@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.d.ts

@@ -0,0 +1,159 @@
+/**
+ * M2M Webhook Delivery Log Schema (Shared) — Polymorphic dual-scope
+ *
+ * Persistence collection that triple-purposes as:
+ *   1. The pending delivery queue the worker drains (`status =
+ *      PENDING`, polled by `(status, nextAttemptAt)`).
+ *   2. The user-facing webhook event log (queryable by admins via
+ *      READ/LIST/SEARCH; scope-appropriate role gating per
+ *      `*.shared.resources-config.schemas.ts`).
+ *   3. The retry checkpoint — failed attempts increment `attemptCount`
+ *      and bump `nextAttemptAt`; final failure flips `status = FAILED`
+ *      with `failureReason` populated.
+ *
+ * One row per (delivery target × notification fire). The polymorphism
+ * engine injects `organizationId` (org variant) or `applicationId`
+ * (app variant) — never both on the same row, so cross-tenant leaks are
+ * structurally impossible.
+ *
+ * @see m2m-webhook-organization-delivery.md — Phase 2 / Step 4 (D3 lock-in)
+ * @see security/authentications/siem/siem-delivery-dlq.shared.schemas.ts
+ *   for the dual-scope polymorphic precedent this mirrors.
+ */
+import { z } from 'zod';
+import { CoreM2MNotificationChannel } from '../notifications.shared.schemas';
+/**
+ * Lifecycle transitions:
+ *   PENDING → IN_FLIGHT → DELIVERED               (success path)
+ *   PENDING → IN_FLIGHT → PENDING                 (transient failure, retry scheduled)
+ *   PENDING → IN_FLIGHT → FAILED                  (final failure — `attemptCount` reached cap)
+ *
+ * The worker uses `(status, nextAttemptAt)` to find rows ready for
+ * delivery; `IN_FLIGHT` is held only while a worker holds the lease.
+ */
+export declare const M2MWebhookDeliveryLogStatus: {
+    readonly PENDING: "pending";
+    readonly IN_FLIGHT: "in_flight";
+    readonly DELIVERED: "delivered";
+    readonly FAILED: "failed";
+};
+export type M2MWebhookDeliveryLogStatus = (typeof M2MWebhookDeliveryLogStatus)[keyof typeof M2MWebhookDeliveryLogStatus];
+/**
+ * Field rationale (per Plan §D3 lock-in):
+ *
+ * - `endpointId`            : Stable FK into `WebhookConfig.endpoints[].id` —
+ *                             survives endpoint rename/url-edit so historical
+ *                             rows remain reconcilable.
+ * - `channel`               : Which notification channel triggered this row.
+ *                             Pinned to `CoreM2MNotificationChannel` for type
+ *                             safety; the spec/runtime invariant in the
+ *                             dispatcher guarantees the channel is
+ *                             scope-compatible with the resource.
+ * - `resourceIdentifier` /
+ *   `operationIdentifier` /
+ *   `variantKey?`           : Provenance — what spec'd op fired the
+ *                             notification (used by admin UIs and audit
+ *                             correlation).
+ * - `httpUrl`               : Snapshot of the destination URL at enqueue
+ *                             time. Decoupled from `WebhookConfig.endpoints`
+ *                             so URL edits don't rewrite history.
+ * - `payloadHash` (sha256)  : Integrity tag — also embedded in the JWT
+ *                             `bodyHash` claim. Lets consumers detect
+ *                             body-vs-claim mismatch independently.
+ * - `payload`               : Full POST body retained per Q1 lock-in
+ *                             (`full` retention). Treated as `unknown` here
+ *                             — the runtime shape is whatever
+ *                             `serializeOperationResultForResponse(...)`
+ *                             produced for the originating operation.
+ * - `status`                : See `M2MWebhookDeliveryLogStatus`.
+ * - `attemptCount`          : Incremented per attempt (success and
+ *                             transient failure). Worker stops retrying
+ *                             when this reaches the cap (Plan §D6).
+ * - `lastAttemptAt?` /
+ *   `nextAttemptAt?`        : Retry scheduling. `nextAttemptAt` is
+ *                             cleared on `DELIVERED` / `FAILED`.
+ * - `responseStatus?`       : HTTP status code from last attempt
+ *                             (populated even on success for analytics).
+ * - `responseBodyTruncated?`: First 4 KB of response body (per Plan §D3
+ *                             retention cap) — useful for debugging.
+ * - `failureReason?`        : Human-readable error summary for `FAILED`
+ *                             rows.
+ * - `signatureJti`          : JWT `jti` claim used to sign this delivery.
+ *                             Stored so consumers can replay-detect.
+ * - `deliveredAt?` /
+ *   `failedAt?`             : Terminal-state timestamps.
+ * - `createdAt`             : Enqueue time (immutable).
+ *
+ * Indexes (asserted at repository init in Phase 3):
+ *   - `(<scopeId>, createdAt)` — admin UI queries (LIST/SEARCH)
+ *   - `(status, nextAttemptAt)` — worker drain queries
+ */
+export declare const M2MWebhookDeliveryLogBaseSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    endpointId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    channel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof CoreM2MNotificationChannel>>;
+    resourceIdentifier: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    operationIdentifier: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    httpUrl: z.ZodURL;
+    payloadHash: z.ZodString;
+    payload: z.ZodUnknown;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
+        readonly PENDING: "pending";
+        readonly IN_FLIGHT: "in_flight";
+        readonly DELIVERED: "delivered";
+        readonly FAILED: "failed";
+    }>>>>;
+    attemptCount: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
+    lastAttemptAt: z.ZodOptional<z.ZodDate>;
+    nextAttemptAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;
+    responseStatus: z.ZodOptional<z.ZodNumber>;
+    responseBodyTruncated: z.ZodOptional<z.ZodString>;
+    failureReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    signatureJti: z.ZodString;
+    deliveredAt: z.ZodOptional<z.ZodDate>;
+    failedAt: z.ZodOptional<z.ZodDate>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip>;
+export type M2MWebhookDeliveryLogBase = z.infer<typeof M2MWebhookDeliveryLogBaseSchema>;
+/**
+ * Yields two `CoreResourceType` variants:
+ *   - `organizationM2mWebhookDeliveryLog` (FK: `organizationId`)
+ *   - `applicationM2mWebhookDeliveryLog` (FK: `applicationId`)
+ *
+ * Both are MANY-cardinality children of their respective scope —
+ * wired in `resources-registry.shared.core.definitions.ts` via
+ * `createPolymorphicScopeRelationships(...)` with `nature:
+ * COMPOSITION` and `onParentDelete: IMMEDIATE` so deleting the org/app
+ * cleanly drops its delivery history.
+ */
+export declare const m2mWebhookDeliveryLogPolymorphicDeclaration: import("../..").PolymorphicSchemaDeclaration<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    endpointId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    channel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof CoreM2MNotificationChannel>>;
+    resourceIdentifier: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    operationIdentifier: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    httpUrl: z.ZodURL;
+    payloadHash: z.ZodString;
+    payload: z.ZodUnknown;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
+        readonly PENDING: "pending";
+        readonly IN_FLIGHT: "in_flight";
+        readonly DELIVERED: "delivered";
+        readonly FAILED: "failed";
+    }>>>>;
+    attemptCount: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
+    lastAttemptAt: z.ZodOptional<z.ZodDate>;
+    nextAttemptAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;
+    responseStatus: z.ZodOptional<z.ZodNumber>;
+    responseBodyTruncated: z.ZodOptional<z.ZodString>;
+    failureReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    signatureJti: z.ZodString;
+    deliveredAt: z.ZodOptional<z.ZodDate>;
+    failedAt: z.ZodOptional<z.ZodDate>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=m2m-webhook-delivery-log.shared.schemas.d.ts.map

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"m2m-webhook-delivery-log.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAwC7E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;CAK9B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAMjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwD1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQtD,CAAC"}

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.js

@@ -0,0 +1,191 @@
+/**
+ * M2M Webhook Delivery Log Schema (Shared) — Polymorphic dual-scope
+ *
+ * Persistence collection that triple-purposes as:
+ *   1. The pending delivery queue the worker drains (`status =
+ *      PENDING`, polled by `(status, nextAttemptAt)`).
+ *   2. The user-facing webhook event log (queryable by admins via
+ *      READ/LIST/SEARCH; scope-appropriate role gating per
+ *      `*.shared.resources-config.schemas.ts`).
+ *   3. The retry checkpoint — failed attempts increment `attemptCount`
+ *      and bump `nextAttemptAt`; final failure flips `status = FAILED`
+ *      with `failureReason` populated.
+ *
+ * One row per (delivery target × notification fire). The polymorphism
+ * engine injects `organizationId` (org variant) or `applicationId`
+ * (app variant) — never both on the same row, so cross-tenant leaks are
+ * structurally impossible.
+ *
+ * @see m2m-webhook-organization-delivery.md — Phase 2 / Step 4 (D3 lock-in)
+ * @see security/authentications/siem/siem-delivery-dlq.shared.schemas.ts
+ *   for the dual-scope polymorphic precedent this mirrors.
+ */
+import { z } from 'zod';
+import { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas.js';
+import { addDataCategories } from '@wildo-ai/zod-decorators';
+import { CoreM2MNotificationChannel } from '../notifications.shared.schemas.js';
+import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey, } from '../../resources/utils/resource-polymorphism.schemas.js';
+import { CoreResourceType, coreResourceShared_FieldIdentifier, } from '../../resources/resources.shared.core.definitions.js';
+// =============================================================================
+// SHARED VARIANT DEFINITIONS
+// =============================================================================
+/**
+ * Local copy of `M2M_WEBHOOK_SCOPE_VARIANTS` to avoid a sibling import
+ * (which would couple the delivery-log schema to the config schema's
+ * load order). The constant is intentionally re-declared identically;
+ * any drift would be caught by Phase 3's runtime invariant in the
+ * dispatcher (which asserts the resolved channel scope matches the
+ * resource's primary scope).
+ */
+const M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL = [
+    {
+        parentResourceType: CoreResourceType.ORGANIZATIONS,
+        parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS],
+        isPrimaryScope: true,
+    },
+    {
+        parentResourceType: CoreResourceType.APPLICATION,
+        parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],
+        isPrimaryScope: true,
+    },
+];
+// =============================================================================
+// STATUS ENUM (4-state finite machine)
+// =============================================================================
+/**
+ * Lifecycle transitions:
+ *   PENDING → IN_FLIGHT → DELIVERED               (success path)
+ *   PENDING → IN_FLIGHT → PENDING                 (transient failure, retry scheduled)
+ *   PENDING → IN_FLIGHT → FAILED                  (final failure — `attemptCount` reached cap)
+ *
+ * The worker uses `(status, nextAttemptAt)` to find rows ready for
+ * delivery; `IN_FLIGHT` is held only while a worker holds the lease.
+ */
+export const M2MWebhookDeliveryLogStatus = {
+    PENDING: 'pending',
+    IN_FLIGHT: 'in_flight',
+    DELIVERED: 'delivered',
+    FAILED: 'failed',
+};
+// =============================================================================
+// BASE SCHEMA (polymorphism injects the scope FK at variant time)
+// =============================================================================
+/**
+ * Field rationale (per Plan §D3 lock-in):
+ *
+ * - `endpointId`            : Stable FK into `WebhookConfig.endpoints[].id` —
+ *                             survives endpoint rename/url-edit so historical
+ *                             rows remain reconcilable.
+ * - `channel`               : Which notification channel triggered this row.
+ *                             Pinned to `CoreM2MNotificationChannel` for type
+ *                             safety; the spec/runtime invariant in the
+ *                             dispatcher guarantees the channel is
+ *                             scope-compatible with the resource.
+ * - `resourceIdentifier` /
+ *   `operationIdentifier` /
+ *   `variantKey?`           : Provenance — what spec'd op fired the
+ *                             notification (used by admin UIs and audit
+ *                             correlation).
+ * - `httpUrl`               : Snapshot of the destination URL at enqueue
+ *                             time. Decoupled from `WebhookConfig.endpoints`
+ *                             so URL edits don't rewrite history.
+ * - `payloadHash` (sha256)  : Integrity tag — also embedded in the JWT
+ *                             `bodyHash` claim. Lets consumers detect
+ *                             body-vs-claim mismatch independently.
+ * - `payload`               : Full POST body retained per Q1 lock-in
+ *                             (`full` retention). Treated as `unknown` here
+ *                             — the runtime shape is whatever
+ *                             `serializeOperationResultForResponse(...)`
+ *                             produced for the originating operation.
+ * - `status`                : See `M2MWebhookDeliveryLogStatus`.
+ * - `attemptCount`          : Incremented per attempt (success and
+ *                             transient failure). Worker stops retrying
+ *                             when this reaches the cap (Plan §D6).
+ * - `lastAttemptAt?` /
+ *   `nextAttemptAt?`        : Retry scheduling. `nextAttemptAt` is
+ *                             cleared on `DELIVERED` / `FAILED`.
+ * - `responseStatus?`       : HTTP status code from last attempt
+ *                             (populated even on success for analytics).
+ * - `responseBodyTruncated?`: First 4 KB of response body (per Plan §D3
+ *                             retention cap) — useful for debugging.
+ * - `failureReason?`        : Human-readable error summary for `FAILED`
+ *                             rows.
+ * - `signatureJti`          : JWT `jti` claim used to sign this delivery.
+ *                             Stored so consumers can replay-detect.
+ * - `deliveredAt?` /
+ *   `failedAt?`             : Terminal-state timestamps.
+ * - `createdAt`             : Enqueue time (immutable).
+ *
+ * Indexes (asserted at repository init in Phase 3):
+ *   - `(<scopeId>, createdAt)` — admin UI queries (LIST/SEARCH)
+ *   - `(status, nextAttemptAt)` — worker drain queries
+ */
+export const M2MWebhookDeliveryLogBaseSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    endpointId: z.string().min(1).isDBIndexed().isSummaryField(),
+    channel: z.enum(CoreM2MNotificationChannel).isSummaryField(),
+    resourceIdentifier: z.string().min(1).isSummaryField(),
+    operationIdentifier: z.string().min(1).isSummaryField(),
+    variantKey: z.string().optional(),
+    httpUrl: z.url(),
+    payloadHash: z.string().min(1),
+    // USER_CONTENT — the resource row being delivered OUTWARD to a customer's endpoint, so it can hold
+    // any personal data the resource holds. Same shape and same reasoning as the A2A push delivery log.
+    //
+    // `addDataCategories` because `z.unknown()` carries no prototype-installed decorators.
+    payload: addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),
+    status: z
+        .enum(M2MWebhookDeliveryLogStatus)
+        .default(M2MWebhookDeliveryLogStatus.PENDING)
+        .isDBIndexed()
+        .isSummaryField(),
+    attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),
+    lastAttemptAt: z.date().optional(),
+    nextAttemptAt: z.date().optional().isDBIndexed(),
+    responseStatus: z.number().int().optional(),
+    /** Capped at 4 KB by the worker before persistence (see Plan §D3). */
+    responseBodyTruncated: z.string().optional(),
+    failureReason: z.string().optional().isSummaryField(),
+    signatureJti: z.string().min(1),
+    deliveredAt: z.date().optional(),
+    failedAt: z.date().optional(),
+    createdAt: z
+        .date()
+        .default(() => new Date())
+        .isDBIndexed()
+        // Summary field: the enqueue time is core row identity for a delivery-log
+        // list (dashboards show per-row time and day-group by it — the LIST's
+        // `temporalGroupField: 'createdAt'` reads it from the SUMMARY DTO).
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate(),
+    updatedAt: z
+        .date()
+        .default(() => new Date())
+        .excludeFromCreate()
+        .excludeFromUpdate(),
+});
+// =============================================================================
+// POLYMORPHIC DECLARATION
+// =============================================================================
+/**
+ * Yields two `CoreResourceType` variants:
+ *   - `organizationM2mWebhookDeliveryLog` (FK: `organizationId`)
+ *   - `applicationM2mWebhookDeliveryLog` (FK: `applicationId`)
+ *
+ * Both are MANY-cardinality children of their respective scope —
+ * wired in `resources-registry.shared.core.definitions.ts` via
+ * `createPolymorphicScopeRelationships(...)` with `nature:
+ * COMPOSITION` and `onParentDelete: IMMEDIATE` so deleting the org/app
+ * cleanly drops its delivery history.
+ */
+export const m2mWebhookDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({
+    baseResourceType: 'm2mWebhookDeliveryLog',
+    baseFieldIdentifier: 'm2mWebhookDeliveryLogId',
+    baseEnumKey: 'M2M_WEBHOOK_DELIVERY_LOG',
+    baseSchema: M2MWebhookDeliveryLogBaseSchema,
+    // Many-rows-per-scope (each delivery attempt is its own document) — opt out
+    // of the polymorphism engine's singleton-per-scope business-key auto-default.
+    variants: M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL.map(optOutPolymorphicAutoBusinessKey),
+});
+//# sourceMappingURL=m2m-webhook-delivery-log.shared.schemas.js.map

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"m2m-webhook-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAmC;IACvE;QACE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa;QAClD,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC;QACzF,cAAc,EAAE,IAAI;KACrB;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;QAChD,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;QACvF,cAAc,EAAE,IAAI;KACrB;CACF,CAAC;AAEF,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAKX,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE;IAE5D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACtD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,mGAAmG;IACnG,oGAAoG;IACpG,EAAE;IACF,uFAAuF;IACvF,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC;IAE1E,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,2BAA2B,CAAC;SACjC,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC;SAC5C,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,sEAAsE;IACtE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;QACd,0EAA0E;QAC1E,sEAAsE;QACtE,oEAAoE;SACnE,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;IACtB,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;CACvB,CAAC,CAAC;AAIH,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,yBAAyB,CAAC;IACnF,gBAAgB,EAAE,uBAAuB;IACzC,mBAAmB,EAAE,yBAAyB;IAC9C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,+BAA+B;IAC3C,4EAA4E;IAC5E,8EAA8E;IAC9E,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/**\n * M2M Webhook Delivery Log Schema (Shared) — Polymorphic dual-scope\n *\n * Persistence collection that triple-purposes as:\n *   1. The pending delivery queue the worker drains (`status =\n *      PENDING`, polled by `(status, nextAttemptAt)`).\n *   2. The user-facing webhook event log (queryable by admins via\n *      READ/LIST/SEARCH; scope-appropriate role gating per\n *      `*.shared.resources-config.schemas.ts`).\n *   3. The retry checkpoint — failed attempts increment `attemptCount`\n *      and bump `nextAttemptAt`; final failure flips `status = FAILED`\n *      with `failureReason` populated.\n *\n * One row per (delivery target × notification fire). The polymorphism\n * engine injects `organizationId` (org variant) or `applicationId`\n * (app variant) — never both on the same row, so cross-tenant leaks are\n * structurally impossible.\n *\n * @see m2m-webhook-organization-delivery.md — Phase 2 / Step 4 (D3 lock-in)\n * @see security/authentications/siem/siem-delivery-dlq.shared.schemas.ts\n *   for the dual-scope polymorphic precedent this mirrors.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories } from '@wildo-ai/zod-decorators';\nimport { CoreM2MNotificationChannel } from '../notifications.shared.schemas';\nimport {\n  declarePolymorphicSchemas,\n  optOutPolymorphicAutoBusinessKey,\n  type PolymorphicVariantDefinition,\n} from '../../resources/utils/resource-polymorphism.schemas';\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../../resources/resources.shared.core.definitions';\n\n// =============================================================================\n// SHARED VARIANT DEFINITIONS\n// =============================================================================\n\n/**\n * Local copy of `M2M_WEBHOOK_SCOPE_VARIANTS` to avoid a sibling import\n * (which would couple the delivery-log schema to the config schema's\n * load order). The constant is intentionally re-declared identically;\n * any drift would be caught by Phase 3's runtime invariant in the\n * dispatcher (which asserts the resolved channel scope matches the\n * resource's primary scope).\n */\nconst M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL: PolymorphicVariantDefinition[] = [\n  {\n    parentResourceType: CoreResourceType.ORGANIZATIONS,\n    parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS],\n    isPrimaryScope: true,\n  },\n  {\n    parentResourceType: CoreResourceType.APPLICATION,\n    parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n    isPrimaryScope: true,\n  },\n];\n\n// =============================================================================\n// STATUS ENUM (4-state finite machine)\n// =============================================================================\n\n/**\n * Lifecycle transitions:\n *   PENDING → IN_FLIGHT → DELIVERED               (success path)\n *   PENDING → IN_FLIGHT → PENDING                 (transient failure, retry scheduled)\n *   PENDING → IN_FLIGHT → FAILED                  (final failure — `attemptCount` reached cap)\n *\n * The worker uses `(status, nextAttemptAt)` to find rows ready for\n * delivery; `IN_FLIGHT` is held only while a worker holds the lease.\n */\nexport const M2MWebhookDeliveryLogStatus = {\n  PENDING: 'pending',\n  IN_FLIGHT: 'in_flight',\n  DELIVERED: 'delivered',\n  FAILED: 'failed',\n} as const;\n\nexport type M2MWebhookDeliveryLogStatus =\n  (typeof M2MWebhookDeliveryLogStatus)[keyof typeof M2MWebhookDeliveryLogStatus];\n\n// =============================================================================\n// BASE SCHEMA (polymorphism injects the scope FK at variant time)\n// =============================================================================\n\n/**\n * Field rationale (per Plan §D3 lock-in):\n *\n * - `endpointId`            : Stable FK into `WebhookConfig.endpoints[].id` —\n *                             survives endpoint rename/url-edit so historical\n *                             rows remain reconcilable.\n * - `channel`               : Which notification channel triggered this row.\n *                             Pinned to `CoreM2MNotificationChannel` for type\n *                             safety; the spec/runtime invariant in the\n *                             dispatcher guarantees the channel is\n *                             scope-compatible with the resource.\n * - `resourceIdentifier` /\n *   `operationIdentifier` /\n *   `variantKey?`           : Provenance — what spec'd op fired the\n *                             notification (used by admin UIs and audit\n *                             correlation).\n * - `httpUrl`               : Snapshot of the destination URL at enqueue\n *                             time. Decoupled from `WebhookConfig.endpoints`\n *                             so URL edits don't rewrite history.\n * - `payloadHash` (sha256)  : Integrity tag — also embedded in the JWT\n *                             `bodyHash` claim. Lets consumers detect\n *                             body-vs-claim mismatch independently.\n * - `payload`               : Full POST body retained per Q1 lock-in\n *                             (`full` retention). Treated as `unknown` here\n *                             — the runtime shape is whatever\n *                             `serializeOperationResultForResponse(...)`\n *                             produced for the originating operation.\n * - `status`                : See `M2MWebhookDeliveryLogStatus`.\n * - `attemptCount`          : Incremented per attempt (success and\n *                             transient failure). Worker stops retrying\n *                             when this reaches the cap (Plan §D6).\n * - `lastAttemptAt?` /\n *   `nextAttemptAt?`        : Retry scheduling. `nextAttemptAt` is\n *                             cleared on `DELIVERED` / `FAILED`.\n * - `responseStatus?`       : HTTP status code from last attempt\n *                             (populated even on success for analytics).\n * - `responseBodyTruncated?`: First 4 KB of response body (per Plan §D3\n *                             retention cap) — useful for debugging.\n * - `failureReason?`        : Human-readable error summary for `FAILED`\n *                             rows.\n * - `signatureJti`          : JWT `jti` claim used to sign this delivery.\n *                             Stored so consumers can replay-detect.\n * - `deliveredAt?` /\n *   `failedAt?`             : Terminal-state timestamps.\n * - `createdAt`             : Enqueue time (immutable).\n *\n * Indexes (asserted at repository init in Phase 3):\n *   - `(<scopeId>, createdAt)` — admin UI queries (LIST/SEARCH)\n *   - `(status, nextAttemptAt)` — worker drain queries\n */\nexport const M2MWebhookDeliveryLogBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  endpointId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  channel: z.enum(CoreM2MNotificationChannel).isSummaryField(),\n\n  resourceIdentifier: z.string().min(1).isSummaryField(),\n  operationIdentifier: z.string().min(1).isSummaryField(),\n  variantKey: z.string().optional(),\n\n  httpUrl: z.url(),\n\n  payloadHash: z.string().min(1),\n  // USER_CONTENT — the resource row being delivered OUTWARD to a customer's endpoint, so it can hold\n  // any personal data the resource holds. Same shape and same reasoning as the A2A push delivery log.\n  //\n  // `addDataCategories` because `z.unknown()` carries no prototype-installed decorators.\n  payload: addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n\n  status: z\n    .enum(M2MWebhookDeliveryLogStatus)\n    .default(M2MWebhookDeliveryLogStatus.PENDING)\n    .isDBIndexed()\n    .isSummaryField(),\n\n  attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n  lastAttemptAt: z.date().optional(),\n  nextAttemptAt: z.date().optional().isDBIndexed(),\n\n  responseStatus: z.number().int().optional(),\n  /** Capped at 4 KB by the worker before persistence (see Plan §D3). */\n  responseBodyTruncated: z.string().optional(),\n  failureReason: z.string().optional().isSummaryField(),\n\n  signatureJti: z.string().min(1),\n\n  deliveredAt: z.date().optional(),\n  failedAt: z.date().optional(),\n\n  createdAt: z\n    .date()\n    .default(() => new Date())\n    .isDBIndexed()\n    // Summary field: the enqueue time is core row identity for a delivery-log\n    // list (dashboards show per-row time and day-group by it — the LIST's\n    // `temporalGroupField: 'createdAt'` reads it from the SUMMARY DTO).\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate(),\n  updatedAt: z\n    .date()\n    .default(() => new Date())\n    .excludeFromCreate()\n    .excludeFromUpdate(),\n});\n\nexport type M2MWebhookDeliveryLogBase = z.infer<typeof M2MWebhookDeliveryLogBaseSchema>;\n\n// =============================================================================\n// POLYMORPHIC DECLARATION\n// =============================================================================\n\n/**\n * Yields two `CoreResourceType` variants:\n *   - `organizationM2mWebhookDeliveryLog` (FK: `organizationId`)\n *   - `applicationM2mWebhookDeliveryLog` (FK: `applicationId`)\n *\n * Both are MANY-cardinality children of their respective scope —\n * wired in `resources-registry.shared.core.definitions.ts` via\n * `createPolymorphicScopeRelationships(...)` with `nature:\n * COMPOSITION` and `onParentDelete: IMMEDIATE` so deleting the org/app\n * cleanly drops its delivery history.\n */\nexport const m2mWebhookDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'm2mWebhookDeliveryLog',\n  baseFieldIdentifier: 'm2mWebhookDeliveryLogId',\n  baseEnumKey: 'M2M_WEBHOOK_DELIVERY_LOG',\n  baseSchema: M2MWebhookDeliveryLogBaseSchema,\n  // Many-rows-per-scope (each delivery attempt is its own document) — opt out\n  // of the polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/notifications/m2m/webhook-config.shared.resources-config.schemas.d.ts

@@ -0,0 +1,62 @@
+/**
+ * M2M Webhook Config Resource Configuration — Polymorphic dual-scope
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...webhookConfigPolymorphicFactories
+ *
+ * Operation set (mirrors SIEM Export Config singleton precedent):
+ *   - READ   (API)              : admin reads the config + derived public key
+ *   - CREATE (REPOSITORY_ONLY)  : seeded once per scope; not externally callable
+ *   - UPDATE (REPOSITORY_ONLY)  : admin edits via dedicated endpoint flow (not a public REST PUT)
+ *   - TEST_ENDPOINT (custom)    : fires a synthetic delivery to verify URL reachability
+ *
+ * @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5
+ * @see security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts
+ */
+import { z } from 'zod';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { WebhookEndpointProbeOutcome } from './webhook-config.shared.schemas';
+export declare enum WebhookConfig_Operations {
+    /**
+     * Synthetic delivery to verify URL reachability + signature
+     * verification on the consumer side. Targets a single endpoint
+     * (selected by `endpointId` in the request body); does not write to
+     * `M2MWebhookDeliveryLog` (test deliveries are excluded from the user
+     * event log to keep the log clean).
+     *
+     * The probe is `resourceOperationLike: UPDATE`, NOT `READ`. It performs no
+     * database write, but it DOES have an external side effect — a live signed
+     * POST leaves the platform and arrives at a customer-controlled URL. Borrowing
+     * READ made this a `GET` whose OpenAPI entry had to declare `x-idempotent: false`,
+     * a self-contradiction, and pushed `endpointId` into a query string. Borrowing
+     * UPDATE yields a `PUT` on the same custom-op sub-path, matching the
+     * `M2MWebhookDeliveryLog.retry` precedent (also a no-DB-write-of-its-own verb
+     * that triggers a delivery).
+     */
+    TEST_ENDPOINT = "testEndpoint"
+}
+export declare const WebhookConfig_TestEndpointRequestDto: z.ZodObject<{
+    endpointId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Diagnostic returned synchronously by `testEndpoint`.
+ *
+ * A transport-level failure at the customer endpoint is a successful PROBE and
+ * therefore answers HTTP 200 carrying `outcome: UNREACHABLE` — it is not an API
+ * error. API errors are reserved for faults in the request itself (unknown
+ * `endpointId`, no config row, rate limit exceeded).
+ */
+export declare const WebhookConfig_TestEndpointResponseDto: z.ZodObject<{
+    endpointId: z.ZodString;
+    url: z.ZodString;
+    outcome: z.ZodEnum<typeof WebhookEndpointProbeOutcome>;
+    responseStatus: z.ZodOptional<z.ZodNumber>;
+    responseBodyTruncated: z.ZodOptional<z.ZodString>;
+    failureReason: z.ZodOptional<z.ZodString>;
+    durationMs: z.ZodNumber;
+    signatureJti: z.ZodString;
+    attemptedAt: z.ZodDate;
+}, z.core.$strip>;
+export declare const webhookConfigPolymorphicFactories: Record<string, import("../..").ResourceConfiguration_InitializationFactory<typeof WebhookConfig_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE, any>>;
+//# sourceMappingURL=webhook-config.shared.resources-config.schemas.d.ts.map

package/dist/esm/notifications/m2m/webhook-config.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/webhook-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EAEtB,MAAM,mDAAmD,CAAC;AAQ3D,OAAO,EAAuC,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAMnH,oBAAY,wBAAwB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,iBAAiB;CAC/B;AAMD,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;iBAmBhD,CAAC;AAMH,eAAO,MAAM,iCAAiC,4OAkG7C,CAAC"}

package/dist/esm/notifications/m2m/webhook-config.shared.resources-config.schemas.js

@@ -0,0 +1,183 @@
+/**
+ * M2M Webhook Config Resource Configuration — Polymorphic dual-scope
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...webhookConfigPolymorphicFactories
+ *
+ * Operation set (mirrors SIEM Export Config singleton precedent):
+ *   - READ   (API)              : admin reads the config + derived public key
+ *   - CREATE (REPOSITORY_ONLY)  : seeded once per scope; not externally callable
+ *   - UPDATE (REPOSITORY_ONLY)  : admin edits via dedicated endpoint flow (not a public REST PUT)
+ *   - TEST_ENDPOINT (custom)    : fires a synthetic delivery to verify URL reachability
+ *
+ * @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5
+ * @see security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts
+ */
+import { z } from 'zod';
+import { CoreResourceOperation, CoreResourceType, } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../resources/resources.shared.schemas.js';
+import { createPolymorphicResourceConfigurations } from '../../resources/utils/resource-polymorphism.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas.js';
+import { webhookConfigPolymorphicDeclaration, WebhookEndpointProbeOutcome } from './webhook-config.shared.schemas.js';
+// =============================================================================
+// CUSTOM OPERATIONS
+// =============================================================================
+export var WebhookConfig_Operations;
+(function (WebhookConfig_Operations) {
+    /**
+     * Synthetic delivery to verify URL reachability + signature
+     * verification on the consumer side. Targets a single endpoint
+     * (selected by `endpointId` in the request body); does not write to
+     * `M2MWebhookDeliveryLog` (test deliveries are excluded from the user
+     * event log to keep the log clean).
+     *
+     * The probe is `resourceOperationLike: UPDATE`, NOT `READ`. It performs no
+     * database write, but it DOES have an external side effect — a live signed
+     * POST leaves the platform and arrives at a customer-controlled URL. Borrowing
+     * READ made this a `GET` whose OpenAPI entry had to declare `x-idempotent: false`,
+     * a self-contradiction, and pushed `endpointId` into a query string. Borrowing
+     * UPDATE yields a `PUT` on the same custom-op sub-path, matching the
+     * `M2MWebhookDeliveryLog.retry` precedent (also a no-DB-write-of-its-own verb
+     * that triggers a delivery).
+     */
+    WebhookConfig_Operations["TEST_ENDPOINT"] = "testEndpoint";
+})(WebhookConfig_Operations || (WebhookConfig_Operations = {}));
+// =============================================================================
+// REQUEST DTOs
+// =============================================================================
+export const WebhookConfig_TestEndpointRequestDto = z.object({
+    endpointId: z.string().min(1),
+});
+// =============================================================================
+// RESPONSE DTOs
+// =============================================================================
+/**
+ * Diagnostic returned synchronously by `testEndpoint`.
+ *
+ * A transport-level failure at the customer endpoint is a successful PROBE and
+ * therefore answers HTTP 200 carrying `outcome: UNREACHABLE` — it is not an API
+ * error. API errors are reserved for faults in the request itself (unknown
+ * `endpointId`, no config row, rate limit exceeded).
+ */
+export const WebhookConfig_TestEndpointResponseDto = z.object({
+    endpointId: z.string(),
+    /** Destination actually contacted, echoed so the admin can confirm the stored URL. */
+    url: z.string(),
+    outcome: z.enum(WebhookEndpointProbeOutcome),
+    /** HTTP status returned by the endpoint. Absent for `UNREACHABLE` / `NOT_SENT`. */
+    responseStatus: z.number().int().optional(),
+    /** Truncated response body, to let an admin read the consumer's own error text. */
+    responseBodyTruncated: z.string().optional(),
+    /** Network / timeout / signing failure detail. Absent when the endpoint answered. */
+    failureReason: z.string().optional(),
+    durationMs: z.number().int().nonnegative(),
+    /**
+     * `jti` of the signed probe. Stated so an admin can correlate this attempt with
+     * the entry in their own consumer's logs — the same dedup key a real delivery
+     * carries.
+     */
+    signatureJti: z.string(),
+    attemptedAt: z.date(),
+});
+// =============================================================================
+// POLYMORPHIC FACTORY
+// =============================================================================
+export const webhookConfigPolymorphicFactories = createPolymorphicResourceConfigurations(webhookConfigPolymorphicDeclaration, {
+    isSystemResource: true,
+    // Server-internal webhook delivery loads the (org/app) endpoint config via
+    // `readAsSystem`, independent of the triggering user's roles — the config
+    // governs runtime delivery behaviour, not user-facing data. READ-only.
+    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED },
+    customOperation: WebhookConfig_Operations,
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                },
+            ],
+        },
+        // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition
+        // onParentDelete cascade so this one-per-scope webhook-config row is physically
+        // removed when its owning org/app is deleted. Without a DELETE op the cascade
+        // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a
+        // config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                },
+            ],
+        },
+        [WebhookConfig_Operations.TEST_ENDPOINT]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // UPDATE-like, not READ-like — see the JSDoc on `TEST_ENDPOINT`. The
+                    // operation writes nothing, but it emits a live outbound request.
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: WebhookConfig_TestEndpointRequestDto,
+                    // Implemented by `createWebhookConfigTestEndpointFactories()` in
+                    // saas-backend-lib (REPLACE_CORE_OPERATIONS): the core write is
+                    // replaced by the synthetic delivery, and this diagnostic — NOT the
+                    // config row — is what the caller receives. Keep this contract in
+                    // lockstep with that implementation.
+                    customResponseDto: WebhookConfig_TestEndpointResponseDto,
+                },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=webhook-config.shared.resources-config.schemas.js.map