@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/billing/product-behavior-policy.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"product-behavior-policy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/product-behavior-policy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAExC,sEAAsE;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,2DAA2D;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,0CAA0C;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC;CACzD,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,mFAAmF;IACnF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,0CAA0C;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,8DAA8D;QAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACjD,CAAC,CAAC,QAAQ,EAAE;IAEb,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,4EAA4E;QAC5E,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACjF,oDAAoD;QACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;KAC/D,CAAC,CAAC,QAAQ,EAAE;IAEb,yEAAyE;IACzE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACpE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KACnE,CAAC,CAAC,QAAQ,EAAE;IAEb,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,2DAA2D;QAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1C,oDAAoD;QACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAC5E,CAAC,CAAC,QAAQ,EAAE;IAEb;;;;;;;;OAQG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,wEAAwE;QACxE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,wDAAwD;QACxD,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,SAAS,CAAC;QACjG,iEAAiE;QACjE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,6CAA6C;QAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC","sourcesContent":["/**\n * Product Behavior Policy & Limit Grant Schemas (Shared)\n *\n * Declarative configuration for how the billing provider and the engine\n * should handle product lifecycle (trial, proration, cancellation, metering).\n *\n * Also defines the LimitGrant schema that controls how product limits compose.\n *\n * @see billing-and-features-system.md §6.1 (LimitGrant), §6.1 (ProductBehaviorPolicy)\n */\n\nimport { z } from 'zod';\nimport {\n  LimitGrantMode,\n  ProrationBehavior,\n  BillingTiming,\n  MeteringAggregationWindow,\n} from './billing-enums.shared.schemas';\n\n// ── Limit Grant ────────────────────────────────────────────────────\n\n/**\n * A limit grant from a product.\n *\n * - SET mode: absolute value (replaces, used for PLAN base limits).\n *   Example: \"Professional plan gives you 50 projects.\"\n * - ADD mode: additive (stacks on top, used for ADDON bonus limits).\n *   Example: \"+10 extra projects.\"\n *\n * Aggregation algorithm in BillingFeatureSyncBackendService:\n *   1. Start with active PLAN's SET limits (only one active plan per billing account)\n *   2. For each active ADDON with ADD mode: sum onto current limit\n *   3. For each active ADDON with SET mode: take max(current, addon value)\n *   4. FEATURES_UNLIMITED always wins in any comparison\n */\nexport const LimitGrantSchema = z.object({\n  /** The limit value (count or -1 for FEATURES_UNLIMITED) */\n  value: z.number(),\n  /** How this grant composes with others */\n  mode: z.enum(LimitGrantMode).default(LimitGrantMode.SET),\n});\nexport type LimitGrant = z.infer<typeof LimitGrantSchema>;\n\n// ── Product Behavior Policy ────────────────────────────────────────\n\n/**\n * Declarative configuration for how the billing provider and the engine\n * should handle this product's lifecycle.\n *\n * This is the \"billing policy\" layer — NOT reimplementing provider logic,\n * but CONFIGURING the parameters that get passed to the provider's API.\n */\nexport const ProductBehaviorPolicySchema = z.object({\n  /** Trial configuration (overrides global BillingConfiguration.defaultTrialDays) */\n  trial: z.object({\n    /** Number of trial days (0 = no trial) */\n    days: z.number().min(0).default(0),\n    /** Whether to require a payment method before trial starts */\n    requirePaymentMethod: z.boolean().default(false),\n  }).optional(),\n\n  /** Upgrade behavior (when switching TO this plan from a lower tier) */\n  upgrade: z.object({\n    /** Proration passed to provider: create_prorations, none, always_invoice */\n    proration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n    /** Apply immediately or at end of current period */\n    timing: z.enum(BillingTiming).default(BillingTiming.IMMEDIATE),\n  }).optional(),\n\n  /** Downgrade behavior (when switching FROM this plan to a lower tier) */\n  downgrade: z.object({\n    proration: z.enum(ProrationBehavior).default(ProrationBehavior.NONE),\n    timing: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).optional(),\n\n  /** Cancellation behavior for subscriptions on this product */\n  cancellation: z.object({\n    /** Allow immediate cancellation (vs only at period end) */\n    allowImmediate: z.boolean().default(false),\n    /** Default cancellation timing when user cancels */\n    defaultBehavior: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).optional(),\n\n  /**\n   * Authored metering policy (for METERED products only).\n   *\n   * The current `UsageMeteringBackendService` does not yet consume these\n   * scheduling, aggregation-window or retry values: it groups every pending row\n   * by billing account and product whenever the externally scheduled flush runs.\n   * Keep this distinction visible so configuration documentation does not turn\n   * an accepted policy shape into a false runtime guarantee.\n   */\n  metering: z.object({\n    /** How often to flush aggregated usage to billing provider (minutes) */\n    flushIntervalMinutes: z.number().min(1).default(60),\n    /** Aggregation window for usage records before flush */\n    aggregationWindow: z.enum(MeteringAggregationWindow).default(MeteringAggregationWindow.PER_FLUSH),\n    /** Aggregate locally before sending (sum up same-key records) */\n    preFlushAggregation: z.boolean().default(true),\n    /** Retry policy when provider flush fails */\n    retryPolicy: z.object({\n      maxRetries: z.number().default(3),\n      backoffMultiplier: z.number().default(2),\n    }).default({ maxRetries: 3, backoffMultiplier: 2 }),\n  }).optional(),\n});\nexport type ProductBehaviorPolicy = z.infer<typeof ProductBehaviorPolicySchema>;\n"]}
+{"version":3,"file":"product-behavior-policy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/product-behavior-policy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAExC,sEAAsE;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,2DAA2D;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,0CAA0C;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC;CACzD,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,mFAAmF;IACnF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,0CAA0C;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC;;;;;;;;;;WAUG;QACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACjD,CAAC,CAAC,QAAQ,EAAE;IAEb,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,4EAA4E;QAC5E,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACjF,oDAAoD;QACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;KAC/D,CAAC,CAAC,QAAQ,EAAE;IAEb,yEAAyE;IACzE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACpE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KACnE,CAAC,CAAC,QAAQ,EAAE;IAEb,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,2DAA2D;QAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1C,oDAAoD;QACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAC5E,CAAC,CAAC,QAAQ,EAAE;IAEb;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB;;;;;;;;WAQG;QACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD;;;;;;;;;WASG;QACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,SAAS,CAAC;QACjG;;;;;;WAMG;QACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C;;;;;;WAMG;QACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC","sourcesContent":["/**\n * Product Behavior Policy & Limit Grant Schemas (Shared)\n *\n * Declarative configuration for how the billing provider and the engine\n * should handle product lifecycle (trial, proration, cancellation, metering).\n *\n * Also defines the LimitGrant schema that controls how product limits compose.\n *\n * @see billing-and-features-system.md §6.1 (LimitGrant), §6.1 (ProductBehaviorPolicy)\n */\n\nimport { z } from 'zod';\nimport {\n  LimitGrantMode,\n  ProrationBehavior,\n  BillingTiming,\n  MeteringAggregationWindow,\n} from './billing-enums.shared.schemas';\n\n// ── Limit Grant ────────────────────────────────────────────────────\n\n/**\n * A limit grant from a product.\n *\n * - SET mode: absolute value (replaces, used for PLAN base limits).\n *   Example: \"Professional plan gives you 50 projects.\"\n * - ADD mode: additive (stacks on top, used for ADDON bonus limits).\n *   Example: \"+10 extra projects.\"\n *\n * Aggregation algorithm in BillingFeatureSyncBackendService:\n *   1. Start with active PLAN's SET limits (only one active plan per billing account)\n *   2. For each active ADDON with ADD mode: sum onto current limit\n *   3. For each active ADDON with SET mode: take max(current, addon value)\n *   4. FEATURES_UNLIMITED always wins in any comparison\n */\nexport const LimitGrantSchema = z.object({\n  /** The limit value (count or -1 for FEATURES_UNLIMITED) */\n  value: z.number(),\n  /** How this grant composes with others */\n  mode: z.enum(LimitGrantMode).default(LimitGrantMode.SET),\n});\nexport type LimitGrant = z.infer<typeof LimitGrantSchema>;\n\n// ── Product Behavior Policy ────────────────────────────────────────\n\n/**\n * Declarative configuration for how the billing provider and the engine\n * should handle this product's lifecycle.\n *\n * This is the \"billing policy\" layer — NOT reimplementing provider logic,\n * but CONFIGURING the parameters that get passed to the provider's API.\n */\nexport const ProductBehaviorPolicySchema = z.object({\n  /** Trial configuration (overrides global BillingConfiguration.defaultTrialDays) */\n  trial: z.object({\n    /** Number of trial days (0 = no trial) */\n    days: z.number().min(0).default(0),\n    /**\n     * Require a payment method before the trial starts. READ since 2026-09-08 (#408).\n     *\n     * It reached no provider call before that, so a trial declared as requiring a card behaved\n     * identically to one that did not — Wonder Todos' enterprise plan (`true`) and professional\n     * plan (`false`) were indistinguishable at the provider.\n     *\n     * Only meaningful WITH a trial: a product declaring it alongside `days: 0` demands nothing,\n     * because asking for a card up front on a purchase with no trial is a different decision and\n     * nobody authored it.\n     */\n    requirePaymentMethod: z.boolean().default(false),\n  }).optional(),\n\n  /** Upgrade behavior (when switching TO this plan from a lower tier) */\n  upgrade: z.object({\n    /** Proration passed to provider: create_prorations, none, always_invoice */\n    proration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n    /** Apply immediately or at end of current period */\n    timing: z.enum(BillingTiming).default(BillingTiming.IMMEDIATE),\n  }).optional(),\n\n  /** Downgrade behavior (when switching FROM this plan to a lower tier) */\n  downgrade: z.object({\n    proration: z.enum(ProrationBehavior).default(ProrationBehavior.NONE),\n    timing: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).optional(),\n\n  /** Cancellation behavior for subscriptions on this product */\n  cancellation: z.object({\n    /** Allow immediate cancellation (vs only at period end) */\n    allowImmediate: z.boolean().default(false),\n    /** Default cancellation timing when user cancels */\n    defaultBehavior: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).optional(),\n\n  /**\n   * Authored metering policy (for METERED products only), READ by\n   * `UsageMeteringBackendService` since 2026-09-08 (#415).\n   *\n   * Every field here was declared, defaulted, documented and read by NOTHING until then: the flush\n   * merged every pending row by billing account and product whatever the product said, so\n   * `preFlushAggregation: false` was unrepresentable and `aggregationWindow`'s two members selected\n   * between behaviours that were the same behaviour. The note that stood here said exactly that and\n   * asked that the gap stay visible rather than become \"a false runtime guarantee\"; this replaces it\n   * because the guarantee is now real, and says which reader makes each field true.\n   */\n  metering: z.object({\n    /**\n     * How often to flush aggregated usage to the billing provider (minutes).\n     *\n     * Read by the engine's usage-flush batch, which picks the SHORTEST interval any metered product\n     * authors — a schedule is one thing and the products sharing it are many, so the fastest promise\n     * is the one that has to be kept. A product asking for less frequent reporting than its neighbour\n     * still gets reported at the neighbour's cadence, which costs nothing: reporting sooner than\n     * authored is never wrong, reporting later than authored is.\n     */\n    flushIntervalMinutes: z.number().min(1).default(60),\n    /**\n     * Whether one meter event may span a billing-period boundary.\n     *\n     * This is not a preference, it is a correctness choice about MONEY. A merged group carries ONE\n     * timestamp and the provider assigns the event to the period that timestamp falls in, so\n     * `PER_FLUSH` merging across a boundary bills the earlier period's usage into the later one.\n     * `PER_BILLING_PERIOD` splits at the boundary, derived from the subscription's own\n     * `currentPeriodStart` / `currentPeriodEnd`. Leave it `PER_FLUSH` when the product's periods do\n     * not change what it costs.\n     */\n    aggregationWindow: z.enum(MeteringAggregationWindow).default(MeteringAggregationWindow.PER_FLUSH),\n    /**\n     * Aggregate locally before sending (sum same-key records into one meter event).\n     *\n     * `false` sends one event per recorded row, each with its own instant. Choose it when the provider\n     * must see every event — because its aggregation is not a sum, or because the individual instants\n     * matter. Local merging destroys both irreversibly, before the provider ever sees them.\n     */\n    preFlushAggregation: z.boolean().default(true),\n    /**\n     * Retry policy when a provider report fails.\n     *\n     * Safe only because every meter event carries a derived idempotency identifier: a retry after a\n     * response lost in transit re-sends the same identifier and the provider discards it. Retrying\n     * without that is how a timeout becomes a double charge, which is why the two shipped together.\n     */\n    retryPolicy: z.object({\n      maxRetries: z.number().default(3),\n      backoffMultiplier: z.number().default(2),\n    }).default({ maxRetries: 3, backoffMultiplier: 2 }),\n  }).optional(),\n});\nexport type ProductBehaviorPolicy = z.infer<typeof ProductBehaviorPolicySchema>;\n"]}

package/dist/esm/billing/product-definition.shared.schemas.d.ts

@@ -74,11 +74,11 @@ export declare const ProductDefinitionSchema: z.ZodObject<{
             requirePaymentMethod: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strip>>;
         upgrade: z.ZodOptional<z.ZodObject<{
-            proration: z.ZodDefault<z.ZodEnum<typeof import("./billing-enums.shared.schemas").ProrationBehavior>>;
+            proration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
             timing: z.ZodDefault<z.ZodEnum<typeof import("./billing-enums.shared.schemas").BillingTiming>>;
         }, z.core.$strip>>;
         downgrade: z.ZodOptional<z.ZodObject<{
-            proration: z.ZodDefault<z.ZodEnum<typeof import("./billing-enums.shared.schemas").ProrationBehavior>>;
+            proration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
             timing: z.ZodDefault<z.ZodEnum<typeof import("./billing-enums.shared.schemas").BillingTiming>>;
         }, z.core.$strip>>;
         cancellation: z.ZodOptional<z.ZodObject<{

package/dist/esm/billing/product.shared.resources-config.schemas.d.ts

@@ -31,11 +31,11 @@ export declare const productsResourceConfiguration_InitializationFactory: (resou
             requirePaymentMethod: import("zod").ZodDefault<import("zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         upgrade: import("zod").ZodOptional<import("zod").ZodObject<{
-            proration: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("./billing-enums.shared.schemas").ProrationBehavior>>;
+            proration: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
             timing: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("./billing-enums.shared.schemas").BillingTiming>>;
         }, import("zod/v4/core").$strip>>;
         downgrade: import("zod").ZodOptional<import("zod").ZodObject<{
-            proration: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("./billing-enums.shared.schemas").ProrationBehavior>>;
+            proration: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
             timing: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("./billing-enums.shared.schemas").BillingTiming>>;
         }, import("zod/v4/core").$strip>>;
         cancellation: import("zod").ZodOptional<import("zod").ZodObject<{

package/dist/esm/billing/product.shared.schemas.d.ts

@@ -44,11 +44,11 @@ export declare const ProductSchema: z.ZodObject<{
             requirePaymentMethod: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strip>>;
         upgrade: z.ZodOptional<z.ZodObject<{
-            proration: z.ZodDefault<z.ZodEnum<typeof import("./billing-enums.shared.schemas").ProrationBehavior>>;
+            proration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
             timing: z.ZodDefault<z.ZodEnum<typeof import("./billing-enums.shared.schemas").BillingTiming>>;
         }, z.core.$strip>>;
         downgrade: z.ZodOptional<z.ZodObject<{
-            proration: z.ZodDefault<z.ZodEnum<typeof import("./billing-enums.shared.schemas").ProrationBehavior>>;
+            proration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
             timing: z.ZodDefault<z.ZodEnum<typeof import("./billing-enums.shared.schemas").BillingTiming>>;
         }, z.core.$strip>>;
         cancellation: z.ZodOptional<z.ZodObject<{

package/dist/esm/billing/product.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"product.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/product.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,cAAc,EACf,MAAM,gCAAgC,CAAC;AAIxC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0ExB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"product.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/product.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,cAAc,EACf,MAAM,gCAAgC,CAAC;AAIxC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8ExB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/esm/billing/product.shared.schemas.js

@@ -49,12 +49,16 @@ export const ProductSchema = z.object({
     /** For ADDON type: required plan tiers to subscribe to this addon (empty = no restriction) */
     requiredPlanTiers: z.array(z.string()).optional(),
     /**
-     * Tax display override for this product (overrides BillingConfiguration.tax.defaultDisplayMode).
+     * Tax display intent for this product, recorded on the product row.
      * - 'exclusive': price amounts are HT (tax added at checkout)
      * - 'inclusive': price amounts are TTC (tax embedded)
-     * When absent: uses global default from BillingConfiguration.
      *
-     * Common pattern: org products → exclusive, user products → inclusive.
+     * It is DECLARATIVE ONLY and does not reach the billing provider. The catalog sync stores it on
+     * the product and then sends each price's own `taxBehavior` unchanged, so a price that declares
+     * none is created without `tax_behavior` regardless of what this field says. To make the
+     * intention effective, set `taxBehavior` on the prices as well.
+     *
+     * Common pattern: org products exclusive, user products inclusive.
      */
     taxDisplayMode: z.enum(TaxDisplayMode).optional(),
     /**

package/dist/esm/billing/product.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"product.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/product.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,cAAc,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAEvF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAEpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;IAClG,yEAAyE;IACzE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAErF,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAEhE;;;;;;;;;;OAUG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAEjF,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAChD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,8FAA8F;IAC9F,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,iFAAiF;QACjF,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpD,sDAAsD;QACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC5C,yFAAyF;QACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC,QAAQ,EAAE;IAEb,gEAAgE;IAChE,cAAc,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAEtD,uFAAuF;IACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAExD,2CAA2C;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,mDAAmD;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACpD,qDAAqD;IACrD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC","sourcesContent":["/**\n * Product Schema (Shared)\n *\n * Products define what you sell. They live in the DB as APPLICATION-scoped records,\n * populated lazily from the code-defined ProductDefinition catalog.\n *\n * Config-driven, lazy-populated:\n * 1. Config is the source of truth: Product definitions live in code (shared lib)\n * 2. Populate on demand: DB records created on first checkout/admin view\n * 3. Provider sync on demand: providerProductId filled when first used in provider ops\n * 4. Bulk sync available: Admin action to pre-populate all products\n * 5. Startup is lightweight: No blocking provider calls at boot\n *\n * The admin UI shows products as read-only resources (view + \"Sync to Provider\" action),\n * NOT as CRUD-editable. Changes require code deployment.\n *\n * @see billing-and-features-system.md §6.2 (Product & Price Catalog)\n */\n\nimport { z } from 'zod';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  ProductType,\n  TaxDisplayMode,\n} from './billing-enums.shared.schemas';\nimport { LimitGrantSchema } from './product-behavior-policy.shared.schemas';\nimport { ProductBehaviorPolicySchema } from './product-behavior-policy.shared.schemas';\n\nexport const ProductSchema = z.object({\n\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  type: z.enum(ProductType).isDBIndexed().isSummaryField().isNotEditable().systemEnum('ProductType'),\n  /** Unique product key (maps to ProductDefinition.key in code catalog) */\n  key: z.string().min(1).isUnique({ scope: 'global' }).isSummaryField().isNotEditable(),\n\n  /** Which scopes can subscribe to this product (code-driven, not user-editable) */\n  targetScopes: z.array(z.enum(ResourcePrimaryScope)).min(1),\n\n  /** Features this product grants (boolean: present = enabled) */\n  grantedFeatures: z.array(z.string()).default([]).isNotEditable(),\n\n  /**\n   * Limits this product grants, with aggregation mode.\n   * - SET: absolute value (for PLAN products: \"Professional gives you 50 projects\")\n   * - ADD: additive to current limits (for ADDON products: \"+10 extra projects\")\n   *\n   * Aggregation algorithm in BillingFeatureSyncBackendService:\n   *   1. Start with active PLAN's SET limits (only one active plan per billing account)\n   *   2. For each active ADDON with ADD mode: sum onto current limit\n   *   3. For each active ADDON with SET mode: take max(current, addon value)\n   *   4. FEATURES_UNLIMITED always wins in any comparison\n   */\n  grantedLimits: z.record(z.string(), LimitGrantSchema).default({}).isNotEditable(),\n\n  /** For PLAN type: mutually exclusive tier ordering (higher number = higher tier) */\n  planTier: z.string().optional().isSummaryField(),\n  /** For PLAN type: tier sort order (used for upgrade/downgrade direction detection) */\n  planTierOrder: z.number().optional(),\n\n  /** For ADDON type: required plan tiers to subscribe to this addon (empty = no restriction) */\n  requiredPlanTiers: z.array(z.string()).optional(),\n\n  /**\n   * Tax display override for this product (overrides BillingConfiguration.tax.defaultDisplayMode).\n   * - 'exclusive': price amounts are HT (tax added at checkout)\n   * - 'inclusive': price amounts are TTC (tax embedded)\n   * When absent: uses global default from BillingConfiguration.\n   *\n   * Common pattern: org products → exclusive, user products → inclusive.\n   */\n  taxDisplayMode: z.enum(TaxDisplayMode).optional(),\n\n  /**\n   * Purchase configuration for non-subscription products (ONE_TIME, CREDIT_PACK, ITEM).\n   * Ignored for subscription products (PLAN, ADDON, METERED).\n   */\n  purchaseConfig: z.object({\n    /** Maximum quantity per purchase (for CREDIT_PACK/ITEM). undefined = no limit */\n    maxQuantityPerPurchase: z.number().min(1).optional(),\n    /** For CREDIT_PACK: how many credits per pack unit */\n    creditsPerUnit: z.number().min(1).optional(),\n    /** For CREDIT_PACK: which \"credit pool\" this feeds (e.g., 'ai_tokens', 'sms_credits') */\n    creditPoolKey: z.string().optional(),\n  }).optional(),\n\n  /** Behavior policy: trial, proration, cancellation, metering */\n  behaviorPolicy: ProductBehaviorPolicySchema.optional(),\n\n  /** Provider sync (lazy: populated on first checkout or sync action, NOT at startup) */\n  providerProductId: z.string().optional().isBackendOnly(),\n\n  /** Display sort order in pricing tables */\n  sortOrder: z.number().default(0),\n  /** Whether this product is visible to end users */\n  isPublic: z.boolean().default(true).isSummaryField(),\n  /** Whether this product is available for purchase */\n  isActive: z.boolean().default(true).isDBIndexed().isSummaryField(),\n  metadata: z.record(z.string(), z.string()).optional(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type Product = z.infer<typeof ProductSchema>;\n"]}
+{"version":3,"file":"product.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/product.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,cAAc,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAEvF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAEpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;IAClG,yEAAyE;IACzE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAErF,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAEhE;;;;;;;;;;OAUG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAEjF,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAChD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,8FAA8F;IAC9F,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,iFAAiF;QACjF,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpD,sDAAsD;QACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC5C,yFAAyF;QACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC,QAAQ,EAAE;IAEb,gEAAgE;IAChE,cAAc,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAEtD,uFAAuF;IACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAExD,2CAA2C;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,mDAAmD;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACpD,qDAAqD;IACrD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC","sourcesContent":["/**\n * Product Schema (Shared)\n *\n * Products define what you sell. They live in the DB as APPLICATION-scoped records,\n * populated lazily from the code-defined ProductDefinition catalog.\n *\n * Config-driven, lazy-populated:\n * 1. Config is the source of truth: Product definitions live in code (shared lib)\n * 2. Populate on demand: DB records created on first checkout/admin view\n * 3. Provider sync on demand: providerProductId filled when first used in provider ops\n * 4. Bulk sync available: Admin action to pre-populate all products\n * 5. Startup is lightweight: No blocking provider calls at boot\n *\n * The admin UI shows products as read-only resources (view + \"Sync to Provider\" action),\n * NOT as CRUD-editable. Changes require code deployment.\n *\n * @see billing-and-features-system.md §6.2 (Product & Price Catalog)\n */\n\nimport { z } from 'zod';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  ProductType,\n  TaxDisplayMode,\n} from './billing-enums.shared.schemas';\nimport { LimitGrantSchema } from './product-behavior-policy.shared.schemas';\nimport { ProductBehaviorPolicySchema } from './product-behavior-policy.shared.schemas';\n\nexport const ProductSchema = z.object({\n\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  type: z.enum(ProductType).isDBIndexed().isSummaryField().isNotEditable().systemEnum('ProductType'),\n  /** Unique product key (maps to ProductDefinition.key in code catalog) */\n  key: z.string().min(1).isUnique({ scope: 'global' }).isSummaryField().isNotEditable(),\n\n  /** Which scopes can subscribe to this product (code-driven, not user-editable) */\n  targetScopes: z.array(z.enum(ResourcePrimaryScope)).min(1),\n\n  /** Features this product grants (boolean: present = enabled) */\n  grantedFeatures: z.array(z.string()).default([]).isNotEditable(),\n\n  /**\n   * Limits this product grants, with aggregation mode.\n   * - SET: absolute value (for PLAN products: \"Professional gives you 50 projects\")\n   * - ADD: additive to current limits (for ADDON products: \"+10 extra projects\")\n   *\n   * Aggregation algorithm in BillingFeatureSyncBackendService:\n   *   1. Start with active PLAN's SET limits (only one active plan per billing account)\n   *   2. For each active ADDON with ADD mode: sum onto current limit\n   *   3. For each active ADDON with SET mode: take max(current, addon value)\n   *   4. FEATURES_UNLIMITED always wins in any comparison\n   */\n  grantedLimits: z.record(z.string(), LimitGrantSchema).default({}).isNotEditable(),\n\n  /** For PLAN type: mutually exclusive tier ordering (higher number = higher tier) */\n  planTier: z.string().optional().isSummaryField(),\n  /** For PLAN type: tier sort order (used for upgrade/downgrade direction detection) */\n  planTierOrder: z.number().optional(),\n\n  /** For ADDON type: required plan tiers to subscribe to this addon (empty = no restriction) */\n  requiredPlanTiers: z.array(z.string()).optional(),\n\n  /**\n   * Tax display intent for this product, recorded on the product row.\n   * - 'exclusive': price amounts are HT (tax added at checkout)\n   * - 'inclusive': price amounts are TTC (tax embedded)\n   *\n   * It is DECLARATIVE ONLY and does not reach the billing provider. The catalog sync stores it on\n   * the product and then sends each price's own `taxBehavior` unchanged, so a price that declares\n   * none is created without `tax_behavior` regardless of what this field says. To make the\n   * intention effective, set `taxBehavior` on the prices as well.\n   *\n   * Common pattern: org products exclusive, user products inclusive.\n   */\n  taxDisplayMode: z.enum(TaxDisplayMode).optional(),\n\n  /**\n   * Purchase configuration for non-subscription products (ONE_TIME, CREDIT_PACK, ITEM).\n   * Ignored for subscription products (PLAN, ADDON, METERED).\n   */\n  purchaseConfig: z.object({\n    /** Maximum quantity per purchase (for CREDIT_PACK/ITEM). undefined = no limit */\n    maxQuantityPerPurchase: z.number().min(1).optional(),\n    /** For CREDIT_PACK: how many credits per pack unit */\n    creditsPerUnit: z.number().min(1).optional(),\n    /** For CREDIT_PACK: which \"credit pool\" this feeds (e.g., 'ai_tokens', 'sms_credits') */\n    creditPoolKey: z.string().optional(),\n  }).optional(),\n\n  /** Behavior policy: trial, proration, cancellation, metering */\n  behaviorPolicy: ProductBehaviorPolicySchema.optional(),\n\n  /** Provider sync (lazy: populated on first checkout or sync action, NOT at startup) */\n  providerProductId: z.string().optional().isBackendOnly(),\n\n  /** Display sort order in pricing tables */\n  sortOrder: z.number().default(0),\n  /** Whether this product is visible to end users */\n  isPublic: z.boolean().default(true).isSummaryField(),\n  /** Whether this product is available for purchase */\n  isActive: z.boolean().default(true).isDBIndexed().isSummaryField(),\n  metadata: z.record(z.string(), z.string()).optional(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type Product = z.infer<typeof ProductSchema>;\n"]}

package/dist/esm/billing/subscription.shared.resources-config.schemas.d.ts

@@ -23,7 +23,7 @@ export declare enum BillingSubscription_Operations {
 }
 /** Request DTO for CANCEL operation — shared between resource config and custom impl */
 export declare const BillingSubscription_CancelRequestDto: z.ZodObject<{
-    cancelImmediately: z.ZodDefault<z.ZodBoolean>;
+    cancelImmediately: z.ZodOptional<z.ZodBoolean>;
     reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Request DTO for CHANGE_PLAN operation — shared between resource config and custom impl */
@@ -49,5 +49,5 @@ export declare const BillingSubscription_RemoveAddonRequestDto: z.ZodObject<{
  *   - organizationSubscriptions
  *   - userSubscriptions
  */
-export declare const billingSubscriptionsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<typeof BillingSubscription_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+export declare const billingSubscriptionsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<typeof BillingSubscription_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=subscription.shared.resources-config.schemas.d.ts.map

package/dist/esm/billing/subscription.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAazG,oBAAY,8BAA8B;IACxC,6DAA6D;IAC7D,MAAM,WAAW;IACjB,wDAAwD;IACxD,MAAM,WAAW;IACjB,qDAAqD;IACrD,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,SAAS,cAAc;IACvB,oDAAoD;IACpD,YAAY,iBAAiB;CAC9B;AAID,wFAAwF;AACxF,eAAO,MAAM,oCAAoC;;;iBAG/C,CAAC;AAEH,6FAA6F;AAC7F,eAAO,MAAM,wCAAwC;;;iBAGnD,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,sCAAsC;;;iBAGjD,CAAC;AAEH,8FAA8F;AAC9F,eAAO,MAAM,yCAAyC;;iBAEpD,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC,6OAmJpD,CAAC"}
+{"version":3,"file":"subscription.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAczG,oBAAY,8BAA8B;IACxC,6DAA6D;IAC7D,MAAM,WAAW;IACjB,wDAAwD;IACxD,MAAM,WAAW;IACjB,qDAAqD;IACrD,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,SAAS,cAAc;IACvB,oDAAoD;IACpD,YAAY,iBAAiB;CAC9B;AAID,wFAAwF;AACxF,eAAO,MAAM,oCAAoC;;;iBAiB/C,CAAC;AAEH,6FAA6F;AAC7F,eAAO,MAAM,wCAAwC;;;iBAGnD,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,sCAAsC;;;iBAGjD,CAAC;AAEH,8FAA8F;AAC9F,eAAO,MAAM,yCAAyC;;iBAEpD,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC,iRA4LpD,CAAC"}

package/dist/esm/billing/subscription.shared.resources-config.schemas.js

@@ -15,6 +15,7 @@ import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.
 import { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
 import { billingSubscriptionsPolymorphicDeclaration } from './subscription.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 // ── Custom Operations ────────────────────────────────────────────────
 export var BillingSubscription_Operations;
 (function (BillingSubscription_Operations) {
@@ -32,7 +33,21 @@ export var BillingSubscription_Operations;
 // ── Request DTOs ─────────────────────────────────────────────────────
 /** Request DTO for CANCEL operation — shared between resource config and custom impl */
 export const BillingSubscription_CancelRequestDto = z.object({
-    cancelImmediately: z.boolean().default(false),
+    /**
+     * OPTIONAL, with no default — and the absence of a default is the point (#408, 2026-09-08).
+     *
+     * It carried `.default(false)` until then, which materialized `false` at parse and made "the
+     * caller expressed no preference" a state the handler could never observe. That erased the only
+     * input `ProductBehaviorPolicy.cancellation.defaultBehavior` exists to answer, so an authored
+     * product default was unimplementable rather than merely unimplemented — a field one layer up
+     * had already decided for it.
+     *
+     * The resolution order is now: the caller's explicit choice, then the plan product's
+     * `defaultBehavior`, then period-end as the framework floor. Omitting it still ends in period-end
+     * for a product that authors no policy, so nothing changes for an existing caller — what changes
+     * is that a product declaring IMMEDIATE now gets it.
+     */
+    cancelImmediately: z.boolean().optional(),
     reason: z.string().max(500).optional(),
 });
 /** Request DTO for CHANGE_PLAN operation — shared between resource config and custom impl */
@@ -76,14 +91,52 @@ export const billingSubscriptionsPolymorphicFactories = createPolymorphicResourc
         list: ResourceSystemAccessMode.ALLOWED,
     },
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /**
+     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.
+ *
+ * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is
+ * subscription terms — plan and price references, status and period boundaries — amounts and contract terms about the ACCOUNT. They
+ * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit
+ * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as
+ * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.
+ *
+ * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an
+ * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_ONLY,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the
+ *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own
+ *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     customOperation: BillingSubscription_Operations,
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it
+         * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the
+         * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the
+         * verb the impersonalize writer uses to stamp the retention markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [{
                     // API_CALL: subscriptions are a user-facing collection (Settings Hub → Billing →

package/dist/esm/billing/subscription.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,0CAA0C,EAAE,MAAM,+BAA+B,CAAC;AAE3F,wEAAwE;AAExE,MAAM,CAAN,IAAY,8BAWX;AAXD,WAAY,8BAA8B;IACxC,6DAA6D;IAC7D,mDAAiB,CAAA;IACjB,wDAAwD;IACxD,mDAAiB,CAAA;IACjB,qDAAqD;IACrD,6DAA2B,CAAA;IAC3B,+CAA+C;IAC/C,yDAAuB,CAAA;IACvB,oDAAoD;IACpD,+DAA6B,CAAA;AAC/B,CAAC,EAXW,8BAA8B,KAA9B,8BAA8B,QAWzC;AAED,wEAAwE;AAExE,wFAAwF;AACxF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,uCAAuC,CAC7F,0CAA0C,EAC1C;IACE,gBAAgB,EAAE,IAAI;IACtB,gGAAgG;IAChG,4FAA4F;IAC5F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,+FAA+F;IAC/F,wDAAwD;IACxD,kBAAkB,EAAE;QAClB,kSAAkS;QAClS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E,eAAe,EAAE,8BAA8B;IAC/C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,iFAAiF;oBACjF,mFAAmF;oBACnF,6EAA6E;oBAC7E,wFAAwF;oBACxF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,oCAAoC;iBACjD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,mFAAmF;oBACnF,iFAAiF;oBACjF,oFAAoF;oBACpF,+EAA+E;oBAC/E,+EAA+E;oBAC/E,gFAAgF;oBAChF,kCAAkC;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAAE;YAC5C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,wCAAwC;iBACrD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,sCAAsC;iBACnD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,YAAY,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Subscription Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...billingSubscriptionsPolymorphicFactories\n *\n * @see polymorphic-scope-approach-A-expansion.md — Phase 3\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { billingSubscriptionsPolymorphicDeclaration } from './subscription.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingSubscription_Operations {\n  /** Cancel the subscription (at period end or immediately) */\n  CANCEL = 'cancel',\n  /** Resume a cancelled subscription before period end */\n  RESUME = 'resume',\n  /** Change to a different plan (upgrade/downgrade) */\n  CHANGE_PLAN = 'change_plan',\n  /** Add an addon product to the subscription */\n  ADD_ADDON = 'add_addon',\n  /** Remove an addon product from the subscription */\n  REMOVE_ADDON = 'remove_addon',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/** Request DTO for CANCEL operation — shared between resource config and custom impl */\nexport const BillingSubscription_CancelRequestDto = z.object({\n  cancelImmediately: z.boolean().default(false),\n  reason: z.string().max(500).optional(),\n});\n\n/** Request DTO for CHANGE_PLAN operation — shared between resource config and custom impl */\nexport const BillingSubscription_ChangePlanRequestDto = z.object({\n  newProductKey: z.string().min(1),\n  newPriceId: z.string().min(1),\n});\n\n/** Request DTO for ADD_ADDON operation — shared between resource config and custom impl */\nexport const BillingSubscription_AddAddonRequestDto = z.object({\n  addonProductKey: z.string().min(1),\n  priceId: z.string().min(1),\n});\n\n/** Request DTO for REMOVE_ADDON operation — shared between resource config and custom impl */\nexport const BillingSubscription_RemoveAddonRequestDto = z.object({\n  addonProductKey: z.string().min(1),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/**\n * Polymorphic factory map for subscriptions.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...billingSubscriptionsPolymorphicFactories\n *\n * Produces entries for:\n *   - organizationSubscriptions\n *   - userSubscriptions\n */\nexport const billingSubscriptionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  billingSubscriptionsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // System-context LIST opt-in (fail-closed default is FORBIDDEN). Subject erasure enumerates the\n    // erased person's live subscriptions so it can cancel them at the provider immediately — an\n    // erased subject must stop being billed. There is no request context on that path (the subject\n    // is being erased), so it reads through `SystemAccessBackendService.listAsSystem`, which refuses\n    // any resource that has not opted in here. LIST's default variant is API_CALL and therefore\n    // resolves through `getServiceOperationPathDefault`; a REPOSITORY_ONLY-only LIST would satisfy\n    // this grant and still fail to resolve at erasure time.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own subscriptions. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n    customOperation: BillingSubscription_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: subscriptions are a user-facing collection (Settings Hub → Billing →\n          // Subscriptions, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n          // strip the op from the frontend registry and register no HTTP route. Writes\n          // (checkout + webhook sync) are INTERNAL_CALL (service-pipeline) / custom API_CALL ops.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [BillingSubscription_Operations.CANCEL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_CancelRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.RESUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // RESUME clears a pending cancellation at the provider and mirrors the result — it\n          // takes no caller input. Its implementation already ignores the payload, but the\n          // dispatcher MERGES a prefix's return onto the caller payload rather than replacing\n          // it, so an unnarrowed contract is still writable. Omitting `requestDto` would\n          // auto-derive the FULL subscription update DTO (`status`, `items`, `discount`,\n          // `currentPeriodEnd`, `cancelledAt`, …), letting a subscriber rewrite their own\n          // billing state through \"resume\".\n          requestDto: z.object({}),\n        }],\n      },\n      [BillingSubscription_Operations.CHANGE_PLAN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_ChangePlanRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.ADD_ADDON]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_AddAddonRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.REMOVE_ADDON]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_RemoveAddonRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"subscription.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,0CAA0C,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,8BAWX;AAXD,WAAY,8BAA8B;IACxC,6DAA6D;IAC7D,mDAAiB,CAAA;IACjB,wDAAwD;IACxD,mDAAiB,CAAA;IACjB,qDAAqD;IACrD,6DAA2B,CAAA;IAC3B,+CAA+C;IAC/C,yDAAuB,CAAA;IACvB,oDAAoD;IACpD,+DAA6B,CAAA;AAC/B,CAAC,EAXW,8BAA8B,KAA9B,8BAA8B,QAWzC;AAED,wEAAwE;AAExE,wFAAwF;AACxF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,uCAAuC,CAC7F,0CAA0C,EAC1C;IACE,gBAAgB,EAAE,IAAI;IACtB,gGAAgG;IAChG,4FAA4F;IAC5F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,+FAA+F;IAC/F,wDAAwD;IACxD,kBAAkB,EAAE;QAClB,kSAAkS;QAClS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,eAAe,EAAE,8BAA8B;IAC/C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,iFAAiF;oBACjF,mFAAmF;oBACnF,6EAA6E;oBAC7E,wFAAwF;oBACxF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,oCAAoC;iBACjD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,mFAAmF;oBACnF,iFAAiF;oBACjF,oFAAoF;oBACpF,+EAA+E;oBAC/E,+EAA+E;oBAC/E,gFAAgF;oBAChF,kCAAkC;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAAE;YAC5C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,wCAAwC;iBACrD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,sCAAsC;iBACnD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,YAAY,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Subscription Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...billingSubscriptionsPolymorphicFactories\n *\n * @see polymorphic-scope-approach-A-expansion.md — Phase 3\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { billingSubscriptionsPolymorphicDeclaration } from './subscription.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingSubscription_Operations {\n  /** Cancel the subscription (at period end or immediately) */\n  CANCEL = 'cancel',\n  /** Resume a cancelled subscription before period end */\n  RESUME = 'resume',\n  /** Change to a different plan (upgrade/downgrade) */\n  CHANGE_PLAN = 'change_plan',\n  /** Add an addon product to the subscription */\n  ADD_ADDON = 'add_addon',\n  /** Remove an addon product from the subscription */\n  REMOVE_ADDON = 'remove_addon',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/** Request DTO for CANCEL operation — shared between resource config and custom impl */\nexport const BillingSubscription_CancelRequestDto = z.object({\n  /**\n   * OPTIONAL, with no default — and the absence of a default is the point (#408, 2026-09-08).\n   *\n   * It carried `.default(false)` until then, which materialized `false` at parse and made \"the\n   * caller expressed no preference\" a state the handler could never observe. That erased the only\n   * input `ProductBehaviorPolicy.cancellation.defaultBehavior` exists to answer, so an authored\n   * product default was unimplementable rather than merely unimplemented — a field one layer up\n   * had already decided for it.\n   *\n   * The resolution order is now: the caller's explicit choice, then the plan product's\n   * `defaultBehavior`, then period-end as the framework floor. Omitting it still ends in period-end\n   * for a product that authors no policy, so nothing changes for an existing caller — what changes\n   * is that a product declaring IMMEDIATE now gets it.\n   */\n  cancelImmediately: z.boolean().optional(),\n  reason: z.string().max(500).optional(),\n});\n\n/** Request DTO for CHANGE_PLAN operation — shared between resource config and custom impl */\nexport const BillingSubscription_ChangePlanRequestDto = z.object({\n  newProductKey: z.string().min(1),\n  newPriceId: z.string().min(1),\n});\n\n/** Request DTO for ADD_ADDON operation — shared between resource config and custom impl */\nexport const BillingSubscription_AddAddonRequestDto = z.object({\n  addonProductKey: z.string().min(1),\n  priceId: z.string().min(1),\n});\n\n/** Request DTO for REMOVE_ADDON operation — shared between resource config and custom impl */\nexport const BillingSubscription_RemoveAddonRequestDto = z.object({\n  addonProductKey: z.string().min(1),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/**\n * Polymorphic factory map for subscriptions.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...billingSubscriptionsPolymorphicFactories\n *\n * Produces entries for:\n *   - organizationSubscriptions\n *   - userSubscriptions\n */\nexport const billingSubscriptionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  billingSubscriptionsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // System-context LIST opt-in (fail-closed default is FORBIDDEN). Subject erasure enumerates the\n    // erased person's live subscriptions so it can cancel them at the provider immediately — an\n    // erased subject must stop being billed. There is no request context on that path (the subject\n    // is being erased), so it reads through `SystemAccessBackendService.listAsSystem`, which refuses\n    // any resource that has not opted in here. LIST's default variant is API_CALL and therefore\n    // resolves through `getServiceOperationPathDefault`; a REPOSITORY_ONLY-only LIST would satisfy\n    // this grant and still fail to resolve at erasure time.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own subscriptions. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * subscription terms — plan and price references, status and period boundaries — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n *\n * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    customOperation: BillingSubscription_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: subscriptions are a user-facing collection (Settings Hub → Billing →\n          // Subscriptions, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n          // strip the op from the frontend registry and register no HTTP route. Writes\n          // (checkout + webhook sync) are INTERNAL_CALL (service-pipeline) / custom API_CALL ops.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [BillingSubscription_Operations.CANCEL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_CancelRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.RESUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // RESUME clears a pending cancellation at the provider and mirrors the result — it\n          // takes no caller input. Its implementation already ignores the payload, but the\n          // dispatcher MERGES a prefix's return onto the caller payload rather than replacing\n          // it, so an unnarrowed contract is still writable. Omitting `requestDto` would\n          // auto-derive the FULL subscription update DTO (`status`, `items`, `discount`,\n          // `currentPeriodEnd`, `cancelledAt`, …), letting a subscriber rewrite their own\n          // billing state through \"resume\".\n          requestDto: z.object({}),\n        }],\n      },\n      [BillingSubscription_Operations.CHANGE_PLAN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_ChangePlanRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.ADD_ADDON]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_AddAddonRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.REMOVE_ADDON]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_RemoveAddonRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/subscription.shared.schemas.d.ts

@@ -35,13 +35,13 @@ export declare const BillingSubscriptionBaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof SubscriptionStatus>>>>>;
-    items: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodArray<z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         productId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         priceId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         quantity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
         providerSubscriptionItemId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-    }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     currentPeriodStart: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
     currentPeriodEnd: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
     trialStart: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;
@@ -78,13 +78,13 @@ export declare const billingSubscriptionsPolymorphicDeclaration: import("..").Po
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof SubscriptionStatus>>>>>;
-    items: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodArray<z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         productId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         priceId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         quantity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
         providerSubscriptionItemId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-    }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     currentPeriodStart: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
     currentPeriodEnd: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
     trialStart: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;

package/dist/esm/billing/subscription.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIpE;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAUjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;;;GASG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQrD,CAAC"}
+{"version":3,"file":"subscription.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIpE;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAUjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0ExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;;;GASG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQrD,CAAC"}

package/dist/esm/billing/subscription.shared.schemas.js

@@ -14,7 +14,6 @@
  * @see billing-and-features-system.md §6.3 (Subscription & Subscription Items)
  */
 import { z } from 'zod';
-import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
 import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas.js';
 import { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas.js';
 import { SubscriptionStatus } from './billing-enums.shared.schemas.js';
@@ -55,7 +54,12 @@ export const BillingSubscriptionBaseSchema = z.object({
     /** Subscription items (what products/prices are included) */
     // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. What the account holder pays
     // for, at what quantity; the lifecycle `status` beside it is a state machine, not a datum.
-    items: z.array(SubscriptionItemSchema).min(1).dataCategories(PersonalDataCategory.FINANCIAL),
+    // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.
+    // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the
+    // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be
+    // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the
+    // resource config (#138).
+    items: z.array(SubscriptionItemSchema).min(1),
     /** Period */
     currentPeriodStart: z.date().isDBIndexed().isNotEditable(),
     currentPeriodEnd: z.date().isDBIndexed().isSummaryField().isNotEditable(),

package/dist/esm/billing/subscription.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9E,sCAAsC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5E,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACvD,oBAAoB;IACpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;CAClE,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEnI,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,wFAAwF;IACxF,6FAA6F;IAC7F,sFAAsF;IACtF,kGAAkG;IAClG,kFAAkF;IAClF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,eAAe,EAAE;IAEpH,6DAA6D;IAC7D,gGAAgG;IAChG,2FAA2F;IAC3F,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAE5F,aAAa;IACb,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;IAC1D,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAEzE,YAAY;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE9D,mBAAmB;IACnB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAC9D,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACzB,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B,uEAAuE;IACvE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,yBAAyB,CAAC;IAClF,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,gBAAgB;IACrC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,6BAA6B;IACzC,qEAAqE;IACrE,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Subscription & Subscription Item Schemas (Shared) — Polymorphic\n *\n * Subscriptions are scope-expanded alongside BillingAccounts. Each subscription\n * variant gets the scope identity FK injected (organizationId / userId)\n * and keeps `billingAccountId` as the FK to its parent billing account variant.\n *\n * The polymorphic expansion produces 2 concrete resources:\n *   - organizationSubscriptions  (with organizationId + organizationBillingAccountId)\n *   - userSubscriptions          (with userId + userBillingAccountId)\n *\n *\n * @see polymorphic-scope-approach-A-expansion.md\n * @see billing-and-features-system.md §6.3 (Subscription & Subscription Items)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { SubscriptionStatus } from './billing-enums.shared.schemas';\n\n// ── Subscription Item ──────────────────────────────────────────────\n\n/**\n * A line item within a subscription (one product/price pair).\n */\nexport const SubscriptionItemSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  /** Reference to the product */\n  productId: z.string().min(1).isForeignKey().isSummaryField({ populate: true }),\n  /** Reference to the specific price */\n  priceId: z.string().min(1).isForeignKey().isSummaryField({ populate: true }),\n  /** Quantity (e.g., number of seats) */\n  quantity: z.number().min(1).default(1).isSummaryField(),\n  /** Provider sync */\n  providerSubscriptionItemId: z.string().optional().isBackendOnly(),\n});\nexport type SubscriptionItem = z.infer<typeof SubscriptionItemSchema>;\n\n// ── Subscription Base Schema ───────────────────────────────────────\n\n/**\n * Subscription base schema — NO identity scope fields.\n * The polymorphic declaration injects the parent scope FK automatically per variant.\n * `billingAccountId` is kept as the FK to the parent billing account variant.\n */\nexport const BillingSubscriptionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /** References the parent billing account (polymorphic FK — renamed per variant) */\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n\n  // `.isAuditEvidence()` — subscription status is the ENTITLEMENT gate: the feature resolver\n  // derives a scope's capabilities from it, so a transition to/from ACTIVE silently widens or\n  // narrows what the tenant may do. Recording the before/after states makes an entitlement\n  // dispute answerable from the trail instead of from the payment provider's own records.\n  // Marked on the STATUS only — the provider identifiers on this schema are `.isBackendOnly()`\n  // and the money/customer fields are not authorization evidence, so neither is marked.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a subscription status transition widens or\n  // narrows tenant capability, so the before/after states are entitlement evidence.\n  status: z.enum(SubscriptionStatus).isDBIndexed().isSummaryField().systemEnum('SubscriptionStatus').isAuditEvidence(),\n\n  /** Subscription items (what products/prices are included) */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. What the account holder pays\n  // for, at what quantity; the lifecycle `status` beside it is a state machine, not a datum.\n  items: z.array(SubscriptionItemSchema).min(1).dataCategories(PersonalDataCategory.FINANCIAL),\n\n  /** Period */\n  currentPeriodStart: z.date().isDBIndexed().isNotEditable(),\n  currentPeriodEnd: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n  /** Trial */\n  trialStart: z.date().optional().isNotEditable(),\n  trialEnd: z.date().optional().isSummaryField().isNotEditable(),\n\n  /** Cancellation */\n  cancelAtPeriodEnd: z.boolean().default(false).isSummaryField(),\n  cancelledAt: z.date().optional().isNotEditable(),\n  cancellationReason: z.string().optional(),\n\n  /** Active discount from a coupon/promotion applied to this subscription (populated from provider) */\n  discount: z.object({\n    providerCouponId: z.string().optional(),\n    percentOff: z.number().optional(),\n    amountOff: z.number().optional(),\n    currency: z.string().optional(),\n    duration: z.string().optional(),\n    durationInMonths: z.number().optional(),\n    end: z.date().optional(),\n  }).optional().isNotEditable(),\n\n  /** Provider sync (payment methods are managed entirely by provider) */\n  providerSubscriptionId: z.string().optional().isBackendOnly(),\n\n  /**\n   * Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n   *\n   * ⚠️ **AUTHORING RULE — never store personal data here.** This row is RETAINED when its subject is\n   * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n   * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n   * personal data of its own — the person is a foreign key. An open bag is the one place that\n   * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n   * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n   * keys it does not know.\n   *\n   * Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n   * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n   * breach that the retained label makes look intentional.\n   *\n   * Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n   * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n   * Revisit only if an app is found using the bag this way.\n   */\n  metadata: z.record(z.string(), z.string()).optional(),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type BillingSubscriptionBase = z.infer<typeof BillingSubscriptionBaseSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\n/**\n * Polymorphic declaration for Subscriptions.\n * Produces 2 variants:\n *   - organizations  → organizationSubscriptions  (organizationId injected)\n *   - users          → userSubscriptions          (userId injected)\n *\n *\n * Each variant gets `billingAccountId` renamed to the scoped FK\n * (e.g., `organizationBillingAccountId`) via polymorphic FK transformation.\n */\nexport const billingSubscriptionsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'subscriptions',\n  baseFieldIdentifier: 'subscriptionId',\n  baseEnumKey: 'SUBSCRIPTIONS',\n  baseSchema: BillingSubscriptionBaseSchema,\n  // Many subscriptions per scope (LIST/CREATE/UPDATE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n\n"]}
+{"version":3,"file":"subscription.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9E,sCAAsC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5E,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACvD,oBAAoB;IACpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;CAClE,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEnI,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,wFAAwF;IACxF,6FAA6F;IAC7F,sFAAsF;IACtF,kGAAkG;IAClG,kFAAkF;IAClF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,eAAe,EAAE;IAEpH,6DAA6D;IAC7D,gGAAgG;IAChG,2FAA2F;IAC3F,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C,aAAa;IACb,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;IAC1D,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAEzE,YAAY;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE9D,mBAAmB;IACnB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAC9D,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACzB,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B,uEAAuE;IACvE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,yBAAyB,CAAC;IAClF,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,gBAAgB;IACrC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,6BAA6B;IACzC,qEAAqE;IACrE,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Subscription & Subscription Item Schemas (Shared) — Polymorphic\n *\n * Subscriptions are scope-expanded alongside BillingAccounts. Each subscription\n * variant gets the scope identity FK injected (organizationId / userId)\n * and keeps `billingAccountId` as the FK to its parent billing account variant.\n *\n * The polymorphic expansion produces 2 concrete resources:\n *   - organizationSubscriptions  (with organizationId + organizationBillingAccountId)\n *   - userSubscriptions          (with userId + userBillingAccountId)\n *\n *\n * @see polymorphic-scope-approach-A-expansion.md\n * @see billing-and-features-system.md §6.3 (Subscription & Subscription Items)\n */\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { SubscriptionStatus } from './billing-enums.shared.schemas';\n\n// ── Subscription Item ──────────────────────────────────────────────\n\n/**\n * A line item within a subscription (one product/price pair).\n */\nexport const SubscriptionItemSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  /** Reference to the product */\n  productId: z.string().min(1).isForeignKey().isSummaryField({ populate: true }),\n  /** Reference to the specific price */\n  priceId: z.string().min(1).isForeignKey().isSummaryField({ populate: true }),\n  /** Quantity (e.g., number of seats) */\n  quantity: z.number().min(1).default(1).isSummaryField(),\n  /** Provider sync */\n  providerSubscriptionItemId: z.string().optional().isBackendOnly(),\n});\nexport type SubscriptionItem = z.infer<typeof SubscriptionItemSchema>;\n\n// ── Subscription Base Schema ───────────────────────────────────────\n\n/**\n * Subscription base schema — NO identity scope fields.\n * The polymorphic declaration injects the parent scope FK automatically per variant.\n * `billingAccountId` is kept as the FK to the parent billing account variant.\n */\nexport const BillingSubscriptionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /** References the parent billing account (polymorphic FK — renamed per variant) */\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n\n  // `.isAuditEvidence()` — subscription status is the ENTITLEMENT gate: the feature resolver\n  // derives a scope's capabilities from it, so a transition to/from ACTIVE silently widens or\n  // narrows what the tenant may do. Recording the before/after states makes an entitlement\n  // dispute answerable from the trail instead of from the payment provider's own records.\n  // Marked on the STATUS only — the provider identifiers on this schema are `.isBackendOnly()`\n  // and the money/customer fields are not authorization evidence, so neither is marked.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a subscription status transition widens or\n  // narrows tenant capability, so the before/after states are entitlement evidence.\n  status: z.enum(SubscriptionStatus).isDBIndexed().isSummaryField().systemEnum('SubscriptionStatus').isAuditEvidence(),\n\n  /** Subscription items (what products/prices are included) */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. What the account holder pays\n  // for, at what quantity; the lifecycle `status` beside it is a state machine, not a datum.\n  // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n  // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n  // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n  // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n  // resource config (#138).\n  items: z.array(SubscriptionItemSchema).min(1),\n\n  /** Period */\n  currentPeriodStart: z.date().isDBIndexed().isNotEditable(),\n  currentPeriodEnd: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n  /** Trial */\n  trialStart: z.date().optional().isNotEditable(),\n  trialEnd: z.date().optional().isSummaryField().isNotEditable(),\n\n  /** Cancellation */\n  cancelAtPeriodEnd: z.boolean().default(false).isSummaryField(),\n  cancelledAt: z.date().optional().isNotEditable(),\n  cancellationReason: z.string().optional(),\n\n  /** Active discount from a coupon/promotion applied to this subscription (populated from provider) */\n  discount: z.object({\n    providerCouponId: z.string().optional(),\n    percentOff: z.number().optional(),\n    amountOff: z.number().optional(),\n    currency: z.string().optional(),\n    duration: z.string().optional(),\n    durationInMonths: z.number().optional(),\n    end: z.date().optional(),\n  }).optional().isNotEditable(),\n\n  /** Provider sync (payment methods are managed entirely by provider) */\n  providerSubscriptionId: z.string().optional().isBackendOnly(),\n\n  /**\n   * Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n   *\n   * ⚠️ **AUTHORING RULE — never store personal data here.** This row is RETAINED when its subject is\n   * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n   * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n   * personal data of its own — the person is a foreign key. An open bag is the one place that\n   * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n   * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n   * keys it does not know.\n   *\n   * Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n   * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n   * breach that the retained label makes look intentional.\n   *\n   * Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n   * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n   * Revisit only if an app is found using the bag this way.\n   */\n  metadata: z.record(z.string(), z.string()).optional(),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type BillingSubscriptionBase = z.infer<typeof BillingSubscriptionBaseSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\n/**\n * Polymorphic declaration for Subscriptions.\n * Produces 2 variants:\n *   - organizations  → organizationSubscriptions  (organizationId injected)\n *   - users          → userSubscriptions          (userId injected)\n *\n *\n * Each variant gets `billingAccountId` renamed to the scoped FK\n * (e.g., `organizationBillingAccountId`) via polymorphic FK transformation.\n */\nexport const billingSubscriptionsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'subscriptions',\n  baseFieldIdentifier: 'subscriptionId',\n  baseEnumKey: 'SUBSCRIPTIONS',\n  baseSchema: BillingSubscriptionBaseSchema,\n  // Many subscriptions per scope (LIST/CREATE/UPDATE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n\n"]}

package/dist/esm/billing/usage-record.shared.resources-config.schemas.d.ts

@@ -6,5 +6,5 @@
  *   ...usageRecordsPolymorphicFactories
  */
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
-export declare const usageRecordsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+export declare const usageRecordsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=usage-record.shared.resources-config.schemas.d.ts.map

package/dist/esm/billing/usage-record.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage-record.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAWzG,eAAO,MAAM,gCAAgC,iNAiE5C,CAAC"}
+{"version":3,"file":"usage-record.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAYzG,eAAO,MAAM,gCAAgC,qPA0G5C,CAAC"}

package/dist/esm/billing/usage-record.shared.resources-config.schemas.js

@@ -12,18 +12,57 @@ import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles
 import { usageRecordsPolymorphicDeclaration } from './usage-record.shared.schemas.js';
 import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 export const usageRecordsPolymorphicFactories = createPolymorphicResourceConfigurations(usageRecordsPolymorphicDeclaration, {
     isSystemResource: true,
     /** Subject-export disclosure. The subject's own usage records. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */
     systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /**
+     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.
+ *
+ * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is
+ * metered usage — a product key, a quantity and a period — amounts and contract terms about the ACCOUNT. They
+ * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit
+ * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as
+ * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.
+ *
+ * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an
+ * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_ONLY,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the
+ *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own
+ *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it
+         * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the
+         * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the
+         * verb the impersonalize writer uses to stamp the retention markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [{
                     // API_CALL: usage records are a user-facing collection (Settings Hub → Billing →