAE;IACtD,GAAG,gDAAgD,EAAE;IACrD,GAAG,6CAA6C,EAAE;IAClD,GAAG,gDAAgD,EAAE;IACrD,GAAG,8BAA8B,EAAE;IACnC,8EAA8E;IAC9E,uEAAuE;IACvE,wEAAwE;IACxE,GAAG,yCAAyC,EAAE;IAC9C,GAAG,yCAAyC,EAAE;IAC9C,GAAG,4CAA4C,EAAE;IACjD,qFAAqF;IACrF,yFAAyF;IACzF,0FAA0F;IAC1F,oBAAoB;IACpB,GAAG,wCAAwC,EAAE;CAC9C,CAAA","sourcesContent":["import { z } from 'zod';\nimport type { ResourceConfiguration_Operation } from '@wildo-ai/saas-models';\nimport type { ResourceOperationCustomImplementationBase } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { userSelfCustomImplementations } from '~wildo-backend-lib/users/services/user-self-custom-implementations.backend';\nimport { billingCustomImplementations } from '~wildo-backend-lib/billing/services/custom-impl/billing-custom-implementations.backend';\nimport { lifecycleCustomImplementations } from '~wildo-backend-lib/guidance/services/lifecycle-custom-implementations.backend';\nimport { scopedStateReadCustomImplementations } from '~wildo-backend-lib/guidance/services/scoped-state-read-custom-implementations.backend';\nimport { authCustomImplementations } from '~wildo-backend-lib/security/authentications/services/custom-impls/auth-custom-implementations.backend';\nimport { createAuditLogsExportFactories } from '~wildo-backend-lib/compliance/audit-trails/audit-logs.custom-impl.backend.service';\nimport { createOrganizationCreateFactories, createOrganizationLifecycleFactories } from '~wildo-backend-lib/organizations/services/organization-custom-implementation.backend.service';\nimport { createOrganizationDeletionAuditFactories } from '~wildo-backend-lib/organizations/services/organization-deletion-audit.custom-impl.backend.service';\nimport { createOrganizationProviderCredentialFactories } from '~wildo-backend-lib/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service';\nimport { createUserProviderCredentialFactories } from '~wildo-backend-lib/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service';\nimport { createEngineResourceStatusTransitionFactories } from '~wildo-backend-lib/base-classes/services/services/resource-status-transition.definitions.backend';\nimport { createOrganizationMemberCreateFactories } from '~wildo-backend-lib/organizations/services/organization-member-custom-implementation.backend.service';\nimport { createPlatformAccessGrantFactories } from '~wildo-backend-lib/security/authorizations/platform-access-grant-custom-implementation.backend.service';\nimport { createApplicationAccessGrantFactories } from '~wildo-backend-lib/security/authorizations/application-access-grant-custom-implementation.backend.service';\nimport {\n  createOrganizationUnitCreatePathFactories,\n  createOrganizationUnitDeleteDependentsGuardFactories,\n  createOrganizationUnitMoveFactories,\n  createOrganizationUnitStatusTransitionFactories,\n  createOrganizationUnitUpdateFactories,\n} from '~wildo-backend-lib/organizations/services/organization-unit-custom-implementation.backend.service';\nimport {\n  createOrganizationUnitMemberCreateFactories,\n  createOrganizationUnitMemberDeleteFactories,\n  createOrganizationUnitMemberUpdateFactories,\n} from '~wildo-backend-lib/organizations/services/organization-unit-member-custom-implementation.backend.service';\nimport { createInboundContactCreateFactories } from '~wildo-backend-lib/users/services/inbound-contact-custom-implementation.backend.service';\nimport {\n  createUserCoreRoleCeilingFactories,\n  createUserRoleSetOperationFactories,\n} from '~wildo-backend-lib/users/services/user-role-administration.custom-impl.backend.service';\nimport { createUserForcePasswordResetFactories } from '~wildo-backend-lib/users/services/user-force-password-reset.custom-impl.backend.service';\nimport { createUserReadRetainedFactories } from '~wildo-backend-lib/users/services/user-read-retained.custom-impl.backend.service';\nimport { createUserDeletionAuditFactories } from '~wildo-backend-lib/users/services/user-deletion-audit.custom-impl.backend.service';\nimport { createUserSuperAdminFloorFactories } from '~wildo-backend-lib/users/services/user-super-admin-floor.custom-impl.backend.service';\nimport {\n  createApiKeyCreateFactories,\n  createApiKeyRotateFactories,\n  createApiKeyRegenerateFactories,\n  createApiKeyExtendExpiryFactories,\n  createApiKeyUsageStatsFactories,\n  createApiKeyDeactivateFactories,\n  createApiKeyExpireFactories,\n  createApiKeyReactivateFactories,\n} from '~wildo-backend-lib/security/api-keys/api-keys.custom-impl.backend.service';\nimport {\n  createOAuthClientCreateFactories,\n  createOAuthClientRotateFactories,\n  createOAuthClientExpireFactories,\n  createOAuthClientRegenerateFactories,\n} from '~wildo-backend-lib/security/oauth-clients/oauth-clients.custom-impl.backend.service';\nimport { createScopeFeaturesCacheInvalidationFactories } from '~wildo-backend-lib/features/services/scope-features-cache-invalidation.custom-impl.backend.service';\nimport { createSiemExportConfigCacheInvalidationFactories } from '~wildo-backend-lib/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service';\nimport { createOrganizationFeaturesAdminWritePathFactories } from '~wildo-backend-lib/features/services/organization-features-admin-write-path.custom-impl.backend.service';\nimport { createApplicationFeaturesAdminWritePathFactories } from '~wildo-backend-lib/features/services/application-features-admin-write-path.custom-impl.backend.service';\nimport { createWebhookConfigReadPublicKeyFactories } from '~wildo-backend-lib/notifications/webhooks/outbound/services/webhook-config-public-key.custom-impl.backend.service';\nimport {\n  createM2MWebhookDeliveryLogRetryFactories,\n  createM2MWebhookDeliveryLogPurgeOldFactories,\n} from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.custom-impl.backend.service';\nimport { createWebhookConfigTestEndpointFactories } from '~wildo-backend-lib/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service';\n\n\nexport const CoreBackend_ServiceImplementationsFactories : ResourceCustomServiceImplementationFactory[] = [\n  ...userSelfCustomImplementations,\n  ...billingCustomImplementations,\n  ...scopedStateReadCustomImplementations,\n  ...lifecycleCustomImplementations,\n  ...authCustomImplementations,\n  ...createOrganizationCreateFactories(),\n  // Tenant lifecycle transitions (WS-A): `request_deletion` on both declared variants + `restore`.\n  // These own `Organization.status`, which generic UPDATE may not write.\n  ...createOrganizationLifecycleFactories(),\n  // ORGANIZATIONS DELETE — emits ORGANIZATION_DELETED. The event type, its typed event-data schema\n  // and its SIEM classification all existed from the start but NOTHING produced them, so destroying\n  // a whole tenant left no evidence at all (the exact sibling of the USER_DELETED gap below).\n  // Registered on BOTH declared doors — the org-admin default AND the super-admin `admin` variant —\n  // because custom impls resolve by an exact operation-path key; one registration would have left\n  // the privileged cross-tenant route unaudited. Post-commit by construction; reads the pre-deletion\n  // snapshot because `name` / `slug` are unrecoverable once the row is gone.\n  ...createOrganizationDeletionAuditFactories(),\n  // Seals every organization provider credential on write, and audits the grant lifecycle. Without\n  // this registration the resource stores plaintext secrets behind a route that still answers 200.\n  ...createOrganizationProviderCredentialFactories(),\n  ...createUserProviderCredentialFactories(),\n  ...createOrganizationMemberCreateFactories(),\n  // PLATFORM_ACCESS_GRANTS — the four lifecycle transitions. Every field that carries the\n  // time-bound/justified/tenant-scoped guarantee (`operatorUserId`, `status`, `expiresAt`,\n  // `approvedByUserId`) is server-authored here; the resource exposes no generic CREATE/UPDATE door,\n  // so these prefixes are the only way a grant can come into existence or change state.\n  ...createPlatformAccessGrantFactories(),\n  ...createApplicationAccessGrantFactories(),\n  // ORGANIZATION_UNITS DELETE prefix — refuses to strand a subtree behind a deleted interior\n  // node (the unit tree self-edge declares no delete cascade).\n  ...createOrganizationUnitDeleteDependentsGuardFactories(),\n  // ORGANIZATION_UNITS tree mechanics. CREATE materializes the hierarchy `path` on the inserting\n  // write (it was previously never written by anything); MOVE re-parents and re-homes the whole\n  // subtree; ARCHIVE/RESTORE own the node-only status transitions. Before these, all three custom\n  // operations were declared with no implementation and succeeded while changing nothing.\n  ...createOrganizationUnitCreatePathFactories(),\n  ...createOrganizationUnitUpdateFactories(),\n  ...createOrganizationUnitMoveFactories(),\n  ...createOrganizationUnitStatusTransitionFactories(),\n  // ORGANIZATION_UNIT_MEMBERS — a unit assignment is a role grant (its `role` is read into\n  // `initiatorRoles` as a unit-narrowed entry), so both write paths carry the role-ceiling gate\n  // explicitly (custom impls resolve by exact operation path; neither inherits the other's gate).\n  // CREATE additionally proves the target unit is in the caller's tenant. All three paths emit the\n  // matching audit event: grant and re-grade via ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED, revocation\n  // via ORGANIZATION_UNIT_MEMBER_REMOVED — without the last one an authorization-filtered trail\n  // would show unit privileges granted and never removed. DELETE must capture the revoked role in\n  // its PREFIX: a delete postfix cannot read the deleted document.\n  ...createOrganizationUnitMemberCreateFactories(),\n  ...createOrganizationUnitMemberUpdateFactories(),\n  ...createOrganizationUnitMemberDeleteFactories(),\n  // Account/entity lifecycle transitions (SUSPEND / REACTIVATE / DEACTIVATE_ACCOUNT …). One shared\n  // implementation across resources, declared as data — see\n  // `resource-status-transition.definitions.backend.ts` for the state machine and for why\n  // `organizations | activate|suspend` are not in the list yet.\n  ...createEngineResourceStatusTransitionFactories(),\n  // INBOUND_CONTACTS CREATE prefix — stamps the backend-only `emailUserMatch`\n  // triage signal (does the lead email match an existing active/inactive user).\n  ...createInboundContactCreateFactories(),\n  // USERS application-role administration. `assign_roles` / `revoke_roles` translate their `roles`\n  // request contract into set algebra over the persisted `appRoles` (they previously named a field\n  // that is not a schema path and wrote nothing); CREATE/UPDATE carry the role-ceiling gate on the\n  // same field, which nothing measured before. All four emit USER_APP_ROLES_CHANGED.\n  ...createUserRoleSetOperationFactories(),\n  ...createUserCoreRoleCeilingFactories(),\n  // USERS force_password_reset — mints a single-use reset token for the TARGET, mails it to\n  // them, evicts their live sessions, and records the acting administrator plus their reason.\n  // Previously declared UPDATE-like with no handler, so it answered 200 while minting nothing\n  // and the declared `{ resetToken, resetUrl }` response could never be produced (that handback\n  // is now gone — it was an account-takeover primitive).\n  ...createUserForcePasswordResetFactories(),\n  // #490 — the operator surface for the audited see-through read of a RETAINED user row.\n  ...createUserReadRetainedFactories(),\n  // USERS DELETE — emits USER_DELETED. The event type and its SIEM classification existed from the\n  // start but NOTHING produced them, so identity destruction left no evidence at all. Post-commit\n  // by construction; reads the pre-deletion snapshot because `email` / `appRoles` are unrecoverable\n  // once the row is gone.\n  ...createUserDeletionAuditFactories(),\n  // USERS DELETE — the last-super-administrator floor. Registered at priority 50 so it refuses\n  // BEFORE the deletion-audit registration above (default 100) prepares anything: destroying the row\n  // that holds the last application authority is the same unrecoverable lockout as revoking the role\n  // off it, which the role-administration registrations refuse on their own paths.\n  ...createUserSuperAdminFloorFactories(),\n  ...createApiKeyCreateFactories(),\n  ...createApiKeyRotateFactories(),\n  ...createApiKeyRegenerateFactories(),\n  ...createApiKeyExtendExpiryFactories(),\n  ...createApiKeyUsageStatsFactories(),\n  ...createApiKeyDeactivateFactories(),\n  ...createApiKeyReactivateFactories(),\n  // ACTIVE → EXPIRED, dispatched only by the credential-expiry sweep (#413).\n  ...createApiKeyExpireFactories(),\n  // OAuth Clients (registered client-credentials front — mirrors API Keys mint pipeline)\n  ...createOAuthClientCreateFactories(),\n  ...createOAuthClientRotateFactories(),\n  ...createOAuthClientRegenerateFactories(),\n  ...createOAuthClientExpireFactories(),\n  ...createOrganizationFeaturesAdminWritePathFactories(),\n  ...createApplicationFeaturesAdminWritePathFactories(),\n  ...createScopeFeaturesCacheInvalidationFactories(),\n  ...createSiemExportConfigCacheInvalidationFactories(),\n  ...createAuditLogsExportFactories(),\n  // Webhook (M2M outbound) domain — the public-key READ postfix existed but was\n  // never registered (the `applicationPublicKeyPem` field silently never\n  // surfaced); registered here together with the RETRY / PURGE_OLD impls.\n  ...createWebhookConfigReadPublicKeyFactories(),\n  ...createM2MWebhookDeliveryLogRetryFactories(),\n  ...createM2MWebhookDeliveryLogPurgeOldFactories(),\n  // TEST_ENDPOINT — fires one signed synthetic delivery through the SAME transport the\n  // delivery worker uses and returns the diagnostic. Previously declared READ-like with no\n  // handler, so the core read answered 200 with the config row and an unreachable URL still\n  // reported success.\n  ...createWebhookConfigTestEndpointFactories(),\n]\n"]}

package/dist/esm/resources/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC;AAClD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qDAAqD,CAAC;AACpE,cAAc,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/resources/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC;AAClD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qDAAqD,CAAC;AACpE,cAAc,gCAAgC,CAAC"}

package/dist/esm/resources/models/resources-operations.backend.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-operations.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-operations.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,8CAA8C,EAAE,MAAM,uBAAuB,CAAC;AACvI,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAOxE,eAAO,MAAM,wCAAwC,EAAE,8CAA8C,CAAC,mBAAmB,CAIxH,CAAC"}
+{"version":3,"file":"resources-operations.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../src/resources/models/resources-operations.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,8CAA8C,EAAE,MAAM,uBAAuB,CAAC;AACvI,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAQxE,eAAO,MAAM,wCAAwC,EAAE,8CAA8C,CAAC,mBAAmB,CAKxH,CAAC"}

package/dist/esm/resources/models/resources-operations.backend.definitions.js

@@ -3,9 +3,11 @@ import { BackendResourceType } from './resources-types.backend.schemas.js';
 import { consumableTokens_ResourceConfiguration_InitializationFactory } from '../../security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.js';
 import { dataSeedRunResourceConfiguration_InitializationFactory } from '../../data-seeding/models/data-seed-run.shared.resources-config.schemas.js';
 import { externalDataPipelineStateResourceConfiguration_InitializationFactory } from '../../external-data/models/external-data-pipeline-state.backend.schemas.js';
+import { billingProviderEventSettlementResourceConfiguration_InitializationFactory } from '../../billing/models/billing-provider-event-settlement.backend.schemas.js';
 export const backendResourcesConfigurationsFactoryMap = {
     [BackendResourceType.CONSUMABLE_TOKENS]: consumableTokens_ResourceConfiguration_InitializationFactory,
     [BackendResourceType.DATA_SEED_RUN]: dataSeedRunResourceConfiguration_InitializationFactory,
     [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: externalDataPipelineStateResourceConfiguration_InitializationFactory,
+    [BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS]: billingProviderEventSettlementResourceConfiguration_InitializationFactory,
 };
 //# sourceMappingURL=resources-operations.backend.definitions.js.map

package/dist/esm/resources/models/resources-operations.backend.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-operations.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-operations.backend.definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,iCAAiC;AACjC,OAAO,EAAE,4DAA4D,EAAE,MAAM,yGAAyG,CAAC;AACvL,OAAO,EAAE,sDAAsD,EAAE,MAAM,sFAAsF,CAAC;AAC9J,OAAO,EAAE,oEAAoE,EAAE,MAAM,sFAAsF,CAAC;AAE5K,MAAM,CAAC,MAAM,wCAAwC,GAAwE;IAC3H,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,4DAA4D;IACrG,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,sDAAsD;IAC3F,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,oEAAoE;CACzH,CAAC","sourcesContent":["import { AnyResourceConfiguration, ResourceRelationship, ResourceConfiguration_InitializationFactoryMap } from '@wildo-ai/saas-models';\nimport { BackendResourceType } from './resources-types.backend.schemas';\n\n// import resource config schemas\nimport { consumableTokens_ResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas';\nimport { dataSeedRunResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/data-seeding/models/data-seed-run.shared.resources-config.schemas';\nimport { externalDataPipelineStateResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/external-data/models/external-data-pipeline-state.backend.schemas';\n\nexport const backendResourcesConfigurationsFactoryMap: ResourceConfiguration_InitializationFactoryMap<BackendResourceType> = {\n  [BackendResourceType.CONSUMABLE_TOKENS]: consumableTokens_ResourceConfiguration_InitializationFactory,\n  [BackendResourceType.DATA_SEED_RUN]: dataSeedRunResourceConfiguration_InitializationFactory,\n  [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: externalDataPipelineStateResourceConfiguration_InitializationFactory,\n};\n"]}
+{"version":3,"file":"resources-operations.backend.definitions.js","sourceRoot":"","sources":["../../../../src/resources/models/resources-operations.backend.definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,iCAAiC;AACjC,OAAO,EAAE,4DAA4D,EAAE,MAAM,yGAAyG,CAAC;AACvL,OAAO,EAAE,sDAAsD,EAAE,MAAM,sFAAsF,CAAC;AAC9J,OAAO,EAAE,oEAAoE,EAAE,MAAM,sFAAsF,CAAC;AAC5K,OAAO,EAAE,yEAAyE,EAAE,MAAM,qFAAqF,CAAC;AAEhL,MAAM,CAAC,MAAM,wCAAwC,GAAwE;IAC3H,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,4DAA4D;IACrG,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,sDAAsD;IAC3F,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,oEAAoE;IACxH,CAAC,mBAAmB,CAAC,kCAAkC,CAAC,EAAE,yEAAyE;CACpI,CAAC","sourcesContent":["import { AnyResourceConfiguration, ResourceRelationship, ResourceConfiguration_InitializationFactoryMap } from '@wildo-ai/saas-models';\nimport { BackendResourceType } from './resources-types.backend.schemas';\n\n// import resource config schemas\nimport { consumableTokens_ResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas';\nimport { dataSeedRunResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/data-seeding/models/data-seed-run.shared.resources-config.schemas';\nimport { externalDataPipelineStateResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/external-data/models/external-data-pipeline-state.backend.schemas';\nimport { billingProviderEventSettlementResourceConfiguration_InitializationFactory } from '~wildo-backend-lib/billing/models/billing-provider-event-settlement.backend.schemas';\n\nexport const backendResourcesConfigurationsFactoryMap: ResourceConfiguration_InitializationFactoryMap<BackendResourceType> = {\n  [BackendResourceType.CONSUMABLE_TOKENS]: consumableTokens_ResourceConfiguration_InitializationFactory,\n  [BackendResourceType.DATA_SEED_RUN]: dataSeedRunResourceConfiguration_InitializationFactory,\n  [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: externalDataPipelineStateResourceConfiguration_InitializationFactory,\n  [BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS]: billingProviderEventSettlementResourceConfiguration_InitializationFactory,\n};\n"]}

package/dist/esm/resources/models/resources-relationships.backend.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-relationships.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-relationships.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4F,oBAAoB,EAAwF,MAAM,uBAAuB,CAAC;AAG7O,eAAO,MAAM,6BAA6B,EAAE,oBAAoB,EA2D/D,CAAC"}
+{"version":3,"file":"resources-relationships.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../src/resources/models/resources-relationships.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4F,oBAAoB,EAAwF,MAAM,uBAAuB,CAAC;AAG7O,eAAO,MAAM,6BAA6B,EAAE,oBAAoB,EA8E/D,CAAC"}

package/dist/esm/resources/models/resources-relationships.backend.definitions.js

@@ -38,5 +38,19 @@ export const backendResourcesRelationships = [
         nature: RelationshipNature.REFERENCE,
         contextPolicy: { enabled: false }
     }),
+    // BillingProviderEventSettlement scope anchor — same posture as the two above: internal
+    // bookkeeping, APPLICATION-tier, STANDALONE to stay off the URL surface.
+    //
+    // APPLICATION rather than the billing account's own scope, deliberately. The claim must be
+    // takeable BEFORE the handler knows which pool it will credit — that is the whole point of
+    // claiming before the money write — and it is keyed by the PROVIDER's event identity, which is
+    // unique across the deployment rather than within one tenant. Anchoring it under an organization
+    // would make the ledger's uniqueness tenant-relative for a key that is not.
+    createResourcesRelationship(CoreResourceType.APPLICATION, BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false }
+    }),
 ];
 //# sourceMappingURL=resources-relationships.backend.definitions.js.map

package/dist/esm/resources/models/resources-relationships.backend.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-relationships.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-relationships.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,uCAAuC,EAAwB,+BAA+B,EAAE,gBAAgB,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC7O,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAA2B;IAEnE,iCAAiC;IACjC,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,iBAAiB,EACnE,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,sEAAsE;QACtE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,2BAA2B,CACzB,gBAAgB,CAAC,aAAa,EAAE,mBAAmB,CAAC,iBAAiB,EACrE,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;QACrE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,sEAAsE;QACtE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,aAAa,EAC/D,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,iFAAiF;IACjF,8DAA8D;IAC9D,gEAAgE;IAChE,yDAAyD;IACzD,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,4BAA4B,EAC9E,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;CAEF,CAAC","sourcesContent":["import { createResourcesRelationship, RelationshipNature, ResourceRelationshipAccessScopeStrategy, ResourceRelationship, ResourceRelationshipCardinality, CoreResourceType, ResourceParentResourceRequirement } from \"@wildo-ai/saas-models\";\nimport { BackendResourceType } from \"./resources-types.backend.schemas\";\n\nexport const backendResourcesRelationships: ResourceRelationship[] = [\n  \n  // ConsumableTokens relationships\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.CONSUMABLE_TOKENS, \n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    { \n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      // SECURITY: Consumable tokens are sensitive - never fetch via context\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  createResourcesRelationship(\n    CoreResourceType.ORGANIZATIONS, BackendResourceType.CONSUMABLE_TOKENS, \n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    { \n      parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      nature: RelationshipNature.REFERENCE,\n      // SECURITY: Consumable tokens are sensitive - never fetch via context\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // DataSeedRuns scope anchor — internal idempotency ledger, APPLICATION-tier.\n  // STANDALONE keeps the rel off the URL surface (data-seeding is administered\n  // through dedicated controllers, not parent-scoped routes); `isPrimaryScope`\n  // anchors the resource's `resourcePrimaryScope` enum to APPLICATION so the\n  // registry-layer factory's no-fallback throw stays satisfied. See\n  // `resources-relationships.shared.factory.ts` Guard 1 for the orthogonal\n  // ownership-vs-routing rationale.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.DATA_SEED_RUN,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // ExternalDataPipelineState scope anchor — same posture as DataSeedRun: internal\n  // pipeline bookkeeping, APPLICATION-tier (slice 1 admits only\n  // SINGLE_TENANT_BINDING pipelines, so a pipeline is app-wide by\n  // construction), STANDALONE to stay off the URL surface.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n];\n"]}
+{"version":3,"file":"resources-relationships.backend.definitions.js","sourceRoot":"","sources":["../../../../src/resources/models/resources-relationships.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,uCAAuC,EAAwB,+BAA+B,EAAE,gBAAgB,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC7O,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAA2B;IAEnE,iCAAiC;IACjC,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,iBAAiB,EACnE,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,sEAAsE;QACtE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,2BAA2B,CACzB,gBAAgB,CAAC,aAAa,EAAE,mBAAmB,CAAC,iBAAiB,EACrE,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;QACrE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,sEAAsE;QACtE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,aAAa,EAC/D,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,iFAAiF;IACjF,8DAA8D;IAC9D,gEAAgE;IAChE,yDAAyD;IACzD,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,4BAA4B,EAC9E,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;IAED,wFAAwF;IACxF,yEAAyE;IACzE,EAAE;IACF,2FAA2F;IAC3F,2FAA2F;IAC3F,+FAA+F;IAC/F,iGAAiG;IACjG,4EAA4E;IAC5E,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,kCAAkC,EACpF,+BAA+B,CAAC,GAAG,EAAE,+BAA+B,CAAC,IAAI,EACzE;QACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAClC,CACF;CAEF,CAAC","sourcesContent":["import { createResourcesRelationship, RelationshipNature, ResourceRelationshipAccessScopeStrategy, ResourceRelationship, ResourceRelationshipCardinality, CoreResourceType, ResourceParentResourceRequirement } from \"@wildo-ai/saas-models\";\nimport { BackendResourceType } from \"./resources-types.backend.schemas\";\n\nexport const backendResourcesRelationships: ResourceRelationship[] = [\n  \n  // ConsumableTokens relationships\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.CONSUMABLE_TOKENS, \n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    { \n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      // SECURITY: Consumable tokens are sensitive - never fetch via context\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  createResourcesRelationship(\n    CoreResourceType.ORGANIZATIONS, BackendResourceType.CONSUMABLE_TOKENS, \n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    { \n      parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      nature: RelationshipNature.REFERENCE,\n      // SECURITY: Consumable tokens are sensitive - never fetch via context\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // DataSeedRuns scope anchor — internal idempotency ledger, APPLICATION-tier.\n  // STANDALONE keeps the rel off the URL surface (data-seeding is administered\n  // through dedicated controllers, not parent-scoped routes); `isPrimaryScope`\n  // anchors the resource's `resourcePrimaryScope` enum to APPLICATION so the\n  // registry-layer factory's no-fallback throw stays satisfied. See\n  // `resources-relationships.shared.factory.ts` Guard 1 for the orthogonal\n  // ownership-vs-routing rationale.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.DATA_SEED_RUN,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // ExternalDataPipelineState scope anchor — same posture as DataSeedRun: internal\n  // pipeline bookkeeping, APPLICATION-tier (slice 1 admits only\n  // SINGLE_TENANT_BINDING pipelines, so a pipeline is app-wide by\n  // construction), STANDALONE to stay off the URL surface.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n  // BillingProviderEventSettlement scope anchor — same posture as the two above: internal\n  // bookkeeping, APPLICATION-tier, STANDALONE to stay off the URL surface.\n  //\n  // APPLICATION rather than the billing account's own scope, deliberately. The claim must be\n  // takeable BEFORE the handler knows which pool it will credit — that is the whole point of\n  // claiming before the money write — and it is keyed by the PROVIDER's event identity, which is\n  // unique across the deployment rather than within one tenant. Anchoring it under an organization\n  // would make the ledger's uniqueness tenant-relative for a key that is not.\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION, BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS,\n    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\n    {\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      isPrimaryScope: true,\n      nature: RelationshipNature.REFERENCE,\n      contextPolicy: { enabled: false }\n    }\n  ),\n\n];\n"]}

package/dist/esm/resources/models/resources-types.backend.schemas.d.ts

@@ -8,7 +8,8 @@
 export declare enum BackendResourceType {
     CONSUMABLE_TOKENS = "consumableTokens",
     DATA_SEED_RUN = "dataSeedRuns",
-    EXTERNAL_DATA_PIPELINE_STATE = "etlPipelineStates"
+    EXTERNAL_DATA_PIPELINE_STATE = "etlPipelineStates",
+    BILLING_PROVIDER_EVENT_SETTLEMENTS = "billingProviderEventSettlements"
 }
 export declare const BackendResourceFieldIdentifier: {
     [key in BackendResourceType]: string;

package/dist/esm/resources/models/resources-types.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-types.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources-types.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,oBAAY,mBAAmB;IAC7B,iBAAiB,qBAAqB;IAMtC,aAAa,iBAAiB;IAgB9B,4BAA4B,sBAAsB;CACnD;AAED,eAAO,MAAM,8BAA8B,EAAE;KAAG,GAAG,IAAI,mBAAmB,GAAG,MAAM;CAIlF,CAAC"}
+{"version":3,"file":"resources-types.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/resources/models/resources-types.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,oBAAY,mBAAmB;IAC7B,iBAAiB,qBAAqB;IAMtC,aAAa,iBAAiB;IAgB9B,4BAA4B,sBAAsB;IAQlD,kCAAkC,oCAAoC;CACvE;AAED,eAAO,MAAM,8BAA8B,EAAE;KAAG,GAAG,IAAI,mBAAmB,GAAG,MAAM;CAKlF,CAAC"}

package/dist/esm/resources/models/resources-types.backend.schemas.js

@@ -28,10 +28,18 @@ export var BackendResourceType;
     // both lanes. Code vocabulary and storage identity are allowed to differ; what is NOT allowed
     // is changing this value without the migration that goes with it.
     BackendResourceType["EXTERNAL_DATA_PIPELINE_STATE"] = "etlPipelineStates";
+    // Billing webhook idempotency ledger — system resource. ONE row per money-affecting provider
+    // event, whose PRIMARY KEY is derived from the event's own identity, so a retry delivered to a
+    // second replica collides at the store instead of granting the credits a second time. The
+    // process-local `Set` this replaced could not see another replica, could not survive a restart,
+    // and evicted its own entries after 10 000 sessions.
+    // See `engine/saas-backend-lib/src/billing/models/billing-provider-event-settlement.backend.schemas.ts`.
+    BackendResourceType["BILLING_PROVIDER_EVENT_SETTLEMENTS"] = "billingProviderEventSettlements";
 })(BackendResourceType || (BackendResourceType = {}));
 export const BackendResourceFieldIdentifier = {
     [BackendResourceType.CONSUMABLE_TOKENS]: 'consumableTokenId',
     [BackendResourceType.DATA_SEED_RUN]: 'dataSeedRunId',
     [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: 'etlPipelineStateId',
+    [BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS]: 'billingProviderEventSettlementId',
 };
 //# sourceMappingURL=resources-types.backend.schemas.js.map

package/dist/esm/resources/models/resources-types.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-types.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/resources/models/resources-types.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAN,IAAY,mBAwBX;AAxBD,WAAY,mBAAmB;IAC7B,6DAAsC,CAAA;IAEtC,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,yFAAyF;IACzF,qDAA8B,CAAA;IAE9B,uFAAuF;IACvF,8FAA8F;IAC9F,+FAA+F;IAC/F,0DAA0D;IAC1D,0GAA0G;IAC1G,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,uFAAuF;IACvF,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,8FAA8F;IAC9F,kEAAkE;IAClE,yEAAkD,CAAA;AACpD,CAAC,EAxBW,mBAAmB,KAAnB,mBAAmB,QAwB9B;AAED,MAAM,CAAC,MAAM,8BAA8B,GAA6C;IACtF,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC5D,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,eAAe;IACpD,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,oBAAoB;CACzE,CAAC","sourcesContent":["/**\n * Backend Resource Types\n *\n * Resource type definitions for SaaS backend infrastructure components.\n * These are backend-specific resources used for internal operations and are\n * never surfaced to frontend bundles (kept out of `@wildo-ai/saas-models`).\n */\n\nexport enum BackendResourceType {\n  CONSUMABLE_TOKENS = 'consumableTokens',\n\n  // Data Seeding Tracking — system resource (Phase 2 of seeding-first-class).\n  // Single source of truth for \"has this seed already run for this scope at\n  // this version?\". Written by DataSeedDispatcher before/after every pass.\n  // See `engine/saas-backend-lib/src/data-seeding/models/data-seed-run.shared.schemas.ts`.\n  DATA_SEED_RUN = 'dataSeedRuns',\n\n  // External-data pipeline state — system resource (partial-resource coverage v3, PR-9).\n  // ONE row per declared `externalDataPipeline`: the persisted extraction cursor (a pass larger\n  // than `maxRowsPerRun` continues across runs and process restarts), plus last-run bookkeeping.\n  // Written only by the external-data pipeline run service.\n  // See `engine/saas-backend-lib/src/external-data/models/external-data-pipeline-state.backend.schemas.ts`.\n  //\n  // ⚠ The VALUE stays `etlPipelineStates` while the member speaks the current vocabulary, and the\n  // divergence is deliberate: this string is a PERSISTED IDENTITY — it is the PostgreSQL table\n  // name, and two generated migrations (app-side `backend-api/migrations`, platform-side\n  // `platform-apps-manager/migrations`) are already committed against it. Renaming a table is a\n  // migration event, not a rename: the runner freezes an applied migration's bytes in its\n  // SHA-256 ledger, so it belongs on the machine that has PostgreSQL and can regenerate + apply\n  // both lanes. Code vocabulary and storage identity are allowed to differ; what is NOT allowed\n  // is changing this value without the migration that goes with it.\n  EXTERNAL_DATA_PIPELINE_STATE = 'etlPipelineStates',\n}\n\nexport const BackendResourceFieldIdentifier: { [key in BackendResourceType]: string } = {\n  [BackendResourceType.CONSUMABLE_TOKENS]: 'consumableTokenId',\n  [BackendResourceType.DATA_SEED_RUN]: 'dataSeedRunId',\n  [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: 'etlPipelineStateId',\n};\n"]}
+{"version":3,"file":"resources-types.backend.schemas.js","sourceRoot":"","sources":["../../../../src/resources/models/resources-types.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAN,IAAY,mBAgCX;AAhCD,WAAY,mBAAmB;IAC7B,6DAAsC,CAAA;IAEtC,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,yFAAyF;IACzF,qDAA8B,CAAA;IAE9B,uFAAuF;IACvF,8FAA8F;IAC9F,+FAA+F;IAC/F,0DAA0D;IAC1D,0GAA0G;IAC1G,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,uFAAuF;IACvF,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,8FAA8F;IAC9F,kEAAkE;IAClE,yEAAkD,CAAA;IAElD,6FAA6F;IAC7F,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,qDAAqD;IACrD,yGAAyG;IACzG,6FAAsE,CAAA;AACxE,CAAC,EAhCW,mBAAmB,KAAnB,mBAAmB,QAgC9B;AAED,MAAM,CAAC,MAAM,8BAA8B,GAA6C;IACtF,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC5D,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,eAAe;IACpD,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,oBAAoB;IACxE,CAAC,mBAAmB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;CAC7F,CAAC","sourcesContent":["/**\n * Backend Resource Types\n *\n * Resource type definitions for SaaS backend infrastructure components.\n * These are backend-specific resources used for internal operations and are\n * never surfaced to frontend bundles (kept out of `@wildo-ai/saas-models`).\n */\n\nexport enum BackendResourceType {\n  CONSUMABLE_TOKENS = 'consumableTokens',\n\n  // Data Seeding Tracking — system resource (Phase 2 of seeding-first-class).\n  // Single source of truth for \"has this seed already run for this scope at\n  // this version?\". Written by DataSeedDispatcher before/after every pass.\n  // See `engine/saas-backend-lib/src/data-seeding/models/data-seed-run.shared.schemas.ts`.\n  DATA_SEED_RUN = 'dataSeedRuns',\n\n  // External-data pipeline state — system resource (partial-resource coverage v3, PR-9).\n  // ONE row per declared `externalDataPipeline`: the persisted extraction cursor (a pass larger\n  // than `maxRowsPerRun` continues across runs and process restarts), plus last-run bookkeeping.\n  // Written only by the external-data pipeline run service.\n  // See `engine/saas-backend-lib/src/external-data/models/external-data-pipeline-state.backend.schemas.ts`.\n  //\n  // ⚠ The VALUE stays `etlPipelineStates` while the member speaks the current vocabulary, and the\n  // divergence is deliberate: this string is a PERSISTED IDENTITY — it is the PostgreSQL table\n  // name, and two generated migrations (app-side `backend-api/migrations`, platform-side\n  // `platform-apps-manager/migrations`) are already committed against it. Renaming a table is a\n  // migration event, not a rename: the runner freezes an applied migration's bytes in its\n  // SHA-256 ledger, so it belongs on the machine that has PostgreSQL and can regenerate + apply\n  // both lanes. Code vocabulary and storage identity are allowed to differ; what is NOT allowed\n  // is changing this value without the migration that goes with it.\n  EXTERNAL_DATA_PIPELINE_STATE = 'etlPipelineStates',\n\n  // Billing webhook idempotency ledger — system resource. ONE row per money-affecting provider\n  // event, whose PRIMARY KEY is derived from the event's own identity, so a retry delivered to a\n  // second replica collides at the store instead of granting the credits a second time. The\n  // process-local `Set` this replaced could not see another replica, could not survive a restart,\n  // and evicted its own entries after 10 000 sessions.\n  // See `engine/saas-backend-lib/src/billing/models/billing-provider-event-settlement.backend.schemas.ts`.\n  BILLING_PROVIDER_EVENT_SETTLEMENTS = 'billingProviderEventSettlements',\n}\n\nexport const BackendResourceFieldIdentifier: { [key in BackendResourceType]: string } = {\n  [BackendResourceType.CONSUMABLE_TOKENS]: 'consumableTokenId',\n  [BackendResourceType.DATA_SEED_RUN]: 'dataSeedRunId',\n  [BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE]: 'etlPipelineStateId',\n  [BackendResourceType.BILLING_PROVIDER_EVENT_SETTLEMENTS]: 'billingProviderEventSettlementId',\n};\n"]}

package/dist/esm/resources/models/resources.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/resources.backend.schemas.ts"],"names":[],"mappings":"AAAA,oBAAY,uBAAuB;IAC/B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;CAC5C"}
+{"version":3,"file":"resources.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/resources/models/resources.backend.schemas.ts"],"names":[],"mappings":"AAAA,oBAAY,uBAAuB;IAC/B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;CAC5C"}

package/dist/esm/resources/models/virtual-fields.backend.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"virtual-fields.backend.types.d.ts","sourceRoot":"","sources":["../../../../../src/resources/models/virtual-fields.backend.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,GAAG,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,IAAI,IAAI,CAAC;IACZ,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC;CAC5C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,YAAY,EAAE,8BAA8B,CAAC;IAE7C;;;OAGG;IACH,MAAM,EAAE,aAAa,CAAC;IAEtB;;;OAGG;IACH,YAAY,EAAE,0BAA0B,CAAC;IAEzC;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;IAEzB;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB,gBAAgB,EAAE,GAAG,CAAC;IACtB,KAAK,EAAE,6BAA6B,CAAC;CACtC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,kFAAkF;IAClF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yDAAyD;IACzD,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,oDAAoD;IACpD,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,kDAAkD;IAClD,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB"}
+{"version":3,"file":"virtual-fields.backend.types.d.ts","sourceRoot":"","sources":["../../../../src/resources/models/virtual-fields.backend.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,GAAG,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,IAAI,IAAI,CAAC;IACZ,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC;CAC5C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,YAAY,EAAE,8BAA8B,CAAC;IAE7C;;;OAGG;IACH,MAAM,EAAE,aAAa,CAAC;IAEtB;;;OAGG;IACH,YAAY,EAAE,0BAA0B,CAAC;IAEzC;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;IAEzB;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB,gBAAgB,EAAE,GAAG,CAAC;IACtB,KAAK,EAAE,6BAA6B,CAAC;CACtC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,kFAAkF;IAClF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yDAAyD;IACzD,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,oDAAoD;IACpD,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,kDAAkD;IAClD,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB"}

package/dist/esm/resources/services/__tests__/mock-resources-registry.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-resources-registry.service.d.ts","sourceRoot":"","sources":["../../../../../../src/resources/services/__tests__/mock-resources-registry.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EAErB,oBAAoB,EACpB,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAE7F,KAAK,yBAAyB,GAAG;IAC/B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,cACM,uCAAuC;IAC3C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAsD;IAC7F,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,aAAa,CAA2B;IAEhD,uBAAuB;;;OAGnB;IAaJ,iCAAiC;;;OAG7B;IAWJ,8BAA8B;;;OAG1B;IAEJ,uBAAuB;;;;OAInB;IAaJ,yCAAyC;;;OActC;IAEH,wBAAwB,2EAIrB;IAEH,gBAAgB,sCAA+C;IAE/D,iBAAiB,4EAEd;IAEH,wBAAwB,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,yBAAyB,GAAG,IAAI;IAKpG,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,GAAG,IAAI;IAQ/E,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI;IAIrD,uBAAuB,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAI7F,KAAK,IAAI,IAAI;CAad;AAED;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAAyD;IACvG,KAAK,GAAG,IAAI,EAAE,qBAAqB,CAAC,OAAO,uCAAuC,CAAC,GAAG,+BAA+B,GAAG,uCAAuC,CAAC;CACjK,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,+BAA+B,GAAG,uCAAuC,CAAC"}
+{"version":3,"file":"mock-resources-registry.service.d.ts","sourceRoot":"","sources":["../../../../../src/resources/services/__tests__/mock-resources-registry.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EAErB,oBAAoB,EACpB,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAE7F,KAAK,yBAAyB,GAAG;IAC/B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,cACM,uCAAuC;IAC3C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAsD;IAC7F,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,aAAa,CAA2B;IAEhD,uBAAuB;;;OAGnB;IAaJ,iCAAiC;;;OAG7B;IAWJ,8BAA8B;;;OAG1B;IAEJ,uBAAuB;;;;OAInB;IAaJ,yCAAyC;;;OActC;IAEH,wBAAwB,2EAIrB;IAEH,gBAAgB,sCAA+C;IAE/D,iBAAiB,4EAEd;IAEH,wBAAwB,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,yBAAyB,GAAG,IAAI;IAKpG,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,GAAG,IAAI;IAQ/E,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI;IAIrD,uBAAuB,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAI7F,KAAK,IAAI,IAAI;CAad;AAED;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAAyD;IACvG,KAAK,GAAG,IAAI,EAAE,qBAAqB,CAAC,OAAO,uCAAuC,CAAC,GAAG,+BAA+B,GAAG,uCAAuC,CAAC;CACjK,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,+BAA+B,GAAG,uCAAuC,CAAC"}

package/dist/esm/resources/services/resource-context.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-context.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/resources/services/resource-context.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,+BAA+B,EAE/B,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,8BAA8B,EAQ/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAM7G;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC,IAAI,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAMrG;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,iDAAiD;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,0CAA0C;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;IAClD,4CAA4C;IAC5C,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,0DAA0D;IAC1D,eAAe,CAAC,EAAE,mCAAmC,EAAE,CAAC;IACxD,yDAAyD;IACzD,cAAc,CAAC,EAAE,mCAAmC,EAAE,CAAC;CACxD;AAED;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,cAAc,mBAAmB;IACjC,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,GAAG;IAC1C,YAAY,EAAE,YAAY,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,CAAC;IACR,UAAU,EAAE,wBAAwB,CAAC;IACrC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,+BAA+B,CAAC;IAC9C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC5D;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,GAAG;IACtC,gCAAgC;IAChC,QAAQ,EAAE,CAAC,CAAC;IACZ,kCAAkC;IAClC,QAAQ,EAAE;QACR,YAAY,EAAE,YAAY,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC;IACF,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACrD,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACtD,+CAA+C;IAC/C,aAAa,EAAE,4BAA4B,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,OAAO,CAAC,4BAA4B,CAAC;IAChF,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,gFAAgF;IAChF,WAAW,CAAC,EAAE,0BAA0B,CAAC;CAC1C;AAED;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,4BAQ3C,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,qBACa,6BAA6B;IAMtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAG7B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAf1C,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,iBAAiB,EAAE,+BAA+B,EAElD,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAGxC,oBAAoB,EAAE,yCAAyC,EAE/D,oBAAoB,EAAE,2BAA2B,EAEjD,uBAAuB,EAAE,qCAAqC;IAYjF;;;;;;;;OAQG;IACH,OAAO,CAAC,8BAA8B;IAuDtC;;;;;;;;;;OAUG;YACW,2BAA2B;IAiCzC;;;;;;;;;;;;;;OAcG;IACI,6BAA6B,CAClC,YAAY,EAAE,oBAAoB,EAClC,SAAS,CAAC,EAAE,qBAAqB,GAChC,sBAAsB;IAmCzB;;;;;;;;OAQG;IACG,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9C,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EACX,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IA8F9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAmB1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA4B1B;;;;;;;;;;;;;;;;;OAiBG;YACW,8BAA8B;IAwI5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;YACW,6BAA6B;IA+O3C;;;;;;;;;;;;;;;;OAgBG;YACW,mBAAmB;IA4FjC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IA+C5B;;;;;;;;;;OAUG;YACW,2BAA2B;CAwC1C"}
+{"version":3,"file":"resource-context.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/resources/services/resource-context.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,+BAA+B,EAE/B,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,8BAA8B,EAQ/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAM7G;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC,IAAI,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAMrG;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,iDAAiD;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,0CAA0C;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;IAClD,4CAA4C;IAC5C,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,0DAA0D;IAC1D,eAAe,CAAC,EAAE,mCAAmC,EAAE,CAAC;IACxD,yDAAyD;IACzD,cAAc,CAAC,EAAE,mCAAmC,EAAE,CAAC;CACxD;AAED;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,cAAc,mBAAmB;IACjC,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,GAAG;IAC1C,YAAY,EAAE,YAAY,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,CAAC;IACR,UAAU,EAAE,wBAAwB,CAAC;IACrC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,+BAA+B,CAAC;IAC9C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC5D;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,GAAG;IACtC,gCAAgC;IAChC,QAAQ,EAAE,CAAC,CAAC;IACZ,kCAAkC;IAClC,QAAQ,EAAE;QACR,YAAY,EAAE,YAAY,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC;IACF,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACrD,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACtD,+CAA+C;IAC/C,aAAa,EAAE,4BAA4B,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,OAAO,CAAC,4BAA4B,CAAC;IAChF,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,gFAAgF;IAChF,WAAW,CAAC,EAAE,0BAA0B,CAAC;CAC1C;AAED;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,4BAQ3C,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,qBACa,6BAA6B;IAMtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAG7B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAf1C,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,iBAAiB,EAAE,+BAA+B,EAElD,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAGxC,oBAAoB,EAAE,yCAAyC,EAE/D,oBAAoB,EAAE,2BAA2B,EAEjD,uBAAuB,EAAE,qCAAqC;IAYjF;;;;;;;;OAQG;IACH,OAAO,CAAC,8BAA8B;IAuDtC;;;;;;;;;;OAUG;YACW,2BAA2B;IAiCzC;;;;;;;;;;;;;;OAcG;IACI,6BAA6B,CAClC,YAAY,EAAE,oBAAoB,EAClC,SAAS,CAAC,EAAE,qBAAqB,GAChC,sBAAsB;IAmCzB;;;;;;;;OAQG;IACG,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9C,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EACX,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IA8F9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAmB1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA4B1B;;;;;;;;;;;;;;;;;OAiBG;YACW,8BAA8B;IAwI5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;YACW,6BAA6B;IA+O3C;;;;;;;;;;;;;;;;OAgBG;YACW,mBAAmB;IA4FjC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IA+C5B;;;;;;;;;;OAUG;YACW,2BAA2B;CAwC1C"}

package/dist/esm/resources/services/resource-id.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-id.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/resources/services/resource-id.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EACL,UAAU,EACV,gBAAgB,EAGhB,sBAAsB,EAKvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAEhI;;;;;;;;;;;;;;;GAeG;AACH,qBACa,wBAAwB;IAGjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAG7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBALjB,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,0BAA0B,EAGxC,gBAAgB,CAAC,EAAE,+BAA+B;IAOrE;;OAEG;IACH,gBAAgB,IAAI,gBAAgB;IAIpC;;;;OAIG;IACH,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB;IAkD7D;;;;OAIG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,sBAAsB;IA4BnE;;;;OAIG;IACH,YAAY,CAAC,EAAE,EAAE,UAAU,GAAG,gBAAgB,GAAG,IAAI;IAQrD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,UAAU;IA2B/C;;;;;OAKG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU;IASrD;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO;IA8ClE;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IASrE;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,gBAAgB,GAAG,OAAO;IAqBjE;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAgChE;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,sBAAsB;IAa9B;;;;;;OAMG;IACH,OAAO,CAAC,2BAA2B;CASpC"}
+{"version":3,"file":"resource-id.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/resources/services/resource-id.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EACL,UAAU,EACV,gBAAgB,EAGhB,sBAAsB,EAKvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAEhI;;;;;;;;;;;;;;;GAeG;AACH,qBACa,wBAAwB;IAGjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAG7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBALjB,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,0BAA0B,EAGxC,gBAAgB,CAAC,EAAE,+BAA+B;IAOrE;;OAEG;IACH,gBAAgB,IAAI,gBAAgB;IAIpC;;;;OAIG;IACH,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB;IAkD7D;;;;OAIG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,sBAAsB;IA4BnE;;;;OAIG;IACH,YAAY,CAAC,EAAE,EAAE,UAAU,GAAG,gBAAgB,GAAG,IAAI;IAQrD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,UAAU;IA2B/C;;;;;OAKG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU;IASrD;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO;IA8ClE;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IASrE;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,gBAAgB,GAAG,OAAO;IAqBjE;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAgChE;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,sBAAsB;IAa9B;;;;;;OAMG;IACH,OAAO,CAAC,2BAA2B;CASpC"}

package/dist/esm/resources/services/resource-population.backend.service.d.ts

@@ -168,12 +168,27 @@ export declare class ResourcePopulationBackendService {
      * Uses the allResourceFieldIdentifiers map for lookup instead of string manipulation.
      */
     private findRelationshipForField;
+    /**
+     * The field name a CONTEXT projection publishes a child relationship under.
+     *
+     * Delegates to `Resources_SharedUtils.resolveRelationshipObjectIdentity` — the authority the DTO
+     * builder uses when it declares the placeholder — so producer and contract cannot disagree. See
+     * the long note at the child-merge site in {@link populateForContext} for what the two
+     * independent derivations cost.
+     *
+     * The fallback is the historical local derivation, and it is reached only when the relationship
+     * cannot be resolved from the registry at all (the same condition under which the empty-array
+     * branch already falls back). Keeping it means an unresolvable relationship degrades exactly as
+     * it did before rather than throwing inside a response path.
+     */
+    private resolveContextChildFieldName;
     /**
      * Resolve the child-direction relationship a CONTEXT children key corresponds to.
      * The key is the child resource type (`resourceType2`) under which
      * `ResourceContextBackendService` groups fetched items. Used by
-     * `populateForContext` to recover a relationship's cardinality when the fetched
-     * item set is EMPTY — cardinality can't be read from a non-existent item, so an
+     * `populateForContext` both to name the published field (see
+     * {@link resolveContextChildFieldName}) and to recover a relationship's cardinality when the
+     * fetched item set is EMPTY — cardinality can't be read from a non-existent item, so an
      * absent 1:1 child would otherwise be mis-projected as `[]` and fail the
      * optional-single-`z.record` contextDto placeholder. Uses the same
      * `getChildDirectionRelationships` enumeration the DTO builder uses, keyed by

package/dist/esm/resources/services/resource-population.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-population.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/resources/services/resource-population.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAsB,SAAS,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,YAAY,EAab,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAYvG,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,EACL,6BAA6B,EAE9B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,4BAA4B,EAAyB,MAAM,mEAAmE,CAAC;AACxI,OAAO,EAAE,iBAAiB,EAAkB,MAAM,qEAAqE,CAAC;AACxH,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAMtI;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B,0FAA0F;IAC1F,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAChC,CAAC;IAEF,mBAAmB;IACnB,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC,cAAc,mBAAmB;IACjC,SAAS,cAAc;CACxB;AAMD,qBACa,gCAAgC;IASzC,OAAO,CAAC,MAAM;IAGd,OAAO,CAAC,iBAAiB;IAGzB,OAAO,CAAC,oBAAoB;IAG5B,OAAO,CAAC,sBAAsB;IAGT,OAAO,CAAC,SAAS;IAGtC,OAAO,CAAC,qBAAqB;IAG7B,OAAO,CAAC,uBAAuB;IAzBjC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAGjF,OAAO,CAAC,iBAAiB,CAAsD;gBAIrE,MAAM,EAAE,aAAa,EAGrB,iBAAiB,EAAE,+BAA+B,EAGlD,oBAAoB,EAAE,yCAAyC,EAG/D,sBAAsB,EAAE,6BAA6B,EAGhC,SAAS,EAAE,SAAS,EAGzC,qBAAqB,EAAE,4BAA4B,EAGnD,uBAAuB,EAAE,qCAAqC;IAQxE,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAqB;IAElE;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAsBnC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;;;;;;OAOG;IACH,mBAAmB,CAAC,YAAY,EAAE,YAAY,GAAG,oBAAoB;IAuFrE;;;OAGG;IACG,uBAAuB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,oBAAoB,EAC3B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,WAAW,GAAE,6BACiC,GAC7C,OAAO,CAAC,kBAAkB,CAAC;IA2D9B;;;;;OAKG;IACG,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpD,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,CAAC,EACP,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,EACrC,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAwGnC;;;OAGG;IACG,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpD,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,CAAC,EACP,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,EACrC,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAiInC;;;OAGG;IACG,sBAAsB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxD,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,CAAC,EAAE,EACV,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,EACrC,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,CAAC,EAAE,CAAC;IA4Jf;;OAEG;IACG,sBAAsB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxD,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,CAAC,EAAE,EACb,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,EACrC,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAsBvC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkBhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,4BAA4B;CAWrC"}
+{"version":3,"file":"resource-population.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/resources/services/resource-population.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAsB,SAAS,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,YAAY,EAcb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAYvG,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,EACL,6BAA6B,EAE9B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,4BAA4B,EAAyB,MAAM,mEAAmE,CAAC;AACxI,OAAO,EAAE,iBAAiB,EAAkB,MAAM,qEAAqE,CAAC;AACxH,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAMtI;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B,0FAA0F;IAC1F,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAChC,CAAC;IAEF,mBAAmB;IACnB,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC,cAAc,mBAAmB;IACjC,SAAS,cAAc;CACxB;AAMD,qBACa,gCAAgC;IASzC,OAAO,CAAC,MAAM;IAGd,OAAO,CAAC,iBAAiB;IAGzB,OAAO,CAAC,oBAAoB;IAG5B,OAAO,CAAC,sBAAsB;IAGT,OAAO,CAAC,SAAS;IAGtC,OAAO,CAAC,qBAAqB;IAG7B,OAAO,CAAC,uBAAuB;IAzBjC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAGjF,OAAO,CAAC,iBAAiB,CAAsD;gBAIrE,MAAM,EAAE,aAAa,EAGrB,iBAAiB,EAAE,+BAA+B,EAGlD,oBAAoB,EAAE,yCAAyC,EAG/D,sBAAsB,EAAE,6BAA6B,EAGhC,SAAS,EAAE,SAAS,EAGzC,qBAAqB,EAAE,4BAA4B,EAGnD,uBAAuB,EAAE,qCAAqC;IAQxE,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAqB;IAElE;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAsBnC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;;;;;;OAOG;IACH,mBAAmB,CAAC,YAAY,EAAE,YAAY,GAAG,oBAAoB;IAuFrE;;;OAGG;IACG,uBAAuB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,oBAAoB,EAC3B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,WAAW,GAAE,6BACiC,GAC7C,OAAO,CAAC,kBAAkB,CAAC;IA2D9B;;;;;OAKG;IACG,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpD,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,CAAC,EACP,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,EACrC,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAwGnC;;;OAGG;IACG,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpD,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,CAAC,EACP,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,EACrC,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAsKnC;;;OAGG;IACG,sBAAsB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxD,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,CAAC,EAAE,EACV,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,EACrC,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,CAAC,EAAE,CAAC;IA4Jf;;OAEG;IACG,sBAAsB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxD,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,CAAC,EAAE,EACb,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,EACrC,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAsBvC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkBhC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,4BAA4B;IAepC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;CAWrC"}

package/dist/esm/resources/services/resource-population.backend.service.js

@@ -45,7 +45,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject, Container } from 'inversify';
-import { ResourceRelationshipCardinality, ResourcesConfigNamingUtils, getAllVariantSchemas, analyzeOperationContextNeeds, DataMode, CoreResourceOperation, getParentDirectionRelationships, getChildDirectionRelationships, isOneToOneCardinality, PersistenceAdapter, } from '@wildo-ai/saas-models';
+import { ResourceRelationshipCardinality, ResourcesConfigNamingUtils, getAllVariantSchemas, analyzeOperationContextNeeds, DataMode, CoreResourceOperation, getParentDirectionRelationships, getChildDirectionRelationships, isOneToOneCardinality, PersistenceAdapter, Resources_SharedUtils, } from '@wildo-ai/saas-models';
 import { getZodObjectShape, isForeignKeyField, isSummaryField, getSummaryFieldParams, isVirtualField, virtualFieldNeedsObjectContext, virtualFieldNeedsUserContext } from '@wildo-ai/zod-decorators';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
 import { LoggerService } from '../../monitoring/logger/services/logger.service.js';
@@ -372,6 +372,21 @@ let ResourcePopulationBackendService = class ResourcePopulationBackendService {
             // Merge parents into result
             // Parents are ResourceContextItem[] - extract .data from each
             // For parents, typically there's one item (1:1 relationship), so we extract the first item's data
+            //
+            // ⚠️ ENUMERATED AND DELIBERATELY NOT CHANGED (2026-09-10, issue #563). This branch has the
+            // SAME name-derivation defect the child branch below just lost: it keys on `resourceType1`
+            // while the context DTO declares the FK-derived name (`users` vs `user`, `organizations` vs
+            // `organization`, `user_self` vs `user`). Measured over the core registry it mismatches on
+            // **37 of 37** context-enabled parent relationships — so no parent object has ever survived
+            // the response parse, on any resource.
+            //
+            // It is not fixed here because the rename is only half a fix and the other half is a DESIGN
+            // decision rather than a rename: `addRelationshipPlaceholders` types a parent placeholder as
+            // `z.object({ _id: z.string() }).optional()`, so a correctly-named parent would still arrive
+            // as a bare `{_id}` whatever SUMMARY/FULL `objectMode` its contextPolicy asked for. Landing
+            // the rename alone would add 37 near-empty objects to context responses in every generated
+            // application and satisfy no requirement #563 states. Filed with the measurement instead, so
+            // the next reader inherits the count rather than re-deriving it.
             if (resourceContext.parents) {
                 for (const [key, items] of Object.entries(resourceContext.parents)) {
                     if (Array.isArray(items) && items.length > 0) {
@@ -381,30 +396,52 @@ let ResourcePopulationBackendService = class ResourcePopulationBackendService {
                     }
                 }
             }
-            // Merge children into result
-            // Children are ResourceContextItem[] - extract .data from each
-            // For 1:1 relationships, return single object with singularized key
-            // For 1:many relationships, return array with plural key
+            // Merge children into result.
+            //
+            // The field name is NOT derived here. It comes from
+            // `Resources_SharedUtils.resolveRelationshipObjectIdentity` — the SAME authority
+            // `ResourcesConfigOperations_DtosBuilderUtils.addRelationshipPlaceholders` uses to declare
+            // the context placeholder on `contextDto` / `internalDto`. That is the whole point of the
+            // call: a populated field survives only if the DTO declares a field of exactly that name,
+            // because BOTH the service-layer `internalDto.parse` (`transformOutput`) and the controller's
+            // response serializer strip anything the schema does not name.
+            //
+            // ⚠️ This used to derive the name independently — `singularize(resourceType2)` for 1:1,
+            // `resourceType2` verbatim for 1:many — on the stated grounds that the two derivations were
+            // "structurally equivalent". They are not. The DTO derives from the related resource's
+            // `resourceFieldIdentifier`, whose stem is authored and need not be the singular of the
+            // resource type: `USER_SELF_PREFERENCES` carries `userSelfPreferencesId` → the DTO declares
+            // `userSelfPreferences` while this site produced `userSelfPreference`. Measured over the core
+            // registry (2026-09-10): of its 111 relationships, 37 carry an enabled `contextPolicy`, and
+            // the two derivations disagreed on 11 of those 37. EVERY one of those 11 fields was populated
+            // by this service and then silently Zod-stripped before it left the process — no error, no
+            // log, on any surface. That is what made every date in every generated application render at
+            // the i18n floor: the member's regional preferences never reached the client (issue #563).
+            //
+            // Deriving from one authority makes the class unrepresentable rather than merely fixed.
+            // Pinned by `resource-population.context-field-name.test.ts` (this site emits the authority's
+            // name, asserted as a LITERAL — recomputing the expectation with the same function the code
+            // uses would pass whichever derivation either side chose) and by `saas-models`'s
+            // `context-projection-field-name-agreement.test.ts` (the generated context DTO declares that
+            // name and strips the retired one).
             if (resourceContext.children) {
                 for (const [key, items] of Object.entries(resourceContext.children)) {
                     this.logDebug(`[populateForContext] Processing child key=${key}, itemsCount=${items?.length || 0}`);
+                    const childRelationship = this.findContextChildRelationship(resourceType, key);
+                    const contextFieldKey = this.resolveContextChildFieldName(childRelationship, key);
                     if (Array.isArray(items) && items.length > 0) {
                         // Check cardinality from the first item to determine if 1:1 or 1:many
                         const cardinality = items[0]?.cardinality;
                         const isOneToOne = cardinality === ResourceRelationshipCardinality.ONE ||
                             cardinality === ResourceRelationshipCardinality.ZERO_OR_ONE;
-                        // Use singularized key for 1:1 relationships
-                        // e.g., 'userSelfProfiles' -> 'userSelfProfile', but 'organizationMembers' stays as-is
-                        const fieldKey = isOneToOne
-                            ? ResourcesConfigNamingUtils.singularize(key)
-                            : key;
+                        const fieldKey = contextFieldKey;
                         this.logDebug(`[populateForContext] Child ${key}: cardinality=${cardinality}, isOneToOne=${isOneToOne}, fieldKey=${fieldKey}`);
                         if (isOneToOne) {
-                            // 1:1 relationship: return single object with singularized key
+                            // 1:1 relationship: return single object under the DTO's declared field name
                             result[fieldKey] = items[0]?.data;
                         }
                         else {
-                            // 1:many relationship: return array with plural key
+                            // 1:many relationship: return array under the DTO's declared field name
                             result[fieldKey] = items.map(item => item?.data).filter(Boolean);
                         }
                     }
@@ -419,13 +456,12 @@ let ResourcePopulationBackendService = class ResourcePopulationBackendService {
                         // placeholder is `z.array(...).optional()`, and consumers expect an array,
                         // not an absent field). If the relationship can't be resolved, fall back to
                         // the historical `[]` behaviour.
-                        const emptyChildRelationship = this.findContextChildRelationship(resourceType, key);
-                        const emptyIsOneToOne = emptyChildRelationship
-                            ? isOneToOneCardinality(emptyChildRelationship.cardinality2)
+                        const emptyIsOneToOne = childRelationship
+                            ? isOneToOneCardinality(childRelationship.cardinality2)
                             : false;
                         this.logDebug(`[populateForContext] Child ${key}: empty items array (isOneToOne=${emptyIsOneToOne})`);
                         if (!emptyIsOneToOne) {
-                            result[key] = [];
+                            result[contextFieldKey] = [];
                         }
                         // 1:1 with no row → leave the field absent (optional single record in contextDto)
                     }
@@ -601,12 +637,32 @@ let ResourcePopulationBackendService = class ResourcePopulationBackendService {
             return standardFieldIdentifier === fkField;
         });
     }
+    /**
+     * The field name a CONTEXT projection publishes a child relationship under.
+     *
+     * Delegates to `Resources_SharedUtils.resolveRelationshipObjectIdentity` — the authority the DTO
+     * builder uses when it declares the placeholder — so producer and contract cannot disagree. See
+     * the long note at the child-merge site in {@link populateForContext} for what the two
+     * independent derivations cost.
+     *
+     * The fallback is the historical local derivation, and it is reached only when the relationship
+     * cannot be resolved from the registry at all (the same condition under which the empty-array
+     * branch already falls back). Keeping it means an unresolvable relationship degrades exactly as
+     * it did before rather than throwing inside a response path.
+     */
+    resolveContextChildFieldName(relationship, childResourceType) {
+        if (relationship) {
+            return Resources_SharedUtils.resolveRelationshipObjectIdentity(relationship, relationship.resourceType2, relationship.cardinality2, this.resourcesRegistry.getAllResourceFieldIdentifiers()).objectFieldName;
+        }
+        return childResourceType;
+    }
     /**
      * Resolve the child-direction relationship a CONTEXT children key corresponds to.
      * The key is the child resource type (`resourceType2`) under which
      * `ResourceContextBackendService` groups fetched items. Used by
-     * `populateForContext` to recover a relationship's cardinality when the fetched
-     * item set is EMPTY — cardinality can't be read from a non-existent item, so an
+     * `populateForContext` both to name the published field (see
+     * {@link resolveContextChildFieldName}) and to recover a relationship's cardinality when the
+     * fetched item set is EMPTY — cardinality can't be read from a non-existent item, so an
      * absent 1:1 child would otherwise be mis-projected as `[]` and fail the
      * optional-single-`z.record` contextDto placeholder. Uses the same
      * `getChildDirectionRelationships` enumeration the DTO builder uses, keyed by