@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/resources/utils/resources-config-operations.dtos-builder.utils.js

@@ -1,11 +1,21 @@
 import { z } from 'zod';
 import { CoreResourceOperation } from '../resources.shared.core.definitions.js';
-import { Resouces_BulkOperationBaseSchema, DataMode, OPERATION_VARIANT_KEY, Resouces_PaginationResponseMetadataSchema, getChildDirectionRelationships, getParentDirectionRelationships } from '../resources-config.shared.schemas.js';
-import { ResourceRelationshipCardinality, isOneToOneCardinality, isArrayCardinality, getDefaultResponseSchemaForOperation, operationShouldHaveRequestDto, DefaultBulkDeleteResponseSchema } from '../resources.shared.schemas.js';
+import { Resouces_BulkOperationBaseSchema, DataMode, OPERATION_VARIANT_KEY, createPaginationResponseMetadataSchema, getChildDirectionRelationships, getParentDirectionRelationships, ResourceGeneratedOperationKind } from '../resources-config.shared.schemas.js';
+import { ResourceRelationshipCardinality, isOneToOneCardinality, isArrayCardinality, getDefaultResponseSchemaForOperation, isOutputEnvelopeOperation, operationShouldHaveRequestDto, DefaultBulkDeleteResponseSchema, CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS, createOrUpdateMandatoryDiscardFields } from '../resources.shared.schemas.js';
 import { Resources_SharedUtils } from '../resources.shared.utils.js';
-import { getCustomFieldMetadata, ZodDecorator, getZodType, hasZodType, isZodObject, isZodArray, isZodOptional, isZodDefault, getZodObjectShape, getZodDefSchemaProperty, getZodDefArrayProperty, getZodDefStringProperty, getZodDefProperty, isZodTypeAny, getEnumValues, isExcludedFromCreate, isExcludedFromUpdate, isVirtualField, isPrimaryKey, isBackendOnlyField, getBackendOnlyParams, isDiscriminatorField, unwrapSchema } from '@wildo-ai/zod-decorators';
+import { addDiscriminator, getCustomFieldMetadata, ZodDecorator, getZodType, hasZodType, isZodObject, isZodArray, isZodOptional, isZodNullable, isZodDefault, toPatchOptionalField, getZodObjectShape, getZodDefSchemaProperty, getZodDefArrayProperty, getZodDefStringProperty, getZodDefProperty, isZodTypeAny, getEnumValues, isExcludedFromCreate, isExcludedFromUpdate, isVirtualField, isTemplatableFileField, isPrimaryKey, isBackendOnlyField, getBackendOnlyParams, isWriteOnlySecretField, isDiscriminatorField, unwrapSchema, getMergedObjectOrUnionShape, withArrayElement, SCHEMA_METADATA } from '@wildo-ai/zod-decorators';
 import { ResourcesSummaryUtils } from './resources-summary.utils.js';
 import { RepositoryDtoBuilderUtils } from './repository-dto-builder.utils.js';
+import { stripTemplatableFileFieldsRecursively as stripTemplatableFileFieldsSchema, } from './templatable-file-fields.shared.utils.js';
+/**
+ * Canonical placeholder shown to clients in place of a `.isWriteOnlySecret()`
+ * field's real value. It doubles as the write-back sentinel: when a client
+ * echoes this exact string back on CREATE/UPDATE, the framework interprets it as
+ * "keep the existing stored secret" and strips the field from the write payload
+ * (UPDATE is a partial `$set`, so the stored value is preserved). Kept as a
+ * single constant so the output mask and the input sentinel never drift.
+ */
+export const WRITE_ONLY_SECRET_MASK = '••••••••';
 /**
  * Type guard to check if schema is a ZodAny
  * In Zod v4, any schemas have type: "any"
@@ -14,6 +24,26 @@ function isZodAny(schema) {
     return hasZodType(schema, 'any');
 }
 export class ResourcesConfigOperationsDtosBuilderUtils {
+    /**
+     * Carry field/schema decorators across a wrapper or leaf rebuild.
+     *
+     * Network-boundary coercion necessarily replaces Zod instances (`date` becomes
+     * `coerce.date`, optional/nullable/default wrappers are rebuilt around transformed
+     * children). Decorators such as `isBackendOnly` live on those instances. Losing
+     * the metadata before the response-stripping pass turns a backend-only field into
+     * an ordinary public field, which is a confidentiality failure rather than a
+     * presentation defect.
+     */
+    static preserveSchemaMetadata(source, rebuilt) {
+        const sourceMetadata = source[SCHEMA_METADATA];
+        if (sourceMetadata !== undefined) {
+            rebuilt[SCHEMA_METADATA] = sourceMetadata;
+        }
+        return rebuilt;
+    }
+    static buildSchemaWithInheritance(mainSchema, inheritanceDefinition) {
+        return this.applyInheritanceToSchema(mainSchema, inheritanceDefinition, new Map());
+    }
     /**
      * Rebuild an object schema, optionally preserving schema-level checks.
      *
@@ -32,6 +62,30 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         for (const check of checks ?? []) {
             rebuiltSchema = rebuiltSchema.check(check);
         }
+        // Preserve decorator metadata (`SCHEMA_METADATA`) across shape-equivalent rebuilds.
+        //
+        // Factory helpers like `z_file()`, `z_money()`, `z_bigdecimal()` and `z_range()`
+        // stamp their identity as a symbol-keyed metadata object on the *ZodObject
+        // instance* (not on any inner field). A fresh `z.object(rebuiltShape)` is a new
+        // instance, so that symbol is lost. When the field SET is unchanged — i.e. the
+        // check-preserving path (date coercion, nested inner rebuilds) — the metadata
+        // still describes the schema faithfully, so it MUST be carried over.
+        //
+        // Concretely: `z_file()`'s value is `z.object({ fileId, updatedAt: z.date() })`.
+        // DTO date-coercion rewrites the inner `updatedAt` to `z.coerce.date()`, which
+        // rebuilds the object here. Without re-attaching `fileConfig`, `getSchemaType()`
+        // resolves the field to a plain OBJECT and the automated form renders it as a raw
+        // `{ fileId, updatedAt }` composite instead of the file uploader — and
+        // `collectUploadableFileFieldPaths()` finds nothing, so no upload endpoints are
+        // derived. This was the root cause of avatar/file fields never rendering an
+        // uploader (the "first real file implementation" gap).
+        //
+        // The omit path (`preserveChecks: false`, above) intentionally skips this: there
+        // the field set changed, so the original field-type identity may no longer hold.
+        const sourceMetadata = schema[SCHEMA_METADATA];
+        if (sourceMetadata !== undefined) {
+            rebuiltSchema[SCHEMA_METADATA] = sourceMetadata;
+        }
         return rebuiltSchema;
     }
     /**
@@ -66,6 +120,41 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             });
         }
     }
+    static stripTemplatableFileFieldsRecursively(schema) {
+        return stripTemplatableFileFieldsSchema(schema, {
+            rebuildObjectSchema: (objectSchema, strippedShape) => this.rebuildObjectSchema(objectSchema, strippedShape, { preserveChecks: false }),
+        });
+    }
+    /**
+     * Run a resource `mainSchema`'s TOP-LEVEL object checks (`.refine()` / `.superRefine()`) against a
+     * fully-materialised row (post-enrichment) and return the ZodError, or null when the schema declares
+     * no top-level check or all pass.
+     *
+     * This is the correct enforcement point for a cross-field invariant declared on a resource
+     * `mainSchema`. A CREATE REQUEST cannot carry it: the request DTO omits every backend-injected field
+     * (`primaryScope`, `organizationId`, `createdAt`, …), so a check referencing one — e.g. a file-scope
+     * check keyed on `primaryScope` — would fire against an ABSENT value and reject a valid create. The
+     * ENRICHED row (after context injection + literal / user-tracking population) carries every field, so
+     * the check validates truthfully: a file-scope check passes on a consistent row, while a check on
+     * create-supplied fields (a junction's `source ≠ target`) still rejects a bad row.
+     *
+     * The checks run in ISOLATION via a passthrough object, so no unrelated shape/coercion validation is
+     * re-applied to the already-built row (its dates are `Date`s, its ids may be driver objects — none of
+     * which a fresh full-schema parse should re-police here). Works whether `mainSchema` is a plain object
+     * or a discriminated-union family — a schema with no top-level check simply returns null.
+     */
+    static validateTopLevelObjectChecks(mainSchema, value) {
+        const checks = getZodDefArrayProperty(mainSchema, 'checks');
+        if (!checks || checks.length === 0) {
+            return null;
+        }
+        let checker = z.looseObject({});
+        for (const check of checks) {
+            checker = checker.check(check);
+        }
+        const result = checker.safeParse(value);
+        return result.success ? null : result.error;
+    }
     /**
      * Rebuild all operation DTOs once the full registry is available.
      *
@@ -120,76 +209,121 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         //    - Rebuild from enhancedMainSchema (with inheritance applied)
         //    - If original was explicitly provided (custom), preserve it but apply transformations
         //    - Otherwise use rebuilt DTO (with inheritance)
-        //    - Apply date coercion
+        //    - Apply network-boundary coercion (dates + money bigints)
         //    - Backend-only fields already excluded in buildEnhancedRequestDto
         let requestDto = this.buildEnhancedRequestDto(operationWithEnhancedSchema, effectiveOperation);
-        // Check if original DTO was explicitly provided (custom DTO from variantParams.requestDto)
-        // Custom DTOs are complete schemas that should be preserved as-is, but still need
-        // transformations (date coercion). We detect custom DTOs by checking if they're
-        // significantly different from what would be auto-derived, OR if they're the same
-        // structure but the user explicitly provided them (we can't distinguish this easily,
-        // so we use a heuristic: if different, preserve; if same, use rebuilt with inheritance).
+        // Check if original DTO was explicitly provided (custom DTO from variantParams.requestDto).
         const rebuiltRequestInfo = this.analyzeDtoSchema(requestDto);
         const originalRequestInfo = originalRequestDto ? this.analyzeDtoSchema(originalRequestDto) : null;
-        // If original exists and is significantly different from rebuilt, it's likely custom
-        // Preserve it but apply transformations (date coercion)
-        // Note: Custom DTOs are complete schemas that don't need inheritance - they're provided
-        // as-is by the user. However, they still need date coercion for API communication.
-        if (originalRequestDto && originalRequestInfo &&
-            originalRequestInfo !== rebuiltRequestInfo &&
-            originalRequestInfo !== '📄 {} (empty object)' &&
-            !isZodAny(originalRequestDto)) {
-            // Custom DTO: preserve structure but apply date coercion
-            requestDto = this.applyDateCoercion(originalRequestDto);
+        // Custom-DTO classification is driven by the explicit `hasCustomRequestDto`
+        // flag that the resource factory stamps on EVERY operation it builds:
+        //   • `true`  → the variant supplied an explicit `requestDto`; preserve it
+        //     verbatim (it is a complete, author-owned contract — e.g. a narrow
+        //     `{ status }` for a CHANGE_STATUS custom operation).
+        //   • `false` → the requestDto is the factory's auto-derived *temporary*
+        //     placeholder, built from the base object via `deriveRequestDto` BEFORE
+        //     inheritance is known. So we MUST use the inheritance-rebuilt DTO —
+        //     which, for an inheritance resource (discriminated-union mainSchema via
+        //     `createSchemaFamily`), is the per-variant union. Preserving the bare
+        //     temporary here is what silently dropped variant-only fields
+        //     (e.g. todos `recurrence`/`startDate`/`endsDate`) from CREATE/UPDATE
+        //     request validation: `z.object` strips unknown keys, so a RECURRING
+        //     payload parsed but lost its extension fields — the request-side twin
+        //     of the RAW-mode LIST responseDto bug fixed just below.
+        // Only when the flag is ABSENT (legacy / hand-authored operations that
+        // predate the flag) do we fall back to the structural `analyzeDtoSchema`
+        // heuristic — a base object always differs structurally from the rebuilt
+        // union, so the heuristic alone cannot tell "custom" from "auto-derived
+        // inheritance DTO".
+        const hasExplicitCustomRequestDto = operation.hasCustomRequestDto === true;
+        const isExplicitlyAutoDerivedRequestDto = operation.hasCustomRequestDto === false;
+        const isCustomRequestDto = hasExplicitCustomRequestDto
+            ? (originalRequestDto && !isZodAny(originalRequestDto))
+            : isExplicitlyAutoDerivedRequestDto
+                ? false
+                : (originalRequestDto && originalRequestInfo &&
+                    originalRequestInfo !== rebuiltRequestInfo &&
+                    originalRequestInfo !== '📄 {} (empty object)' &&
+                    !isZodAny(originalRequestDto));
+        if (isCustomRequestDto && originalRequestDto) {
+            // Custom DTO: preserve structure but apply network-boundary coercion (dates + money bigints)
+            requestDto = this.applyNetworkBoundaryCoercion(this.stripTemplatableFileFieldsRecursively(originalRequestDto));
+        }
+        else if (operation.generatedOperation && originalRequestDto && !isZodAny(originalRequestDto)) {
+            // Framework-generated operations own their DTO contract. In particular,
+            // generated file regeneration is UPDATE-like for authorization and
+            // persistence but intentionally accepts an empty request body.
+            requestDto = this.applyNetworkBoundaryCoercion(this.stripTemplatableFileFieldsRecursively(originalRequestDto));
         }
         else {
             // Auto-derived DTO: use rebuilt (with inheritance) and apply transformations
-            requestDto = this.applyDateCoercion(requestDto);
+            requestDto = this.applyNetworkBoundaryCoercion(requestDto);
         }
+        requestDto = this.stripTemplatableFileFieldsRecursively(requestDto);
         // 3. Build responseDto first (repositoryDto depends on it)
         //    - Rebuild from enhancedMainSchema (with inheritance applied)
         //    - If original was custom (significantly different), preserve it but apply transformations
         //    - Otherwise use rebuilt DTO (with inheritance)
         //    - Strip backend-only fields (except isReturnedAtCreation for CREATE)
-        //    - Apply date coercion
+        //    - Apply network-boundary coercion (dates + money bigints)
         //    - Exclude virtual fields (they're computed, not stored)
         let responseDtoInternal = this.buildEnhancedResponseDto(operationWithEnhancedSchema, effectiveOperation);
         let responseDto = responseDtoInternal;
         // Check if original DTO was explicitly provided (custom DTO from customResponseDto)
         // Custom DTOs are complete schemas that should be preserved as-is, but still need
-        // transformations (backend-only stripping, date coercion).
+        // transformations (backend-only stripping, date + money-bigint coercion).
         const hasExplicitCustomResponseDto = operation.hasCustomResponseDto === true;
         const rebuiltResponseInfo = this.analyzeDtoSchema(responseDtoInternal);
         const originalResponseInfo = originalResponseDto ? this.analyzeDtoSchema(originalResponseDto) : null;
-        // If hasCustomResponseDto flag is set, always preserve the original (skip heuristic).
-        // Otherwise, fall back to analyzeDtoSchema heuristic for backward compatibility.
+        // Custom-DTO classification is driven by the explicit `hasCustomResponseDto`
+        // flag that the resource factory stamps on EVERY operation it builds:
+        //   • `true`  → the app supplied a `customResponseDto`; preserve it verbatim.
+        //   • `false` → the DTO is framework auto-derived. The factory only sets a
+        //     *temporary*, item-level placeholder (documented as "will be replaced by
+        //     buildAllOperationDtos"), so we MUST use the inheritance-rebuilt DTO —
+        //     which, for LIST/SEARCH, is the `{ data, pagination }` pagination wrapper.
+        //     Preserving the bare temporary schema here is what broke RAW-mode list
+        //     responses: `selectResponseDto(op, RAW)` returned the item schema and the
+        //     controller parsed the `{ data, pagination }` envelope against it (Zod
+        //     "No matching discriminator" for inheritance resources such as todos,
+        //     missing-field errors for plain ones).
+        // Only when the flag is ABSENT (legacy / hand-authored operations that predate
+        // the flag) do we fall back to the structural `analyzeDtoSchema` heuristic — an
+        // item schema always differs structurally from the rebuilt wrapper, so the
+        // heuristic alone cannot tell "custom" from "auto-derived collection DTO".
+        const isExplicitlyAutoDerivedResponseDto = operation.hasCustomResponseDto === false;
         const isCustomResponseDto = hasExplicitCustomResponseDto
             ? (originalResponseDto && !isZodAny(originalResponseDto))
-            : (originalResponseDto && originalResponseInfo &&
-                originalResponseInfo !== rebuiltResponseInfo &&
-                originalResponseInfo !== '📄 {} (empty object)' &&
-                !isZodAny(originalResponseDto));
+            : isExplicitlyAutoDerivedResponseDto
+                ? false
+                : (originalResponseDto && originalResponseInfo &&
+                    originalResponseInfo !== rebuiltResponseInfo &&
+                    originalResponseInfo !== '📄 {} (empty object)' &&
+                    !isZodAny(originalResponseDto));
         if (isCustomResponseDto && originalResponseDto) {
-            // Custom DTO: preserve structure but apply transformations
-            // Still need to strip backend-only fields and apply date coercion
+            // Strip while decorator metadata is still on the source nodes, then apply
+            // network coercion to each trust-boundary shape independently. Reversing
+            // this order allowed wrapper rebuilds to erase `isBackendOnly` before the
+            // confidentiality pass inspected it.
             const isCreateOperation = effectiveOperation === CoreResourceOperation.CREATE ||
                 effectiveOperation === CoreResourceOperation.CREATE_MANY;
-            responseDtoInternal = this.applyDateCoercion(originalResponseDto);
-            responseDto = this.stripBackendOnlyFields(responseDtoInternal, {
+            responseDtoInternal = this.applyNetworkBoundaryCoercion(originalResponseDto);
+            responseDto = this.applyNetworkBoundaryCoercion(this.stripBackendOnlyFields(originalResponseDto, {
                 respectIsReturnedAtCreation: isCreateOperation,
                 operationType: isCreateOperation ? CoreResourceOperation.CREATE : undefined
-            });
+            }));
         }
         else {
             // Auto-derived DTO: use rebuilt (with inheritance) and apply transformations
-            // Strip backend-only fields (respect isReturnedAtCreation for CREATE)
+            // Strip backend-only fields before coercion rebuilds wrappers/leaves.
             const isCreateOperation = effectiveOperation === CoreResourceOperation.CREATE ||
                 effectiveOperation === CoreResourceOperation.CREATE_MANY;
-            responseDtoInternal = this.applyDateCoercion(responseDtoInternal);
-            responseDto = this.stripBackendOnlyFields(responseDtoInternal, {
+            const clientResponseDto = this.stripBackendOnlyFields(responseDtoInternal, {
                 respectIsReturnedAtCreation: isCreateOperation,
                 operationType: isCreateOperation ? CoreResourceOperation.CREATE : undefined
             });
+            responseDtoInternal = this.applyNetworkBoundaryCoercion(responseDtoInternal);
+            responseDto = this.applyNetworkBoundaryCoercion(clientResponseDto);
         }
         // Note: Virtual fields are already excluded in buildEnhancedResponseDto
         // 4. Add nested operations DTOs if configured (child + self relationships)
@@ -214,8 +348,12 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         //    - Extract summary fields (isSummaryField)
         //    - If no summary fields defined, fall back to mainSchema (same as RAW)
         //    - DO NOT strip backend-only fields yet (needed for repositoryDto)
-        //    - Apply date coercion (already applied in extractSummaryFields)
         //    - Handle discriminated unions
+        //    - Network-boundary coercion (dates + money bigints) is applied ONCE below,
+        //      after the no-summary-fields fallback resolves, so EVERY summary shape
+        //      (plain object, discriminated union, AND the full-schema fallback) accepts
+        //      ISO-string dates AND bigint-as-string money amounts — the same uniform
+        //      transposition point used for requestDto/responseDto/internalDto.
         let summaryDtoInternal = this.extractSummaryFields(enhancedMainSchema);
         // If no summary fields are defined, use full schema (same as RAW mode)
         // Check if summaryDtoInternal is empty (z.object({}))
@@ -227,19 +365,86 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 summaryDtoInternal = this.excludeVirtualFieldsFromSchema(enhancedMainSchema);
             }
         }
-        // Build stripped version for frontend (summaryDto)
-        const summaryDto = this.stripBackendOnlyFields(summaryDtoInternal);
-        // Note: Date coercion is already applied in extractSummaryFields
+        // Apply network-boundary coercion (z.date() → z.coerce.date() AND string-accepting
+        // z.bigint() for z_money amounts) over the fully-resolved summary schema — the
+        // single, uniform transposition point for the summary DTO, covering the
+        // extracted-summary path, the discriminated-union path, and the full-schema
+        // fallback alike. Without this, summary responses (which carry ISO-string
+        // createdAt/updatedAt and bigint-as-string money totals over JSON) fail frontend
+        // response validation with "expected date, received string" / "expected bigint,
+        // received string" (e.g. invoiceRefs.total.amount is an isSummaryField z_money).
+        const summaryDto = this.applyNetworkBoundaryCoercion(this.stripBackendOnlyFields(summaryDtoInternal));
+        summaryDtoInternal = this.applyNetworkBoundaryCoercion(summaryDtoInternal);
+        // The COLLECTION EXPORT companion is deliberately excluded. It carries
+        // `resourceOperationLike: LIST/SEARCH` so that routing, collection-level authorization and URL
+        // building all treat it as a listing — which is exactly right — but its response is a FILE, not
+        // a pagination envelope, so every list-shaped DTO derivation below (context item extraction,
+        // SUMMARY/CONTEXT envelope rebuilding) would be operating on the wrong shape. Without this
+        // exclusion the derivation throws `pagination response must contain a data array` at resource
+        // configuration time and the whole application fails to start.
+        const isCollectionExportCompanion = operation.generatedOperation?.kind === ResourceGeneratedOperationKind.GENERATED_COLLECTION_EXPORT;
+        const isListOrSearch = !isCollectionExportCompanion
+            && (effectiveOperation === CoreResourceOperation.LIST
+                || effectiveOperation === CoreResourceOperation.SEARCH);
         // 6. Build contextDto:
-        //    - Start with responseDto
+        //    - Start with the response item DTO. LIST/SEARCH responseDto is already
+        //      a pagination envelope, so projecting relationships on that envelope
+        //      would later wrap a page inside another page for the CONTEXT variant.
         //    - Add relationship placeholders
         //    - Date coercion already applied to responseDto
-        const contextDto = this.addRelationshipPlaceholders(responseDto, operation.resourceRelationships, registry);
+        const contextBaseDto = isListOrSearch
+            ? this.extractPaginatedCollectionItemDto(responseDto, effectiveOperation)
+            : responseDto;
+        const contextDto = this.addRelationshipPlaceholders(contextBaseDto, operation.resourceRelationships, registry);
         // 7. Build internalDto base (before variant overrides):
         //    - Start with mainSchema (with inheritance)
         //    - Include backend-only fields (DO NOT strip)
         //    - Exclude virtual fields (they're computed)
+        //
+        //    A non-READ op that declares a `customResponseDto` (e.g. a CREATE that
+        //    returns an ephemeral `plainKey`) legitimately carries the extra fields
+        //    the custom schema adds in its service output. `transformOutput`
+        //    validates that output against `internalDto`, so for these ops internalDto
+        //    must be the custom schema (`responseDtoInternal`), not the bare main
+        //    schema — otherwise the enriched fields are stripped before the controller
+        //    serializes against the custom `responseDto` (the api-key CREATE's
+        //    `plainKey` failed exactly this way). This mirrors the custom-VARIANT
+        //    branch below (lines ~516), which only runs for `variantKey`'d ops and so
+        //    left the DEFAULT custom-DTO op falling through to `enhancedMainSchema`.
+        //    LIST/SEARCH keep the main-schema base (their pagination wrapper is
+        //    applied below and the collection item DTO is handled separately).
+        const internalDtoUsesCustomResponse = effectiveOperation !== CoreResourceOperation.READ
+            && Boolean(isCustomResponseDto)
+            && Boolean(originalResponseDto)
+            && effectiveOperation !== CoreResourceOperation.LIST
+            && effectiveOperation !== CoreResourceOperation.SEARCH;
+        // `internalDto` is what the service layer validates its OUTPUT against
+        // (`ServiceResourceBackendService.transformOutput`). It must mirror the shape the operation
+        // actually returns. For most mutations that is the resource object (`enhancedMainSchema`), but:
+        //   • READ                     → the resource itself (custom read DTOs handled via the flag below)
+        //   • OUTPUT_ENVELOPE_OPERATIONS (DELETE, DELETE_MANY, COUNT) → a framework RESPONSE ENVELOPE
+        //     (`DefaultDeleteResponseSchema` / `DefaultBulkDeleteResponseSchema` / `DefaultCountResponseSchema`)
+        // For all of these the correct `internalDto` is the very schema already exposed via
+        // `responseDto`: `responseDtoInternal` is that schema with backend-only fields retained (a
+        // no-op for these envelopes, which carry none) and is already bulk-vs-single aware because
+        // `buildEnhancedResponseDto` resolved it from `getDefaultResponseSchemaForOperation` (and the
+        // bulk-operation branch). Leaving an envelope operation on `enhancedMainSchema` is what made
+        // `transformOutput` validate the envelope value against the resource object schema and throw
+        // `service_resource_transformation_failed` → HTTP 500 (the delete bug; COUNT was a latent
+        // sibling). Bulk mutations (CREATE_MANY/UPDATE_MANY) are intentionally NOT in the set — they
+        // return per-item resource objects validated item-by-item, so they keep `enhancedMainSchema`.
+        //
+        // ⚠️ Keyed on the operation's OWN `operationIdentifier`, NOT `effectiveOperation`
+        // (`resourceOperationLike || operationIdentifier`). A CUSTOM op that borrows DELETE/COUNT
+        // semantics for its route/verb but returns its own shape (via `REPLACE_CORE_OPERATIONS` or a
+        // `customResponseDto`) must NOT be forced onto the core envelope — its custom response is
+        // already handled by `internalDtoUsesCustomResponse`, or it keeps `enhancedMainSchema`. Only the
+        // genuine core operation carries `operationIdentifier === CoreResourceOperation.DELETE` etc.
+        // For the deletes, the runtime composition of the envelope from the repository's bare id(s)
+        // happens at the transform boundary via `composeDefaultOperationResponse` (same keying).
         let internalDtoProcessed = effectiveOperation === CoreResourceOperation.READ
+            || isOutputEnvelopeOperation(operation.operationIdentifier)
+            || internalDtoUsesCustomResponse
             ? responseDtoInternal
             : enhancedMainSchema;
         // Exclude virtual fields from internalDto
@@ -261,13 +466,11 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         //    - Exclude virtual fields but include their dependencies
         let repositoryDto = RepositoryDtoBuilderUtils.deriveRepositoryDto(responseDto, enhancedMainSchema);
         // 9. For default operations (no variantKey), wrap internalDto in pagination for LIST/SEARCH:
-        const isListOrSearch = effectiveOperation === CoreResourceOperation.LIST
-            || effectiveOperation === CoreResourceOperation.SEARCH;
         if (!operation.variantKey && isListOrSearch) {
             // Default LIST/SEARCH operations: wrap internalDto in pagination
             internalDtoProcessed = z.object({
                 data: z.array(internalDtoProcessed),
-                pagination: Resouces_PaginationResponseMetadataSchema
+                pagination: createPaginationResponseMetadataSchema(operation.maxPaginatedResultPerPageLimit)
             });
         }
         // 10. Override responseDto, repositoryDto, and internalDto for variant operations:
@@ -284,12 +487,12 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                     // Build internalDto for service-layer validation (pagination wrapper with backend-only items)
                     internalDtoProcessed = z.object({
                         data: z.array(summaryDtoInternal),
-                        pagination: Resouces_PaginationResponseMetadataSchema
+                        pagination: createPaginationResponseMetadataSchema(operation.maxPaginatedResultPerPageLimit)
                     });
                     // Wrap summaryDto (frontend version, backend-only stripped) in pagination for responseDto
                     responseDto = z.object({
                         data: z.array(summaryDto),
-                        pagination: Resouces_PaginationResponseMetadataSchema
+                        pagination: createPaginationResponseMetadataSchema(operation.maxPaginatedResultPerPageLimit)
                     });
                 }
                 else {
@@ -307,12 +510,12 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                     // Build internalDto for service-layer validation (pagination wrapper with backend-only items)
                     internalDtoProcessed = z.object({
                         data: z.array(contextDtoInternal),
-                        pagination: Resouces_PaginationResponseMetadataSchema
+                        pagination: createPaginationResponseMetadataSchema(operation.maxPaginatedResultPerPageLimit)
                     });
                     // Wrap contextDto (frontend version, backend-only stripped) in pagination for responseDto
                     responseDto = z.object({
                         data: z.array(contextDto),
-                        pagination: Resouces_PaginationResponseMetadataSchema
+                        pagination: createPaginationResponseMetadataSchema(operation.maxPaginatedResultPerPageLimit)
                     });
                 }
                 else {
@@ -325,13 +528,21 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 // For custom variants with customResponseDto (e.g., 'context_old'):
                 // The internalDto should also use the custom schema to preserve enriched fields.
                 // This ensures that custom implementations can return additional fields that won't be stripped.
-                // Apply date coercion to the custom schema for internal processing.
-                internalDtoProcessed = this.applyDateCoercion(originalResponseDto);
+                // Apply network-boundary coercion (dates + money bigints) to the custom schema for internal processing.
+                internalDtoProcessed = this.applyNetworkBoundaryCoercion(originalResponseDto);
                 repositoryDto = RepositoryDtoBuilderUtils.deriveRepositoryDto(originalResponseDto, enhancedMainSchema);
             }
         }
-        // 11. Finalize internalDto with date coercion:
-        const internalDtoFinal = this.applyDateCoercion(internalDtoProcessed);
+        if (operation.generatedOperation && originalResponseDto && !isZodAny(originalResponseDto)) {
+            // Generated operations may be UPDATE-like for routing/authorization while
+            // returning a framework-owned envelope that is not the resource schema.
+            // Keep service-layer output validation aligned with that envelope.
+            internalDtoProcessed = this.applyNetworkBoundaryCoercion(originalResponseDto);
+            repositoryDto = RepositoryDtoBuilderUtils.deriveRepositoryDto(enhancedMainSchema, enhancedMainSchema);
+        }
+        requestDto = this.stripTemplatableFileFieldsRecursively(requestDto);
+        // 11. Finalize internalDto with network-boundary coercion (dates + money bigints):
+        const internalDtoFinal = this.applyNetworkBoundaryCoercion(internalDtoProcessed);
         // 12. Return operation with all DTOs stored
         return {
             ...operation,
@@ -343,72 +554,6 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             repositoryDto
         };
     }
-    /**
-     * Main entry point to build DTOs for all operations of a resource
-     * This replaces the minimal DTOs set during initialization with comprehensive ones
-     *
-     * INHERITANCE APPROACH:
-     * - Inheritance is applied to mainSchema (not relationship cascading)
-     * - Creates discriminated union schemas based on inheritance definitions
-     * - Inheritance logic is transferred to DTO building process
-     *
-     * NOTE: TDatabaseSchema has been removed. Backend-only fields are now marked with
-     * the `isBackendOnly` decorator on mainSchema and stripped at the service layer.
-     *
-     * IMPORTANT: Each operation represents ONE flattened variant, not multiple variants
-     */
-    static buildOperationDtos(operations, resourceRegistry, // Full resource registry for cross-references
-    processedInheritanceSchemas = new Map() // Cache for inheritance schemas
-    ) {
-        // Process each flattened operation individually
-        const enhancedOperations = operations.map((operation, index) => {
-            return this.buildOperationDto(operation, resourceRegistry, processedInheritanceSchemas);
-        });
-        return enhancedOperations;
-    }
-    /**
-     * Build DTO for a single flattened operation with enhanced inheritance handling
-     */
-    static buildOperationDto(operation, resourceRegistry, processedInheritanceSchemas, resourceConfig) {
-        // Determine the effective operation identifier for DTO building
-        const effectiveOperation = operation.resourceOperationLike || operation.operationIdentifier;
-        // Apply inheritance to mainSchema if inheritance definition exists
-        // Use resource-level inheritance (resourceConfig.inheritenceSchemaDefinition) instead of operation-level
-        const inheritenceSchemaDefinition = resourceConfig?.inheritenceSchemaDefinition;
-        const enhancedMainSchema = this.applyInheritanceToSchema(operation.mainSchema, inheritenceSchemaDefinition, processedInheritanceSchemas);
-        // Create operation with inherited schema
-        const operationWithInheritance = {
-            ...operation,
-            mainSchema: enhancedMainSchema
-        };
-        // Build enhanced request DTO based on operation type and inherited schemas
-        let enhancedRequestDto = this.buildEnhancedRequestDto(operationWithInheritance, effectiveOperation);
-        // Build enhanced response DTO based on operation type and inherited schemas
-        let enhancedResponseDto = this.buildEnhancedResponseDto(operationWithInheritance, effectiveOperation);
-        // Add nested operations DTOs if configured (child + self relationships)
-        const resourceRelationships = operationWithInheritance.resourceRelationships;
-        const childDirRels = resourceRelationships ? getChildDirectionRelationships(resourceRelationships) : [];
-        if (childDirRels.length > 0) {
-            // Build request DTO with nested children for create/update operations,
-            // including bulk variants. Runtime bulk orchestration is handled in the
-            // services layer by applying the same nested-processing principles per
-            // parent result.
-            if (effectiveOperation === CoreResourceOperation.CREATE || effectiveOperation === CoreResourceOperation.CREATE_MANY ||
-                effectiveOperation === CoreResourceOperation.UPDATE || effectiveOperation === CoreResourceOperation.UPDATE_MANY) {
-                enhancedRequestDto = this.buildRequestDtoWithNested(effectiveOperation, enhancedRequestDto, childDirRels, resourceRegistry);
-            }
-            // Build response DTO with nested children (for READ)
-            if (effectiveOperation === CoreResourceOperation.READ) {
-                enhancedResponseDto = this.buildResponseDtoWithNested(enhancedResponseDto, childDirRels, resourceRegistry);
-            }
-        }
-        const result = {
-            ...operationWithInheritance,
-            requestDto: enhancedRequestDto,
-            responseDto: enhancedResponseDto,
-        };
-        return result;
-    }
     /**
      * Build enhanced request DTO based on operation type and existing DTOs.
      *
@@ -422,7 +567,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         const isZAny = operation.requestDto && isZodAny(operation.requestDto);
         const currentRequestInfo = this.analyzeDtoSchema(operation.requestDto);
         if (operation.requestDto && !isZAny && currentRequestInfo !== '📄 {} (empty object)') {
-            return operation.requestDto;
+            return this.stripTemplatableFileFieldsRecursively(operation.requestDto);
         }
         const searchQueryRequestSchema = operation.searchQueryRequestSchema;
         if (effectiveOperation === CoreResourceOperation.SEARCH
@@ -435,7 +580,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         if (!shouldHaveRequestDto) {
             return z.object({});
         }
-        // Apply bulk operation decorator if needed (only for API_CALL operations)
+        // Apply bulk operation decorator for URL-bearing bulk companion operations.
         // For bulk operations, we need to wrap the underlying operation's requestDto
         // with Resouces_BulkOperationBaseSchema
         if ('isBulkOperation' in operation && operation.isBulkOperation) {
@@ -488,7 +633,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         if (operation.responseDto && !isZAny && currentResponseInfo !== '📄 {} (empty object)') {
             return operation.responseDto;
         }
-        // Apply bulk operation decorator for bulk operations (only for API_CALL operations)
+        // Apply bulk operation decorator for URL-bearing bulk companion operations.
         if ('isBulkOperation' in operation && operation.isBulkOperation) {
             switch (effectiveOperation) {
                 case CoreResourceOperation.DELETE:
@@ -506,14 +651,56 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                     return z.array(operation.mainSchema);
             }
         }
-        // Apply pagination decorator for list/search operations
+        // Apply pagination decorator for list/search operations.
+        //
+        // The ceiling comes from the OPERATION, not from a constant. It used to be a hard-coded `50`,
+        // which made `maxPaginatedResultPerPageLimit` inert on the response side: an operation could
+        // declare 100 or 200, the repository would honour it, and the response DTO would then reject the
+        // very page the repository had just built — a 500 (`service_resource_transformation_failed`,
+        // `too_big: expected array to have <=50 items`) rather than a page. Live example found
+        // 2026-08-12 on `users | list | admin`; latent on every operation declaring a larger ceiling
+        // (`users SEARCH` 200, `organizations SEARCH` 100, `user-profiles` 200).
+        //
+        // The default is 100 — the ceiling the Mongo `_doList` hard-coded before it was taught to read
+        // the declared value, and therefore the largest page this DTO could ever have been handed. It is
+        // NOT 50: a 50 default would reject the very pages the repository is still allowed to build for
+        // an operation that declares nothing, which is the 500 this whole change exists to remove, in a
+        // new place. SEARCH's repository default stays 50, so its pages sit comfortably inside this.
         if (effectiveOperation === CoreResourceOperation.LIST || effectiveOperation === CoreResourceOperation.SEARCH) {
-            return this.createPaginatedResponseSchema(operation.mainSchema, 50);
+            return this.createPaginatedResponseSchema(operation.mainSchema, operation.maxPaginatedResultPerPageLimit ?? 100);
         }
         // Apply operation-specific default patterns
         const defaultResponse = getDefaultResponseSchemaForOperation(effectiveOperation, operation.mainSchema);
         return defaultResponse;
     }
+    /**
+     * Return the row schema owned by a standard paginated collection response.
+     *
+     * LIST and SEARCH first derive a client response shaped as
+     * `{ data: Row[]; pagination: ... }`. Context projection enriches `Row`, not
+     * the envelope. Keeping this extraction at the shared DTO boundary makes the
+     * invariant unbypassable for every generated CONTEXT collection operation:
+     * its response is exactly one page of context-enriched rows.
+     *
+     * A malformed/custom collection response fails closed here. Silently falling
+     * back to the envelope recreates the former `Page<Page<Row>>` contract and
+     * lets runtime, OpenAPI, examples and client validation disagree.
+     */
+    static extractPaginatedCollectionItemDto(responseDto, effectiveOperation) {
+        if (!isZodObject(responseDto)) {
+            throw new Error(`Cannot build ${effectiveOperation} context DTO: collection response must be a pagination object`);
+        }
+        const responseShape = getZodObjectShape(responseDto);
+        const dataSchema = responseShape.data;
+        if (!dataSchema || !isZodArray(dataSchema)) {
+            throw new Error(`Cannot build ${effectiveOperation} context DTO: pagination response must contain a data array`);
+        }
+        const itemSchema = getZodDefSchemaProperty(dataSchema, 'element');
+        if (!itemSchema) {
+            throw new Error(`Cannot build ${effectiveOperation} context DTO: pagination data array has no item schema`);
+        }
+        return itemSchema;
+    }
     /**
      * Create request DTO for CREATE operations.
      *
@@ -567,11 +754,14 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         if (!isZodObject(schema)) {
             return schema;
         }
-        // Standard auto-generated fields to omit from create request DTOs
-        // Note: _id is handled via isPrimaryKey decorator which implies excludeFromCreate
-        // Primary scope fields (organizationId, userId, etc.) are auto-populated from context
-        // W7.3a: anonymousUserId is backend-injected from EC context, never client-supplied
-        const fieldsToOmit = ['id', 'createdAt', 'updatedAt', 'createdByUserId', 'organizationId', 'userId', 'applicationId', 'anonymousUserId'];
+        // Standard auto-generated fields to omit from create request DTOs.
+        // Note: _id is handled via isPrimaryKey decorator which implies excludeFromCreate.
+        // The context-auto-populated FKs (createdByUserId, organizationId, userId,
+        // applicationId, anonymousUserId — all backend-injected from the EC, never
+        // client-supplied) come from the shared CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS
+        // single source of truth so this omit list and the trusted-system-write
+        // re-attach allowlist (deriveTrustedSystemWritePreservedFields) never drift.
+        const fieldsToOmit = ['id', 'createdAt', 'updatedAt', ...CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS];
         try {
             const omitObj = {};
             const shape = getZodObjectShape(schema);
@@ -594,6 +784,11 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 if (isBackendOnlyField(fieldSchema)) {
                     omitObj[fieldName] = true;
                 }
+                // Exclude generated file fields - they are materialized by operations,
+                // not uploaded or supplied in client write payloads.
+                if (isTemplatableFileField(fieldSchema)) {
+                    omitObj[fieldName] = true;
+                }
                 // Exclude non-discriminator literals - they are auto-populated by backend
                 // Discriminator literals are KEPT for variant selection in CREATE forms
                 if (this.isNonDiscriminatorLiteral(fieldSchema)) {
@@ -603,13 +798,13 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             // If we have fields to omit, create omitted schema
             if (Object.keys(omitObj).length > 0) {
                 const omittedSchema = this.omitObjectFields(schema, omitObj);
-                return omittedSchema;
+                return this.stripTemplatableFileFieldsRecursively(omittedSchema);
             }
         }
         catch (error) {
             throw new Error(`Failed to create request DTO for CREATE: ${error instanceof Error ? error.message : String(error)}`);
         }
-        return schema;
+        return this.stripTemplatableFileFieldsRecursively(schema);
     }
     /**
      * Create request DTO for UPDATE operations.
@@ -628,30 +823,122 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             const discriminator = getZodDefStringProperty(mainSchema, 'discriminator');
             const options = getZodDefArrayProperty(mainSchema, 'options');
             if (discriminator && options && options.length > 0) {
-                // Apply omissions to each variant in the union
-                const modifiedOptions = options.map(option => this.applyUpdateOmissionsToSchema(option));
-                // Recreate discriminated union with modified variants
-                if (modifiedOptions.length >= 2) {
-                    return z.discriminatedUnion(discriminator, modifiedOptions);
-                }
-                else if (modifiedOptions.length === 1) {
-                    return modifiedOptions[0];
-                }
+                // PATCH semantics for an inheritance resource. Two hard constraints
+                // collide here and only a MERGED SUPERSET OBJECT satisfies both:
+                //
+                //   1. The persisted variant is IMMUTABLE and the repository applies a
+                //      partial `$set` (see `RepositoryResourceBackendService.update` →
+                //      `findOneAndUpdate({ $set })`). A caller therefore legitimately
+                //      sends only the fields it changes — e.g. an inline status
+                //      autosave submits `{ status }` with NO `recurringType`. A
+                //      discriminated union CANNOT express "discriminator optional":
+                //      Zod needs the key present to pick a branch, and a discriminator
+                //      `.default()` does NOT fire inside `z.discriminatedUnion`, so the
+                //      missing key fails with "No matching discriminator" (the exact
+                //      wonder-todos `todos` CHANGE_STATUS / inline-edit crash).
+                //   2. Variant-only fields (`recurrence` / `startDate` / `endsDate`)
+                //      must stay IN the contract — a bare base object would `z.object`-
+                //      strip them, silently dropping a partial update that touches a
+                //      variant field. Keeping every variant field is the whole reason
+                //      this DTO became a union in the first place.
+                //
+                // Collapsing the per-variant options into one object whose fields are
+                // all optional (the discriminator included) keeps every variant field
+                // reachable AND lets any partial subset validate without echoing the
+                // immutable discriminator. Variant/field coherence is enforced
+                // server-side against the merged persisted+patch object (the `$set`
+                // target already carries the true variant), NOT by the static request
+                // contract. CREATE keeps the discriminated union (see
+                // `createRequestDtoForCreate`) because on CREATE the client MUST choose
+                // a variant and variant-field validation applies.
+                return this.mergeUnionOptionsIntoOptionalUpdateObject(options, discriminator);
             }
         }
         // Regular object schema - apply omissions directly
         return this.applyUpdateOmissionsToSchema(mainSchema);
     }
     /**
-     * Check if a field is any kind of literal (discriminator or non-discriminator).
-     * All literals are excluded from UPDATE DTOs as they are immutable after creation.
+     * Collapse the per-variant options of an inheritance UPDATE discriminated
+     * union into a single object with PATCH semantics: every base + variant-only
+     * field present and optional, and the discriminator itself optional.
      *
-     * Handles wrapped types (optional, default, etc.) by unwrapping before type check.
+     * Each option is first run through {@link applyUpdateOmissionsToSchema}
+     * (which drops `excludeFromUpdate` / PK / virtual / backend-only / templatable
+     * file fields and optionalises every non-discriminator field), then the
+     * resulting shapes are merged. The discriminator — which
+     * `applyUpdateOmissionsToSchema` keeps required per-variant so the omission
+     * pass does not mistake it for an auto-populated literal — is replaced by a
+     * single OPTIONAL enum spanning every variant value, so a partial update may
+     * omit it entirely (the persisted variant is immutable) yet a full-object
+     * update that re-sends the current discriminator still validates.
+     *
+     * Nested inheritance (an option that is itself a union) is flattened
+     * recursively so deeply-nested variant fields are preserved too.
      */
-    static isLiteralField(fieldSchema) {
-        // Unwrap to handle z.literal("value").optional() etc.
+    static mergeUnionOptionsIntoOptionalUpdateObject(options, discriminatorField) {
+        const mergedShape = {};
+        const discriminatorValues = new Set();
+        const collectFromOption = (option) => {
+            // Flatten nested discriminated unions (multi-level inheritance).
+            if (getZodType(option) === 'union') {
+                const nestedOptions = getZodDefArrayProperty(option, 'options');
+                if (nestedOptions && nestedOptions.length > 0) {
+                    nestedOptions.forEach(collectFromOption);
+                    return;
+                }
+            }
+            const omitted = this.applyUpdateOmissionsToSchema(option);
+            if (!isZodObject(omitted)) {
+                return;
+            }
+            const shape = getZodObjectShape(omitted);
+            for (const [fieldName, fieldSchema] of Object.entries(shape)) {
+                if (fieldName === discriminatorField) {
+                    // Gather every variant value the discriminator can carry; the field
+                    // is rebuilt as one optional enum below.
+                    for (const value of this.extractDiscriminatorValues(fieldSchema)) {
+                        discriminatorValues.add(value);
+                    }
+                    continue;
+                }
+                // First writer wins: base fields are identical across variants and
+                // variant-only fields appear in exactly one option, so there is no
+                // meaningful collision to resolve. `applyUpdateOmissionsToSchema`
+                // already made every non-discriminator field optional.
+                if (!mergedShape[fieldName]) {
+                    mergedShape[fieldName] = fieldSchema;
+                }
+            }
+        };
+        options.forEach(collectFromOption);
+        if (discriminatorValues.size > 0) {
+            // Optional so a partial update may omit the immutable discriminator; the
+            // enum still accepts a re-sent current value from a full-object update.
+            mergedShape[discriminatorField] = z
+                .enum(Array.from(discriminatorValues))
+                .optional();
+        }
+        return z.object(mergedShape);
+    }
+    /**
+     * Extract the concrete discriminator value(s) a union-option's discriminator
+     * field can hold. Variant options carry a `z.literal(value)`; the base option
+     * carries a `z.enum([...baseValues])`. Both may be wrapped by the
+     * `isDiscriminator` decorator / `.default()` / `.optional()`, so unwrap first.
+     */
+    static extractDiscriminatorValues(fieldSchema) {
         const unwrapped = unwrapSchema(fieldSchema);
-        return getZodType(unwrapped) === 'literal';
+        const unwrappedType = getZodType(unwrapped);
+        if (unwrappedType === 'enum') {
+            return getEnumValues(unwrapped).map(String);
+        }
+        // Literal — Zod 4 stores value(s) in `def.values` (array); fall back to the
+        // legacy scalar `def.value`. Mirrors the literal read at `analyzeDtoSchema`.
+        const literalValues = (getZodDefArrayProperty(unwrapped, 'values')
+            ?? [getZodDefProperty(unwrapped, 'value')]);
+        return literalValues
+            .filter((value) => value !== undefined && value !== null)
+            .map(String);
     }
     /**
      * Apply UPDATE operation omissions to a single schema (object or other).
@@ -660,11 +947,13 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         if (!isZodObject(schema)) {
             return schema;
         }
-        // Standard auto-generated fields to omit from update request DTOs
-        // Note: Primary keys are passed as route params, not in request body
-        // Primary scope fields (organizationId, userId, etc.) are immutable after creation
-        // W7.3a: anonymousUserId is managed by transposition, never client-updatable
-        const fieldsToOmit = ['id', 'createdAt', 'updatedAt', 'createdByUserId', 'organizationId', 'userId', 'applicationId', 'anonymousUserId'];
+        // Standard auto-generated fields to omit from update request DTOs.
+        // Note: Primary keys are passed as route params, not in request body.
+        // The context-auto-populated FKs (immutable after creation; anonymousUserId
+        // is managed by transposition, never client-updatable) come from the shared
+        // CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS single source of truth so this omit
+        // list and the trusted-system-write re-attach allowlist stay in lockstep.
+        const fieldsToOmit = ['id', 'createdAt', 'updatedAt', ...CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS];
         try {
             const omitObj = {};
             const shape = getZodObjectShape(schema);
@@ -691,23 +980,59 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 if (isBackendOnlyField(fieldSchema)) {
                     omitObj[fieldName] = true;
                 }
-                // Exclude ALL literal fields - both discriminator and non-discriminator
-                // Literals are immutable after creation (discriminators define the variant,
-                // non-discriminators are fixed values)
-                if (this.isLiteralField(fieldSchema)) {
+                // Exclude generated file fields - explicit regenerate operations own
+                // refreshing them, so generic UPDATE payloads must not accept them.
+                if (isTemplatableFileField(fieldSchema)) {
+                    omitObj[fieldName] = true;
+                }
+                // Exclude NON-discriminator literals only — they are fixed values
+                // auto-populated by the backend and immutable after creation.
+                //
+                // Discriminator literals are KEPT: for an inheritance resource the
+                // UPDATE DTO is a discriminated union, and the discriminator must be
+                // present (and required) so Zod can select the variant and validate
+                // its variant-specific fields. Stripping it produced a structurally
+                // invalid discriminated union ("Invalid discriminated union option").
+                // The discriminator's immutability is enforced at the service layer
+                // (the update is rejected if it changes the variant), not by removing
+                // it from the request contract — which would silently drop every
+                // variant-only field from the payload.
+                if (this.isNonDiscriminatorLiteral(fieldSchema)) {
                     omitObj[fieldName] = true;
                 }
             }
-            // If we have fields to omit, create omitted schema
-            if (Object.keys(omitObj).length > 0) {
-                const omittedSchema = this.omitObjectFields(schema, omitObj);
-                return omittedSchema;
-            }
+            // Rebuild the shape with PATCH semantics: drop the omitted fields, then
+            // make every remaining field optional EXCEPT the discriminator. This
+            // mirrors the factory's `buildUpdateRequestDto` (partial update). The
+            // discriminator is left REQUIRED here only so this per-variant omission
+            // pass does not mistake it for an auto-populated literal and strip it —
+            // for an inheritance UPDATE the per-variant objects are then merged by
+            // `mergeUnionOptionsIntoOptionalUpdateObject`, which replaces the
+            // discriminator with a single OPTIONAL enum so partial updates may omit
+            // the immutable discriminator. (Without optionalizing the other fields
+            // every field would become mandatory, breaking partial updates for every
+            // resource.)
+            const updateShape = {};
+            for (const [fieldName, fieldSchema] of Object.entries(shape)) {
+                if (omitObj[fieldName]) {
+                    continue;
+                }
+                const strippedField = this.stripTemplatableFileFieldsRecursively(fieldSchema);
+                // Non-discriminator fields are optionalised for PATCH; `toPatchOptionalField`
+                // also peels any `.default()` so an omitted field is never re-materialized to
+                // its default and `$set` back over the stored value (the `attemptCount`-reset
+                // class of bug). The discriminator is kept as-is (required, default intact) so
+                // the union stays selectable — the merge pass replaces it with an optional enum.
+                updateShape[fieldName] = isDiscriminatorField(fieldSchema)
+                    ? strippedField
+                    : toPatchOptionalField(strippedField);
+            }
+            return z.object(updateShape);
         }
         catch (error) {
             throw new Error(`Failed to create request DTO for UPDATE: ${error instanceof Error ? error.message : String(error)}`);
         }
-        return schema;
+        return this.stripTemplatableFileFieldsRecursively(schema);
     }
     /**
      * Exclude virtual fields from a schema.
@@ -767,10 +1092,14 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
     /**
      * Create paginated response schema using shared pagination metadata schema
      */
-    static createPaginatedResponseSchema(dataSchema, maxResultsPerPageLimit = 50) {
+    static createPaginatedResponseSchema(dataSchema, maxResultsPerPageLimit = 100) {
         return z.object({
             data: z.array(dataSchema).max(maxResultsPerPageLimit),
-            pagination: Resouces_PaginationResponseMetadataSchema
+            // Bounded by the SAME ceiling as the data array beside it. Leaving this on the default-bounded
+            // constant is how a legitimately-served 120-row page still answered 500 after the array bound,
+            // the request bound and both repository maxima had been unified: `limit` echoes the page size
+            // actually served, so a stricter bound here rejects what the line above just permitted.
+            pagination: createPaginationResponseMetadataSchema(maxResultsPerPageLimit)
         });
     }
     /**
@@ -843,7 +1172,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 ops.forEach((operation, index) => {
                     totalOperations++;
                     const variantInfo = operation.variantType +
-                        (operation.isBulkOperation ? ' [BULK]' : '') +
+                        ('isBulkOperation' in operation && operation.isBulkOperation ? ' [BULK]' : '') +
                         (operation.isOperationDefault ? ' [DEFAULT]' : '') +
                         (operation.variantKey ? ` [${operation.variantKey}]` : '');
                     console.log(`     └─ Variant ${index + 1}: ${variantInfo}`);
@@ -1260,8 +1589,12 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 }
                 return `union(${optionCount} options)`;
             case 'literal':
-                const literalValue = getZodDefProperty(fieldSchema, 'value');
-                return `literal("${String(literalValue ?? 'unknown')}")`;
+                // Zod 4 stores literal value(s) in def.values (an array); the legacy Zod-3
+                // def.value is always undefined in v4, so reading it alone always rendered
+                // literal("unknown"). Read def.values first, fall back to def.value.
+                const literalValues = (getZodDefArrayProperty(fieldSchema, 'values') ?? [getZodDefProperty(fieldSchema, 'value')])
+                    .filter((entry) => entry !== undefined && entry !== null);
+                return `literal("${String(literalValues[0] ?? 'unknown')}")`;
             case 'any':
                 return 'any';
             case 'unknown':
@@ -1366,8 +1699,11 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         const mainSchemaOptions = [];
         // Add base schema for non-inherited values if specified
         if (withoutInheritanceDiscriminatorFieldValues && withoutInheritanceDiscriminatorFieldValues.length > 0) {
-            // Create enum for base discriminator values
-            const baseDiscriminatorEnum = z.enum(withoutInheritanceDiscriminatorFieldValues);
+            // Create enum for base discriminator values.
+            // Mark it with the isDiscriminator decorator so EVERY union option's
+            // discriminator field is uniformly recognized as a discriminator (and not
+            // mistaken for an auto-populated literal by the request-DTO omission logic).
+            const baseDiscriminatorEnum = addDiscriminator(z.enum(withoutInheritanceDiscriminatorFieldValues), { baseValues: withoutInheritanceDiscriminatorFieldValues });
             // Extend mainSchema with discriminator field
             const baseMainSchema = this.extendSchemaWithDiscriminator(mainSchema, discriminatorField, baseDiscriminatorEnum);
             mainSchemaOptions.push(baseMainSchema);
@@ -1375,8 +1711,14 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         // Process each inherited schema
         inheritedSchemas.forEach((inheritedItem) => {
             const { discriminatorFieldValue, schema: inheritedSchema } = inheritedItem;
-            // Create literal discriminator for this variant
-            const discriminatorLiteral = z.literal(discriminatorFieldValue);
+            // Create literal discriminator for this variant.
+            // It MUST carry the isDiscriminator decorator: `mergeInheritedSchema`
+            // overwrites the variant's discriminator field with this value, dropping
+            // the decorator `createSchemaFamily` originally applied. Without it, the
+            // request-DTO builder's `isNonDiscriminatorLiteral` check would strip the
+            // discriminator from CREATE/UPDATE DTOs, producing a structurally-invalid
+            // discriminated union (Zod: "Invalid discriminated union option").
+            const discriminatorLiteral = addDiscriminator(z.literal(discriminatorFieldValue), { baseValues: withoutInheritanceDiscriminatorFieldValues });
             // Merge inherited schema with base schema and add discriminator
             const mergedMainSchema = this.mergeInheritedSchema(mainSchema, inheritedSchema, discriminatorField, discriminatorLiteral);
             mainSchemaOptions.push(mergedMainSchema);
@@ -1630,8 +1972,9 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             }
         }
         const nestedFields = {};
+        const allResourceFieldIdentifiers = this.getAllResourceFieldIdentifiers(resourceRegistry);
         for (const rel of childRelationships) {
-            const compiledRel = Resources_SharedUtils.ensureCompiledRelationship(rel);
+            const compiledRel = Resources_SharedUtils.ensureCompiledRelationship(rel, allResourceFieldIdentifiers);
             const nestedConfig = Resources_SharedUtils.resolveRelationshipNestedMutationConfig(compiledRel, operation);
             if (!nestedConfig)
                 continue;
@@ -1665,8 +2008,9 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
      */
     static buildResponseDtoWithNested(baseDto, childRelationships, resourceRegistry) {
         const nestedFields = {};
+        const allResourceFieldIdentifiers = this.getAllResourceFieldIdentifiers(resourceRegistry);
         for (const rel of childRelationships) {
-            const compiledRel = Resources_SharedUtils.ensureCompiledRelationship(rel);
+            const compiledRel = Resources_SharedUtils.ensureCompiledRelationship(rel, allResourceFieldIdentifiers);
             const readConfig = Resources_SharedUtils.resolveRelationshipNestedReadConfig(compiledRel);
             if (!readConfig)
                 continue;
@@ -1682,6 +2026,97 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         }
         return this.extendObjectLikeDto(baseDto, nestedFields);
     }
+    /**
+     * Schema-guided value walk that locates every `.isWriteOnlySecret()` field in
+     * a runtime object and hands the holding object + field name to `visitSecret`.
+     *
+     * Mirrors the unwrap/recursion structure of {@link stripBackendOnlyFields} but
+     * operates on VALUES, not schemas. It mutates in place (callers pass a freshly
+     * `.parse()`'d body or a to-be-validated input, both safe to mutate). For
+     * discriminated unions it recurses EVERY variant against the single value —
+     * safe because both leaf actions (mask/strip) are guarded (mask only a present
+     * value; strip only the exact sentinel), so fields belonging to a non-matching
+     * variant are simply absent and no-op.
+     */
+    static walkWriteOnlySecretValues(schema, value, visitSecret) {
+        if (value === null || value === undefined) {
+            return;
+        }
+        // Unwrap optional / nullable / default wrappers — same value, inner schema.
+        if (isZodOptional(schema) || hasZodType(schema, 'nullable') || isZodDefault(schema)) {
+            const innerSchema = getZodDefProperty(schema, 'innerType');
+            if (innerSchema) {
+                this.walkWriteOnlySecretValues(innerSchema, value, visitSecret);
+            }
+            return;
+        }
+        // Unions (incl. discriminated) — recurse every object variant.
+        if (getZodType(schema) === 'union') {
+            const unionOptions = getZodDefArrayProperty(schema, 'options');
+            if (unionOptions) {
+                for (const option of unionOptions) {
+                    this.walkWriteOnlySecretValues(option, value, visitSecret);
+                }
+            }
+            return;
+        }
+        // Arrays — recurse each element against the element schema.
+        if (isZodArray(schema) && Array.isArray(value)) {
+            const elementSchema = getZodDefProperty(schema, 'element');
+            if (elementSchema) {
+                for (const item of value) {
+                    this.walkWriteOnlySecretValues(elementSchema, item, visitSecret);
+                }
+            }
+            return;
+        }
+        // Objects — visit write-only-secret fields, recurse the rest.
+        if (isZodObject(schema) && typeof value === 'object' && !Array.isArray(value)) {
+            const shape = getZodObjectShape(schema);
+            const holder = value;
+            for (const [fieldName, fieldSchema] of Object.entries(shape)) {
+                if (isWriteOnlySecretField(fieldSchema)) {
+                    visitSecret(holder, fieldName);
+                }
+                else {
+                    this.walkWriteOnlySecretValues(fieldSchema, holder[fieldName], visitSecret);
+                }
+            }
+        }
+    }
+    /**
+     * Redact every `.isWriteOnlySecret()` field in a client-facing response body to
+     * {@link WRITE_ONLY_SECRET_MASK}. Applied at the client-serialization boundary
+     * ONLY (`serializeOperationResultForResponse`), never at the service dispatch /
+     * `transformOutput` tier — internal reads (`readAsSystem`, repository
+     * `read<T>()`) must keep the real value so backend consumers (e.g. a webhook
+     * signer) can use it. Returns the same (mutated) value for call-site ergonomics.
+     */
+    static maskWriteOnlySecretFields(schema, value) {
+        this.walkWriteOnlySecretValues(schema, value, (holder, fieldName) => {
+            const current = holder[fieldName];
+            if (current !== null && current !== undefined && current !== '') {
+                holder[fieldName] = WRITE_ONLY_SECRET_MASK;
+            }
+        });
+        return value;
+    }
+    /**
+     * Strip any `.isWriteOnlySecret()` field whose incoming value equals the
+     * {@link WRITE_ONLY_SECRET_MASK} sentinel from a CREATE/UPDATE input payload.
+     * A client that renders the masked read value and submits it unchanged sends
+     * the sentinel back; removing the field means the stored secret is preserved
+     * (UPDATE is a partial `$set`). A genuinely new secret value is left intact.
+     * Returns the same (mutated) value.
+     */
+    static stripWriteOnlySecretSentinel(schema, value) {
+        this.walkWriteOnlySecretValues(schema, value, (holder, fieldName) => {
+            if (holder[fieldName] === WRITE_ONLY_SECRET_MASK) {
+                delete holder[fieldName];
+            }
+        });
+        return value;
+    }
     /**
      * Strip fields marked with isBackendOnly decorator from schema.
      *
@@ -1707,25 +2142,39 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             }
             return schema;
         }
-        // Handle arrays - strip from array element schema
+        // Handle arrays - strip from array element schema.
+        // `withArrayElement` rather than `z.array(...)`: a fresh array carries none of the original's
+        // own `.min()` / `.max()` / `.length()` checks, which would silently drop an authored
+        // collection-size constraint from the response contract.
         if (isZodArray(schema)) {
             // ZodArray stores element schema in _def.element (not _def.type)
             const elementSchema = getZodDefProperty(schema, 'element');
-            return z.array(this.stripBackendOnlyFields(elementSchema, options));
+            return withArrayElement(schema, this.stripBackendOnlyFields(elementSchema, options));
         }
         // Handle optional/nullable/default wrappers - unwrap, strip, rewrap
         if (isZodOptional(schema)) {
             const innerSchema = getZodDefProperty(schema, 'innerType');
-            return this.stripBackendOnlyFields(innerSchema, options).optional();
+            return this.preserveSchemaMetadata(schema, this.stripBackendOnlyFields(innerSchema, options).optional());
         }
         if (hasZodType(schema, 'nullable')) {
             const innerSchema = getZodDefProperty(schema, 'innerType');
-            return this.stripBackendOnlyFields(innerSchema, options).nullable();
+            return this.preserveSchemaMetadata(schema, this.stripBackendOnlyFields(innerSchema, options).nullable());
         }
         if (isZodDefault(schema)) {
             const innerSchema = getZodDefProperty(schema, 'innerType');
-            const defaultValue = getZodDefProperty(schema, 'defaultValue');
-            return this.stripBackendOnlyFields(innerSchema, options).default(defaultValue);
+            // ⚠️ Re-READ the default per parse, never carry a value across.
+            //
+            // In Zod 4 `def.defaultValue` is a GETTER: reading it EVALUATES the default
+            // (`z.date().default(() => new Date())` yields a fresh Date on every read).
+            // A DTO is rebuilt ONCE, when the resource configuration is built at process
+            // start — so `.default(<value read here>)` freezes that instant into every
+            // parse the process ever performs. Recovered 2026-08-11: lifecycle rows were
+            // persisting `stageEnteredAt` / `lastActiveAt` stamped at backend boot,
+            // identical to the millisecond across rows created a minute apart.
+            //
+            // Passing a FUNCTION makes Zod evaluate per parse. A literal default is
+            // unaffected — the getter simply returns the same value each time.
+            return this.preserveSchemaMetadata(schema, this.stripBackendOnlyFields(innerSchema, options).default(() => getZodDefProperty(schema, 'defaultValue')));
         }
         // Handle objects - strip backend-only fields from shape
         if (isZodObject(schema)) {
@@ -1765,19 +2214,23 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         return schema;
     }
     /**
-     * Transform z.date() → z.coerce.date() recursively for API/WebSocket/Queue DTOs.
+     * Transform network-boundary leaves recursively for API/WebSocket/Queue DTOs:
+     * `z.date()` → string-accepting `z.coerce.date()`, and `z.bigint()` (notably
+     * `z_money`'s `amount`) → a string-accepting bigint (see
+     * {@link applyNetworkBoundaryCoercion} for why money bigints arrive as strings).
      *
      * This utility is used to create schemas suitable for parsing API responses/requests
-     * where dates come as ISO strings and need to be coerced to Date objects.
+     * where dates come as ISO strings and money amounts come as numeric strings, both of
+     * which need to be coerced back to their runtime types (Date / bigint).
      *
      * Use this when parsing data from:
-     * - HTTP API responses (JSON with date strings)
+     * - HTTP API responses (JSON with date strings and bigint-as-string money amounts)
      * - WebSocket messages
      * - Queue messages
-     * - Any external data source where dates are serialized as strings
+     * - Any external data source where dates/bigints are serialized as strings
      *
-     * @param schema - Schema to transform (typically a database/internal schema with z.date())
-     * @returns New schema with coerced dates (z.coerce.date()) suitable for API parsing
+     * @param schema - Schema to transform (typically a database/internal schema with z.date()/z.bigint())
+     * @returns New schema with coerced dates + bigints suitable for API parsing
      *
      * @example
      * ```typescript
@@ -1792,22 +2245,57 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
      * ```
      */
     static createApiParsingSchema(schema) {
-        return this.applyDateCoercion(schema);
+        return this.applyNetworkBoundaryCoercion(schema);
     }
     /**
-     * Transform z.date() → z.coerce.date() recursively for API/WebSocket/Queue DTOs.
+     * Recursively transpose the two network-boundary leaf types that do NOT survive
+     * a JSON round-trip as their runtime type — `z.date()` and `z.bigint()` — into
+     * string-accepting forms, walking union / array / optional / nullable / default /
+     * object wrappers so nested and optional leaves are covered identically.
+     *
+     * This is the INBOUND (coerce, string → runtime type) half of the network-boundary
+     * contract. Its OUTBOUND (serialize, runtime type → wire string) counterpart is
+     * `Date.prototype.toJSON` (built-in) for dates and `BigInt.prototype.toJSON`
+     * (installed by `installBigIntJsonEncoding` in `@wildo-ai/zod-decorators`) for
+     * money bigints. Because the SAME coerced `responseDto`/`requestDto` this produces
+     * is parsed on BOTH sides, the backend serialize-parse, the frontend
+     * receive-parse, and worker queue re-hydration all coerce identically. See the
+     * full mechanism map in `install-bigint-json-encoding.ts`.
      *
-     * @param schema - Schema to transform
-     * @returns New schema with coerced dates
+     * **Why `z.bigint()` needs this (the `z_money` case).** `z_money().amount` is a
+     * `z.bigint()`. The Zod→Mongoose convertor persists bigint as a Mongoose **String**
+     * column (with a `v → BigInt(v)` getter), but reads go through `.lean()` /
+     * `toObject` WITHOUT `{ getters: true }`, so the value that reaches the DTO layer
+     * is the raw **string** (e.g. `"1999"`), and over the JSON wire a bigint is always
+     * serialized as a string too. A strict `z.bigint().parse("1999")` then throws
+     * `expected bigint, received string` in the service-layer `transformOutput`. This
+     * pass rewrites every `z.bigint()` leaf to first coerce a string to `BigInt`, so
+     * the same strict schema now accepts the on-wire/from-DB string form. It mirrors
+     * the `z.date()` → `z.coerce.date()` transposition exactly — both are "the runtime
+     * type does not round-trip through JSON, accept its string form on read" fixes.
+     *
+     * The bigint leaf is wrapped with `z.preprocess` over the ORIGINAL schema (rather
+     * than a fresh `z.coerce.bigint()`) specifically to **preserve any `.min()`/`.max()`
+     * checks** — e.g. `z_money({ minAmount: 0n })` compiles to `z.bigint().min(0n)`,
+     * whose non-negativity check must survive the coercion. `z.coerce.bigint()` would
+     * silently drop those checks; preprocessing the untouched schema keeps them intact.
+     *
+     * z_money field coverage this pass restores (each parses after coercion):
+     * `prices.unitPrice`, `prices.tiers[].unitPrice`, `prices.tiers[].flatPrice`
+     * (array-nested), `invoiceRefs.total`, `promotions.discountFixedAmount` (optional),
+     * `productDefinitions.unitPrice`.
+     *
+     * @param schema - Schema to transform (typically a database/internal schema with z.date()/z.bigint())
+     * @returns New schema with coerced dates + string-accepting bigints
      */
-    static applyDateCoercion(schema) {
+    static applyNetworkBoundaryCoercion(schema) {
         // Handle discriminated unions - transform dates in all variants
         const zodType = getZodType(schema);
         if (zodType === 'union') {
             const discriminator = getZodDefStringProperty(schema, 'discriminator');
             const unionOptions = getZodDefArrayProperty(schema, 'options');
             if (discriminator && unionOptions && unionOptions.length > 0) {
-                const transformedOptions = unionOptions.map((option) => this.applyDateCoercion(option));
+                const transformedOptions = unionOptions.map((option) => this.applyNetworkBoundaryCoercion(option));
                 if (transformedOptions.length >= 2) {
                     return z.discriminatedUnion(discriminator, transformedOptions);
                 }
@@ -1817,39 +2305,69 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             }
             return schema;
         }
-        // Handle arrays - transform dates in array element schema
+        // Handle arrays - transform dates in array element schema.
+        // `withArrayElement` rather than `z.array(...)`: this walk runs over EVERY operation DTO,
+        // including an author-supplied `requestDto`, so rebuilding bare here is what stripped
+        // authored `.min()` / `.max()` constraints out of request validation.
         if (isZodArray(schema)) {
             // ZodArray stores element schema in _def.element (not _def.type)
             const elementSchema = getZodDefProperty(schema, 'element');
-            return z.array(this.applyDateCoercion(elementSchema));
+            return withArrayElement(schema, this.applyNetworkBoundaryCoercion(elementSchema));
         }
         // Handle optional/nullable/default wrappers - unwrap, transform, rewrap
         if (isZodOptional(schema)) {
             const innerSchema = getZodDefProperty(schema, 'innerType');
-            return this.applyDateCoercion(innerSchema).optional();
+            return this.preserveSchemaMetadata(schema, this.applyNetworkBoundaryCoercion(innerSchema).optional());
         }
         if (hasZodType(schema, 'nullable')) {
             const innerSchema = getZodDefProperty(schema, 'innerType');
-            return this.applyDateCoercion(innerSchema).nullable();
+            return this.preserveSchemaMetadata(schema, this.applyNetworkBoundaryCoercion(innerSchema).nullable());
         }
         if (isZodDefault(schema)) {
             const innerSchema = getZodDefProperty(schema, 'innerType');
-            const defaultValue = getZodDefProperty(schema, 'defaultValue');
-            return this.applyDateCoercion(innerSchema).default(defaultValue);
+            // Per-parse re-read — see the note on the `stripBackendOnlyFields` default
+            // branch: a materialized default freezes at DTO-build time (process start).
+            return this.preserveSchemaMetadata(schema, this.applyNetworkBoundaryCoercion(innerSchema).default(() => getZodDefProperty(schema, 'defaultValue')));
         }
-        // Handle pipe/refine - unwrap, transform, rewrap
+        // Handle pipe/refine chains (`.transform()` / `.refine()` — e.g. `z_phone()`,
+        // which is `z.string().transform(...).refine(...).transform(...)`, or a bare
+        // `z.coerce.date()`). Return the schema UNCHANGED.
+        //
+        // Rationale: a pipe/refine chain is an opaque validation+normalization pipeline
+        // over a primitive. Framework `z.date()` leaves NEVER live inside such a chain —
+        // dates are only ever wrapped in optional/nullable/default/array/object/union —
+        // so there is nothing for date-coercion to rewrite here.
+        //
+        // Rejected alternative (the prior implementation): unwrap the inner schema,
+        // coerce it, and return that inner. This is doubly wrong — (1) in Zod 4 the pipe
+        // input lives at `def.in`, not the Zod-3-era `def.schema`, so the unwrap read
+        // `undefined` and any surrounding `.optional()/.nullable()/.default()` then
+        // crashed with "Cannot read properties of undefined (reading 'optional')" the
+        // moment a pipe field (e.g. `z_phone().optional()`) reached this branch; and
+        // (2) even reading `def.in` correctly, returning the bare inner would silently
+        // DROP the pipe's transform/refine steps (e.g. `z_phone`'s E.164 normalization
+        // and validation) from every request/response/summary DTO. Preserving the whole
+        // pipe atomically is the only semantically-faithful behavior.
         if (hasZodType(schema, 'pipe') || hasZodType(schema, 'refine')) {
-            const innerSchema = getZodDefProperty(schema, 'schema');
-            const transformed = this.applyDateCoercion(innerSchema);
-            // Reapply pipe/refine - this is complex, for now just transform inner schema
-            // Full pipe/refine preservation would require extracting all pipe steps
-            return transformed;
+            return schema;
         }
         // Handle date - transform to coerce.date
         if (hasZodType(schema, 'date')) {
             // Always transform to coerce.date for DTOs (API/WebSocket/Queue communication)
             // This allows string dates from JSON to be coerced to Date objects
-            return z.coerce.date();
+            return this.preserveSchemaMetadata(schema, z.coerce.date());
+        }
+        // Handle bigint - accept the on-wire/from-DB string form and coerce to bigint.
+        //
+        // z_money's `amount` is a z.bigint(); bigint never round-trips through JSON as a
+        // bigint (it serializes as a string) and the Mongoose String-backed storage + a
+        // getterless .lean()/toObject read also yield the raw string. Wrapping the
+        // ORIGINAL schema in z.preprocess (instead of z.coerce.bigint()) preserves any
+        // .min()/.max() checks compiled from z_money({ minAmount/maxAmount }). Non-string
+        // inputs pass through untouched so an in-process bigint stays a bigint and any
+        // genuinely-wrong type is still reported by the underlying strict bigint schema.
+        if (hasZodType(schema, 'bigint')) {
+            return this.preserveSchemaMetadata(schema, z.preprocess((value) => (typeof value === 'string' ? BigInt(value) : value), schema));
         }
         // Handle objects - transform dates in shape
         if (isZodObject(schema)) {
@@ -1857,7 +2375,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             const transformedShape = {};
             let didTransformAnyField = false;
             for (const [fieldName, fieldSchema] of Object.entries(shape)) {
-                const transformedFieldSchema = this.applyDateCoercion(fieldSchema);
+                const transformedFieldSchema = this.applyNetworkBoundaryCoercion(fieldSchema);
                 transformedShape[fieldName] = transformedFieldSchema;
                 didTransformAnyField = didTransformAnyField || transformedFieldSchema !== fieldSchema;
             }
@@ -1907,11 +2425,13 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             }
             return schema;
         }
-        // Handle arrays - extract summary from array element schema
+        // Handle arrays - extract summary from array element schema.
+        // `withArrayElement` rather than `z.array(...)`, for the same reason as the two walkers above:
+        // a fresh array carries none of the original's own `.min()` / `.max()` / `.length()` checks.
         if (isZodArray(schema)) {
             // ZodArray stores element schema in _def.element (not _def.type)
             const elementSchema = getZodDefProperty(schema, 'element');
-            return z.array(this.extractSummaryFields(elementSchema));
+            return withArrayElement(schema, this.extractSummaryFields(elementSchema));
         }
         // Handle optional/nullable/default wrappers - unwrap, extract, rewrap
         if (isZodOptional(schema)) {
@@ -1924,18 +2444,25 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         }
         if (isZodDefault(schema)) {
             const innerSchema = getZodDefProperty(schema, 'innerType');
-            const defaultValue = getZodDefProperty(schema, 'defaultValue');
-            return this.extractSummaryFields(innerSchema).default(defaultValue);
+            // Per-parse re-read — see the note on the `stripBackendOnlyFields` default
+            // branch: a materialized default freezes at DTO-build time (process start).
+            return this.extractSummaryFields(innerSchema).default(() => getZodDefProperty(schema, 'defaultValue'));
         }
         // Handle objects - use ResourcesSummaryUtils.deriveSummarySchema
         if (isZodObject(schema)) {
             try {
-                const summarySchema = ResourcesSummaryUtils.deriveSummarySchema(schema, {
+                // Pure summary-field extraction — NO network-boundary coercion here.
+                // Network-boundary transposition (z.date() → z.coerce.date() AND
+                // string-accepting z.bigint() for z_money amounts) is applied UNIFORMLY by
+                // the caller (`buildAllOperationDtos`) over the fully-resolved summary
+                // schema, mirroring how requestDto/responseDto/internalDto are coerced.
+                // Coercing per-branch here is what let the discriminated-union branch (and
+                // the no-summary-fields fallback) silently ship strict z.date()/z.bigint()
+                // summary DTOs that reject ISO-string dates / bigint-as-string amounts.
+                return ResourcesSummaryUtils.deriveSummarySchema(schema, {
                     includeId: true,
                     includeForeignKeys: false
                 });
-                // Apply date coercion to summary schema
-                return this.applyDateCoercion(summarySchema);
             }
             catch (error) {
                 throw new Error(`Failed to derive summary schema for object: ${error instanceof Error ? error.message : String(error)}`);
@@ -1988,6 +2515,10 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 continue;
             }
             const fieldName = this.getRelationshipObjectFieldName(relationship, relationship.resourceType2, relationship.cardinality2, registry);
+            // DTO context placeholders are projection conveniences, not transport
+            // addressability proof. Keep this broader than context-addressed mutation
+            // eligibility: URL/backend/frontend runtime predicates separately require
+            // composition nature, explicit FK metadata, and routing scope.
             const isOneToOne = isOneToOneCardinality(relationship.cardinality2);
             // Only add if field doesn't already exist (avoid conflicts)
             if (!shape[fieldName]) {
@@ -2018,16 +2549,47 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
      * @param dtoSchema - DTO schema (with z.coerce.date() fields)
      * @returns Transformed object with Date objects
      */
+    /**
+     * Unwrap the pure field-MODIFIER wrappers (`optional` / `nullable` / `default`) to
+     * reach the underlying schema, so a wrapped date field is still detected as a date
+     * and a wrapped nested object/array is still recursed into.
+     *
+     * WHY: without this, `z.date().optional()` reports type `'optional'` (not `'date'`),
+     * so its string value was never coerced to a `Date`, and an `.optional()`-wrapped
+     * object was treated as a leaf. Nested/optional date fields — notably the collection
+     * filter date ranges `{ startDate, endDate }` built on `z.date()` (NOT
+     * `z.coerce.date()`) — therefore reached the DTO parse as strings and threw
+     * `z.date()` validation. Stackable modifiers (`z.date().nullable().default()`) are
+     * peeled in a bounded loop.
+     *
+     * DELIBERATELY does NOT unwrap `pipe` / `transform` / `readonly` / `catch`: those can
+     * change the value's meaning (input vs output side), so treating their output schema
+     * as their input would mis-coerce. They stay leaves exactly as before. (`z.coerce.date()`
+     * reports type `'date'` directly, so it needs no unwrapping and keeps working.)
+     */
+    static unwrapDateModifierWrappers(schema) {
+        let current = schema;
+        while (isZodOptional(current) || isZodNullable(current) || isZodDefault(current)) {
+            const inner = getZodDefSchemaProperty(current, 'innerType');
+            if (!inner)
+                break;
+            current = inner;
+        }
+        return current;
+    }
     static transformRequestDates(data, dtoSchema) {
         if (!data || typeof data !== 'object') {
             return data;
         }
+        // See through modifier wrappers so a wrapped array/object schema is still handled
+        // (e.g. `z.array(...).optional()`, an `.optional()` nested object).
+        const schema = this.unwrapDateModifierWrappers(dtoSchema);
         // Handle arrays
         if (Array.isArray(data)) {
-            const zodType = getZodType(dtoSchema);
+            const zodType = getZodType(schema);
             if (zodType === 'array') {
                 // ZodArray stores element schema in _def.element (not _def.type)
-                const elementSchema = getZodDefProperty(dtoSchema, 'element');
+                const elementSchema = getZodDefProperty(schema, 'element');
                 if (elementSchema) {
                     return data.map(item => this.transformRequestDates(item, elementSchema));
                 }
@@ -2035,26 +2597,23 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             return data;
         }
         // Handle objects
-        if (isZodObject(dtoSchema)) {
-            const shape = getZodObjectShape(dtoSchema);
+        if (isZodObject(schema)) {
+            const shape = getZodObjectShape(schema);
             const transformed = {};
             for (const [key, value] of Object.entries(data)) {
                 const fieldSchema = shape[key];
                 if (fieldSchema) {
-                    // Check if field is a date (coerced or regular)
-                    const zodType = getZodType(fieldSchema);
-                    if (zodType === 'date' || hasZodType(fieldSchema, 'date')) {
-                        // Transform string to Date
-                        if (typeof value === 'string') {
-                            transformed[key] = new Date(value);
-                        }
-                        else {
-                            transformed[key] = value;
-                        }
+                    // Unwrap modifier wrappers, then check if the underlying field is a date
+                    // (`z.date()` / `z.coerce.date()`, incl. `.optional()` / `.nullable()` /
+                    // `.default()` around them).
+                    const unwrappedField = this.unwrapDateModifierWrappers(fieldSchema);
+                    if (getZodType(unwrappedField) === 'date') {
+                        // Transform string to Date; leave existing Dates (and non-strings) alone.
+                        transformed[key] = typeof value === 'string' ? new Date(value) : value;
                     }
                     else {
-                        // Recursively transform nested objects/arrays
-                        transformed[key] = this.transformRequestDates(value, fieldSchema);
+                        // Recursively transform nested objects/arrays (through their wrappers).
+                        transformed[key] = this.transformRequestDates(value, unwrappedField);
                     }
                 }
                 else {
@@ -2069,6 +2628,15 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
      * Transform object dates from Date objects to ISO strings (for outgoing responses).
      * Uses DTO schema to identify which fields are dates.
      *
+     * NO `transformResponseBigints` twin exists, BY DESIGN. This is date-specific
+     * in-body normalization; the money-`bigint` leaf (the other network-boundary type)
+     * is NOT normalized in the body — it stays a `bigint` in the serialized body and is
+     * encoded to a decimal string at the JSON boundary by `BigInt.prototype.toJSON`
+     * (`installBigIntJsonEncoding`, `@wildo-ai/zod-decorators`). A parallel body-walk for
+     * bigint would be redundant with that `toJSON`. (Indeed, since `Date.prototype.toJSON`
+     * also exists, this date walk is itself now largely belt-and-suspenders — kept as-is,
+     * not extended.) Full mechanism map: `install-bigint-json-encoding.ts`.
+     *
      * @param data - Object to transform
      * @param dtoSchema - DTO schema (with z.coerce.date() fields)
      * @returns Transformed object with ISO string dates
@@ -2154,12 +2722,12 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         // For default operations with dataMode specified, select and wrap appropriately
         if (effectiveDataMode === DataMode.SUMMARY && operation.summaryDto) {
             return isListOrSearch
-                ? this.wrapInPaginationStructure(operation.summaryDto)
+                ? this.wrapInPaginationStructure(operation.summaryDto, operation.maxPaginatedResultPerPageLimit)
                 : operation.summaryDto;
         }
         if (effectiveDataMode === DataMode.CONTEXT && operation.contextDto) {
             return isListOrSearch
-                ? this.wrapInPaginationStructure(operation.contextDto)
+                ? this.wrapInPaginationStructure(operation.contextDto, operation.maxPaginatedResultPerPageLimit)
                 : operation.contextDto;
         }
         // Default to responseDto for RAW mode or when specific DTOs are not available
@@ -2170,11 +2738,108 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
      * @param itemSchema - Schema for individual items
      * @returns Pagination wrapper schema
      */
-    static wrapInPaginationStructure(itemSchema) {
+    static wrapInPaginationStructure(itemSchema, maxResultsPerPageLimit) {
         return z.object({
             data: z.array(itemSchema),
-            pagination: Resouces_PaginationResponseMetadataSchema
+            // The operation's ceiling, like every other pagination bound in the framework. `limit` echoes
+            // the page size that was SERVED, so a bound stricter than the repository's turns a valid page
+            // into a 500 — which is exactly what a hard-coded 100 here did to an operation declaring 200.
+            pagination: createPaginationResponseMetadataSchema(maxResultsPerPageLimit)
         });
     }
 }
-//# sourceMappingURL=resources-config-operations.dtos-builder.utils.js.map
+/**
+ * Derive the re-attach allowlist for a TRUSTED, in-process system write.
+ *
+ * The repository strict-parses every create/update against a client-shaped
+ * request DTO that DROPS three classes of field: `.isBackendOnly()` fields, the
+ * context-auto-populated FKs (`CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS`, stripped
+ * by name), and the verb-excluded fields (`.excludeFromCreate()` on CREATE /
+ * `.excludeFromUpdate()` on UPDATE). On the HTTP path those are re-supplied AFTER
+ * the strip — backend-only material never comes from the client, the context FKs
+ * are injected from the URL-derived context / initiator identity by
+ * `enrichDataWithContext`, and a client is simply not allowed to author the
+ * verb-excluded fields (the server owns them).
+ *
+ * An in-process caller writing to a system resource has NEITHER context: the
+ * payload IS the source of truth. Registration creating `USER_CREDENTIALS` with
+ * `{ userId, passwordHash }` needs the FK + backend-only field to survive; an
+ * OIDC re-login bumping an identity link's `.excludeFromUpdate()` `lastUsedAt`
+ * needs the verb-excluded field to survive. Without help, the strip silently
+ * drops them → a required-path Mongoose crash or silent data loss.
+ *
+ * This function returns exactly the subset of `payloadKeys` the strip would drop
+ * for one of those legitimate reasons, so the trusted-write primitives
+ * (`SystemAccessBackendService.createAsSystem` / `updateAsSystem` /
+ * `updateManyAsSystem`) can forward it as `options.preserveServerInjectedFields`
+ * and have the repository re-attach the values after the strip. Ordinary fields
+ * are deliberately excluded — they parse normally, so re-attaching them would
+ * bypass their own validation.
+ *
+ * PER-VERB EXCLUDE SEMANTICS (the `verb` argument):
+ *   - UPDATE / UPDATE_MANY: re-attach every `.excludeFromUpdate()` key the caller
+ *     authored. UPDATE is a partial `$set` (no default application), so an
+ *     explicitly-authored value is authoritative — this is the path that lets a
+ *     server-managed timestamp like `lastUsedAt` actually advance.
+ *   - CREATE: re-attach an `.excludeFromCreate()` key the caller authored ONLY
+ *     when the field has NO `.default()`. A defaulted excludeFromCreate field
+ *     (`createdAt`, `linkedAt`, …) is server-owned at creation and the
+ *     strip-then-default path is the intended source of truth; re-attaching a
+ *     caller value would let stale input clobber the fresh default. A caller with
+ *     a genuine need to override a defaulted field can still pass an explicit
+ *     `preserveServerInjectedFields`.
+ *
+ * The mandatory-discard fields (`_id` / `createdAt` / `updatedAt` / `deletedAt` /
+ * `_version_db_doc`) are NEVER re-attached — they are force-removed before
+ * validation and are unconditionally server-owned. This guard is what keeps the
+ * UPDATE branch (which would otherwise match `.excludeFromUpdate()` `createdAt` /
+ * `updatedAt`) honest.
+ *
+ * ANTI-SMUGGLING: this is safe ONLY because the primitives are reachable exclusively
+ * from trusted engine code behind a fail-closed `systemAccessPolicy` opt-in — never
+ * from an HTTP payload. Do NOT call this to re-attach fields from an untrusted
+ * request; that would re-open the exact hole the strict parse closes.
+ *
+ * Polymorphic-safe: `getMergedObjectOrUnionShape` merges discriminated-union
+ * variants and returns `{}` for a non-object schema (in which case only the
+ * name-based context-FK detection applies — still correct for scope/audit FKs).
+ *
+ * @param mainSchema  The resource's main Zod schema.
+ * @param payloadKeys The keys actually present on the trusted write payload.
+ * @param verb        The write verb — selects `.excludeFromCreate()` vs
+ *                    `.excludeFromUpdate()` detection (UPDATE_MANY ≡ UPDATE). The
+ *                    write is always one of these, so the caller always knows it.
+ * @returns The subset of `payloadKeys` that are backend-only, context-auto-populated,
+ *          or a legitimately-authored verb-excluded field.
+ */
+export function deriveTrustedSystemWritePreservedFields(mainSchema, payloadKeys, verb) {
+    const backendOnlyFieldNames = new Set();
+    // Verb-excluded fields the client-shaped DTO strips but a TRUSTED caller may
+    // legitimately author (see PER-VERB EXCLUDE SEMANTICS above).
+    const verbExcludedFieldNames = new Set();
+    const shape = getMergedObjectOrUnionShape(mainSchema);
+    for (const [fieldName, fieldSchema] of Object.entries(shape)) {
+        if (isBackendOnlyField(fieldSchema)) {
+            backendOnlyFieldNames.add(fieldName);
+        }
+        if (verb === CoreResourceOperation.CREATE) {
+            // Defaulted excludeFromCreate fields are server-materialised at creation —
+            // withhold them so the schema default wins over any (potentially stale) input.
+            if (isExcludedFromCreate(fieldSchema) && !isZodDefault(fieldSchema)) {
+                verbExcludedFieldNames.add(fieldName);
+            }
+        }
+        else if (verb === CoreResourceOperation.UPDATE || verb === CoreResourceOperation.UPDATE_MANY) {
+            if (isExcludedFromUpdate(fieldSchema)) {
+                verbExcludedFieldNames.add(fieldName);
+            }
+        }
+    }
+    return payloadKeys.filter((key) => 
+    // Never resurrect a mandatory-discard field (force-removed pre-validation).
+    !createOrUpdateMandatoryDiscardFields.includes(key)
+        && (backendOnlyFieldNames.has(key)
+            || verbExcludedFieldNames.has(key)
+            || CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS.includes(key)));
+}
+//# sourceMappingURL=resources-config-operations.dtos-builder.utils.js.map