@wildo-ai/saas-models 1.1.0 → 1.1.2

package/dist/esm/resources/resources-config.shared.schemas.js

@@ -30,7 +30,7 @@ export function createPaginationResponseMetadataSchema(maxLimit = 100) {
     });
 }
 /** The default-bounded response metadata. Prefer {@link createPaginationResponseMetadataSchema} where the ceiling is known. */
-export const Resouces_PaginationResponseMetadataSchema = createPaginationResponseMetadataSchema();
+export const Resources_PaginationResponseMetadataSchema = createPaginationResponseMetadataSchema();
 /**
  * The pagination block a collection request may carry, bounded by the operation's declared ceiling.
  *
@@ -49,7 +49,7 @@ export function createPaginationRequestSchema(maxLimit = 100) {
     });
 }
 /** The default-bounded pagination block. Prefer {@link createPaginationRequestSchema} where the operation's ceiling is known. */
-export const Resouces_PaginationRequestSchema = createPaginationRequestSchema();
+export const Resources_PaginationRequestSchema = createPaginationRequestSchema();
 // --------------------------------
 // Data Mode (for read/list operations)
 // --------------------------------
@@ -114,6 +114,27 @@ export var IntrospectionTenancyStance;
      * story, and nobody would be asked to notice.
      */
     IntrospectionTenancyStance["APPLICATION_STRUCTURE"] = "application-structure";
+    /**
+     * The rows are the DEVELOPMENT COMPANION'S OWN RUNTIME PROJECTIONS for the one application it
+     * serves — the playbook eligibility board, the build plan, the run write-register, the execution
+     * traces. Like `APPLICATION_STRUCTURE` they carry no tenant dimension and no scope predicate can
+     * apply; UNLIKE it, they are not derived from the application's source, and the tenancy stance is
+     * where that difference must stay visible (added 2026-09-01, creation-board resources plan):
+     *
+     * - `APPLICATION_STRUCTURE`'s public-read posture (`APP_PUBLIC` variants on the workbench's
+     *   structural projections) rests on the rows being the application's OWN source, which anyone
+     *   with the working tree can already read. That argument does NOT extend to runtime state, so a
+     *   resource declaring this stance is expected to gate its variants on an authenticated role —
+     *   never `APP_PUBLIC`.
+     * - Row-level tenant-anchor checks are bypassed for this stance exactly as for
+     *   `APPLICATION_STRUCTURE` (the rows carry no anchor BY CONTRACT); authorization comes from the
+     *   session and the operation's role gate.
+     *
+     * Fusing this into `APPLICATION_STRUCTURE` was rejected for the enum's own founding reason: an
+     * unstated distinction is indistinguishable from an overlooked one, and the next decision site
+     * keyed off the stance would inherit a claim nobody checked.
+     */
+    IntrospectionTenancyStance["APPLICATION_RUNTIME"] = "application-runtime";
     /**
      * The rows carry a tenant dimension and a scope predicate must be pushed into the source.
      *
@@ -142,10 +163,15 @@ export var PersistenceAdapter;
      * "how rows are reached", and the mechanism behind it is a binding an author declares.
      *
      * Distinct from `HTTP_API`, deliberately, and not merely because the transport differs. Retrieval
-     * is a SUBPROCESS that imports the target application's built modules; it costs seconds rather than
-     * milliseconds, it requires that application's `dist` to exist, and its failure mode is a behavior
-     * throwing rather than a row being absent. Collapsing the two would give one declaration whose
-     * discriminator chooses between an HTTP call and a subprocess — two adapters wearing one name.
+     * is the COMPANION's decision per behavior (amended 2026-09-01): the app-import behaviors run a
+     * SUBPROCESS that imports the target application's built modules — seconds per read, requiring
+     * that application's `dist`, failing as a thrown behavior — while the creation-plane behaviors
+     * are IN-PROCESS projections of the companion's own runtime services (playbook eligibility,
+     * build plan, write register, traces). Both reach the engine through the same
+     * `IntrospectionResourceSourceBackendPort`; the adapter never encodes the mechanism, which is
+     * exactly why a behavior id is an engine-opaque string. Collapsing this into `HTTP_API` would
+     * still be wrong for the original reason: its failure mode is a source throwing rather than a
+     * row being absent, and nothing here is reached over a network API.
      *
      * ## What every adapter decision site must honor
      *
@@ -307,34 +333,34 @@ export var SortOrder;
     SortOrder["ASC"] = "asc";
     SortOrder["DESC"] = "desc";
 })(SortOrder || (SortOrder = {}));
-export const Resouces_Filter_DateRangeSchema = z.object({
+export const Resources_Filter_DateRangeSchema = z.object({
     startDate: z.date().optional(),
     endDate: z.date().optional()
 });
-export const Resouces_Filter_BaseSchema = z.object({
+export const Resources_Filter_BaseSchema = z.object({
     searchRequest: z.string().optional(),
-    createdAt: Resouces_Filter_DateRangeSchema.optional(),
-    updatedAt: Resouces_Filter_DateRangeSchema.optional(),
+    createdAt: Resources_Filter_DateRangeSchema.optional(),
+    updatedAt: Resources_Filter_DateRangeSchema.optional(),
 });
 // Generic filter request schema (extends base filter with custom fields)
-export const Resouces_FilterRequestSchema = z.object({
+export const Resources_FilterRequestSchema = z.object({
     searchRequest: z.string().optional(),
-    createdAt: Resouces_Filter_DateRangeSchema.optional(),
-    updatedAt: Resouces_Filter_DateRangeSchema.optional(),
+    createdAt: Resources_Filter_DateRangeSchema.optional(),
+    updatedAt: Resources_Filter_DateRangeSchema.optional(),
 }).catchall(z.any().optional()); // Allows additional filter fields
 // Generic sorting field schema
-export const Resouces_SortingFieldSchema = z.object({
+export const Resources_SortingFieldSchema = z.object({
     field: z.string(),
     order: z.enum(SortOrder).default(SortOrder.ASC),
     priority: z.number().min(0).default(0)
 });
 // Generic sorting request schema (object with field keys)
-export const Resouces_SortingRequestSchema = z.record(z.string(), Resouces_SortingFieldSchema.optional()).optional();
+export const Resources_SortingRequestSchema = z.record(z.string(), Resources_SortingFieldSchema.optional()).optional();
 // Generic search query request schema
-export const Resouces_SearchQueryRequestSchema = z.object({
-    pagination: Resouces_PaginationRequestSchema.optional(),
-    sorting: Resouces_SortingRequestSchema.optional(),
-    filters: Resouces_FilterRequestSchema.optional()
+export const Resources_SearchQueryRequestSchema = z.object({
+    pagination: Resources_PaginationRequestSchema.optional(),
+    sorting: Resources_SortingRequestSchema.optional(),
+    filters: Resources_FilterRequestSchema.optional()
 });
 /**
  * Shared collection-view fields for operations that render a collection of items (LIST, SEARCH).
@@ -475,7 +501,7 @@ export function isSearchableRelationDescriptor(field) {
  * validates away to nothing, and then fails as "`_ids` is required" — which is exactly what every
  * frontend bulk surface did until 2026-08-29.
  */
-export const Resouces_BulkOperationBaseSchema = z.object({
+export const Resources_BulkOperationBaseSchema = z.object({
     _ids: z.array(z.string().min(1)).min(1),
 });
 /**
@@ -530,6 +556,69 @@ export var ResourceGeneratedOperationKind;
     /** The CSV/JSON export companion of a LIST/SEARCH operation — see {@link ResourceCollectionExportConfig}. */
     ResourceGeneratedOperationKind["GENERATED_COLLECTION_EXPORT"] = "generated_collection_export";
 })(ResourceGeneratedOperationKind || (ResourceGeneratedOperationKind = {}));
+/**
+ * Whether a declared operation is actually SERVICED — the verdict a shared predicate answers with.
+ *
+ * MOVED HERE FROM `saas-backend-lib` on 2026-09-02, and the reason is a layering one rather than
+ * tidiness. These are closed VOCABULARIES, not backend behaviour: the resolvers that compute them
+ * stay in the backend, but the answers they produce are what other layers must be able to name.
+ * `saas-specifications` could not attest `WILDO.OPERATIONS.EXECUTION_INTEGRITY` in its assurance
+ * authority basis while the vocabulary lived in a package it must not depend on — the control was
+ * real, well-marked and unnameable from the layer obliged to describe it (#207).
+ *
+ * The single-resolver contract is unchanged and still lives with the resolvers: startup validation
+ * and request-time refusal must consume the SAME predicate, because an operation blessed at boot
+ * that can still answer 2xx on the first request is precisely the state that module ended.
+ *
+ * The defect behind all of this: a custom operation declaring a `requestDto` no implementation
+ * consumes falls through to the generic core path, which persists only fields the resource schema
+ * declares. A DTO such as `{ newRole, reason }` names none of them, so the framework validates the
+ * body, writes nothing, and answers HTTP 200 with the unchanged row. A 2026-08-01 hostile probe
+ * caught `organizationMembers | promote` doing exactly that, and a catalogue sweep found 41 routed
+ * operations sharing the shape. Nothing escalates; the destructive direction is the dangerous one —
+ * an admin demotes a compromised account, is told 200 OK, and the account keeps its privileges.
+ *
+ * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — an interface must not report success for
+ * an action it did not perform; monitoring and incident response depend on truthful responses.
+ */
+export var ResourceOperationImplementationCoverage;
+(function (ResourceOperationImplementationCoverage) {
+    /** Something consumes the declared contract: a custom implementation, a declarative side effect, or the core path itself. */
+    ResourceOperationImplementationCoverage["SERVICEABLE"] = "serviceable";
+    /** Nothing does. Left alone, the operation answers 2xx having performed nothing. */
+    ResourceOperationImplementationCoverage["UNSERVICEABLE"] = "unserviceable";
+    /** Outside this guard's remit — a core operation, or a variant the service tier never enters. */
+    ResourceOperationImplementationCoverage["NOT_APPLICABLE"] = "not_applicable";
+})(ResourceOperationImplementationCoverage || (ResourceOperationImplementationCoverage = {}));
+/**
+ * Why an operation was judged {@link ResourceOperationImplementationCoverage.UNSERVICEABLE}.
+ * Surfaced verbatim in the startup error so the fix is obvious without re-deriving the analysis.
+ */
+export var ResourceOperationUnserviceableReason;
+(function (ResourceOperationUnserviceableReason) {
+    /** Write-like: no declared request field is a persisted resource-schema field, so the write is empty. */
+    ResourceOperationUnserviceableReason["NO_REQUEST_FIELD_IS_PERSISTED"] = "no_request_field_is_persisted";
+    /** READ-like: the core read addresses the row by id and consumes no request field, so the declared verb never happens. */
+    ResourceOperationUnserviceableReason["READ_CONSUMES_NO_REQUEST_FIELD"] = "read_consumes_no_request_field";
+    /** Collection-like: no declared request field is a collection parameter the core path reads. */
+    ResourceOperationUnserviceableReason["NO_REQUEST_FIELD_IS_COLLECTION_PARAMETER"] = "no_request_field_is_collection_parameter";
+})(ResourceOperationUnserviceableReason || (ResourceOperationUnserviceableReason = {}));
+/**
+ * Whether a custom write-like verb authored the request contract it exposes, or silently inherited
+ * the resource's whole create/update contract.
+ *
+ * Moved here with {@link ResourceOperationImplementationCoverage}, for the same reason.
+ *
+ * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — a named verb must not silently widen
+ * into an unconstrained write over fields its resource never exposed for update.
+ */
+export var ResourceOperationRequestContractBreadth;
+(function (ResourceOperationRequestContractBreadth) {
+    /** The operation authored its own request contract, or its family cannot inherit one. */
+    ResourceOperationRequestContractBreadth["AUTHORED"] = "authored";
+    /** A write-like custom verb inherited the resource's whole create/update contract. */
+    ResourceOperationRequestContractBreadth["OVERBROAD_INHERITED_FULL_CONTRACT"] = "overbroad_inherited_full_contract";
+})(ResourceOperationRequestContractBreadth || (ResourceOperationRequestContractBreadth = {}));
 /**
  * Where the engine's own inherited implementation gaps are tracked — the 2026-08-01 catalogue
  * sweep that found 41 routed operations answering a success status having performed nothing.