@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/billing/credit-pool.shared.resources-config.schemas.js

@@ -13,6 +13,7 @@ import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles
 import { creditPoolsPolymorphicDeclaration } from './credit-pool.shared.schemas.js';
 import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 // ── Custom Operations ────────────────────────────────────────────────
 export var CreditPool_Operations;
 (function (CreditPool_Operations) {
@@ -36,13 +37,51 @@ export const creditPoolsPolymorphicFactories = createPolymorphicResourceConfigur
     /** Subject-export disclosure. The subject's own credit balances. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */
     systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },
+    /**
+     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.
+ *
+ * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is
+ * credit balances — available, purchased and consumed amounts — amounts and contract terms about the ACCOUNT. They
+ * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit
+ * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as
+ * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.
+ *
+ * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an
+ * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_ONLY,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the
+ *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own
+ *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it
+         * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the
+         * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the
+         * verb the impersonalize writer uses to stamp the retention markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [{
                     variantType: ResourceOperationVariantType.INTERNAL_CALL,

package/dist/esm/billing/credit-pool.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,4CAAmB,CAAA;IACnB;8GAC0G;IAC1G,0CAAiB,CAAA;AACnB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,wSAAwS;IACxS,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IACvE,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,EAAE;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,yFAAyF;QACzF,6CAA6C;QAC7C,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,sCAAsC;QACtC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;wBACvF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,4BAA4B;iBACzC,CAAC;SACH;QACD,8FAA8F;QAC9F,8DAA8D;QAC9D,EAAE;QACF,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,iGAAiG;QACjG,yFAAyF;QACzF,wFAAwF;QACxF,8FAA8F;QAC9F,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,iDAAiD;QACjD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,0BAA0B;iBACvC,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Credit Pool Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...creditPoolsPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { creditPoolsPolymorphicDeclaration } from './credit-pool.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum CreditPool_Operations {\n  /** Consume credits from the pool. System-only (INTERNAL_CALL) — called by custom service code that\n   *  meters a paid capability, never directly by a client. */\n  CONSUME = 'consume',\n  /** Top up credits. System-only (INTERNAL_CALL) — invoked by the billing webhook router after a\n   *  verified CREDIT_PACK purchase, never by a client. The client \"buy credits\" action is OPEN_CHECKOUT. */\n  TOP_UP = 'top_up',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const CreditPool_ConsumeRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const CreditPool_TopUpRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const creditPoolsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  creditPoolsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: CreditPool_Operations,\n    /** Subject-export disclosure. The subject's own credit balances. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit-balance mutation is\n      // system-only; it is never client-initiated.\n      //\n      // CONSUME is INTERNAL_CALL (no HTTP route), matching TOP_UP and the CRUD siblings. It is invoked\n      // by service code that meters a paid feature (its enum doc: \"called by custom service code\"), not\n      // by a client — the balance decrement happens as a side effect of using a metered capability, not\n      // as a direct client action. Leaving it API_CALL let a client spend its own credits arbitrarily\n      // (self-harm, not a grant) and, more importantly, made a system-automated op part of the client\n      // attack surface. The `polymorphicRole` is retained for internal-authorization parity and no\n      // longer confers client reachability.\n      [CreditPool_Operations.CONSUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_MEMBER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_ConsumeRequestDto,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit GRANT (balance increase)\n      // is system/payment-gated only; it is never client-initiated.\n      //\n      // TOP_UP is INTERNAL_CALL (no HTTP route), matching its CREATE/UPDATE siblings above. It\n      // increments the spendable balance, so it must be reachable ONLY from server code that has\n      // already verified payment: the billing webhook router computes `credits` from the PAID\n      // product/quantity and invokes it via `executeCustomOperation` (which resolves the INTERNAL_CALL\n      // default through `getServiceOperationPathDefault`). It was previously API_CALL gated to\n      // ORG_OWNER, which let a tenant owner `PUT …/credit-pools/{id}/top-up {credits: N}` and\n      // self-grant unlimited paid credits — the client \"buy credits\" action is OPEN_CHECKOUT, not a\n      // direct balance write, so this route had no legitimate client caller. (The spec previously\n      // hinted at a manual admin grant here; a support-initiated grant, if ever needed, belongs on a\n      // separate platform-super-admin op with a mandatory audit event, NOT on a tenant-owner route.)\n      // The `polymorphicRole` below is retained for internal-authorization parity with the CRUD ops\n      // and no longer confers any client reachability.\n      [CreditPool_Operations.TOP_UP]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_TopUpRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"credit-pool.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,4CAAmB,CAAA;IACnB;8GAC0G;IAC1G,0CAAiB,CAAA;AACnB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,wSAAwS;IACxS,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IACvE,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,EAAE;IAE3E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,yFAAyF;QACzF,6CAA6C;QAC7C,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,sCAAsC;QACtC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;wBACvF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,4BAA4B;iBACzC,CAAC;SACH;QACD,8FAA8F;QAC9F,8DAA8D;QAC9D,EAAE;QACF,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,iGAAiG;QACjG,yFAAyF;QACzF,wFAAwF;QACxF,8FAA8F;QAC9F,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,iDAAiD;QACjD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,0BAA0B;iBACvC,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Credit Pool Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...creditPoolsPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { creditPoolsPolymorphicDeclaration } from './credit-pool.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum CreditPool_Operations {\n  /** Consume credits from the pool. System-only (INTERNAL_CALL) — called by custom service code that\n   *  meters a paid capability, never directly by a client. */\n  CONSUME = 'consume',\n  /** Top up credits. System-only (INTERNAL_CALL) — invoked by the billing webhook router after a\n   *  verified CREDIT_PACK purchase, never by a client. The client \"buy credits\" action is OPEN_CHECKOUT. */\n  TOP_UP = 'top_up',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const CreditPool_ConsumeRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const CreditPool_TopUpRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const creditPoolsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  creditPoolsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: CreditPool_Operations,\n    /** Subject-export disclosure. The subject's own credit balances. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * credit balances — available, purchased and consumed amounts — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n *\n * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit-balance mutation is\n      // system-only; it is never client-initiated.\n      //\n      // CONSUME is INTERNAL_CALL (no HTTP route), matching TOP_UP and the CRUD siblings. It is invoked\n      // by service code that meters a paid feature (its enum doc: \"called by custom service code\"), not\n      // by a client — the balance decrement happens as a side effect of using a metered capability, not\n      // as a direct client action. Leaving it API_CALL let a client spend its own credits arbitrarily\n      // (self-harm, not a grant) and, more importantly, made a system-automated op part of the client\n      // attack surface. The `polymorphicRole` is retained for internal-authorization parity and no\n      // longer confers client reachability.\n      [CreditPool_Operations.CONSUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_MEMBER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_ConsumeRequestDto,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit GRANT (balance increase)\n      // is system/payment-gated only; it is never client-initiated.\n      //\n      // TOP_UP is INTERNAL_CALL (no HTTP route), matching its CREATE/UPDATE siblings above. It\n      // increments the spendable balance, so it must be reachable ONLY from server code that has\n      // already verified payment: the billing webhook router computes `credits` from the PAID\n      // product/quantity and invokes it via `executeCustomOperation` (which resolves the INTERNAL_CALL\n      // default through `getServiceOperationPathDefault`). It was previously API_CALL gated to\n      // ORG_OWNER, which let a tenant owner `PUT …/credit-pools/{id}/top-up {credits: N}` and\n      // self-grant unlimited paid credits — the client \"buy credits\" action is OPEN_CHECKOUT, not a\n      // direct balance write, so this route had no legitimate client caller. (The spec previously\n      // hinted at a manual admin grant here; a support-initiated grant, if ever needed, belongs on a\n      // separate platform-super-admin op with a mandatory audit event, NOT on a tenant-owner route.)\n      // The `polymorphicRole` below is retained for internal-authorization parity with the CRUD ops\n      // and no longer confers any client reachability.\n      [CreditPool_Operations.TOP_UP]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_TopUpRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/credit-pool.shared.schemas.d.ts

@@ -28,9 +28,9 @@ export declare const CreditPoolSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     poolKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    available: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
-    totalPurchased: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
-    totalConsumed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
+    available: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    totalPurchased: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    totalConsumed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
 }, z.core.$strip>;
@@ -39,9 +39,9 @@ export declare const creditPoolsPolymorphicDeclaration: import("..").Polymorphic
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     poolKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    available: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
-    totalPurchased: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
-    totalConsumed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>>;
+    available: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    totalPurchased: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    totalConsumed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
 }, z.core.$strip>>;

package/dist/esm/billing/credit-pool.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,gBAAgB;;;;;;;;;iBAmB3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;kBAU5C,CAAC"}
+{"version":3,"file":"credit-pool.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB;;;;;;;;;iBAwB3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;kBAU5C,CAAC"}

package/dist/esm/billing/credit-pool.shared.schemas.js

@@ -24,7 +24,6 @@
  * @see billing-and-features-system.md §9 (Credit Pool)
  */
 import { z } from 'zod';
-import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
 import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas.js';
 import { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas.js';
 export const CreditPoolSchema = z.object({
@@ -36,11 +35,16 @@ export const CreditPoolSchema = z.object({
     /** Current available balance */
     // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. A balance is a financial fact
     // about the account holder, not a usage metric.
-    available: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),
+    // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.
+    // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the
+    // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be
+    // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the
+    // resource config (#138).
+    available: z.number().min(0).default(0).isSummaryField().isNotEditable(),
     /** Total credits ever purchased (for audit/display) */
-    totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),
+    totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable(),
     /** Total credits consumed (for audit/display) */
-    totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),
+    totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable(),
     createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
 });

package/dist/esm/billing/credit-pool.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAErG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEnI,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;SACtE,QAAQ,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEjD,gCAAgC;IAChC,iGAAiG;IACjG,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IACvH,uDAAuD;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAC5H,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAE3H,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Credit Pool Schema (Shared) — Polymorphic\n *\n * Tracks credit balances for CREDIT_PACK products.\n * Created/topped-up when a CREDIT_PACK purchase completes.\n * Decremented when credits are consumed (via custom service code).\n *\n * One pool per creditPoolKey per billing account.\n * Database index: `{ billingAccountId: 1, poolKey: 1 }` compound unique.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, credit pools are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationCreditPools  (with organizationId + organizationBillingAccountId)\n *   - userCreditPools          (with userId + userBillingAccountId)\n *\n *\n * Credit flow:\n * 1. User purchases CREDIT_PACK → Checkout completes → webhook\n * 2. Webhook router: creates/updates CreditPool (available += creditsPerUnit * quantity)\n * 3. CreditPool CONSUME custom op: validates balance and decrements available\n * 4. CreditPool TOP_UP custom op: increments available after purchase\n * 5. Frontend shows balance via BillingStateResponse.creditPools\n *\n * @see billing-and-features-system.md §9 (Credit Pool)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\n\nexport const CreditPoolSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n\n  /** Pool identifier (matches ProductDefinition.purchaseConfig.creditPoolKey, e.g., 'ai_tokens') */\n  poolKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable()\n    .isUnique({ compoundWith: 'billingAccountId' }),\n\n  /** Current available balance */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. A balance is a financial fact\n  // about the account holder, not a usage metric.\n  available: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),\n  /** Total credits ever purchased (for audit/display) */\n  totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),\n  /** Total credits consumed (for audit/display) */\n  totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.FINANCIAL),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type CreditPool = z.infer<typeof CreditPoolSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const creditPoolsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'creditPools',\n  baseFieldIdentifier: 'creditPoolId',\n  baseEnumKey: 'CREDIT_POOLS',\n  baseSchema: CreditPoolSchema,\n  // Many pools per billing-account / scope (composite key: billingAccountId +\n  // poolKey) — opt out of the polymorphism engine's singleton-per-scope\n  // business-key auto-default. If pools ever become seedable, declare an\n  // explicit `businessKeyFields: ['billingAccountId', 'poolKey']` instead.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"credit-pool.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAErG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEnI,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;SACtE,QAAQ,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEjD,gCAAgC;IAChC,iGAAiG;IACjG,gDAAgD;IAChD,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IACxE,uDAAuD;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAC7E,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Credit Pool Schema (Shared) — Polymorphic\n *\n * Tracks credit balances for CREDIT_PACK products.\n * Created/topped-up when a CREDIT_PACK purchase completes.\n * Decremented when credits are consumed (via custom service code).\n *\n * One pool per creditPoolKey per billing account.\n * Database index: `{ billingAccountId: 1, poolKey: 1 }` compound unique.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, credit pools are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationCreditPools  (with organizationId + organizationBillingAccountId)\n *   - userCreditPools          (with userId + userBillingAccountId)\n *\n *\n * Credit flow:\n * 1. User purchases CREDIT_PACK → Checkout completes → webhook\n * 2. Webhook router: creates/updates CreditPool (available += creditsPerUnit * quantity)\n * 3. CreditPool CONSUME custom op: validates balance and decrements available\n * 4. CreditPool TOP_UP custom op: increments available after purchase\n * 5. Frontend shows balance via BillingStateResponse.creditPools\n *\n * @see billing-and-features-system.md §9 (Credit Pool)\n */\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\n\nexport const CreditPoolSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n\n  /** Pool identifier (matches ProductDefinition.purchaseConfig.creditPoolKey, e.g., 'ai_tokens') */\n  poolKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable()\n    .isUnique({ compoundWith: 'billingAccountId' }),\n\n  /** Current available balance */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. A balance is a financial fact\n  // about the account holder, not a usage metric.\n  // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n  // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n  // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n  // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n  // resource config (#138).\n  available: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n  /** Total credits ever purchased (for audit/display) */\n  totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n  /** Total credits consumed (for audit/display) */\n  totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type CreditPool = z.infer<typeof CreditPoolSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const creditPoolsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'creditPools',\n  baseFieldIdentifier: 'creditPoolId',\n  baseEnumKey: 'CREDIT_POOLS',\n  baseSchema: CreditPoolSchema,\n  // Many pools per billing-account / scope (composite key: billingAccountId +\n  // poolKey) — opt out of the polymorphism engine's singleton-per-scope\n  // business-key auto-default. If pools ever become seedable, declare an\n  // explicit `businessKeyFields: ['billingAccountId', 'poolKey']` instead.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.d.ts

@@ -6,5 +6,5 @@
  *   ...invoiceRefsPolymorphicFactories
  */
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
-export declare const invoiceRefsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, any>>;
+export declare const invoiceRefsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, any>>;
 //# sourceMappingURL=invoice-ref.shared.resources-config.schemas.d.ts.map

package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAWzG,eAAO,MAAM,+BAA+B,gPAmF3C,CAAC"}
+{"version":3,"file":"invoice-ref.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAYzG,eAAO,MAAM,+BAA+B,oRAwH3C,CAAC"}

package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.js

@@ -12,19 +12,54 @@ import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles
 import { invoiceRefsPolymorphicDeclaration } from './invoice-ref.shared.schemas.js';
 import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 export const invoiceRefsPolymorphicFactories = createPolymorphicResourceConfigurations(invoiceRefsPolymorphicDeclaration, {
     isSystemResource: true,
     /** Subject-export disclosure. The subject's own invoice references — also legally retained records they are entitled to. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */
     systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /**
+     * Subject erasure RETAINS this row and scrubs the provider-hosted document URLs.
+ *
+ * `hostedInvoiceUrl` and `invoicePdfUrl` address documents that carry the person's name and billing
+ * address, so they are personal data this row holds and take `REMOVE`. `total` deliberately keeps its
+ * FINANCIAL category and takes NO treatment: it is retained under the same tax obligation, and the mode
+ * permits a categorized field to survive when the law requires it.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the
+ *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own
+ *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.SEARCH,
         CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it
+         * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the
+         * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the
+         * verb the impersonalize writer uses to stamp the retention markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [{
                     // API_CALL: invoices are a user-facing collection (Settings Hub → Billing →

package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,gWAAgW;IAChW,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IACvE,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,4EAA4E;oBAC5E,8EAA8E;oBAC9E,sEAAsE;oBACtE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,QAAQ,CAAC;oBAC5B,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Invoice Reference Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...invoiceRefsPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { invoiceRefsPolymorphicDeclaration } from './invoice-ref.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\nexport const invoiceRefsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  invoiceRefsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    /** Subject-export disclosure. The subject's own invoice references — also legally retained records they are entitled to. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: invoices are a user-facing collection (Settings Hub → Billing →\n          // Invoices, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n          // strip the op from the frontend registry and register no HTTP route.\n          // Writes are INTERNAL_CALL (service-pipeline, no HTTP; created by Stripe webhooks, not users).\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['status'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: {},\n          sortFields: [],\n          maxPaginatedResultPerPageLimit: 50,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"invoice-ref.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,gWAAgW;IAChW,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IACvE,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,4EAA4E;oBAC5E,8EAA8E;oBAC9E,sEAAsE;oBACtE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,QAAQ,CAAC;oBAC5B,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Invoice Reference Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...invoiceRefsPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { invoiceRefsPolymorphicDeclaration } from './invoice-ref.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nexport const invoiceRefsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  invoiceRefsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    /** Subject-export disclosure. The subject's own invoice references — also legally retained records they are entitled to. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the provider-hosted document URLs.\n *\n * `hostedInvoiceUrl` and `invoicePdfUrl` address documents that carry the person's name and billing\n * address, so they are personal data this row holds and take `REMOVE`. `total` deliberately keeps its\n * FINANCIAL category and takes NO treatment: it is retained under the same tax obligation, and the mode\n * permits a categorized field to survive when the law requires it.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: invoices are a user-facing collection (Settings Hub → Billing →\n          // Invoices, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n          // strip the op from the frontend registry and register no HTTP route.\n          // Writes are INTERNAL_CALL (service-pipeline, no HTTP; created by Stripe webhooks, not users).\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['status'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: {},\n          sortFields: [],\n          maxPaginatedResultPerPageLimit: 50,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/invoice-ref.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,eAAO,MAAM,gBAAgB;;;;;;;;;;iBAyC3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;;kBAQ5C,CAAC"}
+{"version":3,"file":"invoice-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAG/D,eAAO,MAAM,gBAAgB;;;;;;;;;;iBAmD3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;;kBAQ5C,CAAC"}

package/dist/esm/billing/invoice-ref.shared.schemas.js

@@ -14,10 +14,11 @@
  */
 import { z } from 'zod';
 import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
-import { z_money, CurrencyAllowed } from '@wildo-ai/zod-decorators';
+import { z_money, CurrencyAllowed, addImpersonalizeWith } from '@wildo-ai/zod-decorators';
 import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas.js';
 import { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas.js';
 import { InvoiceStatus } from './billing-enums.shared.schemas.js';
+import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
 export const InvoiceRefSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
     billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed(),
@@ -48,8 +49,12 @@ export const InvoiceRefSchema = z.object({
      * SaaS shape. Backend code reads these fields normally — they are present on `internalDto`.
      */
     // The URL IS the invoice: anyone holding it reads the line items. A category, not mere metadata.
-    hostedInvoiceUrl: z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),
-    invoicePdfUrl: z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),
+    // REMOVE both URLs on erasure. They address provider-hosted documents that CARRY the person's name and
+    // billing address — content about them, not an amount about the invoice. `total` deliberately keeps its
+    // category and takes NO treatment: it is retained under the tax/audit obligation this family exists to
+    // serve, and the mode permits a categorized field to survive when the law requires it.
+    hostedInvoiceUrl: addImpersonalizeWith(z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL), RedactionType.REMOVE),
+    invoicePdfUrl: addImpersonalizeWith(z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL), RedactionType.REMOVE),
     /** Provider reference */
     providerInvoiceId: z.string().isBackendOnly(),
     createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),

package/dist/esm/billing/invoice-ref.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE;IAElH,2EAA2E;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;IAExF,uEAAuE;IACvE,sGAAsG;IACtG,KAAK,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAE7H;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iGAAiG;IACjG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IACtG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAEnG,yBAAyB;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE;IAE7C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,uEAAuE;IACvE,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Invoice Reference Schema (Shared) — Polymorphic\n *\n * Thin reference synced FROM provider (webhook-driven), NOT created by Wildo.\n * Only stores what's needed for: billing status checks, quick display, and provider links.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, invoice refs are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationInvoiceRefs  (with organizationId + organizationBillingAccountId)\n *   - userInvoiceRefs          (with userId + userBillingAccountId)\n *\n *\n * @see billing-and-features-system.md §6.4 (Invoice References)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { z_money, CurrencyAllowed } from '@wildo-ai/zod-decorators';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { InvoiceStatus } from './billing-enums.shared.schemas';\n\nexport const InvoiceRefSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed(),\n\n  /** Status - needed for billing status checks (past_due detection, etc.) */\n  status: z.enum(InvoiceStatus).isDBIndexed().isSummaryField().systemEnum('InvoiceStatus'),\n\n  /** Total amount - needed for quick display in subscription overview */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts` for why this rides the shared base.\n  total: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT] }).isSummaryField().dataCategories(PersonalDataCategory.FINANCIAL),\n\n  /**\n   * Provider-hosted invoice URLs — **backend-only, deliberately not exposed to clients.**\n   *\n   * These are CAPABILITY-STYLE links: whoever holds one can open the document, with no\n   * authentication. And the document is a tax invoice, which is legally required to carry the\n   * customer's full name and billing address (EU VAT Directive 2006/112/EC Art. 226(5), and\n   * equivalents elsewhere) — so the invoice PDF is personal data even though this row is not.\n   *\n   * That combination is why the URLs cannot sit in the response DTO. After a subject erasure the\n   * row is deliberately RETAINED and stays visible for accounting, and an ordinarily-readable link\n   * to a document rendering the erased person's name and address would defeat the erasure.\n   *\n   * The document itself is NEVER scrubbed or unlinked: mutilating it would void it as a tax\n   * record, which is precisely what the retention obligation exists to preserve (GDPR Art. 17(3)(b)\n   * exempts processing required by a legal obligation). Access is what is controlled, not content.\n   *\n   * The user-facing door is the provider's own customer portal\n   * (`StandardBilling_Interface.createCustomerPortalSession`, surfaced as the billing account's\n   * `open_portal` operation), which authenticates the viewer provider-side and is the conventional\n   * SaaS shape. Backend code reads these fields normally — they are present on `internalDto`.\n   */\n  // The URL IS the invoice: anyone holding it reads the line items. A category, not mere metadata.\n  hostedInvoiceUrl: z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n  invoicePdfUrl: z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n\n  /** Provider reference */\n  providerInvoiceId: z.string().isBackendOnly(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type InvoiceRef = z.infer<typeof InvoiceRefSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const invoiceRefsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'invoiceRefs',\n  baseFieldIdentifier: 'invoiceRefId',\n  baseEnumKey: 'INVOICE_REFS',\n  baseSchema: InvoiceRefSchema,\n  // Many invoices per scope (LIST/SEARCH/CREATE/UPDATE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"invoice-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE;IAElH,2EAA2E;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;IAExF,uEAAuE;IACvE,sGAAsG;IACtG,KAAK,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAE7H;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iGAAiG;IACjG,uGAAuG;IACvG,wGAAwG;IACxG,uGAAuG;IACvG,uFAAuF;IACvF,gBAAgB,EAAE,oBAAoB,CACpC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IACD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IAED,yBAAyB;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE;IAE7C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,uEAAuE;IACvE,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Invoice Reference Schema (Shared) — Polymorphic\n *\n * Thin reference synced FROM provider (webhook-driven), NOT created by Wildo.\n * Only stores what's needed for: billing status checks, quick display, and provider links.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, invoice refs are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationInvoiceRefs  (with organizationId + organizationBillingAccountId)\n *   - userInvoiceRefs          (with userId + userBillingAccountId)\n *\n *\n * @see billing-and-features-system.md §6.4 (Invoice References)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { z_money, CurrencyAllowed, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { InvoiceStatus } from './billing-enums.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\n\nexport const InvoiceRefSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed(),\n\n  /** Status - needed for billing status checks (past_due detection, etc.) */\n  status: z.enum(InvoiceStatus).isDBIndexed().isSummaryField().systemEnum('InvoiceStatus'),\n\n  /** Total amount - needed for quick display in subscription overview */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts` for why this rides the shared base.\n  total: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT] }).isSummaryField().dataCategories(PersonalDataCategory.FINANCIAL),\n\n  /**\n   * Provider-hosted invoice URLs — **backend-only, deliberately not exposed to clients.**\n   *\n   * These are CAPABILITY-STYLE links: whoever holds one can open the document, with no\n   * authentication. And the document is a tax invoice, which is legally required to carry the\n   * customer's full name and billing address (EU VAT Directive 2006/112/EC Art. 226(5), and\n   * equivalents elsewhere) — so the invoice PDF is personal data even though this row is not.\n   *\n   * That combination is why the URLs cannot sit in the response DTO. After a subject erasure the\n   * row is deliberately RETAINED and stays visible for accounting, and an ordinarily-readable link\n   * to a document rendering the erased person's name and address would defeat the erasure.\n   *\n   * The document itself is NEVER scrubbed or unlinked: mutilating it would void it as a tax\n   * record, which is precisely what the retention obligation exists to preserve (GDPR Art. 17(3)(b)\n   * exempts processing required by a legal obligation). Access is what is controlled, not content.\n   *\n   * The user-facing door is the provider's own customer portal\n   * (`StandardBilling_Interface.createCustomerPortalSession`, surfaced as the billing account's\n   * `open_portal` operation), which authenticates the viewer provider-side and is the conventional\n   * SaaS shape. Backend code reads these fields normally — they are present on `internalDto`.\n   */\n  // The URL IS the invoice: anyone holding it reads the line items. A category, not mere metadata.\n  // REMOVE both URLs on erasure. They address provider-hosted documents that CARRY the person's name and\n  // billing address — content about them, not an amount about the invoice. `total` deliberately keeps its\n  // category and takes NO treatment: it is retained under the tax/audit obligation this family exists to\n  // serve, and the mode permits a categorized field to survive when the law requires it.\n  hostedInvoiceUrl: addImpersonalizeWith(\n    z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n    RedactionType.REMOVE,\n  ),\n  invoicePdfUrl: addImpersonalizeWith(\n    z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n    RedactionType.REMOVE,\n  ),\n\n  /** Provider reference */\n  providerInvoiceId: z.string().isBackendOnly(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type InvoiceRef = z.infer<typeof InvoiceRefSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const invoiceRefsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'invoiceRefs',\n  baseFieldIdentifier: 'invoiceRefId',\n  baseEnumKey: 'INVOICE_REFS',\n  baseSchema: InvoiceRefSchema,\n  // Many invoices per scope (LIST/SEARCH/CREATE/UPDATE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/billing/price.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"price.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/price.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,cAAc,EACf,MAAM,gCAAgC,CAAC;AAIxC;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;iBA4CtB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"price.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/price.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,cAAc,EACf,MAAM,gCAAgC,CAAC;AAIxC;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;iBAkDtB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/esm/billing/price.shared.schemas.js

@@ -55,7 +55,13 @@ export const PriceSchema = z.object({
     usageAggregation: z.enum(UsageAggregationType).optional(),
     /**
      * Tax behavior for this price (maps to Stripe's price.tax_behavior).
-     * Resolved from: price-level override > product.taxDisplayMode > BillingConfiguration.tax.defaultDisplayMode.
+     *
+     * There is NO resolution chain: this value alone reaches the provider. The catalog sync passes
+     * `taxBehavior` straight through on both the price upsert and the provider price creation, so
+     * leaving it unset does not fall back to `product.taxDisplayMode` or to
+     * `BillingConfiguration.tax.defaultDisplayMode`. The provider call simply omits `tax_behavior`
+     * and the billing account's own default decides. Declare it here on every price whose tax
+     * presentation matters.
      * - 'exclusive': amount is HT, tax added on top
      * - 'inclusive': amount is TTC, tax embedded
      * When absent: inherits from product, then from global config.

package/dist/esm/billing/price.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"price.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/price.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,gCAAgC,CAAC;AAExC,sEAAsE;AAEtE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,sEAAsE;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,mCAAmC;IACnC,SAAS,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAChF,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;CACjF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAElC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE;IAEzD,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;IACvE;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE;IAEjG,uDAAuD;IACvD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAC7D,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC1C,iEAAiE;IACjE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,gDAAgD;IAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAEzD;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAE9C,mEAAmE;IACnE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACtD,4EAA4E;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,mDAAmD;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;IAEjD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC","sourcesContent":["/**\n * Price & Price Tier Schemas (Shared)\n *\n * Prices define how much a product costs. A product can have multiple prices\n * (e.g., monthly vs. yearly, different currencies).\n *\n * Prices are APPLICATION-scoped, linked to a Product via productId.\n * Like products, they are populated lazily from the code-defined catalog.\n *\n * @see billing-and-features-system.md §6.2 (Product & Price Catalog)\n */\n\nimport { z } from 'zod';\nimport { z_money, CurrencyAllowed } from '@wildo-ai/zod-decorators';\nimport {\n  PricingModel,\n  BillingInterval,\n  UsageAggregationType,\n  TaxDisplayMode,\n} from './billing-enums.shared.schemas';\n\n// ── Price Tier ─────────────────────────────────────────────────────\n\n/**\n * A single tier in a tiered/graduated pricing model.\n * `upTo: null` means \"infinity\" (the final open-ended tier).\n *\n * Tier amounts carry their own currency via z_money for:\n * - Self-describing data (no implicit dependency on parent Price's currency)\n * - Proper money input rendering in forms\n * - Bigint precision for all monetary values\n */\nexport const PriceTierSchema = z.object({\n  /** Upper bound for this tier (null = infinity, i.e. the last tier) */\n  upTo: z.number().nullable(),\n  /** Per-unit price for this tier */\n  unitPrice: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT], minAmount: 0n }),\n  /** Flat price added to this tier (on top of unit pricing) */\n  flatPrice: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT], minAmount: 0n }),\n});\nexport type PriceTier = z.infer<typeof PriceTierSchema>;\n\n// ── Price ──────────────────────────────────────────────────────────\n\nexport const PriceSchema = z.object({\n\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /** Reference to the parent product */\n  productId: z.string().min(1).isForeignKey().isDBIndexed(),\n\n  /** Pricing model (flat, per_unit, tiered, graduated, package) */\n  model: z.enum(PricingModel).isSummaryField().systemEnum('PricingModel'),\n  /**\n   * Unit price for FLAT/PER_UNIT models.\n   * Uses z_money for bigint precision, self-contained currency, and proper form rendering.\n   * Undefined for TIERED/GRADUATED models (use `tiers` instead).\n   */\n  unitPrice: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT], minAmount: 0n }).isSummaryField(),\n\n  /** Billing interval (undefined for one-time prices) */\n  interval: z.enum(BillingInterval).optional().isSummaryField(),\n  /** Interval count (e.g., 3 for quarterly = interval:'month', intervalCount:3) */\n  intervalCount: z.number().min(1).default(1),\n\n  /** Tiers for TIERED/GRADUATED pricing models */\n  tiers: z.array(PriceTierSchema).optional(),\n  /** Package size for PACKAGE pricing model (price per N units) */\n  packageSize: z.number().min(1).optional(),\n  /** Usage aggregation type for metered prices */\n  usageAggregation: z.enum(UsageAggregationType).optional(),\n\n  /**\n   * Tax behavior for this price (maps to Stripe's price.tax_behavior).\n   * Resolved from: price-level override > product.taxDisplayMode > BillingConfiguration.tax.defaultDisplayMode.\n   * - 'exclusive': amount is HT, tax added on top\n   * - 'inclusive': amount is TTC, tax embedded\n   * When absent: inherits from product, then from global config.\n   */\n  taxBehavior: z.enum(TaxDisplayMode).optional(),\n\n  /** Provider sync (lazy: populated on first use, not at startup) */\n  providerPriceId: z.string().optional().isBackendOnly(),\n  /** Whether this is the default price for the product (shown first in UI) */\n  isDefault: z.boolean().default(true),\n  /** Whether this price is available for purchase */\n  isActive: z.boolean().default(true).isDBIndexed(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type Price = z.infer<typeof PriceSchema>;\n"]}
+{"version":3,"file":"price.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/price.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,gCAAgC,CAAC;AAExC,sEAAsE;AAEtE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,sEAAsE;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,mCAAmC;IACnC,SAAS,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAChF,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;CACjF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAElC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE;IAEzD,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;IACvE;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE;IAEjG,uDAAuD;IACvD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAC7D,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC1C,iEAAiE;IACjE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,gDAAgD;IAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAEzD;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAE9C,mEAAmE;IACnE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACtD,4EAA4E;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,mDAAmD;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;IAEjD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC","sourcesContent":["/**\n * Price & Price Tier Schemas (Shared)\n *\n * Prices define how much a product costs. A product can have multiple prices\n * (e.g., monthly vs. yearly, different currencies).\n *\n * Prices are APPLICATION-scoped, linked to a Product via productId.\n * Like products, they are populated lazily from the code-defined catalog.\n *\n * @see billing-and-features-system.md §6.2 (Product & Price Catalog)\n */\n\nimport { z } from 'zod';\nimport { z_money, CurrencyAllowed } from '@wildo-ai/zod-decorators';\nimport {\n  PricingModel,\n  BillingInterval,\n  UsageAggregationType,\n  TaxDisplayMode,\n} from './billing-enums.shared.schemas';\n\n// ── Price Tier ─────────────────────────────────────────────────────\n\n/**\n * A single tier in a tiered/graduated pricing model.\n * `upTo: null` means \"infinity\" (the final open-ended tier).\n *\n * Tier amounts carry their own currency via z_money for:\n * - Self-describing data (no implicit dependency on parent Price's currency)\n * - Proper money input rendering in forms\n * - Bigint precision for all monetary values\n */\nexport const PriceTierSchema = z.object({\n  /** Upper bound for this tier (null = infinity, i.e. the last tier) */\n  upTo: z.number().nullable(),\n  /** Per-unit price for this tier */\n  unitPrice: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT], minAmount: 0n }),\n  /** Flat price added to this tier (on top of unit pricing) */\n  flatPrice: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT], minAmount: 0n }),\n});\nexport type PriceTier = z.infer<typeof PriceTierSchema>;\n\n// ── Price ──────────────────────────────────────────────────────────\n\nexport const PriceSchema = z.object({\n\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /** Reference to the parent product */\n  productId: z.string().min(1).isForeignKey().isDBIndexed(),\n\n  /** Pricing model (flat, per_unit, tiered, graduated, package) */\n  model: z.enum(PricingModel).isSummaryField().systemEnum('PricingModel'),\n  /**\n   * Unit price for FLAT/PER_UNIT models.\n   * Uses z_money for bigint precision, self-contained currency, and proper form rendering.\n   * Undefined for TIERED/GRADUATED models (use `tiers` instead).\n   */\n  unitPrice: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT], minAmount: 0n }).isSummaryField(),\n\n  /** Billing interval (undefined for one-time prices) */\n  interval: z.enum(BillingInterval).optional().isSummaryField(),\n  /** Interval count (e.g., 3 for quarterly = interval:'month', intervalCount:3) */\n  intervalCount: z.number().min(1).default(1),\n\n  /** Tiers for TIERED/GRADUATED pricing models */\n  tiers: z.array(PriceTierSchema).optional(),\n  /** Package size for PACKAGE pricing model (price per N units) */\n  packageSize: z.number().min(1).optional(),\n  /** Usage aggregation type for metered prices */\n  usageAggregation: z.enum(UsageAggregationType).optional(),\n\n  /**\n   * Tax behavior for this price (maps to Stripe's price.tax_behavior).\n   *\n   * There is NO resolution chain: this value alone reaches the provider. The catalog sync passes\n   * `taxBehavior` straight through on both the price upsert and the provider price creation, so\n   * leaving it unset does not fall back to `product.taxDisplayMode` or to\n   * `BillingConfiguration.tax.defaultDisplayMode`. The provider call simply omits `tax_behavior`\n   * and the billing account's own default decides. Declare it here on every price whose tax\n   * presentation matters.\n   * - 'exclusive': amount is HT, tax added on top\n   * - 'inclusive': amount is TTC, tax embedded\n   * When absent: inherits from product, then from global config.\n   */\n  taxBehavior: z.enum(TaxDisplayMode).optional(),\n\n  /** Provider sync (lazy: populated on first use, not at startup) */\n  providerPriceId: z.string().optional().isBackendOnly(),\n  /** Whether this is the default price for the product (shown first in UI) */\n  isDefault: z.boolean().default(true),\n  /** Whether this price is available for purchase */\n  isActive: z.boolean().default(true).isDBIndexed(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type Price = z.infer<typeof PriceSchema>;\n"]}

package/dist/esm/billing/product-behavior-policy.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"product-behavior-policy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/product-behavior-policy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EAC1B,MAAM,gCAAgC,CAAC;AAIxC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB;;;iBAK3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqDtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"product-behavior-policy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/product-behavior-policy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EAC1B,MAAM,gCAAgC,CAAC;AAIxC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB;;;iBAK3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8FtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/billing/product-behavior-policy.shared.schemas.js

@@ -44,7 +44,17 @@ export const ProductBehaviorPolicySchema = z.object({
     trial: z.object({
         /** Number of trial days (0 = no trial) */
         days: z.number().min(0).default(0),
-        /** Whether to require a payment method before trial starts */
+        /**
+         * Require a payment method before the trial starts. READ since 2026-09-08 (#408).
+         *
+         * It reached no provider call before that, so a trial declared as requiring a card behaved
+         * identically to one that did not — Wonder Todos' enterprise plan (`true`) and professional
+         * plan (`false`) were indistinguishable at the provider.
+         *
+         * Only meaningful WITH a trial: a product declaring it alongside `days: 0` demands nothing,
+         * because asking for a card up front on a purchase with no trial is a different decision and
+         * nobody authored it.
+         */
         requirePaymentMethod: z.boolean().default(false),
     }).optional(),
     /** Upgrade behavior (when switching TO this plan from a lower tier) */
@@ -67,22 +77,53 @@ export const ProductBehaviorPolicySchema = z.object({
         defaultBehavior: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),
     }).optional(),
     /**
-     * Authored metering policy (for METERED products only).
+     * Authored metering policy (for METERED products only), READ by
+     * `UsageMeteringBackendService` since 2026-09-08 (#415).
      *
-     * The current `UsageMeteringBackendService` does not yet consume these
-     * scheduling, aggregation-window or retry values: it groups every pending row
-     * by billing account and product whenever the externally scheduled flush runs.
-     * Keep this distinction visible so configuration documentation does not turn
-     * an accepted policy shape into a false runtime guarantee.
+     * Every field here was declared, defaulted, documented and read by NOTHING until then: the flush
+     * merged every pending row by billing account and product whatever the product said, so
+     * `preFlushAggregation: false` was unrepresentable and `aggregationWindow`'s two members selected
+     * between behaviours that were the same behaviour. The note that stood here said exactly that and
+     * asked that the gap stay visible rather than become "a false runtime guarantee"; this replaces it
+     * because the guarantee is now real, and says which reader makes each field true.
      */
     metering: z.object({
-        /** How often to flush aggregated usage to billing provider (minutes) */
+        /**
+         * How often to flush aggregated usage to the billing provider (minutes).
+         *
+         * Read by the engine's usage-flush batch, which picks the SHORTEST interval any metered product
+         * authors — a schedule is one thing and the products sharing it are many, so the fastest promise
+         * is the one that has to be kept. A product asking for less frequent reporting than its neighbour
+         * still gets reported at the neighbour's cadence, which costs nothing: reporting sooner than
+         * authored is never wrong, reporting later than authored is.
+         */
         flushIntervalMinutes: z.number().min(1).default(60),
-        /** Aggregation window for usage records before flush */
+        /**
+         * Whether one meter event may span a billing-period boundary.
+         *
+         * This is not a preference, it is a correctness choice about MONEY. A merged group carries ONE
+         * timestamp and the provider assigns the event to the period that timestamp falls in, so
+         * `PER_FLUSH` merging across a boundary bills the earlier period's usage into the later one.
+         * `PER_BILLING_PERIOD` splits at the boundary, derived from the subscription's own
+         * `currentPeriodStart` / `currentPeriodEnd`. Leave it `PER_FLUSH` when the product's periods do
+         * not change what it costs.
+         */
         aggregationWindow: z.enum(MeteringAggregationWindow).default(MeteringAggregationWindow.PER_FLUSH),
-        /** Aggregate locally before sending (sum up same-key records) */
+        /**
+         * Aggregate locally before sending (sum same-key records into one meter event).
+         *
+         * `false` sends one event per recorded row, each with its own instant. Choose it when the provider
+         * must see every event — because its aggregation is not a sum, or because the individual instants
+         * matter. Local merging destroys both irreversibly, before the provider ever sees them.
+         */
         preFlushAggregation: z.boolean().default(true),
-        /** Retry policy when provider flush fails */
+        /**
+         * Retry policy when a provider report fails.
+         *
+         * Safe only because every meter event carries a derived idempotency identifier: a retry after a
+         * response lost in transit re-sends the same identifier and the provider discards it. Retrying
+         * without that is how a timeout becomes a double charge, which is why the two shipped together.
+         */
         retryPolicy: z.object({
             maxRetries: z.number().default(3),
             backoffMultiplier: z.number().default(2),