@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/resources/resources-config.shared.factory.js

@@ -3,11 +3,11 @@
  *
  * Reusable operation schemas for bulk actions and common operations
  */
-import { ExpiresInDurationSchema, getImpersonalizeMaskValue, getImpersonalizeTreatment, getZodObjectShape, getZodType, isBackendOnlyField, isDiscriminatorField, isExcludedFromCreate, isExcludedFromUpdate, isBusinessKeyField, isZodObject, isSummaryField, isTemplatableFileField, isVirtualField, SingleFileValueSchema, toPatchOptionalField, mainSchemaFieldIsClearable, unwrapSchema, getDataCategories, } from '@wildo-ai/zod-decorators';
+import { ExpiresInDurationSchema, getImpersonalizeMaskValue, getImpersonalizeTreatment, getZodObjectShape, getZodType, isBackendOnlyField, isDiscriminatorField, isExcludedFromCreate, isExcludedFromUpdate, isBusinessKeyField, isZodObject, isSummaryField, isTemplatableFileField, isUniqueField, isVirtualField, SingleFileValueSchema, toPatchOptionalField, mainSchemaFieldIsClearable, unwrapSchema, getDataCategories, } from '@wildo-ai/zod-decorators';
 import { z } from 'zod';
 import { ErrorType } from '../errors/errors.shared.schemas.js';
 import { ErasureRetentionMode, ResourceDataSubjectKind, RetentionStatus, RetentionStatusSchema } from '../compliance/privacy/impersonalization.shared.schemas.js';
-import { buildImpersonalizeScrubPatch, IMPERSONALIZE_MASK_CONSTANT, isImpersonalizeNeverScrubFloorField, resolveImpersonalizeMaskValue, } from '../compliance/privacy/impersonalization-scrub.shared.utils.js';
+import { buildImpersonalizeScrubPatch, collectDeclaredPersonalDataFields, IMPERSONALIZE_MASK_CONSTANT, isImpersonalizeNeverScrubFloorField, resolveImpersonalizeMaskValue, resolveImpersonalizeResetValue, } from '../compliance/privacy/impersonalization-scrub.shared.utils.js';
 import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
 import { unknownPersonalDataCategories } from '../compliance/privacy/personal-data-category.shared.schemas.js';
 /*
@@ -31,7 +31,7 @@ import { HttpApiResourceBindingSchema, HttpApiTransportDialect, assertHttpApiBin
 import { ExternalDataDestinationPopulation, ExternalDataFieldCoercion, ExternalDataMappingEntryKind, ExternalDataPipelineDeclarationSchema, assertExternalDataPipelineDeclarationCoherence, } from '../external-data/external-data-pipeline.shared.schemas.js';
 import { HttpMethod } from '../requests/http-requests.shared.js';
 import { ConsumableToken_ConsumptionMode, TokenAuthenticationPolicy } from '../security/authentications/consumable-token.shared.schemas.js';
-import { OPERATION_VARIANT_KEY, Resouces_BulkOperationBaseSchema, Resouces_Filter_BaseSchema, Resouces_Filter_DateRangeSchema, createPaginationRequestSchema, createPaginationResponseMetadataSchema, ResourceGeneratedOperationKind, ResourceSystemAccessMode, PersistenceAdapter, SortOrder, ResourceCollectionExportResponseSchema, } from './resources-config.shared.schemas.js';
+import { OPERATION_VARIANT_KEY, Resources_BulkOperationBaseSchema, Resources_Filter_BaseSchema, Resources_Filter_DateRangeSchema, createPaginationRequestSchema, createPaginationResponseMetadataSchema, ResourceGeneratedOperationKind, ResourceSystemAccessMode, PersistenceAdapter, isPersistenceAdapter, SortOrder, ResourceCollectionExportResponseSchema, } from './resources-config.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from './resources.shared.core.definitions.js';
 import { PRIMARY_SCOPE_FIELD_IDENTIFIERS, PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE, FIELD_IDENTIFIER_TO_PRIMARY_SCOPE, RelationshipNature, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceOperation_ServiceRuntimeMode, ResourceParentResourceRequirement, ResourcePrimaryScope, ResourceRelationshipBulkAction, ResourceRelationshipBulkActionResultSchema, ResourceRelationshipBulkClearOperationRequestSchema, ResourceRelationshipBulkCreateOperationRequestSchema, ResourceRelationshipBulkLinkOperationRequestSchema, ResourceRelationshipBulkReplaceOperationRequestSchema, ResourceRelationshipBulkSetOperationRequestSchema, ResourceRelationshipBulkUnlinkOperationRequestSchema, ResourceRelationshipAccessScopeStrategy, ResourceRelationshipCardinality, ResourceTranspositionPolicy } from './resources.shared.schemas.js';
 import { createResourcesRelationship } from './resources-relationships.shared.factory.js';
@@ -39,6 +39,7 @@ import { Resources_SharedUtils } from './resources.shared.utils.js';
 import { ResourcesConfigOperationsDtosBuilderUtils } from './utils/resources-config-operations.dtos-builder.utils.js';
 import { ResourcesSummaryUtils } from './utils/resources-summary.utils.js';
 import { collectTemplatableFileFieldPaths, stripTemplatableFileFieldsRecursively } from './utils/templatable-file-fields.shared.utils.js';
+import { selectByPersistenceAdapter } from './utils/persistence-adapter-discrimination.shared.utils.js';
 import { isServiceResolvableDefaultOperation, SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES, URL_BEARING_OPERATION_VARIANT_TYPES, } from './utils/resource-operation-type-guards.utils.js';
 // --------------------------------
 // Error Helpers
@@ -326,15 +327,79 @@ function createGeneratedFileRegenerateOperations(params) {
         return [];
     }
     /**
-     * Generated PDF file fields are MongoDB-only in v1, so the guard names what IS supported rather
-     * than one adapter that is not: `=== POSTGRESQL` would let any future backing kind slip past as
-     * if it were supported. `undefined` stays admitted — it means "the application's default
-     * adapter", which this shared-tier factory cannot resolve; the backend registry is where an
-     * undeclared adapter gets its concrete answer.
+     * A generated document is MATERIALIZED: rendering it writes a FILES metadata row that must
+     * commit in the SAME native transaction as the row that owns it, or a failure between the two
+     * leaves either a dangling document reference or an orphaned blob. So the only question this
+     * guard can honestly ask of a DECLARATION is whether the declared adapter is one that HAS a
+     * transactional local store at all.
+     *
+     * ## What changed, and why the old shape was wrong rather than merely conservative
+     *
+     * This refused every adapter except MongoDB, on the grounds that file metadata was pinned to
+     * MongoDB, so a generated PDF on a PostgreSQL resource would have crossed adapters. That reason
+     * is gone: FILES was un-pinned and now FOLLOWS the application's default adapter
+     * (`files.shared.resources-config.schemas.ts:43-67`), precisely so a resource and its file
+     * metadata share one native transaction. A PostgreSQL application whose FILES is therefore also
+     * PostgreSQL was being refused at authoring time for a boundary that no longer exists.
+     *
+     * The ASYMMETRY was the tell, and it is the reason this could not be left alone: `undefined` —
+     * "follow the application default" — was and is admitted, so the identical resource in the
+     * identical PostgreSQL application was already authorable by SAYING LESS. A guard whose answer
+     * depends on whether a redundant declaration was written is testing the declaration, not the
+     * capability.
+     *
+     * ## What still refuses, and why that half is load-bearing
+     *
+     * `INTROSPECTION` rows are recomputed per read — there is no store and no transaction. `HTTP_API`
+     * rows live in someone else's system and are read-only by construction. Neither can own a
+     * locally-materialized document row, and unlike the PostgreSQL case that is knowable from the
+     * declaration alone, so refusing at authoring time is strictly better than discovering it on the
+     * first write. `getDatabaseServiceForAdapter` says the same thing at runtime, for the same two
+     * adapters, in the same words.
+     *
+     * ## Shape
+     *
+     * Expressed as an exhaustive `PersistenceAdapterCases` map rather than a comparison, so a fifth
+     * backing kind is a COMPILE error here instead of silently inheriting whichever arm an `else`
+     * happened to mean — the failure mode `selectByPersistenceAdapter` exists to remove, and the one
+     * the previous `!== MONGODB` shape genuinely had in the other direction (it would have refused a
+     * future stored adapter without anyone deciding to).
+     *
+     * `isPersistenceAdapter` runs FIRST so an erased or unknown declaration keeps refusing through
+     * `createConfigurationError` with the resource and the field list named, rather than through the
+     * selector's plain `Error`. This factory is a shared-tier authoring surface: its refusals are
+     * read by an application author, and the field list is the actionable half.
+     *
+     * ## What this guard deliberately does NOT decide
+     *
+     * It cannot see the application's default adapter, so it cannot tell whether THIS resource and
+     * FILES resolve to the same store — a resource declaring `POSTGRESQL` inside a MongoDB-default
+     * application is a real cross-adapter boundary and must still be refused. That refusal is made
+     * where the resolved adapters are actually known, at
+     * `services-registry-handler.backend.service.ts` →
+     * `assertGeneratedFileMaterializationCommitsWithRow`, which asks the persistence unit of work
+     * whether `{this resource, FILES-as-ATOMIC}` can commit atomically and throws
+     * `MIXED_PERSISTENCE_ADAPTERS` when it cannot. It gates all three materialization entry points
+     * (create, createMany, regenerate) and, unlike this one, also covers the undeclared case this
+     * guard has always waved through — which is why relaxing here narrows nothing.
      */
-    if (params.persistenceAdapter !== undefined && params.persistenceAdapter !== PersistenceAdapter.MONGODB) {
-        throw createConfigurationError(`[${params.resourceIdentifier}] generated PDF file fields are only supported for MongoDB-backed resources in v1 `
-            + `(declared adapter: '${String(params.persistenceAdapter)}'): ${generatedFields.map((field) => field.fieldName).join(', ')}`);
+    const GENERATED_DOCUMENT_MATERIALIZATION_SUPPORT = {
+        [PersistenceAdapter.MONGODB]: true,
+        [PersistenceAdapter.POSTGRESQL]: true,
+        [PersistenceAdapter.INTROSPECTION]: false,
+        [PersistenceAdapter.HTTP_API]: false,
+    };
+    if (params.persistenceAdapter !== undefined) {
+        const declaredAdapter = params.persistenceAdapter;
+        const materializationIsSupported = isPersistenceAdapter(declaredAdapter)
+            && selectByPersistenceAdapter(declaredAdapter, GENERATED_DOCUMENT_MATERIALIZATION_SUPPORT);
+        if (!materializationIsSupported) {
+            throw createConfigurationError(`[${params.resourceIdentifier}] generated PDF file fields require a persistence adapter with a transactional local store, `
+                + `so that the generated file's metadata row commits with the row that owns it `
+                + `(declared adapter: '${String(declaredAdapter)}'; supported: `
+                + `'${PersistenceAdapter.MONGODB}', '${PersistenceAdapter.POSTGRESQL}', or no declaration to follow the application default): `
+                + `${generatedFields.map((field) => field.fieldName).join(', ')}`);
+        }
     }
     const baseUpdateOperation = params.operations.find((operation) => isUrlisableOperationVariantType(operation.variantType)
         && operation.operationIdentifier === CoreResourceOperation.UPDATE
@@ -480,19 +545,35 @@ function normalizeRequiredFeatures(input) {
 // DTO Auto-Derivation Utilities
 // --------------------------------
 /**
- * Fields always excluded from create/update DTOs (system-managed)
- * These are hardcoded because they are universal across all resources.
+ * @wildo_source:part:start saas.models.resource-config.system-managed-fields facet:layer:shared facet:audience:app-developer
+ *
+ * The field names the framework owns. They are removed from every generated CREATE and UPDATE
+ * request contract, for every resource, whatever your schema declares and whatever a caller sends.
  *
- * `createdByUserId` is a reserved audit FK by framework convention: the
- * repository layer auto-stamps it from the execution context on CREATE
- * (see RepositoryResource data enrichment) and it is immutable afterwards,
- * so clients never author it. Request DTOs must omit it even when the app
- * schema forgets `.excludeFromCreate()` — otherwise create forms validate
- * against a field no form collects and every submit fails
- * ("expected string, received undefined"; recovered 2026-06-11 on the
- * Wonder Todos todoLists create form).
+ * Declaring one of these in a resource schema is fine and often necessary — the framework maintains
+ * the value. What you cannot do is accept it from a client, default it in a form, or require it on a
+ * create: the field is stripped before validation runs, so a form that collects it submits a value
+ * that is discarded, and a schema that requires it rejects every request.
+ *
+ * | field | who writes it |
+ * |---|---|
+ * | `_id` | the persistence layer (or your own `.isPrimaryKey()` field, stored beneath it) |
+ * | `createdAt` / `updatedAt` / `deletedAt` | the repository, on write |
+ * | `createdByUserId` | the repository, stamped from the execution context on CREATE, immutable afterwards |
+ * | `_version_db_doc` | the framework's optimistic-concurrency marker |
+ *
+ * The failure this prevents is quiet and was paid for once: a create form validating against a
+ * reserved field that no form collects fails every submit with `expected string, received undefined`,
+ * and the schema looks correct while it does. So the exclusion is unconditional and does not depend
+ * on the resource author remembering `.excludeFromCreate()`.
+ *
+ * ⚠️ A NARROWER set — `_id`, `createdAt`, `updatedAt`, `deletedAt`, `_version_db_doc` — is
+ * additionally *mandatory-discard*: even a trusted in-process system write cannot re-attach those
+ * through `preserveServerInjectedFields`. `createdByUserId` is deliberately not in that set, because
+ * an engine flow creating a row on somebody's behalf legitimately needs to stamp it.
  */
 const SYSTEM_MANAGED_FIELDS = ['_id', 'createdAt', 'updatedAt', 'deletedAt', 'createdByUserId', '_version_db_doc'];
+/** @wildo_source:part:end saas.models.resource-config.system-managed-fields */
 // PRIMARY_SCOPE_FIELD_IDENTIFIERS and getPrimaryScopeFieldIdentifier imported from resources.shared.schemas
 /**
  * Build a CREATE request DTO from the main schema using decorators.
@@ -1242,7 +1323,7 @@ export function createResourceSearchQueryRequestSchema(params) {
         Object.entries(fields).forEach(([key, schema]) => {
             // Type-safe schema processing based on schema type
             if (schema instanceof z.ZodDate) {
-                processedFields[key] = Resouces_Filter_DateRangeSchema.optional();
+                processedFields[key] = Resources_Filter_DateRangeSchema.optional();
             }
             else if (schema instanceof z.ZodString) {
                 processedFields[key] = schema.optional();
@@ -1261,7 +1342,7 @@ export function createResourceSearchQueryRequestSchema(params) {
                 processedFields[key] = schema.optional();
             }
         });
-        return Resouces_Filter_BaseSchema.extend(processedFields);
+        return Resources_Filter_BaseSchema.extend(processedFields);
     };
     // Strongly typed sorting schema creation
     const createSortingSchema = (fields) => {
@@ -1295,7 +1376,7 @@ export function createResourceSearchQueryRequestSchema(params) {
         schemaConfig.filters = createFilterSchema(filterFields).optional();
     }
     else {
-        schemaConfig.filters = Resouces_Filter_BaseSchema.optional();
+        schemaConfig.filters = Resources_Filter_BaseSchema.optional();
     }
     // Create the final schema with validation
     const resultSchema = z.object(schemaConfig);
@@ -1452,7 +1533,12 @@ export function createResourceConfiguration_Initialization(params) {
     if (persistenceAdapter === PersistenceAdapter.HTTP_API && persistenceAdapterIsolation !== undefined) {
         throw createConfigurationError(`[${resourceIdentifier}] 'persistenceAdapterIsolation' is declared alongside persistenceAdapter 'http-api', where it is never read — an http-api resource is admitted past the one-adapter rule on the adapter's own nature, not on an isolation claim. Remove the isolation declaration.`);
     }
-    if (httpApiBinding !== undefined) {
+    // The RESOLVED binding, not the authored one. An author writes the schema's INPUT shape
+    // (`HttpApiResourceBindingAuthored`), so defaults like `verifyMetadataAtBoot`, `connection` and
+    // `remoteCallSemantics` may be absent from what they typed; every consumer reads the parsed shape
+    // and is entitled to find them. The parse result used to be DISCARDED — harmless only because
+    // authoring demanded every field, which is precisely the burden the authored shape removes.
+    const resolvedHttpApiBinding = httpApiBinding === undefined ? undefined : (() => {
         const bindingParse = HttpApiResourceBindingSchema.safeParse(httpApiBinding);
         if (!bindingParse.success) {
             throw createConfigurationError(`[${resourceIdentifier}] invalid httpApiBinding declaration: ${bindingParse.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; ')}`);
@@ -1463,7 +1549,8 @@ export function createResourceConfiguration_Initialization(params) {
         catch (error) {
             throw createConfigurationError(`[${resourceIdentifier}] invalid httpApiBinding declaration: ${error instanceof Error ? error.message : String(error)}`);
         }
-    }
+        return bindingParse.data;
+    })();
     /**
      * `externalDataPipeline` — the inbound ETL pipeline on an ordinary LOCAL resource (partial-resource
      * coverage v3; PR-3/PR-4). Validated at AUTHORING like `httpApiBinding` above: shape (Zod),
@@ -1525,6 +1612,21 @@ export function createResourceConfiguration_Initialization(params) {
         if (!isBusinessKeyField(keyFieldSchema)) {
             refuse(`remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must be declared .isBusinessKey() — SYNC's idempotent upsert keys on it, and the business-key declaration is what makes the load MERGE instead of duplicate.`);
         }
+        // ...and `.isUnique()` ON TOP, which is NOT redundant with the line above: the SQL schema
+        // planner derives a UNIQUE constraint from `.isUnique()` and never from `.isBusinessKey()`.
+        // Without it the merge contract is upheld only by our own read-then-write, so two concurrent
+        // runs of one pipeline can leave TWO rows for one remote row — the exact duplication the whole
+        // business-key design exists to prevent, and precisely what a store-level constraint refuses
+        // for free.
+        //
+        // Required rather than suggested because this is an invariant with N call sites (every
+        // destination any application ever declares) and a silent failure mode: nothing misbehaves
+        // until two runs overlap, and by then the duplicate rows already exist. Found by the first
+        // dogfood — the generated migration gave the key a PLAIN index and the omission was invisible
+        // in every test, because a single-threaded upsert merges correctly with or without it.
+        if (!isUniqueField(keyFieldSchema)) {
+            refuse(`remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must ALSO be declared .isUnique(). The schema planner derives a UNIQUE constraint from .isUnique() and NOT from .isBusinessKey(), so without it the store would accept two rows for one remote row whenever two runs overlap — the merge would be enforced only by this engine's read-then-write, never by the database.`);
+        }
         for (const entry of declaration.mapping) {
             const targetSchema = requireMappedTarget(entry.localField, `mapping('${entry.localField}')`);
             if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD) {
@@ -1923,6 +2025,28 @@ export function createResourceConfiguration_Initialization(params) {
                             `declares (format, length, enum membership).`);
                 }
             }
+            else if (treatment === RedactionType.RESET) {
+                /*
+                 * RESET returns the field to its schema default — the treatment for a field that is non-nullable
+                 * WITH a `.default()`, where REMOVE (needs clearable) and MASK (needs a string) both refuse.
+                 *
+                 * The RULES live in `resolveImpersonalizeResetValue`, deliberately, and are NOT restated here: it
+                 * refuses a field with no default, and one that is merely `.optional()` (whose default IS
+                 * undefined, so nothing would be scrubbed). One authority, because a second copy of either check
+                 * would drift from the writer that actually runs them.
+                 *
+                 * What this arm adds is WHERE the failure surfaces. Called here, the refusal is a CONFIGURATION
+                 * error naming the RESOURCE. Left to fall through, the same resolver still runs — via
+                 * `buildImpersonalizeScrubPatch` further down this function — but throws a bare Error naming only
+                 * the field, which boot does not classify as a configuration fault.
+                 */
+                try {
+                    resolveImpersonalizeResetValue(fieldSchema, fieldName);
+                }
+                catch (error) {
+                    throw createConfigurationError(`[${resourceIdentifier}] ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
         }
         // Count what the WRITER would actually scrub, not what was merely declared. `KEEP` treatments and
         // treatments on never-scrub floor fields are both skipped by `buildImpersonalizeScrubPatch`, so
@@ -1951,6 +2075,28 @@ export function createResourceConfiguration_Initialization(params) {
                     `its own, but field(s) [${Object.keys(effectiveScrubPatch).join(', ')}] declare an impersonalize treatment. ` +
                     `Those treatments would never run. Use mode = RETAIN_AND_IMPERSONALIZE to actually scrub them, or remove them.`);
             }
+            /*
+             * The SECOND direction, and until 2026-08-31 it did not exist.
+             *
+             * The check above sees a field with a TREATMENT. This one sees a field DECLARED as personal data
+             * and given no treatment — which is the shape a wrong `RETAIN_ONLY` actually takes. Without it,
+             * the cheap mode was also the one that failed silently: a resource whose fields carry
+             * `.dataCategories()` could assert it holds no personal data, pass every gate, and put that
+             * assertion into a governed document. `RETAIN_AND_IMPERSONALIZE` never had the hole — it is
+             * refused when nothing would be scrubbed.
+             *
+             * This catches a CONTRADICTION, not an omission. A resource that classified nothing still passes,
+             * because "nobody declared a category" and "there is no personal data" are indistinguishable
+             * here; that is the category inventory's question. A clean result is not a proof.
+             */
+            const declaredPersonalDataFields = collectDeclaredPersonalDataFields(effectiveMainSchema);
+            if (declaredPersonalDataFields.length > 0) {
+                throw createConfigurationError(`[${resourceIdentifier}] retentionPolicy.mode = RETAIN_ONLY asserts this resource holds no personal data of ` +
+                    `its own, but field(s) [${declaredPersonalDataFields.join(', ')}] declare .dataCategories(). The resource ` +
+                    `cannot both hold personal data and hold none. Use mode = RETAIN_AND_IMPERSONALIZE and give those fields an ` +
+                    `impersonalize treatment, or — if the category is wrong — correct the field. Scope foreign keys and ` +
+                    `createdByUserId are excluded here: they link a row to a person without being personal data the row holds.`);
+            }
         }
         else if (Object.keys(effectiveScrubPatch).length === 0) {
             throw createConfigurationError(`[${resourceIdentifier}] retentionPolicy.mode = RETAIN_AND_IMPERSONALIZE but NO field would actually be ` +
@@ -2364,6 +2510,10 @@ export function createResourceConfiguration_Initialization(params) {
                 notificationBadgeOperations: config.notificationBadgeOperations || [],
                 userNotifications,
                 m2mNotifications,
+                // Carried verbatim rather than normalized: it is one authored object with no derived
+                // parts, unlike the notification families above, which the factory stamps with scope and
+                // identifier. `undefined` means the operation consumes no metered product.
+                recordsUsage: config.recordsUsage,
                 // Fields from ResourceConfiguration_OperationVariant_Base
                 variantType: variantParams.variantType,
                 resourceOperationLike: variantParams.resourceOperationLike,
@@ -2375,6 +2525,10 @@ export function createResourceConfiguration_Initialization(params) {
                 collectionExport: variantParams.collectionExport,
                 requiredFeatures: normalizeRequiredFeatures(variantParams.requiredFeatures),
                 riskLevel: variantParams.riskLevel || ResourceOperationRiskLevel.LOW,
+                // Forwarded for the same reason as the flags below: the frontend resources client reads it
+                // off the RUNTIME operation, so dropping it here would leave a declared long-run timeout
+                // silently unapplied and the 30s default cutting the request (issue #237).
+                clientRequestTimeoutMs: variantParams.clientRequestTimeoutMs,
                 roles: variantParams.roles,
                 // Forwarded, not defaulted: the startup guard and the request-time refusal both read it
                 // off the RUNTIME operation. This block re-lists variant fields rather than spreading
@@ -2560,11 +2714,11 @@ export function createResourceConfiguration_Initialization(params) {
                                 });
                         }
                         if (apiCallOperationFields.requestDto instanceof z.ZodObject) {
-                            return Resouces_BulkOperationBaseSchema.extend(getZodObjectShape(apiCallOperationFields.requestDto));
+                            return Resources_BulkOperationBaseSchema.extend(getZodObjectShape(apiCallOperationFields.requestDto));
                         }
                         return apiCallOperationFields.requestDto && apiCallOperationFields.requestDto !== z.object({})
-                            ? Resouces_BulkOperationBaseSchema.and(apiCallOperationFields.requestDto)
-                            : Resouces_BulkOperationBaseSchema;
+                            ? Resources_BulkOperationBaseSchema.and(apiCallOperationFields.requestDto)
+                            : Resources_BulkOperationBaseSchema;
                     })();
                     const bulkOperationFields = {
                         ...apiCallOperationFields,
@@ -2636,6 +2790,10 @@ export function createResourceConfiguration_Initialization(params) {
                     resourceOperationLike: defaultApiCallVariant.resourceOperationLike,
                     requiredFeatures: normalizeRequiredFeatures(defaultApiCallVariant.requiredFeatures),
                     riskLevel: defaultApiCallVariant.riskLevel || ResourceOperationRiskLevel.LOW,
+                    // Inherited like riskLevel: an auto-variant is a projection of the default variant. The
+                    // read-shaped projections are unlikely to need it, but inheriting keeps "projection of
+                    // the default" a single consistent rule rather than a per-field accident.
+                    clientRequestTimeoutMs: defaultApiCallVariant.clientRequestTimeoutMs,
                     roles: defaultApiCallVariant.roles, // Inherit roles from default variant
                     // Inherited for the same reason as roles: an auto-variant is a projection of the
                     // default variant, so if the default is a known implementation gap its SUMMARY /
@@ -2889,7 +3047,7 @@ export function createResourceConfiguration_Initialization(params) {
         inheritenceSchemaDefinition,
         persistenceAdapter,
         persistenceAdapterIsolation,
-        httpApiBinding,
+        httpApiBinding: resolvedHttpApiBinding,
         introspectionBinding,
         externalDataPipeline,
         isSystemResource,
@@ -2930,7 +3088,7 @@ export function createResourceConfiguration_Initialization(params) {
         inheritenceSchemaDefinition,
         persistenceAdapter,
         persistenceAdapterIsolation,
-        httpApiBinding,
+        httpApiBinding: resolvedHttpApiBinding,
         introspectionBinding,
         externalDataPipeline,
         isSystemResource,