@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/notifications/email/email-template.shared.enums.js

@@ -0,0 +1,164 @@
+/**
+ * Email Template Classification Enums
+ *
+ * Surviving classification vocabulary for the **file-based** email template
+ * pipeline. These enums classify a template's runtime intent — not a database
+ * row. Post-Step-4 (`email-templates-deprecate-db-backed.md`), the DB-backed
+ * `EMAIL_TEMPLATES` `CoreResourceType` was removed end-to-end and the runtime
+ * sender pipeline reads templates exclusively from the filesystem registry
+ * (`EmailTemplateRegistryBackendService` + `scanEmailTemplateDirectory`).
+ *
+ * ## Why this file exists separately from `email-template.shared.schemas.ts`
+ *
+ * Step 6 of the deprecation plan split these enums out of the DB-backed
+ * `EmailTemplateSchema` file **before** deleting that file. The split was
+ * required because consumers of these enums survive the schema deletion:
+ *
+ * - `email-template-registry.shared.schemas.ts` declares
+ *   `SystemEmailTemplateDefinition` and the `SystemEmailTemplateRegistry` map
+ *   keyed by `EmailTemplateType` / `EmailTemplateFrequency` / `EmailTemplateScope`.
+ * - `engine/saas-backend-lib/src/notifications/email/models/email-template-definition.ts`
+ *   types `EmailTemplateDefinition<L>.type?` as `EmailTemplateType`.
+ * - The runtime sender pipeline (`EmailBackendService`) routes to a provider
+ *   via `EmailTemplateType_ToEngineCapability[type]`.
+ * - The auth services (`auth-registration`, `auth-password-reset`,
+ *   `authentication-controller`) and the dispatcher
+ *   (`notifications-dispatcher.backend.service`) emit
+ *   `EmailTemplateType.TRANSACTIONAL` when enqueuing send jobs.
+ * - The wonder-todos dev companion (`email-template.companion.service.ts`)
+ *   tags scaffolded templates as `EmailTemplateType.TRANSACTIONAL`.
+ *
+ * Splitting the enums into their own module keeps these consumers compiling
+ * after `EmailTemplateSchema` and `EmailHeaderFooterTemplateSchema` are
+ * deleted; before the split, every importer would have to migrate to a new
+ * source path simultaneously, which is a much larger blast radius for the
+ * same eventual outcome.
+ *
+ * ## What this file intentionally does NOT carry
+ *
+ * - `EmailTemplateGenerationSource` — only existed to classify rows in the
+ *   deleted `EmailTemplateSchema.generationSource` and
+ *   `EmailHeaderFooterTemplateSchema.generationSource` fields.
+ * - `EmailTemplatePropDefinitionSchema` / `EmailTemplatePropDefinition` —
+ *   only existed to type the deleted `EmailTemplateSchema.propsDefinition`
+ *   field.
+ * - `EmailTemplateSchema` / `EmailTemplate` — the DB row shape itself.
+ * - `EmailTemplateType_ToPlatformCapability` — `@deprecated` alias of
+ *   `EmailTemplateType_ToEngineCapability` with zero callers; deleted in the
+ *   same pass to remove dead aliases.
+ * - `deriveResourceEmailTemplateRef` — helper for the DB-backed authoring
+ *   surface; zero external callers; deleted in the same pass.
+ *
+ * If any of those symbols come back as a future requirement they should land
+ * in a new module with a clear runtime owner, not be re-introduced here.
+ */
+import { EngineCapability } from '../../external-providers/engine-capabilities.shared.schemas.js';
+// ─────────────────────────────────────────────────────────────────────────────
+// EMAIL TEMPLATE TYPE (provider routing)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Dispatch class for an email template — maps 1:1 with `EngineCapability`
+ * for provider routing inside `EmailBackendService`.
+ *
+ * Templates declare their dispatch class on the file-based
+ * `EmailTemplateDefinition<L>.type?` slot or inside the
+ * `SystemEmailTemplateRegistry` definition; the runtime sender uses
+ * {@link EmailTemplateType_ToEngineCapability} to resolve which configured
+ * provider should ship the message.
+ */
+export var EmailTemplateType;
+(function (EmailTemplateType) {
+    /** Transactional emails — password resets, receipts, notifications. */
+    EmailTemplateType["TRANSACTIONAL"] = "EMAIL_TRANSACTIONAL";
+    /** Marketing emails — newsletters, promotions, campaigns. */
+    EmailTemplateType["MARKETING"] = "EMAIL_MARKETING";
+})(EmailTemplateType || (EmailTemplateType = {}));
+/**
+ * Total `Record<EmailTemplateType, EngineCapability>` used by
+ * `EmailBackendService` to pick the configured provider for a given template
+ * dispatch class. Kept in this enums module (not in the runtime sender)
+ * because it is data, not behavior, and because it stays in lock-step with
+ * the {@link EmailTemplateType} enum — adding a new variant requires an
+ * entry here in the same edit.
+ */
+export const EmailTemplateType_ToEngineCapability = {
+    [EmailTemplateType.TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,
+    [EmailTemplateType.MARKETING]: EngineCapability.EMAIL_MARKETING,
+};
+// ─────────────────────────────────────────────────────────────────────────────
+// EMAIL TEMPLATE FREQUENCY (lifecycle classification)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Lifecycle classification for an email template from the application's
+ * authoring perspective. This is about how the template is used by the
+ * system — not how often a user receives it.
+ *
+ * Surfaced on `SystemEmailTemplateDefinition.frequency`; the runtime sender
+ * pipeline does not branch on this value today, but it is preserved as a
+ * canonical authoring slot so the dev companion can render it (e.g. in
+ * preview metadata) and so future lifecycle automation can key off it.
+ */
+export var EmailTemplateFrequency;
+(function (EmailTemplateFrequency) {
+    /**
+     * Template used once or a few times in the application's lifetime.
+     * Examples: migration announcements, CVE security alerts, T&C updates,
+     * one-time campaigns. These templates may be archived after their
+     * purpose is fulfilled.
+     */
+    EmailTemplateFrequency["EPHEMERAL"] = "EPHEMERAL";
+    /**
+     * Template used repeatedly throughout the application's lifetime.
+     * Examples: welcome emails, password reset, order confirmations,
+     * verification emails. These templates are permanent fixtures of the
+     * application.
+     */
+    EmailTemplateFrequency["RECURRENT"] = "RECURRENT";
+})(EmailTemplateFrequency || (EmailTemplateFrequency = {}));
+// ─────────────────────────────────────────────────────────────────────────────
+// EMAIL TEMPLATE STATUS (workflow state)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Workflow state for a template artifact.
+ *
+ * Pre-Step-4 this enum drove a DRAFT/PUBLISHED versioning workflow on the
+ * deleted `EmailTemplateSchema.status` field. Post-Step-4 it survives only
+ * because the dev companion preview surface and authoring tooling may
+ * still want a workflow vocabulary for in-progress edits before they land
+ * in the filesystem registry. Today no live runtime branches on it; if it
+ * ends up unused after Step 8 (companion-preview integration test) the
+ * cleanup pass should consider deleting it outright.
+ */
+export var EmailTemplateStatus;
+(function (EmailTemplateStatus) {
+    /** Template is in draft state, not used for sending. */
+    EmailTemplateStatus["DRAFT"] = "DRAFT";
+    /** Template is published and active for sending. */
+    EmailTemplateStatus["PUBLISHED"] = "PUBLISHED";
+    /** Template is archived and no longer used. */
+    EmailTemplateStatus["ARCHIVED"] = "ARCHIVED";
+})(EmailTemplateStatus || (EmailTemplateStatus = {}));
+// ─────────────────────────────────────────────────────────────────────────────
+// EMAIL TEMPLATE SCOPE (header/footer behavior)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Scope marker for a template — `APPLICATION` vs `ORGANIZATION`. Aligned
+ * with `ResourcePrimaryScope` but intentionally narrower: email scope only
+ * needs the application/organization split; user-self / anonymous scopes
+ * have no header/footer semantics in the email pipeline.
+ *
+ * Surfaced on `SystemEmailTemplateDefinition.scope`. The header/footer
+ * runtime never reads the deleted `EmailHeaderFooterTemplateSchema` —
+ * post-Step-4 header/footer composition lives entirely inside the
+ * file-based template (`template.tsx` consumes header/footer React
+ * components directly), and this scope marker only informs companion
+ * preview rendering and any future per-scope provider-selection logic.
+ */
+export var EmailTemplateScope;
+(function (EmailTemplateScope) {
+    /** Application-level template (uses app header/footer). */
+    EmailTemplateScope["APPLICATION"] = "APPLICATION";
+    /** Organization-level template (uses org header/footer if defined). */
+    EmailTemplateScope["ORGANIZATION"] = "ORGANIZATION";
+})(EmailTemplateScope || (EmailTemplateScope = {}));
+//# sourceMappingURL=email-template.shared.enums.js.map

package/dist/esm/notifications/email/email-template.shared.enums.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-template.shared.enums.js","sourceRoot":"","sources":["../../../../../src/notifications/email/email-template.shared.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAC3B,uEAAuE;IACvE,0DAAoD,CAAA;IACpD,6DAA6D;IAC7D,kDAA4C,CAAA;AAC9C,CAAC,EALW,iBAAiB,KAAjB,iBAAiB,QAK5B;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAgD;IAC/F,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,eAAe;CAChE,CAAC;AAEF,gFAAgF;AAChF,sDAAsD;AACtD,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,sBAeX;AAfD,WAAY,sBAAsB;IAChC;;;;;OAKG;IACH,iDAAuB,CAAA;IACvB;;;;;OAKG;IACH,iDAAuB,CAAA;AACzB,CAAC,EAfW,sBAAsB,KAAtB,sBAAsB,QAejC;AAED,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,wDAAwD;IACxD,sCAAe,CAAA;IACf,oDAAoD;IACpD,8CAAuB,CAAA;IACvB,+CAA+C;IAC/C,4CAAqB,CAAA;AACvB,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAED,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,2DAA2D;IAC3D,iDAA2B,CAAA;IAC3B,uEAAuE;IACvE,mDAA6B,CAAA;AAC/B,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B","sourcesContent":["/**\n * Email Template Classification Enums\n *\n * Surviving classification vocabulary for the **file-based** email template\n * pipeline. These enums classify a template's runtime intent — not a database\n * row. Post-Step-4 (`email-templates-deprecate-db-backed.md`), the DB-backed\n * `EMAIL_TEMPLATES` `CoreResourceType` was removed end-to-end and the runtime\n * sender pipeline reads templates exclusively from the filesystem registry\n * (`EmailTemplateRegistryBackendService` + `scanEmailTemplateDirectory`).\n *\n * ## Why this file exists separately from `email-template.shared.schemas.ts`\n *\n * Step 6 of the deprecation plan split these enums out of the DB-backed\n * `EmailTemplateSchema` file **before** deleting that file. The split was\n * required because consumers of these enums survive the schema deletion:\n *\n * - `email-template-registry.shared.schemas.ts` declares\n *   `SystemEmailTemplateDefinition` and the `SystemEmailTemplateRegistry` map\n *   keyed by `EmailTemplateType` / `EmailTemplateFrequency` / `EmailTemplateScope`.\n * - `engine/saas-backend-lib/src/notifications/email/models/email-template-definition.ts`\n *   types `EmailTemplateDefinition<L>.type?` as `EmailTemplateType`.\n * - The runtime sender pipeline (`EmailBackendService`) routes to a provider\n *   via `EmailTemplateType_ToEngineCapability[type]`.\n * - The auth services (`auth-registration`, `auth-password-reset`,\n *   `authentication-controller`) and the dispatcher\n *   (`notifications-dispatcher.backend.service`) emit\n *   `EmailTemplateType.TRANSACTIONAL` when enqueuing send jobs.\n * - The wonder-todos dev companion (`email-template.companion.service.ts`)\n *   tags scaffolded templates as `EmailTemplateType.TRANSACTIONAL`.\n *\n * Splitting the enums into their own module keeps these consumers compiling\n * after `EmailTemplateSchema` and `EmailHeaderFooterTemplateSchema` are\n * deleted; before the split, every importer would have to migrate to a new\n * source path simultaneously, which is a much larger blast radius for the\n * same eventual outcome.\n *\n * ## What this file intentionally does NOT carry\n *\n * - `EmailTemplateGenerationSource` — only existed to classify rows in the\n *   deleted `EmailTemplateSchema.generationSource` and\n *   `EmailHeaderFooterTemplateSchema.generationSource` fields.\n * - `EmailTemplatePropDefinitionSchema` / `EmailTemplatePropDefinition` —\n *   only existed to type the deleted `EmailTemplateSchema.propsDefinition`\n *   field.\n * - `EmailTemplateSchema` / `EmailTemplate` — the DB row shape itself.\n * - `EmailTemplateType_ToPlatformCapability` — `@deprecated` alias of\n *   `EmailTemplateType_ToEngineCapability` with zero callers; deleted in the\n *   same pass to remove dead aliases.\n * - `deriveResourceEmailTemplateRef` — helper for the DB-backed authoring\n *   surface; zero external callers; deleted in the same pass.\n *\n * If any of those symbols come back as a future requirement they should land\n * in a new module with a clear runtime owner, not be re-introduced here.\n */\n\nimport { EngineCapability } from '../../external-providers/engine-capabilities.shared.schemas';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// EMAIL TEMPLATE TYPE (provider routing)\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Dispatch class for an email template — maps 1:1 with `EngineCapability`\n * for provider routing inside `EmailBackendService`.\n *\n * Templates declare their dispatch class on the file-based\n * `EmailTemplateDefinition<L>.type?` slot or inside the\n * `SystemEmailTemplateRegistry` definition; the runtime sender uses\n * {@link EmailTemplateType_ToEngineCapability} to resolve which configured\n * provider should ship the message.\n */\nexport enum EmailTemplateType {\n  /** Transactional emails — password resets, receipts, notifications. */\n  TRANSACTIONAL = EngineCapability.EMAIL_TRANSACTIONAL,\n  /** Marketing emails — newsletters, promotions, campaigns. */\n  MARKETING = EngineCapability.EMAIL_MARKETING,\n}\n\n/**\n * Total `Record<EmailTemplateType, EngineCapability>` used by\n * `EmailBackendService` to pick the configured provider for a given template\n * dispatch class. Kept in this enums module (not in the runtime sender)\n * because it is data, not behavior, and because it stays in lock-step with\n * the {@link EmailTemplateType} enum — adding a new variant requires an\n * entry here in the same edit.\n */\nexport const EmailTemplateType_ToEngineCapability: Record<EmailTemplateType, EngineCapability> = {\n  [EmailTemplateType.TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [EmailTemplateType.MARKETING]: EngineCapability.EMAIL_MARKETING,\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// EMAIL TEMPLATE FREQUENCY (lifecycle classification)\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Lifecycle classification for an email template from the application's\n * authoring perspective. This is about how the template is used by the\n * system — not how often a user receives it.\n *\n * Surfaced on `SystemEmailTemplateDefinition.frequency`; the runtime sender\n * pipeline does not branch on this value today, but it is preserved as a\n * canonical authoring slot so the dev companion can render it (e.g. in\n * preview metadata) and so future lifecycle automation can key off it.\n */\nexport enum EmailTemplateFrequency {\n  /**\n   * Template used once or a few times in the application's lifetime.\n   * Examples: migration announcements, CVE security alerts, T&C updates,\n   * one-time campaigns. These templates may be archived after their\n   * purpose is fulfilled.\n   */\n  EPHEMERAL = \"EPHEMERAL\",\n  /**\n   * Template used repeatedly throughout the application's lifetime.\n   * Examples: welcome emails, password reset, order confirmations,\n   * verification emails. These templates are permanent fixtures of the\n   * application.\n   */\n  RECURRENT = \"RECURRENT\",\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// EMAIL TEMPLATE STATUS (workflow state)\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Workflow state for a template artifact.\n *\n * Pre-Step-4 this enum drove a DRAFT/PUBLISHED versioning workflow on the\n * deleted `EmailTemplateSchema.status` field. Post-Step-4 it survives only\n * because the dev companion preview surface and authoring tooling may\n * still want a workflow vocabulary for in-progress edits before they land\n * in the filesystem registry. Today no live runtime branches on it; if it\n * ends up unused after Step 8 (companion-preview integration test) the\n * cleanup pass should consider deleting it outright.\n */\nexport enum EmailTemplateStatus {\n  /** Template is in draft state, not used for sending. */\n  DRAFT = \"DRAFT\",\n  /** Template is published and active for sending. */\n  PUBLISHED = \"PUBLISHED\",\n  /** Template is archived and no longer used. */\n  ARCHIVED = \"ARCHIVED\",\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// EMAIL TEMPLATE SCOPE (header/footer behavior)\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Scope marker for a template — `APPLICATION` vs `ORGANIZATION`. Aligned\n * with `ResourcePrimaryScope` but intentionally narrower: email scope only\n * needs the application/organization split; user-self / anonymous scopes\n * have no header/footer semantics in the email pipeline.\n *\n * Surfaced on `SystemEmailTemplateDefinition.scope`. The header/footer\n * runtime never reads the deleted `EmailHeaderFooterTemplateSchema` —\n * post-Step-4 header/footer composition lives entirely inside the\n * file-based template (`template.tsx` consumes header/footer React\n * components directly), and this scope marker only informs companion\n * preview rendering and any future per-scope provider-selection logic.\n */\nexport enum EmailTemplateScope {\n  /** Application-level template (uses app header/footer). */\n  APPLICATION = \"APPLICATION\",\n  /** Organization-level template (uses org header/footer if defined). */\n  ORGANIZATION = \"ORGANIZATION\",\n}\n"]}

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.d.ts

@@ -0,0 +1,43 @@
+/**
+ * M2M Webhook Delivery Log Resource Configuration — Polymorphic dual-scope
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...m2mWebhookDeliveryLogPolymorphicFactories
+ *
+ * Operation set (per Plan §D3 / Step 5):
+ *   - READ          (API)             : admin views a single delivery row
+ *   - LIST          (API)             : admin browses recent deliveries
+ *   - SEARCH        (API)             : admin filters deliveries (status / endpoint / date)
+ *   - CREATE        (REPOSITORY_ONLY) : dispatcher-only — never externally callable
+ *   - DELETE        (REPOSITORY_ONLY) : reserved for `PURGE_OLD` bulk path; no
+ *                                       external single-row delete to keep the
+ *                                       audit trail stable
+ *   - RETRY         (custom, API)     : re-enqueue a `FAILED` row (mirrors
+ *                                       SIEM DLQ `RETRY_SINGLE`)
+ *   - PURGE_OLD     (custom, API)     : delete `DELIVERED`/`FAILED` rows older
+ *                                       than N days (mirrors SIEM DLQ
+ *                                       `PURGE_ALL` but date-bounded)
+ *
+ * @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5
+ * @see security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts
+ */
+import { z } from 'zod';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+export declare enum M2MWebhookDeliveryLog_Operations {
+    /** Re-enqueue a single `FAILED` row (resets `status → PENDING`, `attemptCount → 0`). */
+    RETRY = "retry",
+    /** Bulk delete `DELIVERED` / `FAILED` rows older than `olderThanDays`. */
+    PURGE_OLD = "purgeOld"
+}
+/**
+ * RETRY addresses exactly one delivery row through the route path. Keeping the
+ * body empty prevents two independently supplied ids from disagreeing; the
+ * backend custom implementation uses the framework-resolved entity id.
+ */
+export declare const M2MWebhookDeliveryLog_RetryRequestDto: z.ZodObject<{}, z.core.$strict>;
+export declare const M2MWebhookDeliveryLog_PurgeOldRequestDto: z.ZodObject<{
+    olderThanDays: z.ZodNumber;
+}, z.core.$strip>;
+export declare const m2mWebhookDeliveryLogPolymorphicFactories: Record<string, import("../..").ResourceConfiguration_InitializationFactory<typeof M2MWebhookDeliveryLog_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.DELETE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, any>>;
+//# sourceMappingURL=m2m-webhook-delivery-log.shared.resources-config.schemas.d.ts.map

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"m2m-webhook-delivery-log.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EAEtB,MAAM,mDAAmD,CAAC;AAiB3D,oBAAY,gCAAgC;IAC1C,wFAAwF;IACxF,KAAK,UAAU;IACf,0EAA0E;IAC1E,SAAS,aAAa;CACvB;AAMD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,iCAAqB,CAAC;AAExE,eAAO,MAAM,wCAAwC;;iBAGnD,CAAC;AAMH,eAAO,MAAM,yCAAyC,oVA+KrD,CAAC"}

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.js

@@ -0,0 +1,231 @@
+/**
+ * M2M Webhook Delivery Log Resource Configuration — Polymorphic dual-scope
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...m2mWebhookDeliveryLogPolymorphicFactories
+ *
+ * Operation set (per Plan §D3 / Step 5):
+ *   - READ          (API)             : admin views a single delivery row
+ *   - LIST          (API)             : admin browses recent deliveries
+ *   - SEARCH        (API)             : admin filters deliveries (status / endpoint / date)
+ *   - CREATE        (REPOSITORY_ONLY) : dispatcher-only — never externally callable
+ *   - DELETE        (REPOSITORY_ONLY) : reserved for `PURGE_OLD` bulk path; no
+ *                                       external single-row delete to keep the
+ *                                       audit trail stable
+ *   - RETRY         (custom, API)     : re-enqueue a `FAILED` row (mirrors
+ *                                       SIEM DLQ `RETRY_SINGLE`)
+ *   - PURGE_OLD     (custom, API)     : delete `DELIVERED`/`FAILED` rows older
+ *                                       than N days (mirrors SIEM DLQ
+ *                                       `PURGE_ALL` but date-bounded)
+ *
+ * @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5
+ * @see security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts
+ */
+import { z } from 'zod';
+import { CoreResourceOperation, CoreResourceType, } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../resources/resources.shared.schemas.js';
+import { createPolymorphicResourceConfigurations } from '../../resources/utils/resource-polymorphism.factory.js';
+import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas.js';
+import { CoreM2MNotificationChannel } from '../notifications.shared.schemas.js';
+import { m2mWebhookDeliveryLogPolymorphicDeclaration, M2MWebhookDeliveryLogStatus, } from './m2m-webhook-delivery-log.shared.schemas.js';
+// =============================================================================
+// CUSTOM OPERATIONS
+// =============================================================================
+export var M2MWebhookDeliveryLog_Operations;
+(function (M2MWebhookDeliveryLog_Operations) {
+    /** Re-enqueue a single `FAILED` row (resets `status → PENDING`, `attemptCount → 0`). */
+    M2MWebhookDeliveryLog_Operations["RETRY"] = "retry";
+    /** Bulk delete `DELIVERED` / `FAILED` rows older than `olderThanDays`. */
+    M2MWebhookDeliveryLog_Operations["PURGE_OLD"] = "purgeOld";
+})(M2MWebhookDeliveryLog_Operations || (M2MWebhookDeliveryLog_Operations = {}));
+// =============================================================================
+// REQUEST DTOs
+// =============================================================================
+/**
+ * RETRY addresses exactly one delivery row through the route path. Keeping the
+ * body empty prevents two independently supplied ids from disagreeing; the
+ * backend custom implementation uses the framework-resolved entity id.
+ */
+export const M2MWebhookDeliveryLog_RetryRequestDto = z.strictObject({});
+export const M2MWebhookDeliveryLog_PurgeOldRequestDto = z.object({
+    /** Rows whose `createdAt` is older than `now() - olderThanDays` are eligible. */
+    olderThanDays: z.number().int().positive().max(365),
+});
+// =============================================================================
+// POLYMORPHIC FACTORY
+// =============================================================================
+export const m2mWebhookDeliveryLogPolymorphicFactories = createPolymorphicResourceConfigurations(m2mWebhookDeliveryLogPolymorphicDeclaration, {
+    isSystemResource: true,
+    customOperation: M2MWebhookDeliveryLog_Operations,
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.SEARCH,
+        CoreResourceOperation.CREATE,
+        // UPDATE is the delivery lifecycle: the dispatcher/worker drives the
+        // PENDING → IN_FLIGHT → DELIVERED/FAILED status transitions
+        // (markInFlight / markDelivered / markFailedAttempt / markFinallyFailed)
+        // through the generic `repository.update`, which requires a DEFAULT UPDATE
+        // operation. REPOSITORY_ONLY like CREATE — never a public HTTP surface
+        // (admins act via the RETRY custom operation, which owns request/response).
+        CoreResourceOperation.UPDATE,
+        CoreResourceOperation.DELETE,
+        CoreResourceOperation.DELETE_MANY,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.SEARCH]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    isSearchable: true,
+                    searchableFields: ['endpointId', 'resourceIdentifier', 'operationIdentifier', 'failureReason'],
+                    filterFields: {
+                        status: z.enum(M2MWebhookDeliveryLogStatus),
+                        channel: z.enum(CoreM2MNotificationChannel),
+                        endpointId: z.string(),
+                        createdAt: z.date(),
+                    },
+                    sortFields: ['createdAt', 'status', 'attemptCount'],
+                },
+            ],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        // Delivery-lifecycle status transitions (dispatcher/worker only). Mirrors
+        // CREATE: REPOSITORY_ONLY default so `repository.update` resolves a default
+        // UPDATE op; never exposed as a public HTTP mutation.
+        [CoreResourceOperation.UPDATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                },
+            ],
+        },
+        // Bulk twin of DELETE — the actual `PURGE_OLD` write path: the custom impl
+        // routes through the repository's `deleteMany` (which requires a default
+        // DELETE_MANY operation) to drop terminal DELIVERED/FAILED rows older
+        // than the requested retention window in one round trip. REPOSITORY_ONLY:
+        // never a public HTTP surface — admins purge via the PURGE_OLD custom
+        // operation, which owns the request validation + response summary.
+        [CoreResourceOperation.DELETE_MANY]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                },
+            ],
+        },
+        [M2MWebhookDeliveryLog_Operations.RETRY]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: M2MWebhookDeliveryLog_RetryRequestDto,
+                },
+            ],
+        },
+        [M2MWebhookDeliveryLog_Operations.PURGE_OLD]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): purging
+                    // rows older than `olderThanDays` acts on the whole scope, so it needs a
+                    // collection route (`…/m2m-webhook-delivery-log/purge-old`, no `:id`) —
+                    // a scope-level maintenance action has no single row to address. Mirrors
+                    // SIEM DLQ `PURGE_ALL`. `isBulkOperation` stays unset (collection-level,
+                    // not a selection bulk). Returns a purge summary, NOT the borrowed
+                    // bulk-delete default `{ deletedIds, deletedCount }` — customResponseDto
+                    // overrides it. Impl: `m2m-webhook-delivery-log.custom-impl.backend.service.ts`
+                    // (saas-backend-lib) — deleteMany of terminal rows older than the window.
+                    resourceOperationLike: CoreResourceOperation.DELETE_MANY,
+                    requestDto: M2MWebhookDeliveryLog_PurgeOldRequestDto,
+                    customResponseDto: z.object({
+                        purgedCount: z.number(),
+                        message: z.string(),
+                    }),
+                },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=m2m-webhook-delivery-log.shared.resources-config.schemas.js.map

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"m2m-webhook-delivery-log.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,2CAA2C,EAC3C,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAN,IAAY,gCAKX;AALD,WAAY,gCAAgC;IAC1C,wFAAwF;IACxF,mDAAe,CAAA;IACf,0EAA0E;IAC1E,0DAAsB,CAAA;AACxB,CAAC,EALW,gCAAgC,KAAhC,gCAAgC,QAK3C;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACpD,CAAC,CAAC;AAEH,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,yCAAyC,GAAG,uCAAuC,CAC9F,2CAA2C,EAC3C;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,gCAAgC;IACjD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qEAAqE;QACrE,4DAA4D;QAC5D,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,eAAe,CAAC;oBAC9F,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;wBAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;wBACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAU;iBAC7D;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,sDAAsD;QACtD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,mEAAmE;QACnE,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,qCAAqC;iBAClD;aACF;SACF;QACD,CAAC,gCAAgC,CAAC,SAAS,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,uEAAuE;oBACvE,yEAAyE;oBACzE,wEAAwE;oBACxE,yEAAyE;oBACzE,yEAAyE;oBACzE,mEAAmE;oBACnE,yEAAyE;oBACzE,gFAAgF;oBAChF,0EAA0E;oBAC1E,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,wCAAwC;oBACpD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;qBACpB,CAAC;iBACH;aACF;SACF;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * M2M Webhook Delivery Log Resource Configuration — Polymorphic dual-scope\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...m2mWebhookDeliveryLogPolymorphicFactories\n *\n * Operation set (per Plan §D3 / Step 5):\n *   - READ          (API)             : admin views a single delivery row\n *   - LIST          (API)             : admin browses recent deliveries\n *   - SEARCH        (API)             : admin filters deliveries (status / endpoint / date)\n *   - CREATE        (REPOSITORY_ONLY) : dispatcher-only — never externally callable\n *   - DELETE        (REPOSITORY_ONLY) : reserved for `PURGE_OLD` bulk path; no\n *                                       external single-row delete to keep the\n *                                       audit trail stable\n *   - RETRY         (custom, API)     : re-enqueue a `FAILED` row (mirrors\n *                                       SIEM DLQ `RETRY_SINGLE`)\n *   - PURGE_OLD     (custom, API)     : delete `DELIVERED`/`FAILED` rows older\n *                                       than N days (mirrors SIEM DLQ\n *                                       `PURGE_ALL` but date-bounded)\n *\n * @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5\n * @see security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts\n */\n\nimport { z } from 'zod';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n} from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { CoreM2MNotificationChannel } from '../notifications.shared.schemas';\nimport {\n  m2mWebhookDeliveryLogPolymorphicDeclaration,\n  M2MWebhookDeliveryLogStatus,\n} from './m2m-webhook-delivery-log.shared.schemas';\n\n// =============================================================================\n// CUSTOM OPERATIONS\n// =============================================================================\n\nexport enum M2MWebhookDeliveryLog_Operations {\n  /** Re-enqueue a single `FAILED` row (resets `status → PENDING`, `attemptCount → 0`). */\n  RETRY = 'retry',\n  /** Bulk delete `DELIVERED` / `FAILED` rows older than `olderThanDays`. */\n  PURGE_OLD = 'purgeOld',\n}\n\n// =============================================================================\n// REQUEST DTOs\n// =============================================================================\n\n/**\n * RETRY addresses exactly one delivery row through the route path. Keeping the\n * body empty prevents two independently supplied ids from disagreeing; the\n * backend custom implementation uses the framework-resolved entity id.\n */\nexport const M2MWebhookDeliveryLog_RetryRequestDto = z.strictObject({});\n\nexport const M2MWebhookDeliveryLog_PurgeOldRequestDto = z.object({\n  /** Rows whose `createdAt` is older than `now() - olderThanDays` are eligible. */\n  olderThanDays: z.number().int().positive().max(365),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY\n// =============================================================================\n\nexport const m2mWebhookDeliveryLogPolymorphicFactories = createPolymorphicResourceConfigurations(\n  m2mWebhookDeliveryLogPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: M2MWebhookDeliveryLog_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      // UPDATE is the delivery lifecycle: the dispatcher/worker drives the\n      // PENDING → IN_FLIGHT → DELIVERED/FAILED status transitions\n      // (markInFlight / markDelivered / markFailedAttempt / markFinallyFailed)\n      // through the generic `repository.update`, which requires a DEFAULT UPDATE\n      // operation. REPOSITORY_ONLY like CREATE — never a public HTTP surface\n      // (admins act via the RETRY custom operation, which owns request/response).\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            isSearchable: true,\n            searchableFields: ['endpointId', 'resourceIdentifier', 'operationIdentifier', 'failureReason'],\n            filterFields: {\n              status: z.enum(M2MWebhookDeliveryLogStatus),\n              channel: z.enum(CoreM2MNotificationChannel),\n              endpointId: z.string(),\n              createdAt: z.date(),\n            },\n            sortFields: ['createdAt', 'status', 'attemptCount'] as const,\n          },\n        ],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n      // Delivery-lifecycle status transitions (dispatcher/worker only). Mirrors\n      // CREATE: REPOSITORY_ONLY default so `repository.update` resolves a default\n      // UPDATE op; never exposed as a public HTTP mutation.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n      // Bulk twin of DELETE — the actual `PURGE_OLD` write path: the custom impl\n      // routes through the repository's `deleteMany` (which requires a default\n      // DELETE_MANY operation) to drop terminal DELIVERED/FAILED rows older\n      // than the requested retention window in one round trip. REPOSITORY_ONLY:\n      // never a public HTTP surface — admins purge via the PURGE_OLD custom\n      // operation, which owns the request validation + response summary.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n      [M2MWebhookDeliveryLog_Operations.RETRY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: M2MWebhookDeliveryLog_RetryRequestDto,\n          },\n        ],\n      },\n      [M2MWebhookDeliveryLog_Operations.PURGE_OLD]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): purging\n            // rows older than `olderThanDays` acts on the whole scope, so it needs a\n            // collection route (`…/m2m-webhook-delivery-log/purge-old`, no `:id`) —\n            // a scope-level maintenance action has no single row to address. Mirrors\n            // SIEM DLQ `PURGE_ALL`. `isBulkOperation` stays unset (collection-level,\n            // not a selection bulk). Returns a purge summary, NOT the borrowed\n            // bulk-delete default `{ deletedIds, deletedCount }` — customResponseDto\n            // overrides it. Impl: `m2m-webhook-delivery-log.custom-impl.backend.service.ts`\n            // (saas-backend-lib) — deleteMany of terminal rows older than the window.\n            resourceOperationLike: CoreResourceOperation.DELETE_MANY,\n            requestDto: M2MWebhookDeliveryLog_PurgeOldRequestDto,\n            customResponseDto: z.object({\n              purgedCount: z.number(),\n              message: z.string(),\n            }),\n          },\n        ],\n      },\n    },\n  },\n);\n"]}