@wildo-ai/saas-models 1.1.0 → 1.1.2

package/dist/esm/applications/applications-context.schemas.d.ts

@@ -18,6 +18,7 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
             displayName: z.ZodOptional<z.ZodString>;
             description: z.ZodOptional<z.ZodString>;
             version: z.ZodString;
+            applicationId: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
         brandAssets: z.ZodOptional<z.ZodArray<z.ZodObject<{
             composition: z.ZodEnum<typeof import("..").BrandAssetComposition>;
@@ -323,6 +324,7 @@ export declare const ApplicationContextSchema: z.ZodObject<{
             displayName: z.ZodOptional<z.ZodString>;
             description: z.ZodOptional<z.ZodString>;
             version: z.ZodString;
+            applicationId: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
         brandAssets: z.ZodOptional<z.ZodArray<z.ZodObject<{
             composition: z.ZodEnum<typeof import("..").BrandAssetComposition>;

package/dist/esm/applications/applications-context.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"applications-context.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications-context.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"applications-context.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications-context.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/billing/billing-account.shared.resources-config.schemas.d.ts

@@ -41,5 +41,5 @@ export declare const BillingAccount_OpenPortalRequestDto: z.ZodObject<{
  *   - organizationBillingAccounts
  *   - userBillingAccounts
  */
-export declare const billingAccountsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<typeof BillingAccount_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+export declare const billingAccountsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<typeof BillingAccount_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=billing-account.shared.resources-config.schemas.d.ts.map

package/dist/esm/billing/billing-account.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-account.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAezG,oBAAY,yBAAyB;IACnC,wEAAwE;IACxE,aAAa,kBAAkB;IAC/B,kEAAkE;IAClE,WAAW,gBAAgB;IAC3B,6FAA6F;IAC7F,SAAS,cAAc;CACxB;AAID,8CAA8C;AAC9C,eAAO,MAAM,qCAAqC;;;;;;;;;iBAqChD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,uQA2J/C,CAAC"}
+{"version":3,"file":"billing-account.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAgBzG,oBAAY,yBAAyB;IACnC,wEAAwE;IACxE,aAAa,kBAAkB;IAC/B,kEAAkE;IAClE,WAAW,gBAAgB;IAC3B,6FAA6F;IAC7F,SAAS,cAAc;CACxB;AAID,8CAA8C;AAC9C,eAAO,MAAM,qCAAqC;;;;;;;;;iBAqChD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,2SAiM/C,CAAC"}

package/dist/esm/billing/billing-account.shared.resources-config.schemas.js

@@ -17,6 +17,7 @@ import { BILLING_CHECKOUT_MAX_QUANTITY, BILLING_RESERVED_METADATA_KEY_PREFIX } f
 import { billingAccountsPolymorphicDeclaration } from './billing-account.shared.schemas.js';
 import { BillingStateResponseSchema } from './billing-types.shared.schemas.js';
 import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 // ── Custom Operations ────────────────────────────────────────────────
 export var BillingAccount_Operations;
 (function (BillingAccount_Operations) {
@@ -105,6 +106,24 @@ export const billingAccountsPolymorphicFactories = createPolymorphicResourceConf
         list: ResourceSystemAccessMode.ALLOWED,
     },
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /**
+     * Subject erasure RETAINS this row and scrubs the provider customer id.
+ *
+ * The financial record is kept for the tax/audit obligation this family exists to serve, and — as the
+ * family's authoring rule states — erasure scrubs the linked USER rather than these rows, because the
+ * person is a foreign key. `providerCustomerId` is the exception the rule does not cover: it is a stable
+ * handle that re-identifies the person INSIDE the payment provider, so it is personal data this row holds.
+ * It takes `REMOVE`; everything else is retained.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the
+ *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own
+ *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     customOperation: BillingAccount_Operations,
     coreOperations: [
         CoreResourceOperation.READ,
@@ -112,8 +131,25 @@ export const billingAccountsPolymorphicFactories = createPolymorphicResourceConf
         CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
         CoreResourceOperation.DELETE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it
+         * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the
+         * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the
+         * verb the impersonalize writer uses to stamp the retention markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [{
                     // API_CALL: the billing account is a user-facing record (Settings Hub → Billing →

package/dist/esm/billing/billing-account.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-account.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACrH,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,wEAAwE;AAExE,MAAM,CAAN,IAAY,yBAOX;AAPD,WAAY,yBAAyB;IACnC,wEAAwE;IACxE,4DAA+B,CAAA;IAC/B,kEAAkE;IAClE,wDAA2B,CAAA;IAC3B,6FAA6F;IAC7F,oDAAuB,CAAA;AACzB,CAAC,EAPW,yBAAyB,KAAzB,yBAAyB,QAOpC;AAED,wEAAwE;AAExE,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;IAClB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,oCAAoC,CAAC,EAC9D,gCAAgC,oCAAoC,sEAAsE,CAC3I,EACD,CAAC,CAAC,MAAM,EAAE,CACX;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;CACnB,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,oFAAoF;IACpF,kBAAkB,EAAE;QAClB,oSAAoS;QACpS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,yFAAyF;QACzF,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,uCAAuC;QACvC,EAAE;QACF,0FAA0F;QAC1F,yEAAyE;QACzE,2FAA2F;QAC3F,yFAAyF;QACzF,mCAAmC;QACnC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E,eAAe,EAAE,yBAAyB;IAC1C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,kFAAkF;oBAClF,mFAAmF;oBACnF,oFAAoF;oBACpF,yFAAyF;oBACzF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,aAAa,CAAC,EAAE;YACzC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,qCAAqC;oBACjD,sEAAsE;oBACtE,0EAA0E;oBAC1E,yEAAyE;oBACzE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;qBACtB,CAAC;iBACH,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,mCAAmC;oBAC/C,kEAAkE;oBAClE,kDAAkD;oBAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;qBACb,CAAC;iBACH,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE;YACrC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,KAAK;oBAClD,sEAAsE;oBACtE,sEAAsE;oBACtE,sEAAsE;oBACtE,sDAAsD;oBACtD,iBAAiB,EAAE,0BAA0B;iBAC9C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Billing Account Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...billingAccountsPolymorphicFactories\n *\n * @see polymorphic-scope-approach-A-expansion.md — Phase 3\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { BILLING_CHECKOUT_MAX_QUANTITY, BILLING_RESERVED_METADATA_KEY_PREFIX } from './billing-enums.shared.schemas';\nimport { billingAccountsPolymorphicDeclaration } from './billing-account.shared.schemas';\nimport { BillingStateResponseSchema } from './billing-types.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingAccount_Operations {\n  /** Create a Stripe Checkout Session for the user to complete payment */\n  OPEN_CHECKOUT = 'open_checkout',\n  /** Open the Stripe Customer Portal for self-service management */\n  OPEN_PORTAL = 'open_portal',\n  /** Fetch aggregated billing state (account, subscription, products, prices, credit pools) */\n  GET_STATE = 'get_state',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/** Request DTO for OPEN_CHECKOUT operation */\nexport const BillingAccount_OpenCheckoutRequestDto = z.object({\n  productKey: z.string().min(1),\n  priceId: z.string().min(1),\n  successUrl: z.url(),\n  cancelUrl: z.url(),\n  /**\n   * Bounded by the same constant the webhook consumer honours. An unbounded quantity here would be\n   * billed by the provider and then refused on the way back in, charging the customer for credits\n   * that never arrive.\n   */\n  quantity: z.number().int().min(1).max(BILLING_CHECKOUT_MAX_QUANTITY).default(1),\n  trialDays: z.number().min(0).optional(),\n  promotionCode: z.string().optional(),\n  /**\n   * Caller-supplied tags mirrored to the provider for the application's own analytics or\n   * reconciliation. They carry NO authority.\n   *\n   * Keys in the framework-reserved namespace are REFUSED here rather than silently dropped: the\n   * caller is trying to write into the namespace that decides which billing account gets credited\n   * and by how much, and an app developer who typed a reserved key deserves to be told, not to\n   * watch their tag vanish. Refusal at the DTO is the loud, outermost half of the boundary; the\n   * builder's write-reserved-last ordering and the consumer's read-only-reserved rule are the two\n   * structural halves. See {@link BILLING_RESERVED_METADATA_KEY_PREFIX}.\n   *\n   * The refinement sits on the KEY schema, not on the record: it keeps the DTO a plain `ZodRecord`\n   * for the OpenAPI projector and the request-validation pipeline, where a wrapping effect would\n   * change the node type every consumer of this DTO narrows on.\n   */\n  metadata: z\n    .record(\n      z.string().refine(\n        (key) => !key.startsWith(BILLING_RESERVED_METADATA_KEY_PREFIX),\n        `Metadata keys starting with \"${BILLING_RESERVED_METADATA_KEY_PREFIX}\" are reserved by the framework and cannot be supplied by the caller`,\n      ),\n      z.string(),\n    )\n    .optional(),\n});\n\n/** Request DTO for OPEN_PORTAL operation */\nexport const BillingAccount_OpenPortalRequestDto = z.object({\n  returnUrl: z.url(),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/**\n * Polymorphic factory map for billing accounts.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...billingAccountsPolymorphicFactories\n *\n * Produces entries for:\n *   - organizationBillingAccounts\n *   - userBillingAccounts\n */\nexport const billingAccountsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  billingAccountsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // System-context CREATE opt-in (fail-closed default is FORBIDDEN). The billing\n    // account is auto-created by `BillingStateBackendService.getState()` on first\n    // access via `SystemAccessBackendService.createAsSystem` — a trusted in-process\n    // write with no HTTP surface and no request context to seed the scope FK. That\n    // path relocates the ACL onto the billing service (which has already resolved\n    // the scope) and injects the scope FK (`organizationId` / `userId`) through the\n    // execution context map. Resource-level and shared by BOTH scope variants\n    // (org + user) per the polymorphic-resource contract on ResourceSystemAccessPolicy.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own billing account. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      // System-context LIST opt-in. Subject erasure must enumerate the erased person's billing\n      // accounts to reach their provider customer (cancel subscriptions, anonymize, detach payment\n      // methods). That runs with no request context — the subject is being erased — so it reads\n      // through `SystemAccessBackendService.listAsSystem`, which is fail-closed and refuses a\n      // resource that has not opted in here.\n      //\n      // Safe to grant: LIST is the READ side, and the erasure path filters by the subject's own\n      // scope FK. The default LIST variant is API_CALL, so it resolves through\n      // `getServiceOperationPathDefault` — a REPOSITORY_ONLY-only LIST would pass this grant and\n      // then fail to resolve at erasure time, which is the failure mode this comment exists to\n      // stop someone from reintroducing.\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n    customOperation: BillingAccount_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: the billing account is a user-facing record (Settings Hub → Billing →\n          // Account, and the resource presets' LIST/READ views). REPOSITORY_ONLY would strip\n          // the op from the frontend registry and register no HTTP route. Writes (auto-create\n          // + webhook sync) are INTERNAL_CALL — run through the service pipeline, no HTTP surface.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [BillingAccount_Operations.OPEN_CHECKOUT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingAccount_OpenCheckoutRequestDto,\n          // Borrows UPDATE for its route/verb but returns the provider checkout\n          // session, NOT the billing-account resource. Without this the DTO builder\n          // would validate the service output against the resource schema and 500.\n          customResponseDto: z.object({\n            url: z.url(),\n            sessionId: z.string(),\n          }),\n        }],\n      },\n      [BillingAccount_Operations.OPEN_PORTAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: BillingAccount_OpenPortalRequestDto,\n          // Borrows READ for its route/verb but returns the provider portal\n          // redirect URL, NOT the billing-account resource.\n          customResponseDto: z.object({\n            url: z.url(),\n          }),\n        }],\n      },\n      [BillingAccount_Operations.GET_STATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.COUNT,\n          // Borrows COUNT for its route/verb but returns the aggregated billing\n          // state bundle, NOT a `{ count }`. Without this the DTO builder would\n          // assign the COUNT default envelope and the service output would fail\n          // `transformOutput`'s `internalDto.parse` → HTTP 500.\n          customResponseDto: BillingStateResponseSchema,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"billing-account.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACrH,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,yBAOX;AAPD,WAAY,yBAAyB;IACnC,wEAAwE;IACxE,4DAA+B,CAAA;IAC/B,kEAAkE;IAClE,wDAA2B,CAAA;IAC3B,6FAA6F;IAC7F,oDAAuB,CAAA;AACzB,CAAC,EAPW,yBAAyB,KAAzB,yBAAyB,QAOpC;AAED,wEAAwE;AAExE,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;IAClB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,oCAAoC,CAAC,EAC9D,gCAAgC,oCAAoC,sEAAsE,CAC3I,EACD,CAAC,CAAC,MAAM,EAAE,CACX;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;CACnB,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,oFAAoF;IACpF,kBAAkB,EAAE;QAClB,oSAAoS;QACpS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,yFAAyF;QACzF,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,uCAAuC;QACvC,EAAE;QACF,0FAA0F;QAC1F,yEAAyE;QACzE,2FAA2F;QAC3F,yFAAyF;QACzF,mCAAmC;QACnC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,eAAe,EAAE,yBAAyB;IAC1C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,kFAAkF;oBAClF,mFAAmF;oBACnF,oFAAoF;oBACpF,yFAAyF;oBACzF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,aAAa,CAAC,EAAE;YACzC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,qCAAqC;oBACjD,sEAAsE;oBACtE,0EAA0E;oBAC1E,yEAAyE;oBACzE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;qBACtB,CAAC;iBACH,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,mCAAmC;oBAC/C,kEAAkE;oBAClE,kDAAkD;oBAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;qBACb,CAAC;iBACH,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE;YACrC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,KAAK;oBAClD,sEAAsE;oBACtE,sEAAsE;oBACtE,sEAAsE;oBACtE,sDAAsD;oBACtD,iBAAiB,EAAE,0BAA0B;iBAC9C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Billing Account Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...billingAccountsPolymorphicFactories\n *\n * @see polymorphic-scope-approach-A-expansion.md — Phase 3\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { BILLING_CHECKOUT_MAX_QUANTITY, BILLING_RESERVED_METADATA_KEY_PREFIX } from './billing-enums.shared.schemas';\nimport { billingAccountsPolymorphicDeclaration } from './billing-account.shared.schemas';\nimport { BillingStateResponseSchema } from './billing-types.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingAccount_Operations {\n  /** Create a Stripe Checkout Session for the user to complete payment */\n  OPEN_CHECKOUT = 'open_checkout',\n  /** Open the Stripe Customer Portal for self-service management */\n  OPEN_PORTAL = 'open_portal',\n  /** Fetch aggregated billing state (account, subscription, products, prices, credit pools) */\n  GET_STATE = 'get_state',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/** Request DTO for OPEN_CHECKOUT operation */\nexport const BillingAccount_OpenCheckoutRequestDto = z.object({\n  productKey: z.string().min(1),\n  priceId: z.string().min(1),\n  successUrl: z.url(),\n  cancelUrl: z.url(),\n  /**\n   * Bounded by the same constant the webhook consumer honours. An unbounded quantity here would be\n   * billed by the provider and then refused on the way back in, charging the customer for credits\n   * that never arrive.\n   */\n  quantity: z.number().int().min(1).max(BILLING_CHECKOUT_MAX_QUANTITY).default(1),\n  trialDays: z.number().min(0).optional(),\n  promotionCode: z.string().optional(),\n  /**\n   * Caller-supplied tags mirrored to the provider for the application's own analytics or\n   * reconciliation. They carry NO authority.\n   *\n   * Keys in the framework-reserved namespace are REFUSED here rather than silently dropped: the\n   * caller is trying to write into the namespace that decides which billing account gets credited\n   * and by how much, and an app developer who typed a reserved key deserves to be told, not to\n   * watch their tag vanish. Refusal at the DTO is the loud, outermost half of the boundary; the\n   * builder's write-reserved-last ordering and the consumer's read-only-reserved rule are the two\n   * structural halves. See {@link BILLING_RESERVED_METADATA_KEY_PREFIX}.\n   *\n   * The refinement sits on the KEY schema, not on the record: it keeps the DTO a plain `ZodRecord`\n   * for the OpenAPI projector and the request-validation pipeline, where a wrapping effect would\n   * change the node type every consumer of this DTO narrows on.\n   */\n  metadata: z\n    .record(\n      z.string().refine(\n        (key) => !key.startsWith(BILLING_RESERVED_METADATA_KEY_PREFIX),\n        `Metadata keys starting with \"${BILLING_RESERVED_METADATA_KEY_PREFIX}\" are reserved by the framework and cannot be supplied by the caller`,\n      ),\n      z.string(),\n    )\n    .optional(),\n});\n\n/** Request DTO for OPEN_PORTAL operation */\nexport const BillingAccount_OpenPortalRequestDto = z.object({\n  returnUrl: z.url(),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/**\n * Polymorphic factory map for billing accounts.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...billingAccountsPolymorphicFactories\n *\n * Produces entries for:\n *   - organizationBillingAccounts\n *   - userBillingAccounts\n */\nexport const billingAccountsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  billingAccountsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // System-context CREATE opt-in (fail-closed default is FORBIDDEN). The billing\n    // account is auto-created by `BillingStateBackendService.getState()` on first\n    // access via `SystemAccessBackendService.createAsSystem` — a trusted in-process\n    // write with no HTTP surface and no request context to seed the scope FK. That\n    // path relocates the ACL onto the billing service (which has already resolved\n    // the scope) and injects the scope FK (`organizationId` / `userId`) through the\n    // execution context map. Resource-level and shared by BOTH scope variants\n    // (org + user) per the polymorphic-resource contract on ResourceSystemAccessPolicy.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own billing account. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      // System-context LIST opt-in. Subject erasure must enumerate the erased person's billing\n      // accounts to reach their provider customer (cancel subscriptions, anonymize, detach payment\n      // methods). That runs with no request context — the subject is being erased — so it reads\n      // through `SystemAccessBackendService.listAsSystem`, which is fail-closed and refuses a\n      // resource that has not opted in here.\n      //\n      // Safe to grant: LIST is the READ side, and the erasure path filters by the subject's own\n      // scope FK. The default LIST variant is API_CALL, so it resolves through\n      // `getServiceOperationPathDefault` — a REPOSITORY_ONLY-only LIST would pass this grant and\n      // then fail to resolve at erasure time, which is the failure mode this comment exists to\n      // stop someone from reintroducing.\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the provider customer id.\n *\n * The financial record is kept for the tax/audit obligation this family exists to serve, and — as the\n * family's authoring rule states — erasure scrubs the linked USER rather than these rows, because the\n * person is a foreign key. `providerCustomerId` is the exception the rule does not cover: it is a stable\n * handle that re-identifies the person INSIDE the payment provider, so it is personal data this row holds.\n * It takes `REMOVE`; everything else is retained.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    customOperation: BillingAccount_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: the billing account is a user-facing record (Settings Hub → Billing →\n          // Account, and the resource presets' LIST/READ views). REPOSITORY_ONLY would strip\n          // the op from the frontend registry and register no HTTP route. Writes (auto-create\n          // + webhook sync) are INTERNAL_CALL — run through the service pipeline, no HTTP surface.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [BillingAccount_Operations.OPEN_CHECKOUT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingAccount_OpenCheckoutRequestDto,\n          // Borrows UPDATE for its route/verb but returns the provider checkout\n          // session, NOT the billing-account resource. Without this the DTO builder\n          // would validate the service output against the resource schema and 500.\n          customResponseDto: z.object({\n            url: z.url(),\n            sessionId: z.string(),\n          }),\n        }],\n      },\n      [BillingAccount_Operations.OPEN_PORTAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: BillingAccount_OpenPortalRequestDto,\n          // Borrows READ for its route/verb but returns the provider portal\n          // redirect URL, NOT the billing-account resource.\n          customResponseDto: z.object({\n            url: z.url(),\n          }),\n        }],\n      },\n      [BillingAccount_Operations.GET_STATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.COUNT,\n          // Borrows COUNT for its route/verb but returns the aggregated billing\n          // state bundle, NOT a `{ count }`. Without this the DTO builder would\n          // assign the COUNT default envelope and the service output would fail\n          // `transformOutput`'s `internalDto.parse` → HTTP 500.\n          customResponseDto: BillingStateResponseSchema,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/billing-account.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-account.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,OAAO,EAA6B,KAAK,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAOhI;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,4BAA4B,EAGhE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,oBAAoB,EAGzD,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,uCAAuC,EAAE,oBAAoB,EAWzE,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBA0CnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;kBAMhD,CAAC;AAMH,eAAO,MAAM,oBAAoB;;;;;;;;iBAA2B,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"billing-account.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,OAAO,EAA6B,KAAK,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAShI;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,4BAA4B,EAGhE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,oBAAoB,EAGzD,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,uCAAuC,EAAE,oBAAoB,EAWzE,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAkDnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;kBAMhD,CAAC;AAMH,eAAO,MAAM,oBAAoB;;;;;;;;iBAA2B,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/billing/billing-account.shared.schemas.js

@@ -23,6 +23,8 @@ import { PersonalDataCategory } from '../compliance/privacy/personal-data-catego
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
 import { declarePolymorphicSchemas } from '../resources/utils/resource-polymorphism.schemas.js';
 import { BillingScopeType } from './billing-enums.shared.schemas.js';
+import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
+import { addImpersonalizeWith } from '@wildo-ai/zod-decorators';
 // =============================================================================
 // SHARED VARIANT DEFINITIONS
 // =============================================================================
@@ -101,7 +103,12 @@ export const BillingAccountBaseSchema = z.object({
     // hypothetical user-only variant would UNDER-report, which is the silent failure a notice must
     // never make; declaring on both at worst tells a reader the operator holds financial data, which
     // it does. The same note applies to the invoice, usage, credit-pool and subscription siblings.
-    providerCustomerId: z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),
+    // REMOVE on erasure. This is the person's identifier AT THE PAYMENT PROVIDER — a stable handle that
+    // re-identifies them in a system we do not own, which is personal data this row HOLDS rather than a
+    // link it merely carries. The provider-side customer is retired by the billing subject-erasure
+    // external effect, so keeping the id afterwards would leave a dangling pointer at a deleted person.
+    // Clearable: the field is `.optional()`, so REMOVE resolves to a removed key rather than a rejected null.
+    providerCustomerId: addImpersonalizeWith(z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL), RedactionType.REMOVE),
     /** Which provider (e.g., 'stripe') */
     providerRef: z.string().optional().isBackendOnly(),
     /** Status */

package/dist/esm/billing/billing-account.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-account.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAqC,MAAM,kDAAkD,CAAC;AAChI,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmC;IACpE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA2B,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;IACxC,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;CAC/C,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAA2B;IAC7E;QACE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa;QAClD,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC;QACzF,kBAAkB,EAAE,gBAAgB,CAAC,aAAa;KACnD;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;QAC1C,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;QACjF,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;KAC/C;CACF,CAAC;AAEF,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gEAAgE;IAChE,iFAAiF;IACjF,EAAE;IACF,2FAA2F;IAC3F,iGAAiG;IACjG,mGAAmG;IACnG,2FAA2F;IAC3F,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IACxG,sCAAsC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAElD,aAAa;IACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAElE;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,yBAAyB,CAAC;IAC7E,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,kBAAkB;IACvC,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,wBAAwB;IACpC,QAAQ,EAAE,sBAAsB;CACjC,CAAC,CAAC;AAEH,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC","sourcesContent":["/**\n * Billing Account Schema (Shared) — Polymorphic\n *\n * BillingAccount is the PURE SCOPE BRIDGE between a Wildo entity and the billing provider.\n *\n * POLYMORPHIC EXPANSION: The base schema does NOT contain identity scope fields\n * (organizationId, userId). These are injected per variant by\n * `declarePolymorphicSchemas()`, producing 2 concrete resources:\n *   - organizationBillingAccounts  (with organizationId)\n *   - userBillingAccounts          (with userId)\n *\n * DELEGATION PRINCIPLE: All customer details (contact info, billing address, tax IDs,\n * payment methods) are managed by the provider. BillingAccount stores ONLY:\n * 1. The provider reference (which provider customer this maps to)\n * 2. Status\n * The scope reference is the injected identity FK.\n *\n * @see polymorphic-scope-approach-A-expansion.md\n * @see billing-and-features-system.md §6.1 (Core Design)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport type { PolymorphicFkVariant } from '@wildo-ai/zod-decorators';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { declarePolymorphicSchemas, type PolymorphicVariantDefinition } from '../resources/utils/resource-polymorphism.schemas';\nimport { BillingScopeType } from './billing-enums.shared.schemas';\n\n// =============================================================================\n// SHARED VARIANT DEFINITIONS\n// =============================================================================\n\n/**\n * The 2 billing scope variants — shared across BillingAccounts, Subscriptions, and children.\n * Centralised here to avoid repetition (DX concern from plan remarks #1).\n */\nexport const BILLING_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n];\n\n/**\n * FK variant definitions for child resources referencing polymorphic billing accounts.\n * Used on `billingAccountId` fields as: `.isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS })`\n *\n * This tells the polymorphic engine to rename `billingAccountId` per variant:\n *   - organizations → `organizationBillingAccountId`\n *   - users → `userBillingAccountId`\n */\nexport const BILLING_SCOPE_FK_VARIANTS: PolymorphicFkVariant[] = BILLING_SCOPE_VARIANTS.map(v => ({\n  parentResourceType: v.parentResourceType,\n  parentFieldIdentifier: v.parentFieldIdentifier,\n}));\n\n/**\n * FK variant definitions for a SHARED-FIELD DISCRIMINATED polymorphic\n * billing-account FK — e.g. a referral's `referrerBillingAccountId`, a single\n * column on the flat `referrals` resource that points at EITHER a user OR an\n * organization billing account, with the branch chosen PER RECORD by a sibling\n * `*ScopeType` field.\n *\n * Same scope branches as {@link BILLING_SCOPE_FK_VARIANTS}, but each variant\n * additionally carries the `discriminatorValue` ({@link BillingScopeType}) that\n * the holder record's discriminator field uses to select the branch. Declare as:\n *\n * ```ts\n * referrerBillingAccountId: z.string().min(1).isForeignKey({\n *   polymorphicVariants: BILLING_SCOPE_DISCRIMINATED_FK_VARIANTS,\n *   polymorphicDiscriminatorField: 'referrerScopeType',\n * })\n * ```\n *\n * Contrast with {@link BILLING_SCOPE_FK_VARIANTS} (rename-only, used when the\n * HOLDER is itself polymorphically expanded). The branch TARGET is resolved at\n * runtime via the scope bridge: `discriminatorValue` selects the variant, whose\n * `parentResourceType` scope root matches the branch's `resourcePrimaryScope`.\n */\nexport const BILLING_SCOPE_DISCRIMINATED_FK_VARIANTS: PolymorphicFkVariant[] = [\n  {\n    parentResourceType: CoreResourceType.ORGANIZATIONS,\n    parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS],\n    discriminatorValue: BillingScopeType.ORGANIZATIONS,\n  },\n  {\n    parentResourceType: CoreResourceType.USERS,\n    parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],\n    discriminatorValue: BillingScopeType.USER_SELF,\n  },\n];\n\n// =============================================================================\n// BASE SCHEMA\n// =============================================================================\n\n/**\n * BillingAccount base schema — NO identity scope fields.\n * The polymorphic declaration injects the parent FK (organizationId / userId)\n * automatically per variant.\n */\nexport const BillingAccountBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** Provider sync - the ONLY provider-side reference we store */\n  // ── FINANCIAL, and declared on the SHARED base rather than per scope variant ──\n  //\n  // This family is polymorphic: `userBillingAccounts` holds a person's billing relationship,\n  // `organizationBillingAccounts` a company's, and both are built from this one schema. A category\n  // declared here therefore reaches both, and that is the direction to err in — an organization on a\n  // single-seat plan is one person, and the framework cannot tell which. Declaring only on a\n  // hypothetical user-only variant would UNDER-report, which is the silent failure a notice must\n  // never make; declaring on both at worst tells a reader the operator holds financial data, which\n  // it does. The same note applies to the invoice, usage, credit-pool and subscription siblings.\n  providerCustomerId: z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n  /** Which provider (e.g., 'stripe') */\n  providerRef: z.string().optional().isBackendOnly(),\n\n  /** Status */\n  isActive: z.boolean().default(true).isDBIndexed().isSummaryField(),\n\n  /**\n   * Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n   *\n   * ⚠️ **AUTHORING RULE — never store personal data here.** This row is RETAINED when its subject is\n   * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n   * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n   * personal data of its own — the person is a foreign key. An open bag is the one place that\n   * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n   * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n   * keys it does not know.\n   *\n   * Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n   * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n   * breach that the retained label makes look intentional.\n   *\n   * Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n   * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n   * Revisit only if an app is found using the bag this way.\n   */\n  metadata: z.record(z.string(), z.string()).optional(),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type BillingAccountBase = z.infer<typeof BillingAccountBaseSchema>;\n\n// =============================================================================\n// POLYMORPHIC DECLARATION\n// =============================================================================\n\n/**\n * Polymorphic declaration for BillingAccounts.\n * Produces 2 variants:\n *   - organizations  → organizationBillingAccounts  (organizationId injected)\n *   - users          → userBillingAccounts          (userId injected)\n */\nexport const billingAccountsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'billingAccounts',\n  baseFieldIdentifier: 'billingAccountId',\n  baseEnumKey: 'BILLING_ACCOUNTS',\n  baseSchema: BillingAccountBaseSchema,\n  variants: BILLING_SCOPE_VARIANTS,\n});\n\n// =============================================================================\n// EXPORTED SCHEMA & TYPE\n// =============================================================================\n\nexport const BillingAccountSchema = BillingAccountBaseSchema;\nexport type BillingAccount = z.infer<typeof BillingAccountBaseSchema>;\n"]}
+{"version":3,"file":"billing-account.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAqC,MAAM,kDAAkD,CAAC;AAChI,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmC;IACpE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA2B,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;IACxC,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;CAC/C,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAA2B;IAC7E;QACE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa;QAClD,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC;QACzF,kBAAkB,EAAE,gBAAgB,CAAC,aAAa;KACnD;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;QAC1C,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;QACjF,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;KAC/C;CACF,CAAC;AAEF,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gEAAgE;IAChE,iFAAiF;IACjF,EAAE;IACF,2FAA2F;IAC3F,iGAAiG;IACjG,mGAAmG;IACnG,2FAA2F;IAC3F,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,oGAAoG;IACpG,oGAAoG;IACpG,+FAA+F;IAC/F,oGAAoG;IACpG,0GAA0G;IAC1G,kBAAkB,EAAE,oBAAoB,CACtC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IACD,sCAAsC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAElD,aAAa;IACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAElE;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,yBAAyB,CAAC;IAC7E,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,kBAAkB;IACvC,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,wBAAwB;IACpC,QAAQ,EAAE,sBAAsB;CACjC,CAAC,CAAC;AAEH,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC","sourcesContent":["/**\n * Billing Account Schema (Shared) — Polymorphic\n *\n * BillingAccount is the PURE SCOPE BRIDGE between a Wildo entity and the billing provider.\n *\n * POLYMORPHIC EXPANSION: The base schema does NOT contain identity scope fields\n * (organizationId, userId). These are injected per variant by\n * `declarePolymorphicSchemas()`, producing 2 concrete resources:\n *   - organizationBillingAccounts  (with organizationId)\n *   - userBillingAccounts          (with userId)\n *\n * DELEGATION PRINCIPLE: All customer details (contact info, billing address, tax IDs,\n * payment methods) are managed by the provider. BillingAccount stores ONLY:\n * 1. The provider reference (which provider customer this maps to)\n * 2. Status\n * The scope reference is the injected identity FK.\n *\n * @see polymorphic-scope-approach-A-expansion.md\n * @see billing-and-features-system.md §6.1 (Core Design)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport type { PolymorphicFkVariant } from '@wildo-ai/zod-decorators';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { declarePolymorphicSchemas, type PolymorphicVariantDefinition } from '../resources/utils/resource-polymorphism.schemas';\nimport { BillingScopeType } from './billing-enums.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\n// =============================================================================\n// SHARED VARIANT DEFINITIONS\n// =============================================================================\n\n/**\n * The 2 billing scope variants — shared across BillingAccounts, Subscriptions, and children.\n * Centralised here to avoid repetition (DX concern from plan remarks #1).\n */\nexport const BILLING_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n];\n\n/**\n * FK variant definitions for child resources referencing polymorphic billing accounts.\n * Used on `billingAccountId` fields as: `.isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS })`\n *\n * This tells the polymorphic engine to rename `billingAccountId` per variant:\n *   - organizations → `organizationBillingAccountId`\n *   - users → `userBillingAccountId`\n */\nexport const BILLING_SCOPE_FK_VARIANTS: PolymorphicFkVariant[] = BILLING_SCOPE_VARIANTS.map(v => ({\n  parentResourceType: v.parentResourceType,\n  parentFieldIdentifier: v.parentFieldIdentifier,\n}));\n\n/**\n * FK variant definitions for a SHARED-FIELD DISCRIMINATED polymorphic\n * billing-account FK — e.g. a referral's `referrerBillingAccountId`, a single\n * column on the flat `referrals` resource that points at EITHER a user OR an\n * organization billing account, with the branch chosen PER RECORD by a sibling\n * `*ScopeType` field.\n *\n * Same scope branches as {@link BILLING_SCOPE_FK_VARIANTS}, but each variant\n * additionally carries the `discriminatorValue` ({@link BillingScopeType}) that\n * the holder record's discriminator field uses to select the branch. Declare as:\n *\n * ```ts\n * referrerBillingAccountId: z.string().min(1).isForeignKey({\n *   polymorphicVariants: BILLING_SCOPE_DISCRIMINATED_FK_VARIANTS,\n *   polymorphicDiscriminatorField: 'referrerScopeType',\n * })\n * ```\n *\n * Contrast with {@link BILLING_SCOPE_FK_VARIANTS} (rename-only, used when the\n * HOLDER is itself polymorphically expanded). The branch TARGET is resolved at\n * runtime via the scope bridge: `discriminatorValue` selects the variant, whose\n * `parentResourceType` scope root matches the branch's `resourcePrimaryScope`.\n */\nexport const BILLING_SCOPE_DISCRIMINATED_FK_VARIANTS: PolymorphicFkVariant[] = [\n  {\n    parentResourceType: CoreResourceType.ORGANIZATIONS,\n    parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS],\n    discriminatorValue: BillingScopeType.ORGANIZATIONS,\n  },\n  {\n    parentResourceType: CoreResourceType.USERS,\n    parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],\n    discriminatorValue: BillingScopeType.USER_SELF,\n  },\n];\n\n// =============================================================================\n// BASE SCHEMA\n// =============================================================================\n\n/**\n * BillingAccount base schema — NO identity scope fields.\n * The polymorphic declaration injects the parent FK (organizationId / userId)\n * automatically per variant.\n */\nexport const BillingAccountBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** Provider sync - the ONLY provider-side reference we store */\n  // ── FINANCIAL, and declared on the SHARED base rather than per scope variant ──\n  //\n  // This family is polymorphic: `userBillingAccounts` holds a person's billing relationship,\n  // `organizationBillingAccounts` a company's, and both are built from this one schema. A category\n  // declared here therefore reaches both, and that is the direction to err in — an organization on a\n  // single-seat plan is one person, and the framework cannot tell which. Declaring only on a\n  // hypothetical user-only variant would UNDER-report, which is the silent failure a notice must\n  // never make; declaring on both at worst tells a reader the operator holds financial data, which\n  // it does. The same note applies to the invoice, usage, credit-pool and subscription siblings.\n  // REMOVE on erasure. This is the person's identifier AT THE PAYMENT PROVIDER — a stable handle that\n  // re-identifies them in a system we do not own, which is personal data this row HOLDS rather than a\n  // link it merely carries. The provider-side customer is retired by the billing subject-erasure\n  // external effect, so keeping the id afterwards would leave a dangling pointer at a deleted person.\n  // Clearable: the field is `.optional()`, so REMOVE resolves to a removed key rather than a rejected null.\n  providerCustomerId: addImpersonalizeWith(\n    z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n    RedactionType.REMOVE,\n  ),\n  /** Which provider (e.g., 'stripe') */\n  providerRef: z.string().optional().isBackendOnly(),\n\n  /** Status */\n  isActive: z.boolean().default(true).isDBIndexed().isSummaryField(),\n\n  /**\n   * Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n   *\n   * ⚠️ **AUTHORING RULE — never store personal data here.** This row is RETAINED when its subject is\n   * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n   * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n   * personal data of its own — the person is a foreign key. An open bag is the one place that\n   * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n   * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n   * keys it does not know.\n   *\n   * Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n   * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n   * breach that the retained label makes look intentional.\n   *\n   * Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n   * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n   * Revisit only if an app is found using the bag this way.\n   */\n  metadata: z.record(z.string(), z.string()).optional(),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type BillingAccountBase = z.infer<typeof BillingAccountBaseSchema>;\n\n// =============================================================================\n// POLYMORPHIC DECLARATION\n// =============================================================================\n\n/**\n * Polymorphic declaration for BillingAccounts.\n * Produces 2 variants:\n *   - organizations  → organizationBillingAccounts  (organizationId injected)\n *   - users          → userBillingAccounts          (userId injected)\n */\nexport const billingAccountsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'billingAccounts',\n  baseFieldIdentifier: 'billingAccountId',\n  baseEnumKey: 'BILLING_ACCOUNTS',\n  baseSchema: BillingAccountBaseSchema,\n  variants: BILLING_SCOPE_VARIANTS,\n});\n\n// =============================================================================\n// EXPORTED SCHEMA & TYPE\n// =============================================================================\n\nexport const BillingAccountSchema = BillingAccountBaseSchema;\nexport type BillingAccount = z.infer<typeof BillingAccountBaseSchema>;\n"]}

package/dist/esm/billing/billing-types.shared.schemas.d.ts

@@ -88,13 +88,13 @@ export declare const BillingStateResponseSchema: z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
         status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").SubscriptionStatus>>>>>;
-        items: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodArray<z.ZodObject<{
+        items: z.ZodArray<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
             productId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
             priceId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
             quantity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
             providerSubscriptionItemId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-        }, z.core.$strip>>>;
+        }, z.core.$strip>>;
         currentPeriodStart: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
         currentPeriodEnd: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
         trialStart: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;

package/dist/esm/billing/credit-pool.shared.resources-config.schemas.d.ts

@@ -21,5 +21,5 @@ export declare const CreditPool_ConsumeRequestDto: z.ZodObject<{
 export declare const CreditPool_TopUpRequestDto: z.ZodObject<{
     credits: z.ZodNumber;
 }, z.core.$strip>;
-export declare const creditPoolsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<typeof CreditPool_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+export declare const creditPoolsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<typeof CreditPool_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=credit-pool.shared.resources-config.schemas.d.ts.map

package/dist/esm/billing/credit-pool.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAazG,oBAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,OAAO,YAAY;IACnB;8GAC0G;IAC1G,MAAM,WAAW;CAClB;AAID,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,eAAO,MAAM,+BAA+B,oOAiH3C,CAAC"}
+{"version":3,"file":"credit-pool.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAczG,oBAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,OAAO,YAAY;IACnB;8GAC0G;IAC1G,MAAM,WAAW;CAClB;AAID,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,eAAO,MAAM,+BAA+B,wQA0J3C,CAAC"}

package/dist/esm/billing/credit-pool.shared.resources-config.schemas.js

@@ -13,6 +13,7 @@ import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles
 import { creditPoolsPolymorphicDeclaration } from './credit-pool.shared.schemas.js';
 import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 // ── Custom Operations ────────────────────────────────────────────────
 export var CreditPool_Operations;
 (function (CreditPool_Operations) {
@@ -36,13 +37,51 @@ export const creditPoolsPolymorphicFactories = createPolymorphicResourceConfigur
     /** Subject-export disclosure. The subject's own credit balances. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */
     systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },
+    /**
+     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.
+ *
+ * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is
+ * credit balances — available, purchased and consumed amounts — amounts and contract terms about the ACCOUNT. They
+ * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit
+ * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as
+ * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.
+ *
+ * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an
+ * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_ONLY,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the
+ *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own
+ *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it
+         * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the
+         * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the
+         * verb the impersonalize writer uses to stamp the retention markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [{
                     variantType: ResourceOperationVariantType.INTERNAL_CALL,

package/dist/esm/billing/credit-pool.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,4CAAmB,CAAA;IACnB;8GAC0G;IAC1G,0CAAiB,CAAA;AACnB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,wSAAwS;IACxS,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IACvE,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,EAAE;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,yFAAyF;QACzF,6CAA6C;QAC7C,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,sCAAsC;QACtC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;wBACvF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,4BAA4B;iBACzC,CAAC;SACH;QACD,8FAA8F;QAC9F,8DAA8D;QAC9D,EAAE;QACF,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,iGAAiG;QACjG,yFAAyF;QACzF,wFAAwF;QACxF,8FAA8F;QAC9F,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,iDAAiD;QACjD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,0BAA0B;iBACvC,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Credit Pool Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...creditPoolsPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { creditPoolsPolymorphicDeclaration } from './credit-pool.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum CreditPool_Operations {\n  /** Consume credits from the pool. System-only (INTERNAL_CALL) — called by custom service code that\n   *  meters a paid capability, never directly by a client. */\n  CONSUME = 'consume',\n  /** Top up credits. System-only (INTERNAL_CALL) — invoked by the billing webhook router after a\n   *  verified CREDIT_PACK purchase, never by a client. The client \"buy credits\" action is OPEN_CHECKOUT. */\n  TOP_UP = 'top_up',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const CreditPool_ConsumeRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const CreditPool_TopUpRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const creditPoolsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  creditPoolsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: CreditPool_Operations,\n    /** Subject-export disclosure. The subject's own credit balances. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit-balance mutation is\n      // system-only; it is never client-initiated.\n      //\n      // CONSUME is INTERNAL_CALL (no HTTP route), matching TOP_UP and the CRUD siblings. It is invoked\n      // by service code that meters a paid feature (its enum doc: \"called by custom service code\"), not\n      // by a client — the balance decrement happens as a side effect of using a metered capability, not\n      // as a direct client action. Leaving it API_CALL let a client spend its own credits arbitrarily\n      // (self-harm, not a grant) and, more importantly, made a system-automated op part of the client\n      // attack surface. The `polymorphicRole` is retained for internal-authorization parity and no\n      // longer confers client reachability.\n      [CreditPool_Operations.CONSUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_MEMBER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_ConsumeRequestDto,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit GRANT (balance increase)\n      // is system/payment-gated only; it is never client-initiated.\n      //\n      // TOP_UP is INTERNAL_CALL (no HTTP route), matching its CREATE/UPDATE siblings above. It\n      // increments the spendable balance, so it must be reachable ONLY from server code that has\n      // already verified payment: the billing webhook router computes `credits` from the PAID\n      // product/quantity and invokes it via `executeCustomOperation` (which resolves the INTERNAL_CALL\n      // default through `getServiceOperationPathDefault`). It was previously API_CALL gated to\n      // ORG_OWNER, which let a tenant owner `PUT …/credit-pools/{id}/top-up {credits: N}` and\n      // self-grant unlimited paid credits — the client \"buy credits\" action is OPEN_CHECKOUT, not a\n      // direct balance write, so this route had no legitimate client caller. (The spec previously\n      // hinted at a manual admin grant here; a support-initiated grant, if ever needed, belongs on a\n      // separate platform-super-admin op with a mandatory audit event, NOT on a tenant-owner route.)\n      // The `polymorphicRole` below is retained for internal-authorization parity with the CRUD ops\n      // and no longer confers any client reachability.\n      [CreditPool_Operations.TOP_UP]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_TopUpRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"credit-pool.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,4CAAmB,CAAA;IACnB;8GAC0G;IAC1G,0CAAiB,CAAA;AACnB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,wSAAwS;IACxS,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IACvE,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,EAAE;IAE3E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,yFAAyF;QACzF,6CAA6C;QAC7C,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,sCAAsC;QACtC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;wBACvF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,4BAA4B;iBACzC,CAAC;SACH;QACD,8FAA8F;QAC9F,8DAA8D;QAC9D,EAAE;QACF,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,iGAAiG;QACjG,yFAAyF;QACzF,wFAAwF;QACxF,8FAA8F;QAC9F,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,iDAAiD;QACjD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,0BAA0B;iBACvC,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Credit Pool Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...creditPoolsPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { creditPoolsPolymorphicDeclaration } from './credit-pool.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum CreditPool_Operations {\n  /** Consume credits from the pool. System-only (INTERNAL_CALL) — called by custom service code that\n   *  meters a paid capability, never directly by a client. */\n  CONSUME = 'consume',\n  /** Top up credits. System-only (INTERNAL_CALL) — invoked by the billing webhook router after a\n   *  verified CREDIT_PACK purchase, never by a client. The client \"buy credits\" action is OPEN_CHECKOUT. */\n  TOP_UP = 'top_up',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const CreditPool_ConsumeRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const CreditPool_TopUpRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const creditPoolsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  creditPoolsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: CreditPool_Operations,\n    /** Subject-export disclosure. The subject's own credit balances. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * credit balances — available, purchased and consumed amounts — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n *\n * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit-balance mutation is\n      // system-only; it is never client-initiated.\n      //\n      // CONSUME is INTERNAL_CALL (no HTTP route), matching TOP_UP and the CRUD siblings. It is invoked\n      // by service code that meters a paid feature (its enum doc: \"called by custom service code\"), not\n      // by a client — the balance decrement happens as a side effect of using a metered capability, not\n      // as a direct client action. Leaving it API_CALL let a client spend its own credits arbitrarily\n      // (self-harm, not a grant) and, more importantly, made a system-automated op part of the client\n      // attack surface. The `polymorphicRole` is retained for internal-authorization parity and no\n      // longer confers client reachability.\n      [CreditPool_Operations.CONSUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_MEMBER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_ConsumeRequestDto,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit GRANT (balance increase)\n      // is system/payment-gated only; it is never client-initiated.\n      //\n      // TOP_UP is INTERNAL_CALL (no HTTP route), matching its CREATE/UPDATE siblings above. It\n      // increments the spendable balance, so it must be reachable ONLY from server code that has\n      // already verified payment: the billing webhook router computes `credits` from the PAID\n      // product/quantity and invokes it via `executeCustomOperation` (which resolves the INTERNAL_CALL\n      // default through `getServiceOperationPathDefault`). It was previously API_CALL gated to\n      // ORG_OWNER, which let a tenant owner `PUT …/credit-pools/{id}/top-up {credits: N}` and\n      // self-grant unlimited paid credits — the client \"buy credits\" action is OPEN_CHECKOUT, not a\n      // direct balance write, so this route had no legitimate client caller. (The spec previously\n      // hinted at a manual admin grant here; a support-initiated grant, if ever needed, belongs on a\n      // separate platform-super-admin op with a mandatory audit event, NOT on a tenant-owner route.)\n      // The `polymorphicRole` below is retained for internal-authorization parity with the CRUD ops\n      // and no longer confers any client reachability.\n      [CreditPool_Operations.TOP_UP]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_TopUpRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/credit-pool.shared.schemas.d.ts

@@ -28,9 +28,9 @@ export declare const CreditPoolSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     poolKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    available: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
-    totalPurchased: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
-    totalConsumed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
+    available: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    totalPurchased: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    totalConsumed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
 }, z.core.$strip>;
@@ -39,9 +39,9 @@ export declare const creditPoolsPolymorphicDeclaration: import("..").Polymorphic
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     poolKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    available: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
-    totalPurchased: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
-    totalConsumed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
+    available: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    totalPurchased: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    totalConsumed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
 }, z.core.$strip>>;

package/dist/esm/billing/credit-pool.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,gBAAgB;;;;;;;;;iBAmB3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;kBAU5C,CAAC"}
+{"version":3,"file":"credit-pool.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB;;;;;;;;;iBAwB3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;kBAU5C,CAAC"}

package/dist/esm/billing/credit-pool.shared.schemas.js

@@ -24,7 +24,6 @@
  * @see billing-and-features-system.md §9 (Credit Pool)
  */
 import { z } from 'zod';
-import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
 import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas.js';
 import { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas.js';
 export const CreditPoolSchema = z.object({
@@ -36,11 +35,16 @@ export const CreditPoolSchema = z.object({
     /** Current available balance */
     // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. A balance is a financial fact
     // about the account holder, not a usage metric.
-    available: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),
+    // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.
+    // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the
+    // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be
+    // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the
+    // resource config (#138).
+    available: z.number().min(0).default(0).isSummaryField().isNotEditable(),
     /** Total credits ever purchased (for audit/display) */
-    totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),
+    totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable(),
     /** Total credits consumed (for audit/display) */
-    totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),
+    totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable(),
     createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
 });

package/dist/esm/billing/credit-pool.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAErG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEnI,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;SACtE,QAAQ,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEjD,gCAAgC;IAChC,iGAAiG;IACjG,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IACvH,uDAAuD;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAC5H,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAE3H,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Credit Pool Schema (Shared) — Polymorphic\n *\n * Tracks credit balances for CREDIT_PACK products.\n * Created/topped-up when a CREDIT_PACK purchase completes.\n * Decremented when credits are consumed (via custom service code).\n *\n * One pool per creditPoolKey per billing account.\n * Database index: `{ billingAccountId: 1, poolKey: 1 }` compound unique.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, credit pools are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationCreditPools  (with organizationId + organizationBillingAccountId)\n *   - userCreditPools          (with userId + userBillingAccountId)\n *\n *\n * Credit flow:\n * 1. User purchases CREDIT_PACK → Checkout completes → webhook\n * 2. Webhook router: creates/updates CreditPool (available += creditsPerUnit * quantity)\n * 3. CreditPool CONSUME custom op: validates balance and decrements available\n * 4. CreditPool TOP_UP custom op: increments available after purchase\n * 5. Frontend shows balance via BillingStateResponse.creditPools\n *\n * @see billing-and-features-system.md §9 (Credit Pool)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\n\nexport const CreditPoolSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n\n  /** Pool identifier (matches ProductDefinition.purchaseConfig.creditPoolKey, e.g., 'ai_tokens') */\n  poolKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable()\n    .isUnique({ compoundWith: 'billingAccountId' }),\n\n  /** Current available balance */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. A balance is a financial fact\n  // about the account holder, not a usage metric.\n  available: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),\n  /** Total credits ever purchased (for audit/display) */\n  totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),\n  /** Total credits consumed (for audit/display) */\n  totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type CreditPool = z.infer<typeof CreditPoolSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const creditPoolsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'creditPools',\n  baseFieldIdentifier: 'creditPoolId',\n  baseEnumKey: 'CREDIT_POOLS',\n  baseSchema: CreditPoolSchema,\n  // Many pools per billing-account / scope (composite key: billingAccountId +\n  // poolKey) — opt out of the polymorphism engine's singleton-per-scope\n  // business-key auto-default. If pools ever become seedable, declare an\n  // explicit `businessKeyFields: ['billingAccountId', 'poolKey']` instead.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"credit-pool.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAErG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEnI,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;SACtE,QAAQ,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEjD,gCAAgC;IAChC,iGAAiG;IACjG,gDAAgD;IAChD,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IACxE,uDAAuD;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAC7E,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Credit Pool Schema (Shared) — Polymorphic\n *\n * Tracks credit balances for CREDIT_PACK products.\n * Created/topped-up when a CREDIT_PACK purchase completes.\n * Decremented when credits are consumed (via custom service code).\n *\n * One pool per creditPoolKey per billing account.\n * Database index: `{ billingAccountId: 1, poolKey: 1 }` compound unique.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, credit pools are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationCreditPools  (with organizationId + organizationBillingAccountId)\n *   - userCreditPools          (with userId + userBillingAccountId)\n *\n *\n * Credit flow:\n * 1. User purchases CREDIT_PACK → Checkout completes → webhook\n * 2. Webhook router: creates/updates CreditPool (available += creditsPerUnit * quantity)\n * 3. CreditPool CONSUME custom op: validates balance and decrements available\n * 4. CreditPool TOP_UP custom op: increments available after purchase\n * 5. Frontend shows balance via BillingStateResponse.creditPools\n *\n * @see billing-and-features-system.md §9 (Credit Pool)\n */\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\n\nexport const CreditPoolSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n\n  /** Pool identifier (matches ProductDefinition.purchaseConfig.creditPoolKey, e.g., 'ai_tokens') */\n  poolKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable()\n    .isUnique({ compoundWith: 'billingAccountId' }),\n\n  /** Current available balance */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. A balance is a financial fact\n  // about the account holder, not a usage metric.\n  // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n  // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n  // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n  // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n  // resource config (#138).\n  available: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n  /** Total credits ever purchased (for audit/display) */\n  totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n  /** Total credits consumed (for audit/display) */\n  totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type CreditPool = z.infer<typeof CreditPoolSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const creditPoolsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'creditPools',\n  baseFieldIdentifier: 'creditPoolId',\n  baseEnumKey: 'CREDIT_POOLS',\n  baseSchema: CreditPoolSchema,\n  // Many pools per billing-account / scope (composite key: billingAccountId +\n  // poolKey) — opt out of the polymorphism engine's singleton-per-scope\n  // business-key auto-default. If pools ever become seedable, declare an\n  // explicit `businessKeyFields: ['billingAccountId', 'poolKey']` instead.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.d.ts

@@ -6,5 +6,5 @@
  *   ...invoiceRefsPolymorphicFactories
  */
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
-export declare const invoiceRefsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, any>>;
+export declare const invoiceRefsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, any>>;
 //# sourceMappingURL=invoice-ref.shared.resources-config.schemas.d.ts.map

package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAWzG,eAAO,MAAM,+BAA+B,gPAmF3C,CAAC"}
+{"version":3,"file":"invoice-ref.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAYzG,eAAO,MAAM,+BAA+B,oRAwH3C,CAAC"}