@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/resources/resources-relationships.shared.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-relationships.shared.factory.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources-relationships.shared.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,kBAAkB,EAClB,KAAK,gCAAgC,EACrC,iCAAiC,EAEjC,oBAAoB,EAEpB,uCAAuC,EACvC,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAA+B,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AAC1I,OAAO,EAAE,yBAAyB,EAAmC,MAAM,uCAAuC,CAAC;AAYnH;;;;GAIG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,UAAU,CAAC,EAAG,OAAO,CAAC;IACtB,cAAc,CAAC,EAAG,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAG,iCAAiC,CAAC;IAC/D,mBAAmB,CAAC,EAAG,uCAAuC,CAAC;IAC/D,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wFAAwF;IACxF,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,gCAAgC,CAAC;IACxC;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC;;;;OAIG;IACH,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,+BAA+B,CAAC;IAC5C;;;OAGG;IACH,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,CAAC;AACF,kFAAkF;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,wBAAgB,2BAA2B,CACvC,aAAa,EAAE,YAAY,EAC3B,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,+BAA+B,EAC7C,YAAY,EAAE,+BAA+B,EAC7C,OAAO,EAAE,sCAAsC,GAC7C,oBAAoB,CA0PvB"}
+{"version":3,"file":"resources-relationships.shared.factory.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources-relationships.shared.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,kBAAkB,EAClB,KAAK,gCAAgC,EACrC,iCAAiC,EAEjC,oBAAoB,EAEpB,uCAAuC,EACvC,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAA+B,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AAC1I,OAAO,EAAE,yBAAyB,EAAmC,MAAM,uCAAuC,CAAC;AAYnH;;;;GAIG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,UAAU,CAAC,EAAG,OAAO,CAAC;IACtB,cAAc,CAAC,EAAG,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAG,iCAAiC,CAAC;IAC/D,mBAAmB,CAAC,EAAG,uCAAuC,CAAC;IAC/D,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wFAAwF;IACxF,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,gCAAgC,CAAC;IACxC;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC;;;;OAIG;IACH,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,+BAA+B,CAAC;IAC5C;;;OAGG;IACH,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,CAAC;AACF,kFAAkF;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,wBAAgB,2BAA2B,CACvC,aAAa,EAAE,YAAY,EAC3B,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,+BAA+B,EAC7C,YAAY,EAAE,+BAA+B,EAC7C,OAAO,EAAE,sCAAsC,GAC7C,oBAAoB,CAyQvB"}

package/dist/esm/resources/resources-relationships.shared.factory.js

@@ -109,6 +109,19 @@ export function createResourcesRelationship(resourceType1, resourceType2, cardin
     // ========================================
     // VALIDATION GUARDS
     // ========================================
+    //
+    // The numbers below are STABLE LABELS, not a count and not a sequence. They are cited from
+    // `resources-relationships-factory.test.ts`, from `resources-registry.shared.core.definitions.ts`
+    // and from sibling packages, so renumbering them breaks those references. Two consequences a
+    // reader has to know before counting anything here:
+    //
+    //   - there is no Guard 4, and no commit touching this file has ever added or removed one;
+    //   - three refusals in this sequence carry no number at all (self-referencing MANY-to-MANY
+    //     below Guard 2, the unresolvable primary scope, and the post-default-resolution repeat of
+    //     Guard 1 near the end of the function).
+    //
+    // So "the guards" is a larger set than "the numbered guards". Enumerate the `throw` statements,
+    // not the labels.
     // Guard 1: `isPrimaryScope` cannot be paired with `OPTIONAL_CONTEXT`.
     //
     // ## Why this guard exists (and why it only forbids OPTIONAL_CONTEXT, not STANDALONE)
@@ -163,6 +176,8 @@ export function createResourcesRelationship(resourceType1, resourceType2, cardin
             `Self-referencing MANY-to-MANY relationships cannot be authored as one association declaration.\n` +
             `Declare explicit junction-resource relationships so source and target edge identity stay explicit.`);
     }
+    // (The refusal immediately above carries no guard number: self-referencing MANY-to-MANY.)
+    //
     // Note: foreignKeyField IS valid with isPrimaryScope - it specifies the FK field on the child
     // resource that points back to the parent, which is useful for 1:1 relationships
     // Guard 3: jointResourceType should not be combined with foreignKeyField.

package/dist/esm/resources/resources-relationships.shared.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-relationships.shared.factory.js","sourceRoot":"","sources":["../../../../src/resources/resources-relationships.shared.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,kBAAkB,EAElB,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,GAGhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE5D,OAAO,EAAyB,2BAA2B,EAAqC,MAAM,mCAAmC,CAAC;AAC1I,OAAO,EAA6B,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;GAEG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAa,CAAC,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AA4FD,kFAAkF;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,UAAU,2BAA2B,CACvC,aAA2B,EAC3B,aAA2B,EAC3B,YAA6C,EAC7C,YAA6C,EAC7C,OAA+C;IAG/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,4DAA4D;YAC5D,sGAAsG,CACvG,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,oBAAoB;IACpB,2CAA2C;IAE3C,sEAAsE;IACtE,EAAE;IACF,sFAAsF;IACtF,EAAE;IACF,6EAA6E;IAC7E,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,sEAAsE;IACtE,EAAE;IACF,iEAAiE;IACjE,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,iEAAiE;IACjE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,mBAAmB,KAAK,uCAAuC,CAAC,gBAAgB,EAAE,CAAC;QAC9F,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,mEAAmE;YACnE,+EAA+E;YAC/E,4EAA4E;YAC5E,sEAAsE;YACtE,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAChC,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,IACE,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,OAAO,EAAE,iBAAiB;QAC1B,aAAa,KAAK,aAAa,EAC/B,CAAC;QACD,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,kGAAkG;YAClG,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,iFAAiF;IAEjF,0EAA0E;IAC1E,mEAAmE;IACnE,0EAA0E;IAC1E,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,eAAe,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QAC9F,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,sFAAsF;YACtF,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,oBAAoB,OAAO,sEAAsE;gBACjG,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,uFAAuF;IACvF,uFAAuF;IACvF,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,aAAa,KAAK,aAAa,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,mFAAmF;gBACnF,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,yFAAyF;QACzF,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,EAAE,yBAAyB,IAAI,iCAAiC,CAAC,SAAS,CAAC;QAC7G,IAAI,kBAAkB,KAAK,iCAAiC,CAAC,SAAS,EAAE,CAAC;YACvE,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,wFAAwF;gBACxF,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACvG,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,yEAAyE;YACzE,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,EAAE,MAAM,KAAK,kBAAkB,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACtF,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,kDAAkD;YAClD,kGAAkG,CACnG,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,wBAAwB;IACxB,2CAA2C;IAE3C,IAAI,YAA+C,CAAC;IACpD,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;QAE5B,MAAM,eAAe,GAAG;YACtB,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC,aAAa;YACpE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,SAAS;YACxD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,SAAS;YAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,WAAW;YAChE,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,SAAS;SACnE,CAAA;QACD,YAAY,GAAG,eAAe,CAAC,aAAiC,CAAC,CAAC;QAElE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,wBAAwB,CAAC,iBAAiB,aAAa,oCAAoC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,iCAAiC;IACjC,2CAA2C;IAE3C,MAAM,yBAAyB,GAAG,OAAO,EAAE,yBAAyB,IAAI,iCAAiC,CAAC,SAAS,CAAC;IACpH,IAAI,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;IAEnF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAClC,IAAI,yBAAyB,KAAK,iCAAiC,CAAC,SAAS,EAAE,CAAC;YAC9E,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IACpD,CAAC;IAED,mFAAmF;IACnF,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,sBAAsB;IACtB,IAAI,OAAO,EAAE,cAAc;QACvB,mBAAmB,KAAK,uCAAuC,CAAC,gBAAgB,EAAE,CAAC;QACrF,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,uEAAuE;YACvE,gFAAgF;YAChF,8EAA8E;YAC9E,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,qBAAqB,GAAG,OAAO,EAAE,eAAe;QACpD,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO;QACpC,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,uBAAuB,GAAoC;QAC/D,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,aAAa;QACb,mBAAmB;QACnB,yBAAyB;QACzB,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,KAAK;QAChD,YAAY;QACZ,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,IAAI,SAAS;QAC1D,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;QACxC,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;QACxC,4CAA4C;QAC5C,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,iEAAiE;QACjE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,qEAAqE;QACrE,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,sFAAsF;QACtF,eAAe,EAAE,qBAAqB;QACtC,4DAA4D;QAC5D,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,yDAAyD;QACzD,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,4DAA4D;QAC5D,OAAO,EAAE,aAAa;QACtB,8DAA8D;QAC9D,eAAe,EAAE,OAAO,EAAE,eAAe;QACzC,gGAAgG;QAChG,eAAe,EAAE,OAAO,EAAE,eAAe;KAC1C,CAAC;IAEF,OAAO,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { CoreResourceType, ResourceType } from \"./resources.shared.core.definitions\";\nimport {\n  RelationshipNature,\n  type RelationshipHandlingReadSettings,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceRelationshipConditionFn,\n  type ScopeMembership,\n} from \"./resources.shared.schemas\";\nimport { ErrorType } from \"../errors/errors.shared.schemas\";\nimport { RelationshipContextPolicy } from \"./context-policy.shared.schemas\";\nimport { ChildOperationsConfig, ChildOperationsConfigSchema, ResourceRelationshipDiscriminator } from \"./child-operations.shared.schemas\";\nimport { RelationshipDisplayConfig, RelationshipDisplayConfigSchema } from \"./relationship-display.shared.schemas\";\nimport { Resources_SharedUtils } from \"./resources.shared.utils\";\n\n/**\n * Creates a configuration error with ErrorType.CONFIGURATION\n */\nfunction createConfigurationError(message: string): Error {\n  const error = new Error(message);\n  (error as any).type = ErrorType.CONFIGURATION;\n  return error;\n}\n\n/**\n * @wildo_source:part:start saas.models.resource-relationship-builder-parameters facet:layer:shared facet:family:resource-config\n *\n * Parameters accepted by `createResourcesRelationship()` (app registry authoring).\n */\nexport type ResourceRelationship_BuilderParameters = {\n  isDisabled? : boolean,\n  isPrimaryScope? : boolean,\n  parentResourceRequirement? : ResourceParentResourceRequirement,\n  accessScopeStrategy? : ResourceRelationshipAccessScopeStrategy,\n  jointResourceType?: ResourceType,\n  /**\n   * Opt-in flag for relationships that form cycles in the resource graph.\n   * Required on every edge in a cycle for schema-level validation to pass.\n   * @see ResourceRelationshipSchema.allowCycle\n   */\n  allowCycle?: boolean,\n  /** Context policy for this relationship - controls how related resources are fetched */\n  contextPolicy?: RelationshipContextPolicy,\n  /**\n   * High-level shared meaning of the relationship.\n   *\n   * This is the primary semantic field app developers should author. The\n   * framework derives the deeper internal handling contract from it plus the\n   * optional explicit read intent when present.\n   */\n  nature: RelationshipNature,\n  /**\n   * Optional explicit semantic read intent.\n   *\n   * This does not replace `childOperations.nested.onRead`; it only declares the\n   * semantic read model the framework should resolve.\n   */\n  read?: RelationshipHandlingReadSettings,\n  /**\n   * Child operations configuration for this relationship.\n   * Handles BACKEND concerns: lifecycle cascade and nested DTO aggregation.\n   */\n  childOperations?: ChildOperationsConfig,\n  /**\n   * Static discriminator filter for conditional relationships.\n   * When specified, this relationship only applies when the parent resource's\n   * discriminator field matches one of the specified values.\n   */\n  discriminator?: ResourceRelationshipDiscriminator,\n  /**\n   * Function-based condition for conditional relationships.\n   * Evaluated at runtime with the parent resource data.\n   * Unlike the static `discriminator`, this allows arbitrary logic.\n   */\n  condition?: ResourceRelationshipConditionFn,\n  /**\n   * Frontend display configuration for this relationship.\n   * Defines how related resources are displayed in the UI.\n   */\n  display?: RelationshipDisplayConfig,\n  /**\n   * Foreign key field name for this relationship.\n   *\n   * When omitted: Inferred from parent's resourceFieldIdentifier via allResourceFieldIdentifiers map.\n   * When specified: Used for disambiguation when multiple FKs point to same resource type,\n   *                 or when FK field name differs from standard naming convention.\n   *\n   * Examples:\n   * - Standard: ORGANIZATIONS → TODOS uses organizationId (inferred, no foreignKeyField needed)\n   * - Disambiguation: TODOS → USERS via assignedToUserId vs createdByUserId (explicit)\n   * - Self-referencing M:N is not expressed as one relationship declaration;\n   *   declare two explicit junction-resource edges so source and target FK\n   *   identities remain distinct.\n   */\n  foreignKeyField?: string,\n  /**\n   * Write-time SCOPE CONFINEMENT for a REFERENCE foreign key: the referenced target must be linked to\n   * the writing row's scope through a junction, enforced on CREATE and UPDATE. Opt-in and additive —\n   * omit for unchanged behavior.\n   *\n   * STRUCTURE only. `scopeMembership: true` is the simple case (junction auto-resolved from the M:N\n   * scope-junction map); the object form names the junction / its columns when convention cannot — a\n   * SELF-REFERENTIAL junction (organizations ↔ organizations). Per-variant POLICY (status, roles, typed\n   * junction rows) is declared on the operation config's `referenceConstraints`.\n   *\n   * @example todos.assignedToUserId must be a member of the row's organization:\n   * { nature: RelationshipNature.REFERENCE, foreignKeyField: 'assignedToUserId', scopeMembership: true }\n   *\n   * @example todos.sharedWithOrganizationId must be a partner of the row's organization:\n   * { nature: RelationshipNature.REFERENCE, foreignKeyField: 'sharedWithOrganizationId',\n   *   scopeMembership: { junction: CoreResourceType.ORGANIZATION_PARTNERSHIPS } }\n   */\n  scopeMembership?: ScopeMembership,\n};\n/** @wildo_source:part:end saas.models.resource-relationship-builder-parameters */\n\n\n\n/**\n * Create a resource relationship declaration between two resource types.\n *\n * This is the primary entry point for declaring relationships in the resource registry.\n * Returns a `ResourceRelationship` object that is spread into the registry's relationship\n * array and later categorized by `transformResourceRelationships()` at factory time.\n *\n * ## Conditional Relationships\n *\n * Relationships can optionally carry runtime conditions via `discriminator` and/or `condition`:\n *\n * - **`discriminator`** (static): A simple `{ discriminatorField, values }` object.\n *   The relationship is active only when `String(parent[discriminatorField])` is in `values`.\n *   Useful for discriminated union patterns (e.g., recurring vs. one-time todos).\n *\n * - **`condition`** (dynamic): An arbitrary `(parentResource) => boolean` function.\n *   Allows cross-field logic, computed checks, etc. Cannot be serialized to Zod.\n *\n * When both are provided, AND semantics apply — both must pass for the relationship\n * to be active at runtime.\n *\n * These conditions are NOT evaluated at startup/factory time. They are stored inline\n * on the relationship object and evaluated at runtime by:\n * - `ResourceContextBackendService.fetchChildResourcesWithPolicy()` — backend context building\n * - `ServicesRegistryHandler.filterRelationshipsByParent()` — nested CRUD + lifecycle\n * - `ResourceLayout_ContainerNested` — frontend display filtering\n *\n * @param resourceType1 - The parent resource type in 1:N/1:1, or the first entity side in M:N\n * @param resourceType2 - The child resource type in 1:N/1:1, or the second entity side in M:N\n * @param cardinality1 - Cardinality from the perspective of resourceType1\n * @param cardinality2 - Cardinality from the perspective of resourceType2\n * @param options - Required relationship options; must include `nature`.\n *   Other relationship fields remain optional as needed (discriminator,\n *   condition, childOperations, display, etc.)\n * @returns A fully constructed `ResourceRelationship` object\n *\n * ## M:N developer mental model\n *\n * For `MANY <-> MANY`, the declaration is still authored at the association level:\n * developers declare the two peer entity types plus `jointResourceType`.\n *\n * The framework may later decompose non-self associations into synthetic\n * entity->junction and junction->entity edges for DTO, routing, and runtime\n * processing, but that decomposition is an internal implementation detail.\n * App-facing meaning should stay association-centric, not \"manually declare the\n * synthetic edges yourself.\"\n *\n * Self-referencing M:N is the exception: one declaration cannot carry two\n * distinct source/target FK identities for the same resource type. Model it with\n * explicit junction-resource relationships instead.\n *\n * ## Semantic Resolution Order\n *\n * Relationship declarations now have an explicit semantic precedence:\n *\n * 1. structural topology (`cardinality*`, `jointResourceType`, `foreignKeyField`, ...)\n * 2. `nature`\n * 3. explicit semantic read intent (`read`) when authored\n * 4. derived handling contract (future resolver step, internal)\n * 5. current low-level operational projection (`childOperations`)\n *\n * `nature` is therefore the primary semantic declaration for app developers.\n * The fuller handling contract belongs to framework internals, not the authored\n * relationship API.\n *\n * ## Greenfield Direction\n *\n * Relationship declarations must define explicit `nature`. Missing annotations\n * are configuration bugs, not a compatibility target.\n *\n * @example Static discriminator (recurring todos → occurrences)\n * ```typescript\n * createResourcesRelationship(TODOS, RECURRING_OCCURRENCES, ONE, MANY, {\n *   nature: RelationshipNature.COMPOSITION,\n *   discriminator: { discriminatorField: 'recurringType', values: ['RECURRING'] },\n *   childOperations: { lifecycle: { onParentDelete: { enabled: true } } },\n * })\n * ```\n *\n * @example Function-based condition\n * ```typescript\n * createResourcesRelationship(ORDERS, REFUND_RECORDS, ONE, MANY, {\n *   nature: RelationshipNature.COMPOSITION,\n *   condition: (parent) => parent.status === 'COMPLETED' && parent.totalAmount > 0,\n * })\n * ```\n */\nexport function createResourcesRelationship(\n    resourceType1: ResourceType, \n    resourceType2: ResourceType, \n    cardinality1: ResourceRelationshipCardinality, \n    cardinality2: ResourceRelationshipCardinality, \n    options: ResourceRelationship_BuilderParameters\n  ) : ResourceRelationship {\n\n    if (!options?.nature) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Relationship declarations must define nature explicitly.\\n` +\n        `Greenfield relationship semantics no longer infer meaning from childOperations or jointResourceType.`\n      );\n    }\n    \n    // ========================================\n    // VALIDATION GUARDS\n    // ========================================\n\n    // Guard 1: `isPrimaryScope` cannot be paired with `OPTIONAL_CONTEXT`.\n    //\n    // ## Why this guard exists (and why it only forbids OPTIONAL_CONTEXT, not STANDALONE)\n    //\n    // `isPrimaryScope` and `accessScopeStrategy` govern two ORTHOGONAL concerns:\n    //\n    // - `isPrimaryScope`        — ownership graph anchor: \"this parent is the\n    //                             row's structural scope root\". Drives the\n    //                             resource's `resourcePrimaryScope` enum, which\n    //                             in turn drives scope-aware services (auth,\n    //                             notifications, execution context, etc).\n    // - `accessScopeStrategy`   — URL routing + fetch-time context gating.\n    //                             STANDALONE  → no URL segment, no context gate\n    //                             REQUIRES_CONTEXT → mandatory URL segment + gate\n    //                             OPTIONAL_CONTEXT → optional URL segment\n    //\n    // The two concerns are already orthogonalized in the URL builder\n    // (`generateParentCombinations` filters out STANDALONE parents *before*\n    // bucketing the rest by `isPrimaryScope`), so a `STANDALONE + isPrimaryScope`\n    // rel is URL-inert by construction — it contributes zero path segments and\n    // simply anchors the scope enum. That is a coherent, intended configuration\n    // (e.g. internal ledgers like `jobExecutions` that are APP-scoped but not\n    // routed under `/applications/:id/…`, user-owned credential stores that are\n    // USER_SELF-scoped but not exposed as routable child resources).\n    //\n    // `OPTIONAL_CONTEXT + isPrimaryScope` is however INCOHERENT under the current\n    // combinator: `generateParentCombinations` puts every `isPrimaryScope` edge\n    // into the always-on bucket, which would force an \"optional\" primary parent\n    // to appear in every URL combination — contradicting its optionality. That\n    // redesign is out of scope here; until then the guard remains.\n    if (options?.isPrimaryScope &&\n        options?.accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Primary scope cannot have accessScopeStrategy=OPTIONAL_CONTEXT.\\n` +\n        `A primary-scope rel marks the structural ownership anchor; OPTIONAL_CONTEXT\\n` +\n        `would make the anchor optional in URLs, which the current URL combinator\\n` +\n        `cannot express coherently. Use REQUIRES_CONTEXT (routed anchor) or\\n` +\n        `STANDALONE (logical anchor, not routed).`\n      );\n    }\n    \n    // Guard 2: MANY-to-MANY requires jointResourceType (junction table)\n    if (cardinality1 === ResourceRelationshipCardinality.MANY && \n        cardinality2 === ResourceRelationshipCardinality.MANY &&\n        !options?.jointResourceType) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `MANY-to-MANY relationships require a jointResourceType (junction table).`\n      );\n    }\n\n    if (\n      cardinality1 === ResourceRelationshipCardinality.MANY &&\n      cardinality2 === ResourceRelationshipCardinality.MANY &&\n      options?.jointResourceType &&\n      resourceType1 === resourceType2\n    ) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Self-referencing MANY-to-MANY relationships cannot be authored as one association declaration.\\n` +\n        `Declare explicit junction-resource relationships so source and target edge identity stay explicit.`\n      );\n    }\n    \n    // Note: foreignKeyField IS valid with isPrimaryScope - it specifies the FK field on the child\n    // resource that points back to the parent, which is useful for 1:1 relationships\n    \n    // Guard 3: jointResourceType should not be combined with foreignKeyField.\n    // Self-referencing many-to-many is rejected above because a single\n    // declaration cannot encode two FK identities for the same peer resource.\n    if (options?.jointResourceType && options?.foreignKeyField && resourceType1 !== resourceType2) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Cannot combine jointResourceType and foreignKeyField for non-self-referencing M:N.\\n` +\n        `Use jointResourceType for MANY-to-MANY via junction table.`\n      );\n    }\n    \n    // Guard 5: foreignKeyField must end with 'Id' or 'Ids' (reserved for FK naming convention)\n    if (options?.foreignKeyField) {\n      const fkField = options.foreignKeyField;\n      if (!fkField.endsWith('Id') && !fkField.endsWith('Ids')) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `foreignKeyField \"${fkField}\" must end with 'Id' or 'Ids' (e.g., assignedToUserId, memberIds).\\n` +\n          `This naming convention is reserved for foreign key fields.`\n        );\n      }\n    }\n    \n    // Guard 6: Self-referencing 1:N/1:1 relationships require explicit foreignKeyField.\n    // Without it, the default FK (derived from resourceFieldIdentifier) would collide with\n    // itself in URL param generation — e.g., /resource/{resourceId}/resource/{resourceId}.\n    // M:N self-refs are rejected above: one declaration cannot encode distinct\n    // source/target FK identities for the same peer resource.\n    if (resourceType1 === resourceType2 && !options?.jointResourceType) {\n      if (!options?.foreignKeyField) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `Self-referencing 1:N/1:1 relationships MUST specify foreignKeyField explicitly.\\n` +\n          `Without it, URL parameter names collide (same resource type on both sides).`\n        );\n      }\n\n      // Guard 7: Self-referencing 1:N/1:1 relationships must have OPTIONAL parent requirement.\n      // Tree roots have no parent — MANDATORY would make root-level access impossible.\n      const effectiveParentReq = options?.parentResourceRequirement || ResourceParentResourceRequirement.MANDATORY;\n      if (effectiveParentReq === ResourceParentResourceRequirement.MANDATORY) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `Self-referencing 1:N/1:1 relationships MUST have parentResourceRequirement=OPTIONAL.\\n` +\n          `Tree/graph roots have no parent — MANDATORY would make root-level access impossible.`\n        );\n      }\n    }\n\n    // Guard 8: junction-backed relationships are association semantics when nature is explicit.\n    if (options?.jointResourceType && options?.nature && options.nature !== RelationshipNature.ASSOCIATION) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Relationships with jointResourceType must declare nature=ASSOCIATION.\\n` +\n        `Junction-backed relationships are association-centric in the shared model.`\n      );\n    }\n\n    // Guard 9: explicit association semantics require a junction resource.\n    if (options?.nature === RelationshipNature.ASSOCIATION && !options?.jointResourceType) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `nature=ASSOCIATION requires jointResourceType.\\n` +\n        `Association semantics are reserved for explicit link-management / junction-backed relationships.`\n      );\n    }\n    \n    // ========================================\n    // PRIMARY SCOPE MAPPING\n    // ========================================\n    \n    let primaryScope : ResourcePrimaryScope | undefined;\n    if (options?.isPrimaryScope) {\n     \n      const primaryScopeMap = {\n        [CoreResourceType.ORGANIZATIONS]: ResourcePrimaryScope.ORGANIZATIONS,\n        [CoreResourceType.USERS]: ResourcePrimaryScope.USER_SELF,\n        [CoreResourceType.USER_SELF]: ResourcePrimaryScope.USER_SELF,\n        [CoreResourceType.APPLICATION]: ResourcePrimaryScope.APPLICATION,\n        [CoreResourceType.ANONYMOUS_USERS]: ResourcePrimaryScope.ANONYMOUS,\n      }\n      primaryScope = primaryScopeMap[resourceType1 as CoreResourceType];\n  \n      if (!primaryScope) {\n        throw createConfigurationError(`Resource type ${resourceType1} is not related to a primary scope`);\n      }\n    }\n    \n    // ========================================\n    // ACCESS SCOPE STRATEGY DEFAULTS\n    // ========================================\n\n    const parentResourceRequirement = options?.parentResourceRequirement || ResourceParentResourceRequirement.MANDATORY;\n    let accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT;\n\n    if (!options?.accessScopeStrategy) {\n      if (parentResourceRequirement === ResourceParentResourceRequirement.MANDATORY) {\n        accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT;\n      } else {\n        accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT;\n      }\n    } else {\n      accessScopeStrategy = options.accessScopeStrategy;\n    }\n\n    // Post-default-resolution check: `isPrimaryScope` must resolve to REQUIRES_CONTEXT\n    // or STANDALONE, never OPTIONAL_CONTEXT. See Guard 1 above for the full\n    // rationale (ownership graph vs URL routing are orthogonal, except for the\n    // OPTIONAL_CONTEXT incoherence).\n    //\n    // This second gate exists because `accessScopeStrategy` may be filled in by\n    // the DEFAULTS block above (lines 332-340) rather than authored explicitly.\n    // Guard 1 only fires on explicit authoring; this one catches the defaulted\n    // case where `parentResourceRequirement=OPTIONAL` silently resolves to\n    // `OPTIONAL_CONTEXT`.\n    if (options?.isPrimaryScope &&\n        accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Primary scope rel defaulted to accessScopeStrategy=OPTIONAL_CONTEXT\\n` +\n        `(triggered by parentResourceRequirement=OPTIONAL without explicit strategy).\\n` +\n        `Declare accessScopeStrategy=REQUIRES_CONTEXT (routed anchor) or STANDALONE\\n` +\n        `(logical anchor, not routed) explicitly.`\n      );\n    }\n  \n    // Parse childOperations and display to apply defaults and convert to parsed types\n    const parsedChildOperations = options?.childOperations \n      ? ChildOperationsConfigSchema.parse(options.childOperations)\n      : undefined;\n    \n    const parsedDisplay = options?.display\n      ? RelationshipDisplayConfigSchema.parse(options.display)\n      : undefined;\n\n    const relationshipDeclaration: ResourceRelationshipDeclaration = {\n      cardinality1,\n      cardinality2,\n      resourceType1,\n      resourceType2,\n      accessScopeStrategy,\n      parentResourceRequirement,\n      isPrimaryScope: options?.isPrimaryScope || false,\n      primaryScope,\n      jointResourceType: options?.jointResourceType || undefined,\n      allowCycle: options?.allowCycle || false,\n      isDisabled: options?.isDisabled || false,\n      // Context policy for relationship traversal\n      contextPolicy: options?.contextPolicy,\n      // High-level shared semantic meaning authored by app developers.\n      nature: options.nature,\n      // Optional explicit semantic read intent authored by app developers.\n      read: options?.read,\n      // Child operations configuration (lifecycle + nested DTOs) - parsed to apply defaults\n      childOperations: parsedChildOperations,\n      // Static discriminator filter for conditional relationships\n      discriminator: options?.discriminator,\n      // Function-based condition for conditional relationships\n      condition: options?.condition,\n      // Frontend display configuration - parsed to apply defaults\n      display: parsedDisplay,\n      // Foreign key field for disambiguation or non-standard naming\n      foreignKeyField: options?.foreignKeyField,\n      // Write-time scope-membership constraint (opt-in; enforced on CREATE/UPDATE by write-integrity)\n      scopeMembership: options?.scopeMembership,\n    };\n\n    return Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n  }\n"]}
+{"version":3,"file":"resources-relationships.shared.factory.js","sourceRoot":"","sources":["../../../../src/resources/resources-relationships.shared.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,kBAAkB,EAElB,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,GAGhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE5D,OAAO,EAAyB,2BAA2B,EAAqC,MAAM,mCAAmC,CAAC;AAC1I,OAAO,EAA6B,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;GAEG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAa,CAAC,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AA4FD,kFAAkF;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,UAAU,2BAA2B,CACvC,aAA2B,EAC3B,aAA2B,EAC3B,YAA6C,EAC7C,YAA6C,EAC7C,OAA+C;IAG/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,4DAA4D;YAC5D,sGAAsG,CACvG,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,oBAAoB;IACpB,2CAA2C;IAC3C,EAAE;IACF,2FAA2F;IAC3F,kGAAkG;IAClG,6FAA6F;IAC7F,oDAAoD;IACpD,EAAE;IACF,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,6CAA6C;IAC7C,EAAE;IACF,gGAAgG;IAChG,kBAAkB;IAElB,sEAAsE;IACtE,EAAE;IACF,sFAAsF;IACtF,EAAE;IACF,6EAA6E;IAC7E,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,sEAAsE;IACtE,EAAE;IACF,iEAAiE;IACjE,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,iEAAiE;IACjE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,mBAAmB,KAAK,uCAAuC,CAAC,gBAAgB,EAAE,CAAC;QAC9F,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,mEAAmE;YACnE,+EAA+E;YAC/E,4EAA4E;YAC5E,sEAAsE;YACtE,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAChC,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,IACE,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,OAAO,EAAE,iBAAiB;QAC1B,aAAa,KAAK,aAAa,EAC/B,CAAC;QACD,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,kGAAkG;YAClG,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,0FAA0F;IAC1F,EAAE;IACF,8FAA8F;IAC9F,iFAAiF;IAEjF,0EAA0E;IAC1E,mEAAmE;IACnE,0EAA0E;IAC1E,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,eAAe,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QAC9F,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,sFAAsF;YACtF,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,oBAAoB,OAAO,sEAAsE;gBACjG,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,uFAAuF;IACvF,uFAAuF;IACvF,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,aAAa,KAAK,aAAa,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,mFAAmF;gBACnF,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,yFAAyF;QACzF,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,EAAE,yBAAyB,IAAI,iCAAiC,CAAC,SAAS,CAAC;QAC7G,IAAI,kBAAkB,KAAK,iCAAiC,CAAC,SAAS,EAAE,CAAC;YACvE,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,wFAAwF;gBACxF,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACvG,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,yEAAyE;YACzE,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,EAAE,MAAM,KAAK,kBAAkB,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACtF,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,kDAAkD;YAClD,kGAAkG,CACnG,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,wBAAwB;IACxB,2CAA2C;IAE3C,IAAI,YAA+C,CAAC;IACpD,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;QAE5B,MAAM,eAAe,GAAG;YACtB,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC,aAAa;YACpE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,SAAS;YACxD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,SAAS;YAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,WAAW;YAChE,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,SAAS;SACnE,CAAA;QACD,YAAY,GAAG,eAAe,CAAC,aAAiC,CAAC,CAAC;QAElE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,wBAAwB,CAAC,iBAAiB,aAAa,oCAAoC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,iCAAiC;IACjC,2CAA2C;IAE3C,MAAM,yBAAyB,GAAG,OAAO,EAAE,yBAAyB,IAAI,iCAAiC,CAAC,SAAS,CAAC;IACpH,IAAI,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;IAEnF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAClC,IAAI,yBAAyB,KAAK,iCAAiC,CAAC,SAAS,EAAE,CAAC;YAC9E,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IACpD,CAAC;IAED,mFAAmF;IACnF,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,sBAAsB;IACtB,IAAI,OAAO,EAAE,cAAc;QACvB,mBAAmB,KAAK,uCAAuC,CAAC,gBAAgB,EAAE,CAAC;QACrF,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,uEAAuE;YACvE,gFAAgF;YAChF,8EAA8E;YAC9E,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,qBAAqB,GAAG,OAAO,EAAE,eAAe;QACpD,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO;QACpC,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,uBAAuB,GAAoC;QAC/D,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,aAAa;QACb,mBAAmB;QACnB,yBAAyB;QACzB,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,KAAK;QAChD,YAAY;QACZ,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,IAAI,SAAS;QAC1D,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;QACxC,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;QACxC,4CAA4C;QAC5C,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,iEAAiE;QACjE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,qEAAqE;QACrE,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,sFAAsF;QACtF,eAAe,EAAE,qBAAqB;QACtC,4DAA4D;QAC5D,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,yDAAyD;QACzD,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,4DAA4D;QAC5D,OAAO,EAAE,aAAa;QACtB,8DAA8D;QAC9D,eAAe,EAAE,OAAO,EAAE,eAAe;QACzC,gGAAgG;QAChG,eAAe,EAAE,OAAO,EAAE,eAAe;KAC1C,CAAC;IAEF,OAAO,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { CoreResourceType, ResourceType } from \"./resources.shared.core.definitions\";\nimport {\n  RelationshipNature,\n  type RelationshipHandlingReadSettings,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceRelationshipConditionFn,\n  type ScopeMembership,\n} from \"./resources.shared.schemas\";\nimport { ErrorType } from \"../errors/errors.shared.schemas\";\nimport { RelationshipContextPolicy } from \"./context-policy.shared.schemas\";\nimport { ChildOperationsConfig, ChildOperationsConfigSchema, ResourceRelationshipDiscriminator } from \"./child-operations.shared.schemas\";\nimport { RelationshipDisplayConfig, RelationshipDisplayConfigSchema } from \"./relationship-display.shared.schemas\";\nimport { Resources_SharedUtils } from \"./resources.shared.utils\";\n\n/**\n * Creates a configuration error with ErrorType.CONFIGURATION\n */\nfunction createConfigurationError(message: string): Error {\n  const error = new Error(message);\n  (error as any).type = ErrorType.CONFIGURATION;\n  return error;\n}\n\n/**\n * @wildo_source:part:start saas.models.resource-relationship-builder-parameters facet:layer:shared facet:family:resource-config\n *\n * Parameters accepted by `createResourcesRelationship()` (app registry authoring).\n */\nexport type ResourceRelationship_BuilderParameters = {\n  isDisabled? : boolean,\n  isPrimaryScope? : boolean,\n  parentResourceRequirement? : ResourceParentResourceRequirement,\n  accessScopeStrategy? : ResourceRelationshipAccessScopeStrategy,\n  jointResourceType?: ResourceType,\n  /**\n   * Opt-in flag for relationships that form cycles in the resource graph.\n   * Required on every edge in a cycle for schema-level validation to pass.\n   * @see ResourceRelationshipSchema.allowCycle\n   */\n  allowCycle?: boolean,\n  /** Context policy for this relationship - controls how related resources are fetched */\n  contextPolicy?: RelationshipContextPolicy,\n  /**\n   * High-level shared meaning of the relationship.\n   *\n   * This is the primary semantic field app developers should author. The\n   * framework derives the deeper internal handling contract from it plus the\n   * optional explicit read intent when present.\n   */\n  nature: RelationshipNature,\n  /**\n   * Optional explicit semantic read intent.\n   *\n   * This does not replace `childOperations.nested.onRead`; it only declares the\n   * semantic read model the framework should resolve.\n   */\n  read?: RelationshipHandlingReadSettings,\n  /**\n   * Child operations configuration for this relationship.\n   * Handles BACKEND concerns: lifecycle cascade and nested DTO aggregation.\n   */\n  childOperations?: ChildOperationsConfig,\n  /**\n   * Static discriminator filter for conditional relationships.\n   * When specified, this relationship only applies when the parent resource's\n   * discriminator field matches one of the specified values.\n   */\n  discriminator?: ResourceRelationshipDiscriminator,\n  /**\n   * Function-based condition for conditional relationships.\n   * Evaluated at runtime with the parent resource data.\n   * Unlike the static `discriminator`, this allows arbitrary logic.\n   */\n  condition?: ResourceRelationshipConditionFn,\n  /**\n   * Frontend display configuration for this relationship.\n   * Defines how related resources are displayed in the UI.\n   */\n  display?: RelationshipDisplayConfig,\n  /**\n   * Foreign key field name for this relationship.\n   *\n   * When omitted: Inferred from parent's resourceFieldIdentifier via allResourceFieldIdentifiers map.\n   * When specified: Used for disambiguation when multiple FKs point to same resource type,\n   *                 or when FK field name differs from standard naming convention.\n   *\n   * Examples:\n   * - Standard: ORGANIZATIONS → TODOS uses organizationId (inferred, no foreignKeyField needed)\n   * - Disambiguation: TODOS → USERS via assignedToUserId vs createdByUserId (explicit)\n   * - Self-referencing M:N is not expressed as one relationship declaration;\n   *   declare two explicit junction-resource edges so source and target FK\n   *   identities remain distinct.\n   */\n  foreignKeyField?: string,\n  /**\n   * Write-time SCOPE CONFINEMENT for a REFERENCE foreign key: the referenced target must be linked to\n   * the writing row's scope through a junction, enforced on CREATE and UPDATE. Opt-in and additive —\n   * omit for unchanged behavior.\n   *\n   * STRUCTURE only. `scopeMembership: true` is the simple case (junction auto-resolved from the M:N\n   * scope-junction map); the object form names the junction / its columns when convention cannot — a\n   * SELF-REFERENTIAL junction (organizations ↔ organizations). Per-variant POLICY (status, roles, typed\n   * junction rows) is declared on the operation config's `referenceConstraints`.\n   *\n   * @example todos.assignedToUserId must be a member of the row's organization:\n   * { nature: RelationshipNature.REFERENCE, foreignKeyField: 'assignedToUserId', scopeMembership: true }\n   *\n   * @example todos.sharedWithOrganizationId must be a partner of the row's organization:\n   * { nature: RelationshipNature.REFERENCE, foreignKeyField: 'sharedWithOrganizationId',\n   *   scopeMembership: { junction: CoreResourceType.ORGANIZATION_PARTNERSHIPS } }\n   */\n  scopeMembership?: ScopeMembership,\n};\n/** @wildo_source:part:end saas.models.resource-relationship-builder-parameters */\n\n\n\n/**\n * Create a resource relationship declaration between two resource types.\n *\n * This is the primary entry point for declaring relationships in the resource registry.\n * Returns a `ResourceRelationship` object that is spread into the registry's relationship\n * array and later categorized by `transformResourceRelationships()` at factory time.\n *\n * ## Conditional Relationships\n *\n * Relationships can optionally carry runtime conditions via `discriminator` and/or `condition`:\n *\n * - **`discriminator`** (static): A simple `{ discriminatorField, values }` object.\n *   The relationship is active only when `String(parent[discriminatorField])` is in `values`.\n *   Useful for discriminated union patterns (e.g., recurring vs. one-time todos).\n *\n * - **`condition`** (dynamic): An arbitrary `(parentResource) => boolean` function.\n *   Allows cross-field logic, computed checks, etc. Cannot be serialized to Zod.\n *\n * When both are provided, AND semantics apply — both must pass for the relationship\n * to be active at runtime.\n *\n * These conditions are NOT evaluated at startup/factory time. They are stored inline\n * on the relationship object and evaluated at runtime by:\n * - `ResourceContextBackendService.fetchChildResourcesWithPolicy()` — backend context building\n * - `ServicesRegistryHandler.filterRelationshipsByParent()` — nested CRUD + lifecycle\n * - `ResourceLayout_ContainerNested` — frontend display filtering\n *\n * @param resourceType1 - The parent resource type in 1:N/1:1, or the first entity side in M:N\n * @param resourceType2 - The child resource type in 1:N/1:1, or the second entity side in M:N\n * @param cardinality1 - Cardinality from the perspective of resourceType1\n * @param cardinality2 - Cardinality from the perspective of resourceType2\n * @param options - Required relationship options; must include `nature`.\n *   Other relationship fields remain optional as needed (discriminator,\n *   condition, childOperations, display, etc.)\n * @returns A fully constructed `ResourceRelationship` object\n *\n * ## M:N developer mental model\n *\n * For `MANY <-> MANY`, the declaration is still authored at the association level:\n * developers declare the two peer entity types plus `jointResourceType`.\n *\n * The framework may later decompose non-self associations into synthetic\n * entity->junction and junction->entity edges for DTO, routing, and runtime\n * processing, but that decomposition is an internal implementation detail.\n * App-facing meaning should stay association-centric, not \"manually declare the\n * synthetic edges yourself.\"\n *\n * Self-referencing M:N is the exception: one declaration cannot carry two\n * distinct source/target FK identities for the same resource type. Model it with\n * explicit junction-resource relationships instead.\n *\n * ## Semantic Resolution Order\n *\n * Relationship declarations now have an explicit semantic precedence:\n *\n * 1. structural topology (`cardinality*`, `jointResourceType`, `foreignKeyField`, ...)\n * 2. `nature`\n * 3. explicit semantic read intent (`read`) when authored\n * 4. derived handling contract (future resolver step, internal)\n * 5. current low-level operational projection (`childOperations`)\n *\n * `nature` is therefore the primary semantic declaration for app developers.\n * The fuller handling contract belongs to framework internals, not the authored\n * relationship API.\n *\n * ## Greenfield Direction\n *\n * Relationship declarations must define explicit `nature`. Missing annotations\n * are configuration bugs, not a compatibility target.\n *\n * @example Static discriminator (recurring todos → occurrences)\n * ```typescript\n * createResourcesRelationship(TODOS, RECURRING_OCCURRENCES, ONE, MANY, {\n *   nature: RelationshipNature.COMPOSITION,\n *   discriminator: { discriminatorField: 'recurringType', values: ['RECURRING'] },\n *   childOperations: { lifecycle: { onParentDelete: { enabled: true } } },\n * })\n * ```\n *\n * @example Function-based condition\n * ```typescript\n * createResourcesRelationship(ORDERS, REFUND_RECORDS, ONE, MANY, {\n *   nature: RelationshipNature.COMPOSITION,\n *   condition: (parent) => parent.status === 'COMPLETED' && parent.totalAmount > 0,\n * })\n * ```\n */\nexport function createResourcesRelationship(\n    resourceType1: ResourceType, \n    resourceType2: ResourceType, \n    cardinality1: ResourceRelationshipCardinality, \n    cardinality2: ResourceRelationshipCardinality, \n    options: ResourceRelationship_BuilderParameters\n  ) : ResourceRelationship {\n\n    if (!options?.nature) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Relationship declarations must define nature explicitly.\\n` +\n        `Greenfield relationship semantics no longer infer meaning from childOperations or jointResourceType.`\n      );\n    }\n    \n    // ========================================\n    // VALIDATION GUARDS\n    // ========================================\n    //\n    // The numbers below are STABLE LABELS, not a count and not a sequence. They are cited from\n    // `resources-relationships-factory.test.ts`, from `resources-registry.shared.core.definitions.ts`\n    // and from sibling packages, so renumbering them breaks those references. Two consequences a\n    // reader has to know before counting anything here:\n    //\n    //   - there is no Guard 4, and no commit touching this file has ever added or removed one;\n    //   - three refusals in this sequence carry no number at all (self-referencing MANY-to-MANY\n    //     below Guard 2, the unresolvable primary scope, and the post-default-resolution repeat of\n    //     Guard 1 near the end of the function).\n    //\n    // So \"the guards\" is a larger set than \"the numbered guards\". Enumerate the `throw` statements,\n    // not the labels.\n\n    // Guard 1: `isPrimaryScope` cannot be paired with `OPTIONAL_CONTEXT`.\n    //\n    // ## Why this guard exists (and why it only forbids OPTIONAL_CONTEXT, not STANDALONE)\n    //\n    // `isPrimaryScope` and `accessScopeStrategy` govern two ORTHOGONAL concerns:\n    //\n    // - `isPrimaryScope`        — ownership graph anchor: \"this parent is the\n    //                             row's structural scope root\". Drives the\n    //                             resource's `resourcePrimaryScope` enum, which\n    //                             in turn drives scope-aware services (auth,\n    //                             notifications, execution context, etc).\n    // - `accessScopeStrategy`   — URL routing + fetch-time context gating.\n    //                             STANDALONE  → no URL segment, no context gate\n    //                             REQUIRES_CONTEXT → mandatory URL segment + gate\n    //                             OPTIONAL_CONTEXT → optional URL segment\n    //\n    // The two concerns are already orthogonalized in the URL builder\n    // (`generateParentCombinations` filters out STANDALONE parents *before*\n    // bucketing the rest by `isPrimaryScope`), so a `STANDALONE + isPrimaryScope`\n    // rel is URL-inert by construction — it contributes zero path segments and\n    // simply anchors the scope enum. That is a coherent, intended configuration\n    // (e.g. internal ledgers like `jobExecutions` that are APP-scoped but not\n    // routed under `/applications/:id/…`, user-owned credential stores that are\n    // USER_SELF-scoped but not exposed as routable child resources).\n    //\n    // `OPTIONAL_CONTEXT + isPrimaryScope` is however INCOHERENT under the current\n    // combinator: `generateParentCombinations` puts every `isPrimaryScope` edge\n    // into the always-on bucket, which would force an \"optional\" primary parent\n    // to appear in every URL combination — contradicting its optionality. That\n    // redesign is out of scope here; until then the guard remains.\n    if (options?.isPrimaryScope &&\n        options?.accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Primary scope cannot have accessScopeStrategy=OPTIONAL_CONTEXT.\\n` +\n        `A primary-scope rel marks the structural ownership anchor; OPTIONAL_CONTEXT\\n` +\n        `would make the anchor optional in URLs, which the current URL combinator\\n` +\n        `cannot express coherently. Use REQUIRES_CONTEXT (routed anchor) or\\n` +\n        `STANDALONE (logical anchor, not routed).`\n      );\n    }\n    \n    // Guard 2: MANY-to-MANY requires jointResourceType (junction table)\n    if (cardinality1 === ResourceRelationshipCardinality.MANY && \n        cardinality2 === ResourceRelationshipCardinality.MANY &&\n        !options?.jointResourceType) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `MANY-to-MANY relationships require a jointResourceType (junction table).`\n      );\n    }\n\n    if (\n      cardinality1 === ResourceRelationshipCardinality.MANY &&\n      cardinality2 === ResourceRelationshipCardinality.MANY &&\n      options?.jointResourceType &&\n      resourceType1 === resourceType2\n    ) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Self-referencing MANY-to-MANY relationships cannot be authored as one association declaration.\\n` +\n        `Declare explicit junction-resource relationships so source and target edge identity stay explicit.`\n      );\n    }\n    \n    // (The refusal immediately above carries no guard number: self-referencing MANY-to-MANY.)\n    //\n    // Note: foreignKeyField IS valid with isPrimaryScope - it specifies the FK field on the child\n    // resource that points back to the parent, which is useful for 1:1 relationships\n    \n    // Guard 3: jointResourceType should not be combined with foreignKeyField.\n    // Self-referencing many-to-many is rejected above because a single\n    // declaration cannot encode two FK identities for the same peer resource.\n    if (options?.jointResourceType && options?.foreignKeyField && resourceType1 !== resourceType2) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Cannot combine jointResourceType and foreignKeyField for non-self-referencing M:N.\\n` +\n        `Use jointResourceType for MANY-to-MANY via junction table.`\n      );\n    }\n    \n    // Guard 5: foreignKeyField must end with 'Id' or 'Ids' (reserved for FK naming convention)\n    if (options?.foreignKeyField) {\n      const fkField = options.foreignKeyField;\n      if (!fkField.endsWith('Id') && !fkField.endsWith('Ids')) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `foreignKeyField \"${fkField}\" must end with 'Id' or 'Ids' (e.g., assignedToUserId, memberIds).\\n` +\n          `This naming convention is reserved for foreign key fields.`\n        );\n      }\n    }\n    \n    // Guard 6: Self-referencing 1:N/1:1 relationships require explicit foreignKeyField.\n    // Without it, the default FK (derived from resourceFieldIdentifier) would collide with\n    // itself in URL param generation — e.g., /resource/{resourceId}/resource/{resourceId}.\n    // M:N self-refs are rejected above: one declaration cannot encode distinct\n    // source/target FK identities for the same peer resource.\n    if (resourceType1 === resourceType2 && !options?.jointResourceType) {\n      if (!options?.foreignKeyField) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `Self-referencing 1:N/1:1 relationships MUST specify foreignKeyField explicitly.\\n` +\n          `Without it, URL parameter names collide (same resource type on both sides).`\n        );\n      }\n\n      // Guard 7: Self-referencing 1:N/1:1 relationships must have OPTIONAL parent requirement.\n      // Tree roots have no parent — MANDATORY would make root-level access impossible.\n      const effectiveParentReq = options?.parentResourceRequirement || ResourceParentResourceRequirement.MANDATORY;\n      if (effectiveParentReq === ResourceParentResourceRequirement.MANDATORY) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `Self-referencing 1:N/1:1 relationships MUST have parentResourceRequirement=OPTIONAL.\\n` +\n          `Tree/graph roots have no parent — MANDATORY would make root-level access impossible.`\n        );\n      }\n    }\n\n    // Guard 8: junction-backed relationships are association semantics when nature is explicit.\n    if (options?.jointResourceType && options?.nature && options.nature !== RelationshipNature.ASSOCIATION) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Relationships with jointResourceType must declare nature=ASSOCIATION.\\n` +\n        `Junction-backed relationships are association-centric in the shared model.`\n      );\n    }\n\n    // Guard 9: explicit association semantics require a junction resource.\n    if (options?.nature === RelationshipNature.ASSOCIATION && !options?.jointResourceType) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `nature=ASSOCIATION requires jointResourceType.\\n` +\n        `Association semantics are reserved for explicit link-management / junction-backed relationships.`\n      );\n    }\n    \n    // ========================================\n    // PRIMARY SCOPE MAPPING\n    // ========================================\n    \n    let primaryScope : ResourcePrimaryScope | undefined;\n    if (options?.isPrimaryScope) {\n     \n      const primaryScopeMap = {\n        [CoreResourceType.ORGANIZATIONS]: ResourcePrimaryScope.ORGANIZATIONS,\n        [CoreResourceType.USERS]: ResourcePrimaryScope.USER_SELF,\n        [CoreResourceType.USER_SELF]: ResourcePrimaryScope.USER_SELF,\n        [CoreResourceType.APPLICATION]: ResourcePrimaryScope.APPLICATION,\n        [CoreResourceType.ANONYMOUS_USERS]: ResourcePrimaryScope.ANONYMOUS,\n      }\n      primaryScope = primaryScopeMap[resourceType1 as CoreResourceType];\n  \n      if (!primaryScope) {\n        throw createConfigurationError(`Resource type ${resourceType1} is not related to a primary scope`);\n      }\n    }\n    \n    // ========================================\n    // ACCESS SCOPE STRATEGY DEFAULTS\n    // ========================================\n\n    const parentResourceRequirement = options?.parentResourceRequirement || ResourceParentResourceRequirement.MANDATORY;\n    let accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT;\n\n    if (!options?.accessScopeStrategy) {\n      if (parentResourceRequirement === ResourceParentResourceRequirement.MANDATORY) {\n        accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT;\n      } else {\n        accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT;\n      }\n    } else {\n      accessScopeStrategy = options.accessScopeStrategy;\n    }\n\n    // Post-default-resolution check: `isPrimaryScope` must resolve to REQUIRES_CONTEXT\n    // or STANDALONE, never OPTIONAL_CONTEXT. See Guard 1 above for the full\n    // rationale (ownership graph vs URL routing are orthogonal, except for the\n    // OPTIONAL_CONTEXT incoherence).\n    //\n    // This second gate exists because `accessScopeStrategy` may be filled in by\n    // the DEFAULTS block above (lines 332-340) rather than authored explicitly.\n    // Guard 1 only fires on explicit authoring; this one catches the defaulted\n    // case where `parentResourceRequirement=OPTIONAL` silently resolves to\n    // `OPTIONAL_CONTEXT`.\n    if (options?.isPrimaryScope &&\n        accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Primary scope rel defaulted to accessScopeStrategy=OPTIONAL_CONTEXT\\n` +\n        `(triggered by parentResourceRequirement=OPTIONAL without explicit strategy).\\n` +\n        `Declare accessScopeStrategy=REQUIRES_CONTEXT (routed anchor) or STANDALONE\\n` +\n        `(logical anchor, not routed) explicitly.`\n      );\n    }\n  \n    // Parse childOperations and display to apply defaults and convert to parsed types\n    const parsedChildOperations = options?.childOperations \n      ? ChildOperationsConfigSchema.parse(options.childOperations)\n      : undefined;\n    \n    const parsedDisplay = options?.display\n      ? RelationshipDisplayConfigSchema.parse(options.display)\n      : undefined;\n\n    const relationshipDeclaration: ResourceRelationshipDeclaration = {\n      cardinality1,\n      cardinality2,\n      resourceType1,\n      resourceType2,\n      accessScopeStrategy,\n      parentResourceRequirement,\n      isPrimaryScope: options?.isPrimaryScope || false,\n      primaryScope,\n      jointResourceType: options?.jointResourceType || undefined,\n      allowCycle: options?.allowCycle || false,\n      isDisabled: options?.isDisabled || false,\n      // Context policy for relationship traversal\n      contextPolicy: options?.contextPolicy,\n      // High-level shared semantic meaning authored by app developers.\n      nature: options.nature,\n      // Optional explicit semantic read intent authored by app developers.\n      read: options?.read,\n      // Child operations configuration (lifecycle + nested DTOs) - parsed to apply defaults\n      childOperations: parsedChildOperations,\n      // Static discriminator filter for conditional relationships\n      discriminator: options?.discriminator,\n      // Function-based condition for conditional relationships\n      condition: options?.condition,\n      // Frontend display configuration - parsed to apply defaults\n      display: parsedDisplay,\n      // Foreign key field for disambiguation or non-standard naming\n      foreignKeyField: options?.foreignKeyField,\n      // Write-time scope-membership constraint (opt-in; enforced on CREATE/UPDATE by write-integrity)\n      scopeMembership: options?.scopeMembership,\n    };\n\n    return Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n  }\n"]}

package/dist/esm/resources/resources.shared.core.definitions.d.ts

@@ -68,6 +68,14 @@ export declare enum CoreResourceType {
     ORGANIZATION_UNIT_MEMBERS = "organizationUnitMembers",
     ORG_API_KEYS = "organizationApiKeys",
     OAUTH_CLIENTS_ORGANIZATION = "organizationOAuthClients",
+    /**
+     * An organization's OWN credential toward a third-party provider — its Slack workspace token,
+     * its CRM API key. Distinct from the deployment's `process.env` secret, which is one value for
+     * every tenant in the application, and distinct from a user's delegated OAuth grant (#333),
+     * which has a different owner and a different revocation.
+     */
+    ORG_PROVIDER_CREDENTIALS = "organizationProviderCredentials",
+    USER_PROVIDER_CREDENTIALS = "userProviderCredentials",
     ORGANIZATION_SCIM_TOKENS = "organizationScimTokens",
     ORGANIZATION_SCIM_PROVISIONING_CONFIG = "organizationScimProvisioningConfig",
     ORGANIZATION_SSO_CONNECTIONS = "organizationSsoConnections",
@@ -100,6 +108,35 @@ export declare enum CoreResourceType {
     PROMOTIONS = "promotions",
     REFERRALS = "referrals",
     AUDIT_LOGS = "auditLogs",
+    /**
+     * The APPLICATION-scoped door onto the SAME audit rows `AUDIT_LOGS` serves.
+     *
+     * `AUDIT_LOGS` is organization-scoped: its only route is
+     * `/organizations/{organizationId}/audit-logs`, so it can only ever return rows carrying that
+     * tenant. But a security event is frequently application-scoped BY NATURE — `logUserLogin` takes
+     * `organizationId` as OPTIONAL because at login no organization is selected, and the same holds
+     * for session eviction, token refresh and application-wide authentication-policy changes.
+     * Measured on a dogfood application (#317): 94 of 127 rows carried no organization and were
+     * therefore reachable through no API at all.
+     *
+     * This type is that missing door, and it is a SEPARATE type rather than a second route on
+     * `AUDIT_LOGS` because the URL combinator forbids the alternative: `generateParentCombinations`
+     * puts every `isPrimaryScope` and every `REQUIRES_CONTEXT` parent into EVERY combination, so
+     * routing `AUDIT_LOGS`' application edge would rewrite its organization route to
+     * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` and break every
+     * existing consumer. A sibling type with a single application parent takes the route it needs and
+     * leaves the organization door untouched.
+     *
+     * Both types address ONE row set through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES` — the
+     * mechanism `USER_SELF` already uses to address `USERS`' rows. Two doors, one record set: the
+     * organization door stays tenant-filtered, this one is `APP_ADMIN_SUPER_ADMIN`-only, and a read
+     * here that touches a tenant-attributed row emits `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, once per
+     * tenant reached. That emission is NOT inherited: `authorizeOrganizations`, where the event is
+     * otherwise raised, runs only for ORGANIZATIONS-scoped resources. Each read variant here declares
+     * `admitsCrossTenantPlatformAdministration`, and that declaration is what enrols the read in the
+     * trail (`security/authorizations/cross-tenant-read-observation.backend.ts`).
+     */
+    APPLICATION_AUDIT_LOGS = "applicationAuditLogs",
     USER_NOTIFICATION_BADGES = "userNotificationBadges",
     ORGANIZATION_NOTIFICATION_BADGES = "organizationNotificationBadges",
     ORGANIZATION_WEBHOOK_CONFIG = "organizationWebhookConfig",

package/dist/esm/resources/resources.shared.core.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.shared.core.definitions.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;GAOG;AACH,oBAAY,qBAAqB;IAC/B,IAAI,SAAS,CAAS,kCAAkC;IACxD,MAAM,WAAW,CAAO,2BAA2B;IACnD,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,MAAM,WAAW,CAAK,kBAAkB;IACxC,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,MAAM,WAAW,CAAK,sBAAsB;IAC5C,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,IAAI,SAAS,CAAS,iCAAiC;IACvD,MAAM,WAAW,CAAK,2CAA2C;IACjE,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,mBAAmB,yBAAuC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,iCAAiC,EAAE,qBAAqB,EAMpE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAAqB,EAGhE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,qBAAqB,EAG5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,qBAAqB,EAK5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,qBAAqB,EAMlE,CAAC;AACF,iEAAiE;AAEjE,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,gBAAgB,oBAAoB;IACpC,aAAa,iBAAiB;IAC9B,gBAAgB,oBAAoB;IACpC,kBAAkB,qBAAqB;IACvC,qBAAqB,wBAAwB;IAC7C,aAAa,kBAAkB;IAC/B,kBAAkB,sBAAsB;IACxC,qBAAqB,yBAAyB;IAC9C,wBAAwB,4BAA4B;IACpD,sBAAsB,yBAAyB;IAC/C,0BAA0B,8BAA8B;IACxD,qBAAqB,yBAAyB;IAC9C,aAAa,iBAAiB;IAC9B,oBAAoB,wBAAwB;IAC5C,sGAAsG;IACtG,yBAAyB,4BAA4B;IAGrD,YAAY,wBAAwB;IACpC,0BAA0B,6BAA6B;IACvD,wBAAwB,2BAA2B;IACnD,qCAAqC,uCAAuC;IAG5E,4BAA4B,+BAA+B;IAC3D,uBAAuB,0BAA0B;IAGjD,+BAA+B,iCAAiC;IAChE,8BAA8B,gCAAgC;IAE9D,WAAW,iBAAiB;IAC5B,sBAAsB,yBAAyB;IAC/C,2BAA2B,8BAA8B;IACzD,8BAA8B,gCAAgC;IAC9D,6BAA6B,+BAA+B;IAC5D,oCAAoC,sCAAsC;IAC1E,oBAAoB,uBAAuB;IAC3C,yBAAyB,4BAA4B;IACrD,oBAAoB,wBAAwB;IAC5C,oBAAoB,wBAAwB;IAC5C,oBAAoB,wBAAwB;IAG5C,6BAA6B,gCAAgC;IAC7D,qBAAqB,wBAAwB;IAG7C,0BAA0B,8BAA8B;IACxD,kBAAkB,sBAAsB;IAGxC,yBAAyB,4BAA4B;IACrD,iBAAiB,oBAAoB;IAGrC,0BAA0B,6BAA6B;IACvD,kBAAkB,qBAAqB;IAGvC,yBAAyB,4BAA4B;IACrD,iBAAiB,oBAAoB;IAGrC,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,UAAU,eAAe;IACzB,SAAS,cAAc;IAGvB,UAAU,cAAc;IASxB,wBAAwB,2BAA2B;IACnD,gCAAgC,mCAAmC;IAKnE,2BAA2B,8BAA8B;IACzD,0BAA0B,6BAA6B;IACvD,qCAAqC,sCAAsC;IAC3E,oCAAoC,qCAAqC;IAGzE,KAAK,UAAU;IAGf,cAAc,kBAAkB;IAChC,mBAAmB,sBAAsB;IAGzC,mBAAmB,sBAAsB;IAGzC,oBAAoB,uBAAuB;IAG3C,eAAe,oBAAoB;IAKnC,gBAAgB,oBAAoB;IAGpC,mBAAmB,sBAAsB;IACzC,2BAA2B,8BAA8B;IAGzD,sBAAsB,yBAAyB;IAC/C,8BAA8B,iCAAiC;IAG/D,oBAAoB,uBAAuB;IAC3C,4BAA4B,+BAA+B;IAS3D,0BAA0B,4BAA4B;IACtD,kCAAkC,oCAAoC;IACtE,iCAAiC,mCAAmC;IAepE,qBAAqB,uBAAuB;IAC5C,6BAA6B,+BAA+B;IAC5D,4BAA4B,8BAA8B;IAQ1D,0BAA0B,2BAA2B;IACrD,kCAAkC,mCAAmC;IACrE,iCAAiC,kCAAkC;IAOnE,2BAA2B,4BAA4B;IACvD,mCAAmC,oCAAoC;IACvE,kCAAkC,mCAAmC;CACtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,sCAAsC,EAAE,WAAW,CAAC,MAAM,CAErE,CAAC;AAGH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,gBAAgB,CAqB/D,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,wEAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,uDAAuD;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAEvF,CAAC;AAEF,eAAO,MAAM,kCAAkC,EAAE;KAAG,GAAG,IAAI,gBAAgB,GAAG,MAAM;CAyGnF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,iDAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,mEAAmE;AAEnE;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,6DAA6D;IAC7D,OAAO,YAAY;IACnB,0DAA0D;IAC1D,QAAQ,aAAa;CACtB"}
+{"version":3,"file":"resources.shared.core.definitions.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;GAOG;AACH,oBAAY,qBAAqB;IAC/B,IAAI,SAAS,CAAS,kCAAkC;IACxD,MAAM,WAAW,CAAO,2BAA2B;IACnD,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,MAAM,WAAW,CAAK,kBAAkB;IACxC,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,MAAM,WAAW,CAAK,sBAAsB;IAC5C,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,IAAI,SAAS,CAAS,iCAAiC;IACvD,MAAM,WAAW,CAAK,2CAA2C;IACjE,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,mBAAmB,yBAAuC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,iCAAiC,EAAE,qBAAqB,EAMpE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAAqB,EAGhE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,qBAAqB,EAG5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,qBAAqB,EAK5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,qBAAqB,EAMlE,CAAC;AACF,iEAAiE;AAEjE,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,gBAAgB,oBAAoB;IACpC,aAAa,iBAAiB;IAC9B,gBAAgB,oBAAoB;IACpC,kBAAkB,qBAAqB;IACvC,qBAAqB,wBAAwB;IAC7C,aAAa,kBAAkB;IAC/B,kBAAkB,sBAAsB;IACxC,qBAAqB,yBAAyB;IAC9C,wBAAwB,4BAA4B;IACpD,sBAAsB,yBAAyB;IAC/C,0BAA0B,8BAA8B;IACxD,qBAAqB,yBAAyB;IAC9C,aAAa,iBAAiB;IAC9B,oBAAoB,wBAAwB;IAC5C,sGAAsG;IACtG,yBAAyB,4BAA4B;IAGrD,YAAY,wBAAwB;IACpC,0BAA0B,6BAA6B;IACvD;;;;;OAKG;IACH,wBAAwB,oCAAoC;IAC5D,yBAAyB,4BAA4B;IACrD,wBAAwB,2BAA2B;IACnD,qCAAqC,uCAAuC;IAG5E,4BAA4B,+BAA+B;IAC3D,uBAAuB,0BAA0B;IAGjD,+BAA+B,iCAAiC;IAChE,8BAA8B,gCAAgC;IAE9D,WAAW,iBAAiB;IAC5B,sBAAsB,yBAAyB;IAC/C,2BAA2B,8BAA8B;IACzD,8BAA8B,gCAAgC;IAC9D,6BAA6B,+BAA+B;IAC5D,oCAAoC,sCAAsC;IAC1E,oBAAoB,uBAAuB;IAC3C,yBAAyB,4BAA4B;IACrD,oBAAoB,wBAAwB;IAC5C,oBAAoB,wBAAwB;IAC5C,oBAAoB,wBAAwB;IAG5C,6BAA6B,gCAAgC;IAC7D,qBAAqB,wBAAwB;IAG7C,0BAA0B,8BAA8B;IACxD,kBAAkB,sBAAsB;IAGxC,yBAAyB,4BAA4B;IACrD,iBAAiB,oBAAoB;IAGrC,0BAA0B,6BAA6B;IACvD,kBAAkB,qBAAqB;IAGvC,yBAAyB,4BAA4B;IACrD,iBAAiB,oBAAoB;IAGrC,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,UAAU,eAAe;IACzB,SAAS,cAAc;IAGvB,UAAU,cAAc;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAAsB,yBAAyB;IAS/C,wBAAwB,2BAA2B;IACnD,gCAAgC,mCAAmC;IAKnE,2BAA2B,8BAA8B;IACzD,0BAA0B,6BAA6B;IACvD,qCAAqC,sCAAsC;IAC3E,oCAAoC,qCAAqC;IAczE,KAAK,UAAU;IAGf,cAAc,kBAAkB;IAChC,mBAAmB,sBAAsB;IAGzC,mBAAmB,sBAAsB;IAGzC,oBAAoB,uBAAuB;IAG3C,eAAe,oBAAoB;IAKnC,gBAAgB,oBAAoB;IAGpC,mBAAmB,sBAAsB;IACzC,2BAA2B,8BAA8B;IAGzD,sBAAsB,yBAAyB;IAC/C,8BAA8B,iCAAiC;IAG/D,oBAAoB,uBAAuB;IAC3C,4BAA4B,+BAA+B;IAS3D,0BAA0B,4BAA4B;IACtD,kCAAkC,oCAAoC;IACtE,iCAAiC,mCAAmC;IAepE,qBAAqB,uBAAuB;IAC5C,6BAA6B,+BAA+B;IAC5D,4BAA4B,8BAA8B;IAQ1D,0BAA0B,2BAA2B;IACrD,kCAAkC,mCAAmC;IACrE,iCAAiC,kCAAkC;IAOnE,2BAA2B,4BAA4B;IACvD,mCAAmC,oCAAoC;IACvE,kCAAkC,mCAAmC;CACtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,sCAAsC,EAAE,WAAW,CAAC,MAAM,CAErE,CAAC;AAGH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,gBAAgB,CAqB/D,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,wEAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,uDAAuD;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAEvF,CAAC;AAEF,eAAO,MAAM,kCAAkC,EAAE;KAAG,GAAG,IAAI,gBAAgB,GAAG,MAAM;CA4GnF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,iDAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,mEAAmE;AAEnE;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,6DAA6D;IAC7D,OAAO,YAAY;IACnB,0DAA0D;IAC1D,QAAQ,aAAa;CACtB"}

package/dist/esm/resources/resources.shared.core.definitions.js

@@ -93,6 +93,14 @@ export var CoreResourceType;
     CoreResourceType["ORGANIZATION_UNIT_MEMBERS"] = "organizationUnitMembers";
     CoreResourceType["ORG_API_KEYS"] = "organizationApiKeys";
     CoreResourceType["OAUTH_CLIENTS_ORGANIZATION"] = "organizationOAuthClients";
+    /**
+     * An organization's OWN credential toward a third-party provider — its Slack workspace token,
+     * its CRM API key. Distinct from the deployment's `process.env` secret, which is one value for
+     * every tenant in the application, and distinct from a user's delegated OAuth grant (#333),
+     * which has a different owner and a different revocation.
+     */
+    CoreResourceType["ORG_PROVIDER_CREDENTIALS"] = "organizationProviderCredentials";
+    CoreResourceType["USER_PROVIDER_CREDENTIALS"] = "userProviderCredentials";
     CoreResourceType["ORGANIZATION_SCIM_TOKENS"] = "organizationScimTokens";
     CoreResourceType["ORGANIZATION_SCIM_PROVISIONING_CONFIG"] = "organizationScimProvisioningConfig";
     // SSO Resources (Phase H-SSO)
@@ -134,6 +142,35 @@ export var CoreResourceType;
     CoreResourceType["REFERRALS"] = "referrals";
     // Audit and Compliance Resources
     CoreResourceType["AUDIT_LOGS"] = "auditLogs";
+    /**
+     * The APPLICATION-scoped door onto the SAME audit rows `AUDIT_LOGS` serves.
+     *
+     * `AUDIT_LOGS` is organization-scoped: its only route is
+     * `/organizations/{organizationId}/audit-logs`, so it can only ever return rows carrying that
+     * tenant. But a security event is frequently application-scoped BY NATURE — `logUserLogin` takes
+     * `organizationId` as OPTIONAL because at login no organization is selected, and the same holds
+     * for session eviction, token refresh and application-wide authentication-policy changes.
+     * Measured on a dogfood application (#317): 94 of 127 rows carried no organization and were
+     * therefore reachable through no API at all.
+     *
+     * This type is that missing door, and it is a SEPARATE type rather than a second route on
+     * `AUDIT_LOGS` because the URL combinator forbids the alternative: `generateParentCombinations`
+     * puts every `isPrimaryScope` and every `REQUIRES_CONTEXT` parent into EVERY combination, so
+     * routing `AUDIT_LOGS`' application edge would rewrite its organization route to
+     * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` and break every
+     * existing consumer. A sibling type with a single application parent takes the route it needs and
+     * leaves the organization door untouched.
+     *
+     * Both types address ONE row set through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES` — the
+     * mechanism `USER_SELF` already uses to address `USERS`' rows. Two doors, one record set: the
+     * organization door stays tenant-filtered, this one is `APP_ADMIN_SUPER_ADMIN`-only, and a read
+     * here that touches a tenant-attributed row emits `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, once per
+     * tenant reached. That emission is NOT inherited: `authorizeOrganizations`, where the event is
+     * otherwise raised, runs only for ORGANIZATIONS-scoped resources. Each read variant here declares
+     * `admitsCrossTenantPlatformAdministration`, and that declaration is what enrols the read in the
+     * trail (`security/authorizations/cross-tenant-read-observation.backend.ts`).
+     */
+    CoreResourceType["APPLICATION_AUDIT_LOGS"] = "applicationAuditLogs";
     // Notification Badges Resources — polymorphic dual-scope (USER + ORG).
     // Each scope owns its own collection and its own access-control surface:
     //   - USER variant: the user themselves reads/lists their badges; CREATE/UPDATE
@@ -150,6 +187,17 @@ export var CoreResourceType;
     CoreResourceType["APPLICATION_WEBHOOK_CONFIG"] = "applicationWebhookConfig";
     CoreResourceType["ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG"] = "organizationM2mWebhookDeliveryLog";
     CoreResourceType["APPLICATION_M2M_WEBHOOK_DELIVERY_LOG"] = "applicationM2mWebhookDeliveryLog";
+    // There is NO email equivalent of these two, and that is a DECISION rather than an oversight
+    // (#412, 2026-09-08). A sent email leaves log lines and nothing else — no resource, no delivery
+    // record — so "did this customer receive it?" is answered with the email provider's own tooling,
+    // never with Wildo. The asymmetry with these webhook logs is what makes the absence look
+    // accidental, which is why it is written down HERE as well as at the email service.
+    //
+    // The cost is not the table. A persisted email record carries retention policy, privacy
+    // classification, subject-export and erasure obligations FOR MESSAGE CONTENT — a new per-user
+    // personal-data store, for an answer a vendor already gives. A metadata-only variant (recipient,
+    // template, timestamp, provider id; no body) was available and also declined, because it is the
+    // same set of obligations over a smaller payload.
     // File Management Resources
     CoreResourceType["FILES"] = "files";
     // Queue/Job Resources (internal, repository-only)
@@ -334,6 +382,8 @@ export const coreResourceShared_FieldIdentifier = {
     [CoreResourceType.ORGANIZATION_UNIT_MEMBERS]: 'organizationUnitMemberId',
     [CoreResourceType.ORG_API_KEYS]: 'orgApiKeyId',
     [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: 'orgOAuthClientId',
+    [CoreResourceType.ORG_PROVIDER_CREDENTIALS]: 'orgProviderCredentialId',
+    [CoreResourceType.USER_PROVIDER_CREDENTIALS]: 'userProviderCredentialId',
     [CoreResourceType.ORGANIZATION_SCIM_TOKENS]: 'organizationScimTokenId',
     [CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG]: 'organizationScimProvisioningConfigId',
     [CoreResourceType.APPLICATION_API_KEYS]: 'appApiKeyId',
@@ -365,6 +415,7 @@ export const coreResourceShared_FieldIdentifier = {
     [CoreResourceType.PROMOTIONS]: 'promotionId',
     [CoreResourceType.REFERRALS]: 'referralId',
     [CoreResourceType.AUDIT_LOGS]: 'auditLogId',
+    [CoreResourceType.APPLICATION_AUDIT_LOGS]: 'applicationAuditLogId',
     // Notification Badges — polymorphic dual-scope variants
     [CoreResourceType.USER_NOTIFICATION_BADGES]: 'userNotificationBadgeId',
     [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: 'organizationNotificationBadgeId',

package/dist/esm/resources/resources.shared.core.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources.shared.core.definitions.js","sourceRoot":"","sources":["../../../../src/resources/resources.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,qBAWX;AAXD,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,sCAAa,CAAA;IACb,0CAAiB,CAAA;IACjB,wCAAe,CAAA;AACjB,CAAC,EAXW,qBAAqB,KAArB,qBAAqB,QAWhC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4B;IACxE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA4B;IACpE,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,GAAG,iCAAiC;IACpC,GAAG,6BAA6B;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA4B;IACtE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AACF,iEAAiE;AAEjE,MAAM,CAAN,IAAY,gBA6KX;AA7KD,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;IACvB,mCAAe,CAAA;IACf,wDAAoC,CAAA;IACpC,kDAA8B,CAAA;IAC9B,wDAAoC,CAAA;IACpC,2DAAuC,CAAA;IACvC,iEAA6C,CAAA;IAC7C,mDAA+B,CAAA;IAC/B,4DAAwC,CAAA;IACxC,kEAA8C,CAAA;IAC9C,wEAAoD,CAAA;IACpD,mEAA+C,CAAA;IAC/C,4EAAwD,CAAA;IACxD,kEAA8C,CAAA;IAC9C,kDAA8B,CAAA;IAC9B,gEAA4C,CAAA;IAC5C,sGAAsG;IACtG,yEAAqD,CAAA;IAGrD,wDAAoC,CAAA;IACpC,2EAAuD,CAAA;IACvD,uEAAmD,CAAA;IACnD,gGAA4E,CAAA;IAE5E,8BAA8B;IAC9B,+EAA2D,CAAA;IAC3D,qEAAiD,CAAA;IAEjD,6CAA6C;IAC7C,oFAAgE,CAAA;IAChE,kFAA8D,CAAA;IAE9D,gDAA4B,CAAA;IAC5B,mEAA+C,CAAA;IAC/C,6EAAyD,CAAA;IACzD,kFAA8D,CAAA;IAC9D,gFAA4D,CAAA;IAC5D,8FAA0E,CAAA;IAC1E,+DAA2C,CAAA;IAC3C,yEAAqD,CAAA;IACrD,gEAA4C,CAAA;IAC5C,gEAA4C,CAAA;IAC5C,gEAA4C,CAAA;IAE5C,kEAAkE;IAClE,iFAA6D,CAAA;IAC7D,iEAA6C,CAAA;IAE7C,+DAA+D;IAC/D,4EAAwD,CAAA;IACxD,4DAAwC,CAAA;IAExC,8DAA8D;IAC9D,yEAAqD,CAAA;IACrD,yDAAqC,CAAA;IAErC,+DAA+D;IAC/D,2EAAuD,CAAA;IACvD,2DAAuC,CAAA;IAEvC,8DAA8D;IAC9D,yEAAqD,CAAA;IACrD,yDAAqC,CAAA;IAErC,uDAAuD;IACvD,yCAAqB,CAAA;IACrB,qCAAiB,CAAA;IACjB,6CAAyB,CAAA;IACzB,2CAAuB,CAAA;IAEvB,iCAAiC;IACjC,4CAAwB,CAAA;IAExB,uEAAuE;IACvE,yEAAyE;IACzE,gFAAgF;IAChF,uEAAuE;IACvE,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAC9E,uEAAmD,CAAA;IACnD,uFAAmE,CAAA;IAEnE,uEAAuE;IACvE,+DAA+D;IAC/D,kEAAkE;IAClE,6EAAyD,CAAA;IACzD,2EAAuD,CAAA;IACvD,+FAA2E,CAAA;IAC3E,6FAAyE,CAAA;IAEzE,4BAA4B;IAC5B,mCAAe,CAAA;IAEf,kDAAkD;IAClD,oDAAgC,CAAA;IAChC,6DAAyC,CAAA;IAEzC,2BAA2B;IAC3B,6DAAyC,CAAA;IAEzC,0FAA0F;IAC1F,+DAA2C,CAAA;IAE3C,8BAA8B;IAC9B,uDAAmC,CAAA;IAEnC,wEAAwE;IACxE,wEAAwE;IACxE,wCAAwC;IACxC,wDAAoC,CAAA;IAEpC,8DAA8D;IAC9D,6DAAyC,CAAA;IACzC,6EAAyD,CAAA;IAEzD,iEAAiE;IACjE,mEAA+C,CAAA;IAC/C,mFAA+D,CAAA;IAE/D,+DAA+D;IAC/D,+DAA2C,CAAA;IAC3C,+EAA2D,CAAA;IAE3D,4EAA4E;IAC5E,+EAA+E;IAC/E,kFAAkF;IAClF,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,+DAA+D;IAC/D,0EAAsD,CAAA;IACtD,0FAAsE,CAAA;IACtE,wFAAoE,CAAA;IAEpE,0EAA0E;IAC1E,iFAAiF;IACjF,gFAAgF;IAChF,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,6FAA6F;IAC7F,sFAAsF;IACtF,iFAAiF;IACjF,+EAA+E;IAC/E,+CAA+C;IAC/C,gEAA4C,CAAA;IAC5C,gFAA4D,CAAA;IAC5D,8EAA0D,CAAA;IAE1D,0EAA0E;IAC1E,uFAAuF;IACvF,yFAAyF;IACzF,yFAAyF;IACzF,wEAAwE;IACxE,8CAA8C;IAC9C,yEAAqD,CAAA;IACrD,yFAAqE,CAAA;IACrE,uFAAmE,CAAA;IAEnE,kFAAkF;IAClF,oFAAoF;IACpF,wFAAwF;IACxF,8EAA8E;IAC9E,0FAA0F;IAC1F,2EAAuD,CAAA;IACvD,2FAAuE,CAAA;IACvE,yFAAqE,CAAA;AACvE,CAAC,EA7KW,gBAAgB,KAAhB,gBAAgB,QA6K3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAwB,IAAI,GAAG,CAAS;IACzF,gBAAgB,CAAC,SAAS;CAC3B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAkC,IAAI,GAAG,CAAC;IAC3E,uCAAuC;IACvC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,qBAAqB;IACtC,oCAAoC;IACpC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,kBAAkB;IACnC,mCAAmC;IACnC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,iBAAiB;IAClC,oCAAoC;IACpC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,kBAAkB;IACnC,mCAAmC;IACnC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,iBAAiB;IAClC,oCAAoC;IACpC,gBAAgB,CAAC,QAAQ;IACzB,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,SAAS;CAC3B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACxB,CAAC,CAAC,MAAM,EAAE,CAAC,wBAAwB;CACpC,CAAC,CAAC;AAGH,uDAAuD;AAEvD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAqC;IACxF,MAAM,EAAE,gBAAgB,CAAC,KAAK;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAA0C;IACrF,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAClD,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ;IAClC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IACxD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,sCAAsC;IAC9E,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,eAAe;IACjD,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IACxD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,mBAAmB;IAC1D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,eAAe;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;IACnE,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B;IAC5E,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAClF,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,EAAE,qCAAqC;IAC9F,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAChE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAEhE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC3D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IACxE,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB;IAClE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAC5E,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAClE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAClD,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAExE,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,aAAa;IAC9C,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,kBAAkB;IACjE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,EAAE,sCAAsC;IAChG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,aAAa;IACtD,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,kBAAkB;IAChE,gBAAgB;IAChB,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,6BAA6B;IAC9E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,yBAAyB;IACrE,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,EAAE,gCAAgC;IACpF,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAElF,0CAA0C;IAC1C,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,sBAAsB;IAChE,uCAAuC;IACvC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B;IAC3E,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC3D,sCAAsC;IACtC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;IACxD,uCAAuC;IACvC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IAC1E,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,mBAAmB;IAC1D,sCAAsC;IACtC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;IACxD,oCAAoC;IACpC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW;IACxC,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS;IACpC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,aAAa;IAC5C,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,YAAY;IAC1C,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,YAAY;IAC3C,wDAAwD;IACxD,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,iCAAiC;IACtF,0DAA0D;IAC1D,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,6BAA6B;IAC7E,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B;IAC3E,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,EAAE,qCAAqC;IAC/F,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,EAAE,oCAAoC;IAC7F,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ;IAClC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,gBAAgB;IACnD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,oBAAoB;IAC5D,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,qBAAqB;IAC9D,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACrD,qCAAqC;IACrC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACvD,2BAA2B;IAC3B,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,6BAA6B;IAC7E,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;IACnE,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,gCAAgC;IACnF,4BAA4B;IAC5B,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B;IAC/E,uEAAuE;IACvE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B;IACzE,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,kEAAkE;IAClE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,qBAAqB;IAC/D,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,6BAA6B;IAC/E,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B;IAC7E,yEAAyE;IACzE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B;IACzE,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,iFAAiF;IACjF,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,2BAA2B;IAC3E,CAAC,gBAAgB,CAAC,mCAAmC,CAAC,EAAE,mCAAmC;IAC3F,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;CAC5F,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC9F,OAAO,EAAE,gDAAgD;KAC1D,CAAC;IACF,CAAC,CAAC,MAAM,EAAE,CAAC,oCAAoC;CAChD,CAAC,CAAC;AAGH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,6DAA6D;IAC7D,uCAAmB,CAAA;IACnB,0DAA0D;IAC1D,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B","sourcesContent":["import { z } from 'zod';\nimport { EnumLikeType }from '@wildo-ai/zod-decorators';\n\n\n\n\n/**\n * @wildo_source:part:start saas.models.core-resource-operation facet:layer:shared facet:family:resource-config\n *\n * Core CRUD and collection operations every resource may expose.\n *\n * @remarks Import from `@wildo-ai/saas-models`. App `resources-config` picks a\n * subset via `coreOperations` and adds `customOperation` identifiers.\n */\nexport enum CoreResourceOperation {\n  READ = 'read',        // View/retrieve existing resource\n  UPDATE = 'update',      // Update existing resource\n  UPDATE_MANY = 'update_many',   // Update multiple resources\n  DELETE = 'delete',    // Remove resource\n  DELETE_MANY = 'delete_many',   // Delete multiple resources\n  CREATE = 'create',    // Create new resource\n  CREATE_MANY = 'create_many',   // Create multiple resources\n  LIST = 'list',        // List/search multiple resources\n  SEARCH = 'search',    // Search resources with advanced filtering\n  COUNT = 'count',      // Count resources matching criteria\n}\n\nexport const ALL_CORE_OPERATIONS = Object.values(CoreResourceOperation);\n\n/**\n * Collection operations that operate on collections rather than specific resources.\n * These operations don't require a resource ID and authorization is based on roles + parent scope.\n */\nexport const COLLECTION_OPERATIONS_WITHOUT_IDS: CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.CREATE_MANY,\n  CoreResourceOperation.SEARCH,\n  CoreResourceOperation.COUNT,\n];\n\n/**\n * Collection operations that may require resource IDs in the request body or query parameters.\n * These operations operate on collections but may filter/update/delete specific resources by ID.\n */\nexport const COLLECTION_OPERATIONS_WITH_ID: CoreResourceOperation[] = [\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE_MANY,\n];\n\n/**\n * All collection operations (both with and without IDs).\n * These operations operate on collections rather than specific resources.\n * Used for URL building to determine if an operation needs an entity ID in the URL path.\n */\nexport const ALL_COLLECTION_OPERATIONS: CoreResourceOperation[] = [\n  ...COLLECTION_OPERATIONS_WITHOUT_IDS,\n  ...COLLECTION_OPERATIONS_WITH_ID,\n];\n\n/**\n * Operations that return array responses (multiple resources).\n * Used for validation and transformation logic that needs to handle arrays.\n */\nexport const ARRAY_RESPONSE_OPERATIONS: CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.DELETE_MANY,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.CREATE_MANY,\n];\n\n/**\n * Operations that don't require request body validation.\n * These operations use IDs from execution context or query parameters, not from request body.\n */\nexport const OPERATIONS_WITHOUT_REQUEST_BODY: CoreResourceOperation[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.DELETE,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.SEARCH,\n];\n/** @wildo_source:part:end saas.models.core-resource-operation */\n\nexport enum CoreResourceType {\n\n  USER_SELF = 'user_self',\n  USERS = 'users',\n  USER_CREDENTIALS = 'userCredentials',\n  USER_PROFILES = 'userProfiles',\n  USER_PREFERENCES = 'userPreferences',\n  USER_SELF_PROFILES = 'userSelfProfiles',\n  USER_SELF_PREFERENCES = 'userSelfPreferences',\n  ORGANIZATIONS = 'organizations',\n  ORGANIZATION_UNITS = 'organizationUnits',\n  ORGANIZATION_PROFILES = 'organizationProfiles',\n  ORGANIZATION_PREFERENCES = 'organizationPreferences',\n  PLATFORM_ACCESS_GRANTS = 'platformAccessGrants',\n  ORGANIZATION_NOTIFICATIONS = 'organizationNotifications',\n  ORGANIZATION_FEATURES = 'organizationFeatures',\n  USER_FEATURES = 'userFeatures',\n  ORGANIZATION_MEMBERS = 'organizationMembers',\n  /** Junction: a membership's role inside one organization unit (replaced an embedded array — D-B5). */\n  ORGANIZATION_UNIT_MEMBERS = 'organizationUnitMembers',\n\n\n  ORG_API_KEYS = 'organizationApiKeys',\n  OAUTH_CLIENTS_ORGANIZATION = 'organizationOAuthClients',\n  ORGANIZATION_SCIM_TOKENS = 'organizationScimTokens',\n  ORGANIZATION_SCIM_PROVISIONING_CONFIG = 'organizationScimProvisioningConfig',\n\n  // SSO Resources (Phase H-SSO)\n  ORGANIZATION_SSO_CONNECTIONS = 'organizationSsoConnections',\n  ORGANIZATION_SSO_CONFIG = 'organizationSsoConfig',\n\n  // SIEM / Compliance Resources (Phase H-SIEM)\n  ORGANIZATION_SIEM_EXPORT_CONFIG = 'organizationSiemExportConfig',\n  ORGANIZATION_SIEM_DELIVERY_DLQ = 'organizationSiemDeliveryDlq',\n\n  APPLICATION = 'applications',\n  APPLICATION_SSO_CONFIG = 'applicationSsoConfig',\n  APPLICATION_SSO_CONNECTIONS = 'applicationSsoConnections',\n  APPLICATION_SIEM_EXPORT_CONFIG = 'applicationSiemExportConfig',\n  APPLICATION_SIEM_DELIVERY_DLQ = 'applicationSiemDeliveryDlq',\n  APPLICATION_SCIM_PROVISIONING_CONFIG = 'applicationScimProvisioningConfig',\n  APPLICATION_API_KEYS = 'applicationApiKeys',\n  OAUTH_CLIENTS_APPLICATION = 'applicationOAuthClients',\n  APPLICATION_METADATA = 'applicationMetadata',\n  APPLICATION_VERSIONS = 'applicationVersions',\n  APPLICATION_FEATURES = 'applicationFeatures',\n\n  // Billing Accounts — polymorphic variants (one per primary scope)\n  ORGANIZATION_BILLING_ACCOUNTS = 'organizationBillingAccounts',\n  USER_BILLING_ACCOUNTS = 'userBillingAccounts',\n\n  // Subscriptions — polymorphic variants (one per primary scope)\n  ORGANIZATION_SUBSCRIPTIONS = 'organizationSubscriptions',\n  USER_SUBSCRIPTIONS = 'userSubscriptions',\n\n  // Invoice Refs — polymorphic variants (one per primary scope)\n  ORGANIZATION_INVOICE_REFS = 'organizationInvoiceRefs',\n  USER_INVOICE_REFS = 'userInvoiceRefs',\n\n  // Usage Records — polymorphic variants (one per primary scope)\n  ORGANIZATION_USAGE_RECORDS = 'organizationUsageRecords',\n  USER_USAGE_RECORDS = 'userUsageRecords',\n\n  // Credit Pools — polymorphic variants (one per primary scope)\n  ORGANIZATION_CREDIT_POOLS = 'organizationCreditPools',\n  USER_CREDIT_POOLS = 'userCreditPools',\n\n  // Billing Resources — non-polymorphic (shared catalog)\n  PRODUCTS = 'products',\n  PRICES = 'prices',\n  PROMOTIONS = 'promotions',\n  REFERRALS = 'referrals',\n\n  // Audit and Compliance Resources\n  AUDIT_LOGS = 'auditLogs',\n\n  // Notification Badges Resources — polymorphic dual-scope (USER + ORG).\n  // Each scope owns its own collection and its own access-control surface:\n  //   - USER variant: the user themselves reads/lists their badges; CREATE/UPDATE\n  //     are system-internal (driven by the dispatcher / batch services).\n  //   - ORG variant: org admins read/list their org's badges; CREATE/UPDATE are\n  //     system-internal.\n  // See `notifications/notification-badges.shared.resources-config.schemas.ts`.\n  USER_NOTIFICATION_BADGES = 'userNotificationBadges',\n  ORGANIZATION_NOTIFICATION_BADGES = 'organizationNotificationBadges',\n\n  // M2M Outbound Webhook Resources — polymorphic dual-scope (ORG + APP).\n  // See `notifications/m2m/webhook-config.shared.schemas.ts` and\n  // `notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts`.\n  ORGANIZATION_WEBHOOK_CONFIG = 'organizationWebhookConfig',\n  APPLICATION_WEBHOOK_CONFIG = 'applicationWebhookConfig',\n  ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG = 'organizationM2mWebhookDeliveryLog',\n  APPLICATION_M2M_WEBHOOK_DELIVERY_LOG = 'applicationM2mWebhookDeliveryLog',\n\n  // File Management Resources\n  FILES = 'files',\n\n  // Queue/Job Resources (internal, repository-only)\n  JOB_EXECUTIONS = 'jobExecutions',\n  JOB_PAYLOAD_STORAGE = 'jobPayloadStorage',\n\n  // Authentication Resources\n  USER_IDENTITY_LINKS = 'userIdentityLinks',\n\n  // OIDC persistent consent grants (\"remember this app\") — USER_SELF-scoped, provider-side.\n  OAUTH_CONSENT_GRANTS = 'oauthConsentGrants',\n\n  // Anonymous Session Resources\n  ANONYMOUS_USERS = 'anonymous_users',\n\n  // Marketing / Lead Capture Resources (Phase 0.5 — public marketing site\n  // forms write here; APPLICATION-scoped, no isAnonymizable, see Q-E=B in\n  // .cursor/plans/saas-website-slice.md).\n  INBOUND_CONTACTS = 'inboundContacts',\n\n  // Guidance State Resources — dual-scope (USER / ORGANIZATION)\n  USER_GUIDANCE_STATE = 'userGuidanceState',\n  ORGANIZATION_GUIDANCE_STATE = 'organizationGuidanceState',\n\n  // Progression State Resources — dual-scope (USER / ORGANIZATION)\n  USER_PROGRESSION_STATE = 'userProgressionState',\n  ORGANIZATION_PROGRESSION_STATE = 'organizationProgressionState',\n\n  // Lifecycle State Resources — dual-scope (USER / ORGANIZATION)\n  USER_LIFECYCLE_STATE = 'userLifecycleState',\n  ORGANIZATION_LIFECYCLE_STATE = 'organizationLifecycleState',\n\n  // Flows-Actors Execution Resources — persisted flow/actor system executions\n  // (conversational message log + kind-discriminated runtime state). POLYMORPHIC\n  // across owner scope: one variant per scope, each owned by the injected owner FK.\n  // The user variant is WS chat + user-delegated A2A; the org/app variants are\n  // machine-owned (API-key / OIDC-client A2A). Written by the conversational\n  // runtime; read as chat history by the owner. Values MUST match the polymorphic\n  // derivation from `flowActorExecutionsPolymorphicDeclaration`.\n  USER_FLOW_ACTOR_EXECUTIONS = 'userFlowActorExecutions',\n  ORGANIZATION_FLOW_ACTOR_EXECUTIONS = 'organizationFlowActorExecutions',\n  APPLICATION_FLOW_ACTOR_EXECUTIONS = 'applicationFlowActorExecutions',\n\n  // Flows-Actors Task Resources — the persisted WORK record, deliberately a\n  // SEPARATE plane from the conversational execution above: executions own session\n  // history, tasks own an addressable/pollable/cancelable work lifecycle with its\n  // own status and artifacts. A task links back to an execution through a SOFT INDEXED\n  // FIELD (`flowActorExecutionId`), NOT a declared relationship of any kind — executions are\n  // polymorphic, so one foreign key would match no variant, and a declared edge would imply a\n  // cascade path that must not exist: a task has to OUTLIVE the conversation that produced it.\n  // (An earlier revision of this comment said \"REFERENCE, never COMPOSITION\", which read as a\n  // declared edge; no such relationship exists. The schema and the spec both describe the soft\n  // link correctly.) Derived from the canonical `Actors_Task_Schema`, mirroring how the\n  // platform persists `wildoApplicationActorTasks`. Surfaces the A2A `Task` object\n  // (`tasks/get` / `tasks/cancel`). Values MUST match the polymorphic derivation\n  // from `flowActorTasksPolymorphicDeclaration`.\n  USER_FLOW_ACTOR_TASKS = 'userFlowActorTasks',\n  ORGANIZATION_FLOW_ACTOR_TASKS = 'organizationFlowActorTasks',\n  APPLICATION_FLOW_ACTOR_TASKS = 'applicationFlowActorTasks',\n\n  // A2A Push Notification Delivery Log (polymorphic — one per owner scope).\n  // One row per (task state change × registered webhook), written BEFORE the delivery is\n  // attempted so an unreachable queue still leaves a trace. Scope set MUST mirror the task\n  // resources above: an owner with no delivery-log variant is an owner whose notifications\n  // cannot be recorded. Values MUST match the polymorphic derivation from\n  // `a2aPushDeliveryLogPolymorphicDeclaration`.\n  USER_A2A_PUSH_DELIVERY_LOG = 'userA2aPushDeliveryLog',\n  ORGANIZATION_A2A_PUSH_DELIVERY_LOG = 'organizationA2aPushDeliveryLog',\n  APPLICATION_A2A_PUSH_DELIVERY_LOG = 'applicationA2aPushDeliveryLog',\n\n  // A2A Token Budget State Resources (polymorphic SINGLETON — one per owner scope).\n  // Per-tenant, per-period LLM token-budget accumulator enforced on inbound A2A agent\n  // turns; written + read ONLY by the A2A runtime (via *AsSystem). Enum VALUES MUST match\n  // the polymorphic derivation from `a2aTokenBudgetStatePolymorphicDeclaration`\n  // (`toPascalCase('a2aTokenBudgetState')` = `A2aTokenBudgetState`, so the value is `A2a`).\n  USER_A2A_TOKEN_BUDGET_STATE = 'userA2aTokenBudgetState',\n  ORGANIZATION_A2A_TOKEN_BUDGET_STATE = 'organizationA2aTokenBudgetState',\n  APPLICATION_A2A_TOKEN_BUDGET_STATE = 'applicationA2aTokenBudgetState',\n}\n\n/**\n * The core resources the ENGINE'S OWN runtime reads, which an application may never exclude.\n *\n * `excludedResourceTypes` exists so an application can drop core vocabulary it does not use — the\n * billing-conditional resources it was built for, or, for a purpose-built console, most of the core\n * catalog. That freedom has one floor: a resource the engine itself reads to function.\n *\n * It is declared HERE, in the shared tier, because the floor has TWO enforcement sites in different\n * layers and they must never disagree: the frontend registry must REGISTER the resource, and the\n * backend serving that frontend must MOUNT its controller. A floor honoured on one side only fails\n * exactly as loudly as no floor at all — the workbench proved both halves in turn, first a registry\n * with no `user_self` entry, then a 404 on `/api/v1/user-self/:id/context`.\n *\n * `USER_SELF` is that floor today. `UserOrgsContext.restoreUserSession` reads it to build the\n * authenticated context after every login and every reload, and returns `false` when the registry\n * has no entry for it — on which the caller logs out \"to avoid a half-restored state\". So excluding\n * it does not degrade a feature; it makes authentication IMPOSSIBLE, in the most misleading way\n * available: `POST /auth/authenticate` answers 200 with a valid token, the very next request goes out\n * with no `Authorization` header, the 401 that follows is read as an expired session, and the user\n * lands back on the login form. The only trace is one `warn`.\n *\n * That is why this is a floor the engine ENFORCES rather than a line in an application's\n * documentation. An application cannot see this dependency — `restoreUserSession` is engine-internal\n * — so an exclusion set derived from the application's own vocabulary (which is the correct way to\n * write one) has no way to know it must carve this out. Measured on the application-creation\n * workbench, whose exclusion is derived exactly that way: login succeeded and bounced, every time.\n *\n * `ORGANIZATIONS` is deliberately NOT here. `loadOrganizations` also reads the registry, but it warns\n * and returns an empty list, so excluding it degrades the organization switcher and nothing else —\n * a legitimate choice for a console with no tenant vocabulary. The floor is what BREAKS when absent,\n * not everything the engine happens to read; a floor that grows past that would quietly re-impose the\n * whole core catalog on every application.\n */\nexport const ENGINE_RUNTIME_REQUIRED_RESOURCE_TYPES: ReadonlySet<string> = new Set<string>([\n  CoreResourceType.USER_SELF,\n]);\n\n\n/**\n * Set of all billing resource types.\n * Used by the resource exclusion mechanism to conditionally exclude\n * all billing resources when billing is disabled in app config.\n */\nexport const BILLING_RESOURCE_TYPES: ReadonlySet<CoreResourceType> = new Set([\n  // Polymorphic billing account variants\n  CoreResourceType.ORGANIZATION_BILLING_ACCOUNTS,\n  CoreResourceType.USER_BILLING_ACCOUNTS,\n  // Polymorphic subscription variants\n  CoreResourceType.ORGANIZATION_SUBSCRIPTIONS,\n  CoreResourceType.USER_SUBSCRIPTIONS,\n  // Polymorphic invoice ref variants\n  CoreResourceType.ORGANIZATION_INVOICE_REFS,\n  CoreResourceType.USER_INVOICE_REFS,\n  // Polymorphic usage record variants\n  CoreResourceType.ORGANIZATION_USAGE_RECORDS,\n  CoreResourceType.USER_USAGE_RECORDS,\n  // Polymorphic credit pool variants\n  CoreResourceType.ORGANIZATION_CREDIT_POOLS,\n  CoreResourceType.USER_CREDIT_POOLS,\n  // Non-polymorphic billing resources\n  CoreResourceType.PRODUCTS,\n  CoreResourceType.PRICES,\n  CoreResourceType.PROMOTIONS,\n  CoreResourceType.REFERRALS,\n]);\n\n/**\n * @wildo_source:part:start saas.models.resource-type facet:layer:shared facet:family:resource-config\n *\n * Resource Type Schema (Core + Custom)\n *\n * @remarks Import from `@wildo-ai/saas-models`. Custom app resources use\n * string literals beyond `CoreResourceType`.\n */\nexport const ResourceTypeSchema = z.union([\n  z.enum(CoreResourceType),\n  z.string() // Custom resource types\n]);\n\nexport type ResourceType = z.infer<typeof ResourceTypeSchema>;\n/** @wildo_source:part:end saas.models.resource-type */\n\n/**\n * When multiple resource types share the same field identifier (e.g., USERS and\n * USER_SELF both use \"userId\"), this map declares which resource type is the\n * canonical FK resolution target. Without this, the winner would depend on\n * relationship declaration order — a latent fragility.\n *\n * Used by both frontend and backend registry builds as a post-enrichment fixup.\n */\nexport const coreResourceShared_FieldIdentifierPriority: Record<string, CoreResourceType> = {\n    userId: CoreResourceType.USERS,\n};\n\nexport const coreResourceShared_FieldIdentifier: { [key in CoreResourceType]: string } = {\n    [CoreResourceType.ORGANIZATIONS]: 'organizationId',\n    [CoreResourceType.USERS]: 'userId',\n    [CoreResourceType.USER_CREDENTIALS]: 'userCredentialsId',\n    [CoreResourceType.USER_SELF]: 'userId', // Same as USERS but different context\n    [CoreResourceType.USER_PROFILES]: 'userProfileId',\n    [CoreResourceType.USER_PREFERENCES]: 'userPreferencesId',\n    [CoreResourceType.USER_SELF_PROFILES]: 'userSelfProfileId',\n    [CoreResourceType.USER_SELF_PREFERENCES]: 'userSelfPreferencesId',\n    [CoreResourceType.APPLICATION]: 'applicationId',\n    [CoreResourceType.APPLICATION_SSO_CONFIG]: 'applicationSsoConfigId',\n    [CoreResourceType.APPLICATION_SSO_CONNECTIONS]: 'applicationSsoConnectionId',\n    [CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG]: 'applicationSiemExportConfigId',\n    [CoreResourceType.APPLICATION_SIEM_DELIVERY_DLQ]: 'applicationSiemDeliveryDlqId',\n    [CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG]: 'applicationScimProvisioningConfigId',\n    [CoreResourceType.APPLICATION_METADATA]: 'applicationMetadataId',\n    [CoreResourceType.APPLICATION_VERSIONS]: 'applicationVersionId',\n    [CoreResourceType.APPLICATION_FEATURES]: 'applicationFeaturesId',\n\n    [CoreResourceType.ORGANIZATION_UNITS]: 'organizationUnitId',\n    [CoreResourceType.ORGANIZATION_PROFILES]: 'organizationProfileId',\n    [CoreResourceType.ORGANIZATION_PREFERENCES]: 'organizationPreferencesId',\n    [CoreResourceType.PLATFORM_ACCESS_GRANTS]: 'platformAccessGrantId',\n    [CoreResourceType.ORGANIZATION_NOTIFICATIONS]: 'organizationNotificationsId',\n    [CoreResourceType.ORGANIZATION_FEATURES]: 'organizationFeaturesId',\n    [CoreResourceType.USER_FEATURES]: 'userFeaturesId',\n    [CoreResourceType.ORGANIZATION_MEMBERS]: 'organizationMemberId',\n    [CoreResourceType.ORGANIZATION_UNIT_MEMBERS]: 'organizationUnitMemberId',\n\n    [CoreResourceType.ORG_API_KEYS]: 'orgApiKeyId',\n    [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: 'orgOAuthClientId',\n    [CoreResourceType.ORGANIZATION_SCIM_TOKENS]: 'organizationScimTokenId',\n    [CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG]: 'organizationScimProvisioningConfigId',\n    [CoreResourceType.APPLICATION_API_KEYS]: 'appApiKeyId',\n    [CoreResourceType.OAUTH_CLIENTS_APPLICATION]: 'appOAuthClientId',\n    // SSO Resources\n    [CoreResourceType.ORGANIZATION_SSO_CONNECTIONS]: 'organizationSsoConnectionId',\n    [CoreResourceType.ORGANIZATION_SSO_CONFIG]: 'organizationSsoConfigId',\n    // SIEM / Compliance Resources\n    [CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG]: 'organizationSiemExportConfigId',\n    [CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ]: 'organizationSiemDeliveryDlqId',\n\n    // Billing Accounts — polymorphic variants\n    [CoreResourceType.ORGANIZATION_BILLING_ACCOUNTS]: 'organizationBillingAccountId',\n    [CoreResourceType.USER_BILLING_ACCOUNTS]: 'userBillingAccountId',\n    // Subscriptions — polymorphic variants\n    [CoreResourceType.ORGANIZATION_SUBSCRIPTIONS]: 'organizationSubscriptionId',\n    [CoreResourceType.USER_SUBSCRIPTIONS]: 'userSubscriptionId',\n    // Invoice Refs — polymorphic variants\n    [CoreResourceType.ORGANIZATION_INVOICE_REFS]: 'organizationInvoiceRefId',\n    [CoreResourceType.USER_INVOICE_REFS]: 'userInvoiceRefId',\n    // Usage Records — polymorphic variants\n    [CoreResourceType.ORGANIZATION_USAGE_RECORDS]: 'organizationUsageRecordId',\n    [CoreResourceType.USER_USAGE_RECORDS]: 'userUsageRecordId',\n    // Credit Pools — polymorphic variants\n    [CoreResourceType.ORGANIZATION_CREDIT_POOLS]: 'organizationCreditPoolId',\n    [CoreResourceType.USER_CREDIT_POOLS]: 'userCreditPoolId',\n    // Non-polymorphic billing resources\n    [CoreResourceType.PRODUCTS]: 'productId',\n    [CoreResourceType.PRICES]: 'priceId',\n    [CoreResourceType.PROMOTIONS]: 'promotionId',\n    [CoreResourceType.REFERRALS]: 'referralId',\n    [CoreResourceType.AUDIT_LOGS]: 'auditLogId',\n    // Notification Badges — polymorphic dual-scope variants\n    [CoreResourceType.USER_NOTIFICATION_BADGES]: 'userNotificationBadgeId',\n    [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: 'organizationNotificationBadgeId',\n    // M2M Outbound Webhook Resources — polymorphic dual-scope\n    [CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG]: 'organizationWebhookConfigId',\n    [CoreResourceType.APPLICATION_WEBHOOK_CONFIG]: 'applicationWebhookConfigId',\n    [CoreResourceType.ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG]: 'organizationM2mWebhookDeliveryLogId',\n    [CoreResourceType.APPLICATION_M2M_WEBHOOK_DELIVERY_LOG]: 'applicationM2mWebhookDeliveryLogId',\n    [CoreResourceType.FILES]: 'fileId',\n    [CoreResourceType.JOB_EXECUTIONS]: 'jobExecutionId',\n    [CoreResourceType.JOB_PAYLOAD_STORAGE]: 'jobPayloadStorageId',\n    [CoreResourceType.USER_IDENTITY_LINKS]: 'userIdentityLinkId',\n    [CoreResourceType.OAUTH_CONSENT_GRANTS]: 'oauthConsentGrantId',\n    // Anonymous Session Resources\n    [CoreResourceType.ANONYMOUS_USERS]: 'anonymousUserId',\n    // Marketing / Lead Capture Resources\n    [CoreResourceType.INBOUND_CONTACTS]: 'inboundContactId',\n    // Guidance State Resources\n    [CoreResourceType.USER_GUIDANCE_STATE]: 'userGuidanceStateId',\n    [CoreResourceType.ORGANIZATION_GUIDANCE_STATE]: 'organizationGuidanceStateId',\n    // Progression State Resources\n    [CoreResourceType.USER_PROGRESSION_STATE]: 'userProgressionStateId',\n    [CoreResourceType.ORGANIZATION_PROGRESSION_STATE]: 'organizationProgressionStateId',\n    // Lifecycle State Resources\n    [CoreResourceType.USER_LIFECYCLE_STATE]: 'userLifecycleStateId',\n    [CoreResourceType.ORGANIZATION_LIFECYCLE_STATE]: 'organizationLifecycleStateId',\n    // Flows-Actors Execution Resources (polymorphic — one per owner scope)\n    [CoreResourceType.USER_FLOW_ACTOR_EXECUTIONS]: 'userFlowActorExecutionId',\n    [CoreResourceType.ORGANIZATION_FLOW_ACTOR_EXECUTIONS]: 'organizationFlowActorExecutionId',\n    [CoreResourceType.APPLICATION_FLOW_ACTOR_EXECUTIONS]: 'applicationFlowActorExecutionId',\n    // Flows-Actors Task Resources (polymorphic — one per owner scope)\n    [CoreResourceType.USER_FLOW_ACTOR_TASKS]: 'userFlowActorTaskId',\n    [CoreResourceType.ORGANIZATION_FLOW_ACTOR_TASKS]: 'organizationFlowActorTaskId',\n    [CoreResourceType.APPLICATION_FLOW_ACTOR_TASKS]: 'applicationFlowActorTaskId',\n    // A2A Push Notification Delivery Log (polymorphic — one per owner scope)\n    [CoreResourceType.USER_A2A_PUSH_DELIVERY_LOG]: 'userA2aPushDeliveryLogId',\n    [CoreResourceType.ORGANIZATION_A2A_PUSH_DELIVERY_LOG]: 'organizationA2aPushDeliveryLogId',\n    [CoreResourceType.APPLICATION_A2A_PUSH_DELIVERY_LOG]: 'applicationA2aPushDeliveryLogId',\n    // A2A Token Budget State Resources (polymorphic singleton — one per owner scope)\n    [CoreResourceType.USER_A2A_TOKEN_BUDGET_STATE]: 'userA2aTokenBudgetStateId',\n    [CoreResourceType.ORGANIZATION_A2A_TOKEN_BUDGET_STATE]: 'organizationA2aTokenBudgetStateId',\n    [CoreResourceType.APPLICATION_A2A_TOKEN_BUDGET_STATE]: 'applicationA2aTokenBudgetStateId',\n};\n\n/**\n * @wildo_source:part:start saas.models.resource-field-identifier facet:layer:shared facet:family:resource-config\n *\n * FK / primary-key field identifier string for a resource (core or custom).\n *\n * @remarks Import from `@wildo-ai/saas-models`.\n */\nexport const ResourceFieldIdentifierSchema = z.union([\n  z.string().refine((value) => Object.values(coreResourceShared_FieldIdentifier).includes(value), {\n    message: \"Must be a valid core resource field identifier\"\n  }),\n  z.string() // Custom resource field identifiers\n]);\n\nexport type ResourceFieldIdentifier = z.infer<typeof ResourceFieldIdentifierSchema>;\n/** @wildo_source:part:end saas.models.resource-field-identifier */\n\n/**\n * Cascade direction for self-referencing relationships.\n * Used when resourceType1 === resourceType2 to disambiguate parent vs child.\n */\nexport enum CascadeDirection {\n  /** Standard parent→child — declaring resource is ancestor */\n  FORWARD = 'forward',\n  /** Reverse child→parent — related resource is ancestor */\n  BACKWARD = 'backward',\n}\n"]}
+{"version":3,"file":"resources.shared.core.definitions.js","sourceRoot":"","sources":["../../../../src/resources/resources.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,qBAWX;AAXD,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,sCAAa,CAAA;IACb,0CAAiB,CAAA;IACjB,wCAAe,CAAA;AACjB,CAAC,EAXW,qBAAqB,KAArB,qBAAqB,QAWhC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4B;IACxE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA4B;IACpE,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,GAAG,iCAAiC;IACpC,GAAG,6BAA6B;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA4B;IACtE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AACF,iEAAiE;AAEjE,MAAM,CAAN,IAAY,gBA6NX;AA7ND,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;IACvB,mCAAe,CAAA;IACf,wDAAoC,CAAA;IACpC,kDAA8B,CAAA;IAC9B,wDAAoC,CAAA;IACpC,2DAAuC,CAAA;IACvC,iEAA6C,CAAA;IAC7C,mDAA+B,CAAA;IAC/B,4DAAwC,CAAA;IACxC,kEAA8C,CAAA;IAC9C,wEAAoD,CAAA;IACpD,mEAA+C,CAAA;IAC/C,4EAAwD,CAAA;IACxD,kEAA8C,CAAA;IAC9C,kDAA8B,CAAA;IAC9B,gEAA4C,CAAA;IAC5C,sGAAsG;IACtG,yEAAqD,CAAA;IAGrD,wDAAoC,CAAA;IACpC,2EAAuD,CAAA;IACvD;;;;;OAKG;IACH,gFAA4D,CAAA;IAC5D,yEAAqD,CAAA;IACrD,uEAAmD,CAAA;IACnD,gGAA4E,CAAA;IAE5E,8BAA8B;IAC9B,+EAA2D,CAAA;IAC3D,qEAAiD,CAAA;IAEjD,6CAA6C;IAC7C,oFAAgE,CAAA;IAChE,kFAA8D,CAAA;IAE9D,gDAA4B,CAAA;IAC5B,mEAA+C,CAAA;IAC/C,6EAAyD,CAAA;IACzD,kFAA8D,CAAA;IAC9D,gFAA4D,CAAA;IAC5D,8FAA0E,CAAA;IAC1E,+DAA2C,CAAA;IAC3C,yEAAqD,CAAA;IACrD,gEAA4C,CAAA;IAC5C,gEAA4C,CAAA;IAC5C,gEAA4C,CAAA;IAE5C,kEAAkE;IAClE,iFAA6D,CAAA;IAC7D,iEAA6C,CAAA;IAE7C,+DAA+D;IAC/D,4EAAwD,CAAA;IACxD,4DAAwC,CAAA;IAExC,8DAA8D;IAC9D,yEAAqD,CAAA;IACrD,yDAAqC,CAAA;IAErC,+DAA+D;IAC/D,2EAAuD,CAAA;IACvD,2DAAuC,CAAA;IAEvC,8DAA8D;IAC9D,yEAAqD,CAAA;IACrD,yDAAqC,CAAA;IAErC,uDAAuD;IACvD,yCAAqB,CAAA;IACrB,qCAAiB,CAAA;IACjB,6CAAyB,CAAA;IACzB,2CAAuB,CAAA;IAEvB,iCAAiC;IACjC,4CAAwB,CAAA;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mEAA+C,CAAA;IAE/C,uEAAuE;IACvE,yEAAyE;IACzE,gFAAgF;IAChF,uEAAuE;IACvE,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAC9E,uEAAmD,CAAA;IACnD,uFAAmE,CAAA;IAEnE,uEAAuE;IACvE,+DAA+D;IAC/D,kEAAkE;IAClE,6EAAyD,CAAA;IACzD,2EAAuD,CAAA;IACvD,+FAA2E,CAAA;IAC3E,6FAAyE,CAAA;IACzE,6FAA6F;IAC7F,gGAAgG;IAChG,iGAAiG;IACjG,yFAAyF;IACzF,oFAAoF;IACpF,EAAE;IACF,wFAAwF;IACxF,8FAA8F;IAC9F,iGAAiG;IACjG,gGAAgG;IAChG,kDAAkD;IAElD,4BAA4B;IAC5B,mCAAe,CAAA;IAEf,kDAAkD;IAClD,oDAAgC,CAAA;IAChC,6DAAyC,CAAA;IAEzC,2BAA2B;IAC3B,6DAAyC,CAAA;IAEzC,0FAA0F;IAC1F,+DAA2C,CAAA;IAE3C,8BAA8B;IAC9B,uDAAmC,CAAA;IAEnC,wEAAwE;IACxE,wEAAwE;IACxE,wCAAwC;IACxC,wDAAoC,CAAA;IAEpC,8DAA8D;IAC9D,6DAAyC,CAAA;IACzC,6EAAyD,CAAA;IAEzD,iEAAiE;IACjE,mEAA+C,CAAA;IAC/C,mFAA+D,CAAA;IAE/D,+DAA+D;IAC/D,+DAA2C,CAAA;IAC3C,+EAA2D,CAAA;IAE3D,4EAA4E;IAC5E,+EAA+E;IAC/E,kFAAkF;IAClF,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,+DAA+D;IAC/D,0EAAsD,CAAA;IACtD,0FAAsE,CAAA;IACtE,wFAAoE,CAAA;IAEpE,0EAA0E;IAC1E,iFAAiF;IACjF,gFAAgF;IAChF,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,6FAA6F;IAC7F,sFAAsF;IACtF,iFAAiF;IACjF,+EAA+E;IAC/E,+CAA+C;IAC/C,gEAA4C,CAAA;IAC5C,gFAA4D,CAAA;IAC5D,8EAA0D,CAAA;IAE1D,0EAA0E;IAC1E,uFAAuF;IACvF,yFAAyF;IACzF,yFAAyF;IACzF,wEAAwE;IACxE,8CAA8C;IAC9C,yEAAqD,CAAA;IACrD,yFAAqE,CAAA;IACrE,uFAAmE,CAAA;IAEnE,kFAAkF;IAClF,oFAAoF;IACpF,wFAAwF;IACxF,8EAA8E;IAC9E,0FAA0F;IAC1F,2EAAuD,CAAA;IACvD,2FAAuE,CAAA;IACvE,yFAAqE,CAAA;AACvE,CAAC,EA7NW,gBAAgB,KAAhB,gBAAgB,QA6N3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAwB,IAAI,GAAG,CAAS;IACzF,gBAAgB,CAAC,SAAS;CAC3B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAkC,IAAI,GAAG,CAAC;IAC3E,uCAAuC;IACvC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,qBAAqB;IACtC,oCAAoC;IACpC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,kBAAkB;IACnC,mCAAmC;IACnC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,iBAAiB;IAClC,oCAAoC;IACpC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,kBAAkB;IACnC,mCAAmC;IACnC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,iBAAiB;IAClC,oCAAoC;IACpC,gBAAgB,CAAC,QAAQ;IACzB,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,SAAS;CAC3B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACxB,CAAC,CAAC,MAAM,EAAE,CAAC,wBAAwB;CACpC,CAAC,CAAC;AAGH,uDAAuD;AAEvD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAqC;IACxF,MAAM,EAAE,gBAAgB,CAAC,KAAK;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAA0C;IACrF,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAClD,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ;IAClC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IACxD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,sCAAsC;IAC9E,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,eAAe;IACjD,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IACxD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,mBAAmB;IAC1D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,eAAe;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;IACnE,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B;IAC5E,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAClF,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,EAAE,qCAAqC;IAC9F,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAChE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAEhE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC3D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IACxE,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB;IAClE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAC5E,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAClE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAClD,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAExE,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,aAAa;IAC9C,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,kBAAkB;IACjE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,EAAE,sCAAsC;IAChG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,aAAa;IACtD,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,kBAAkB;IAChE,gBAAgB;IAChB,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,6BAA6B;IAC9E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,yBAAyB;IACrE,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,EAAE,gCAAgC;IACpF,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAElF,0CAA0C;IAC1C,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,sBAAsB;IAChE,uCAAuC;IACvC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B;IAC3E,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC3D,sCAAsC;IACtC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;IACxD,uCAAuC;IACvC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IAC1E,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,mBAAmB;IAC1D,sCAAsC;IACtC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;IACxD,oCAAoC;IACpC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW;IACxC,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS;IACpC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,aAAa;IAC5C,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,YAAY;IAC1C,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,YAAY;IAC3C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB;IAClE,wDAAwD;IACxD,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,iCAAiC;IACtF,0DAA0D;IAC1D,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,6BAA6B;IAC7E,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B;IAC3E,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,EAAE,qCAAqC;IAC/F,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,EAAE,oCAAoC;IAC7F,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ;IAClC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,gBAAgB;IACnD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,oBAAoB;IAC5D,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,qBAAqB;IAC9D,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACrD,qCAAqC;IACrC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACvD,2BAA2B;IAC3B,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,6BAA6B;IAC7E,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;IACnE,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,gCAAgC;IACnF,4BAA4B;IAC5B,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B;IAC/E,uEAAuE;IACvE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B;IACzE,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,kEAAkE;IAClE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,qBAAqB;IAC/D,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,6BAA6B;IAC/E,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B;IAC7E,yEAAyE;IACzE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B;IACzE,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,iFAAiF;IACjF,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,2BAA2B;IAC3E,CAAC,gBAAgB,CAAC,mCAAmC,CAAC,EAAE,mCAAmC;IAC3F,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;CAC5F,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC9F,OAAO,EAAE,gDAAgD;KAC1D,CAAC;IACF,CAAC,CAAC,MAAM,EAAE,CAAC,oCAAoC;CAChD,CAAC,CAAC;AAGH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,6DAA6D;IAC7D,uCAAmB,CAAA;IACnB,0DAA0D;IAC1D,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B","sourcesContent":["import { z } from 'zod';\nimport { EnumLikeType }from '@wildo-ai/zod-decorators';\n\n\n\n\n/**\n * @wildo_source:part:start saas.models.core-resource-operation facet:layer:shared facet:family:resource-config\n *\n * Core CRUD and collection operations every resource may expose.\n *\n * @remarks Import from `@wildo-ai/saas-models`. App `resources-config` picks a\n * subset via `coreOperations` and adds `customOperation` identifiers.\n */\nexport enum CoreResourceOperation {\n  READ = 'read',        // View/retrieve existing resource\n  UPDATE = 'update',      // Update existing resource\n  UPDATE_MANY = 'update_many',   // Update multiple resources\n  DELETE = 'delete',    // Remove resource\n  DELETE_MANY = 'delete_many',   // Delete multiple resources\n  CREATE = 'create',    // Create new resource\n  CREATE_MANY = 'create_many',   // Create multiple resources\n  LIST = 'list',        // List/search multiple resources\n  SEARCH = 'search',    // Search resources with advanced filtering\n  COUNT = 'count',      // Count resources matching criteria\n}\n\nexport const ALL_CORE_OPERATIONS = Object.values(CoreResourceOperation);\n\n/**\n * Collection operations that operate on collections rather than specific resources.\n * These operations don't require a resource ID and authorization is based on roles + parent scope.\n */\nexport const COLLECTION_OPERATIONS_WITHOUT_IDS: CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.CREATE_MANY,\n  CoreResourceOperation.SEARCH,\n  CoreResourceOperation.COUNT,\n];\n\n/**\n * Collection operations that may require resource IDs in the request body or query parameters.\n * These operations operate on collections but may filter/update/delete specific resources by ID.\n */\nexport const COLLECTION_OPERATIONS_WITH_ID: CoreResourceOperation[] = [\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE_MANY,\n];\n\n/**\n * All collection operations (both with and without IDs).\n * These operations operate on collections rather than specific resources.\n * Used for URL building to determine if an operation needs an entity ID in the URL path.\n */\nexport const ALL_COLLECTION_OPERATIONS: CoreResourceOperation[] = [\n  ...COLLECTION_OPERATIONS_WITHOUT_IDS,\n  ...COLLECTION_OPERATIONS_WITH_ID,\n];\n\n/**\n * Operations that return array responses (multiple resources).\n * Used for validation and transformation logic that needs to handle arrays.\n */\nexport const ARRAY_RESPONSE_OPERATIONS: CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.DELETE_MANY,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.CREATE_MANY,\n];\n\n/**\n * Operations that don't require request body validation.\n * These operations use IDs from execution context or query parameters, not from request body.\n */\nexport const OPERATIONS_WITHOUT_REQUEST_BODY: CoreResourceOperation[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.DELETE,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.SEARCH,\n];\n/** @wildo_source:part:end saas.models.core-resource-operation */\n\nexport enum CoreResourceType {\n\n  USER_SELF = 'user_self',\n  USERS = 'users',\n  USER_CREDENTIALS = 'userCredentials',\n  USER_PROFILES = 'userProfiles',\n  USER_PREFERENCES = 'userPreferences',\n  USER_SELF_PROFILES = 'userSelfProfiles',\n  USER_SELF_PREFERENCES = 'userSelfPreferences',\n  ORGANIZATIONS = 'organizations',\n  ORGANIZATION_UNITS = 'organizationUnits',\n  ORGANIZATION_PROFILES = 'organizationProfiles',\n  ORGANIZATION_PREFERENCES = 'organizationPreferences',\n  PLATFORM_ACCESS_GRANTS = 'platformAccessGrants',\n  ORGANIZATION_NOTIFICATIONS = 'organizationNotifications',\n  ORGANIZATION_FEATURES = 'organizationFeatures',\n  USER_FEATURES = 'userFeatures',\n  ORGANIZATION_MEMBERS = 'organizationMembers',\n  /** Junction: a membership's role inside one organization unit (replaced an embedded array — D-B5). */\n  ORGANIZATION_UNIT_MEMBERS = 'organizationUnitMembers',\n\n\n  ORG_API_KEYS = 'organizationApiKeys',\n  OAUTH_CLIENTS_ORGANIZATION = 'organizationOAuthClients',\n  /**\n   * An organization's OWN credential toward a third-party provider — its Slack workspace token,\n   * its CRM API key. Distinct from the deployment's `process.env` secret, which is one value for\n   * every tenant in the application, and distinct from a user's delegated OAuth grant (#333),\n   * which has a different owner and a different revocation.\n   */\n  ORG_PROVIDER_CREDENTIALS = 'organizationProviderCredentials',\n  USER_PROVIDER_CREDENTIALS = 'userProviderCredentials',\n  ORGANIZATION_SCIM_TOKENS = 'organizationScimTokens',\n  ORGANIZATION_SCIM_PROVISIONING_CONFIG = 'organizationScimProvisioningConfig',\n\n  // SSO Resources (Phase H-SSO)\n  ORGANIZATION_SSO_CONNECTIONS = 'organizationSsoConnections',\n  ORGANIZATION_SSO_CONFIG = 'organizationSsoConfig',\n\n  // SIEM / Compliance Resources (Phase H-SIEM)\n  ORGANIZATION_SIEM_EXPORT_CONFIG = 'organizationSiemExportConfig',\n  ORGANIZATION_SIEM_DELIVERY_DLQ = 'organizationSiemDeliveryDlq',\n\n  APPLICATION = 'applications',\n  APPLICATION_SSO_CONFIG = 'applicationSsoConfig',\n  APPLICATION_SSO_CONNECTIONS = 'applicationSsoConnections',\n  APPLICATION_SIEM_EXPORT_CONFIG = 'applicationSiemExportConfig',\n  APPLICATION_SIEM_DELIVERY_DLQ = 'applicationSiemDeliveryDlq',\n  APPLICATION_SCIM_PROVISIONING_CONFIG = 'applicationScimProvisioningConfig',\n  APPLICATION_API_KEYS = 'applicationApiKeys',\n  OAUTH_CLIENTS_APPLICATION = 'applicationOAuthClients',\n  APPLICATION_METADATA = 'applicationMetadata',\n  APPLICATION_VERSIONS = 'applicationVersions',\n  APPLICATION_FEATURES = 'applicationFeatures',\n\n  // Billing Accounts — polymorphic variants (one per primary scope)\n  ORGANIZATION_BILLING_ACCOUNTS = 'organizationBillingAccounts',\n  USER_BILLING_ACCOUNTS = 'userBillingAccounts',\n\n  // Subscriptions — polymorphic variants (one per primary scope)\n  ORGANIZATION_SUBSCRIPTIONS = 'organizationSubscriptions',\n  USER_SUBSCRIPTIONS = 'userSubscriptions',\n\n  // Invoice Refs — polymorphic variants (one per primary scope)\n  ORGANIZATION_INVOICE_REFS = 'organizationInvoiceRefs',\n  USER_INVOICE_REFS = 'userInvoiceRefs',\n\n  // Usage Records — polymorphic variants (one per primary scope)\n  ORGANIZATION_USAGE_RECORDS = 'organizationUsageRecords',\n  USER_USAGE_RECORDS = 'userUsageRecords',\n\n  // Credit Pools — polymorphic variants (one per primary scope)\n  ORGANIZATION_CREDIT_POOLS = 'organizationCreditPools',\n  USER_CREDIT_POOLS = 'userCreditPools',\n\n  // Billing Resources — non-polymorphic (shared catalog)\n  PRODUCTS = 'products',\n  PRICES = 'prices',\n  PROMOTIONS = 'promotions',\n  REFERRALS = 'referrals',\n\n  // Audit and Compliance Resources\n  AUDIT_LOGS = 'auditLogs',\n  /**\n   * The APPLICATION-scoped door onto the SAME audit rows `AUDIT_LOGS` serves.\n   *\n   * `AUDIT_LOGS` is organization-scoped: its only route is\n   * `/organizations/{organizationId}/audit-logs`, so it can only ever return rows carrying that\n   * tenant. But a security event is frequently application-scoped BY NATURE — `logUserLogin` takes\n   * `organizationId` as OPTIONAL because at login no organization is selected, and the same holds\n   * for session eviction, token refresh and application-wide authentication-policy changes.\n   * Measured on a dogfood application (#317): 94 of 127 rows carried no organization and were\n   * therefore reachable through no API at all.\n   *\n   * This type is that missing door, and it is a SEPARATE type rather than a second route on\n   * `AUDIT_LOGS` because the URL combinator forbids the alternative: `generateParentCombinations`\n   * puts every `isPrimaryScope` and every `REQUIRES_CONTEXT` parent into EVERY combination, so\n   * routing `AUDIT_LOGS`' application edge would rewrite its organization route to\n   * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` and break every\n   * existing consumer. A sibling type with a single application parent takes the route it needs and\n   * leaves the organization door untouched.\n   *\n   * Both types address ONE row set through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES` — the\n   * mechanism `USER_SELF` already uses to address `USERS`' rows. Two doors, one record set: the\n   * organization door stays tenant-filtered, this one is `APP_ADMIN_SUPER_ADMIN`-only, and a read\n   * here that touches a tenant-attributed row emits `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, once per\n   * tenant reached. That emission is NOT inherited: `authorizeOrganizations`, where the event is\n   * otherwise raised, runs only for ORGANIZATIONS-scoped resources. Each read variant here declares\n   * `admitsCrossTenantPlatformAdministration`, and that declaration is what enrols the read in the\n   * trail (`security/authorizations/cross-tenant-read-observation.backend.ts`).\n   */\n  APPLICATION_AUDIT_LOGS = 'applicationAuditLogs',\n\n  // Notification Badges Resources — polymorphic dual-scope (USER + ORG).\n  // Each scope owns its own collection and its own access-control surface:\n  //   - USER variant: the user themselves reads/lists their badges; CREATE/UPDATE\n  //     are system-internal (driven by the dispatcher / batch services).\n  //   - ORG variant: org admins read/list their org's badges; CREATE/UPDATE are\n  //     system-internal.\n  // See `notifications/notification-badges.shared.resources-config.schemas.ts`.\n  USER_NOTIFICATION_BADGES = 'userNotificationBadges',\n  ORGANIZATION_NOTIFICATION_BADGES = 'organizationNotificationBadges',\n\n  // M2M Outbound Webhook Resources — polymorphic dual-scope (ORG + APP).\n  // See `notifications/m2m/webhook-config.shared.schemas.ts` and\n  // `notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts`.\n  ORGANIZATION_WEBHOOK_CONFIG = 'organizationWebhookConfig',\n  APPLICATION_WEBHOOK_CONFIG = 'applicationWebhookConfig',\n  ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG = 'organizationM2mWebhookDeliveryLog',\n  APPLICATION_M2M_WEBHOOK_DELIVERY_LOG = 'applicationM2mWebhookDeliveryLog',\n  // There is NO email equivalent of these two, and that is a DECISION rather than an oversight\n  // (#412, 2026-09-08). A sent email leaves log lines and nothing else — no resource, no delivery\n  // record — so \"did this customer receive it?\" is answered with the email provider's own tooling,\n  // never with Wildo. The asymmetry with these webhook logs is what makes the absence look\n  // accidental, which is why it is written down HERE as well as at the email service.\n  //\n  // The cost is not the table. A persisted email record carries retention policy, privacy\n  // classification, subject-export and erasure obligations FOR MESSAGE CONTENT — a new per-user\n  // personal-data store, for an answer a vendor already gives. A metadata-only variant (recipient,\n  // template, timestamp, provider id; no body) was available and also declined, because it is the\n  // same set of obligations over a smaller payload.\n\n  // File Management Resources\n  FILES = 'files',\n\n  // Queue/Job Resources (internal, repository-only)\n  JOB_EXECUTIONS = 'jobExecutions',\n  JOB_PAYLOAD_STORAGE = 'jobPayloadStorage',\n\n  // Authentication Resources\n  USER_IDENTITY_LINKS = 'userIdentityLinks',\n\n  // OIDC persistent consent grants (\"remember this app\") — USER_SELF-scoped, provider-side.\n  OAUTH_CONSENT_GRANTS = 'oauthConsentGrants',\n\n  // Anonymous Session Resources\n  ANONYMOUS_USERS = 'anonymous_users',\n\n  // Marketing / Lead Capture Resources (Phase 0.5 — public marketing site\n  // forms write here; APPLICATION-scoped, no isAnonymizable, see Q-E=B in\n  // .cursor/plans/saas-website-slice.md).\n  INBOUND_CONTACTS = 'inboundContacts',\n\n  // Guidance State Resources — dual-scope (USER / ORGANIZATION)\n  USER_GUIDANCE_STATE = 'userGuidanceState',\n  ORGANIZATION_GUIDANCE_STATE = 'organizationGuidanceState',\n\n  // Progression State Resources — dual-scope (USER / ORGANIZATION)\n  USER_PROGRESSION_STATE = 'userProgressionState',\n  ORGANIZATION_PROGRESSION_STATE = 'organizationProgressionState',\n\n  // Lifecycle State Resources — dual-scope (USER / ORGANIZATION)\n  USER_LIFECYCLE_STATE = 'userLifecycleState',\n  ORGANIZATION_LIFECYCLE_STATE = 'organizationLifecycleState',\n\n  // Flows-Actors Execution Resources — persisted flow/actor system executions\n  // (conversational message log + kind-discriminated runtime state). POLYMORPHIC\n  // across owner scope: one variant per scope, each owned by the injected owner FK.\n  // The user variant is WS chat + user-delegated A2A; the org/app variants are\n  // machine-owned (API-key / OIDC-client A2A). Written by the conversational\n  // runtime; read as chat history by the owner. Values MUST match the polymorphic\n  // derivation from `flowActorExecutionsPolymorphicDeclaration`.\n  USER_FLOW_ACTOR_EXECUTIONS = 'userFlowActorExecutions',\n  ORGANIZATION_FLOW_ACTOR_EXECUTIONS = 'organizationFlowActorExecutions',\n  APPLICATION_FLOW_ACTOR_EXECUTIONS = 'applicationFlowActorExecutions',\n\n  // Flows-Actors Task Resources — the persisted WORK record, deliberately a\n  // SEPARATE plane from the conversational execution above: executions own session\n  // history, tasks own an addressable/pollable/cancelable work lifecycle with its\n  // own status and artifacts. A task links back to an execution through a SOFT INDEXED\n  // FIELD (`flowActorExecutionId`), NOT a declared relationship of any kind — executions are\n  // polymorphic, so one foreign key would match no variant, and a declared edge would imply a\n  // cascade path that must not exist: a task has to OUTLIVE the conversation that produced it.\n  // (An earlier revision of this comment said \"REFERENCE, never COMPOSITION\", which read as a\n  // declared edge; no such relationship exists. The schema and the spec both describe the soft\n  // link correctly.) Derived from the canonical `Actors_Task_Schema`, mirroring how the\n  // platform persists `wildoApplicationActorTasks`. Surfaces the A2A `Task` object\n  // (`tasks/get` / `tasks/cancel`). Values MUST match the polymorphic derivation\n  // from `flowActorTasksPolymorphicDeclaration`.\n  USER_FLOW_ACTOR_TASKS = 'userFlowActorTasks',\n  ORGANIZATION_FLOW_ACTOR_TASKS = 'organizationFlowActorTasks',\n  APPLICATION_FLOW_ACTOR_TASKS = 'applicationFlowActorTasks',\n\n  // A2A Push Notification Delivery Log (polymorphic — one per owner scope).\n  // One row per (task state change × registered webhook), written BEFORE the delivery is\n  // attempted so an unreachable queue still leaves a trace. Scope set MUST mirror the task\n  // resources above: an owner with no delivery-log variant is an owner whose notifications\n  // cannot be recorded. Values MUST match the polymorphic derivation from\n  // `a2aPushDeliveryLogPolymorphicDeclaration`.\n  USER_A2A_PUSH_DELIVERY_LOG = 'userA2aPushDeliveryLog',\n  ORGANIZATION_A2A_PUSH_DELIVERY_LOG = 'organizationA2aPushDeliveryLog',\n  APPLICATION_A2A_PUSH_DELIVERY_LOG = 'applicationA2aPushDeliveryLog',\n\n  // A2A Token Budget State Resources (polymorphic SINGLETON — one per owner scope).\n  // Per-tenant, per-period LLM token-budget accumulator enforced on inbound A2A agent\n  // turns; written + read ONLY by the A2A runtime (via *AsSystem). Enum VALUES MUST match\n  // the polymorphic derivation from `a2aTokenBudgetStatePolymorphicDeclaration`\n  // (`toPascalCase('a2aTokenBudgetState')` = `A2aTokenBudgetState`, so the value is `A2a`).\n  USER_A2A_TOKEN_BUDGET_STATE = 'userA2aTokenBudgetState',\n  ORGANIZATION_A2A_TOKEN_BUDGET_STATE = 'organizationA2aTokenBudgetState',\n  APPLICATION_A2A_TOKEN_BUDGET_STATE = 'applicationA2aTokenBudgetState',\n}\n\n/**\n * The core resources the ENGINE'S OWN runtime reads, which an application may never exclude.\n *\n * `excludedResourceTypes` exists so an application can drop core vocabulary it does not use — the\n * billing-conditional resources it was built for, or, for a purpose-built console, most of the core\n * catalog. That freedom has one floor: a resource the engine itself reads to function.\n *\n * It is declared HERE, in the shared tier, because the floor has TWO enforcement sites in different\n * layers and they must never disagree: the frontend registry must REGISTER the resource, and the\n * backend serving that frontend must MOUNT its controller. A floor honoured on one side only fails\n * exactly as loudly as no floor at all — the workbench proved both halves in turn, first a registry\n * with no `user_self` entry, then a 404 on `/api/v1/user-self/:id/context`.\n *\n * `USER_SELF` is that floor today. `UserOrgsContext.restoreUserSession` reads it to build the\n * authenticated context after every login and every reload, and returns `false` when the registry\n * has no entry for it — on which the caller logs out \"to avoid a half-restored state\". So excluding\n * it does not degrade a feature; it makes authentication IMPOSSIBLE, in the most misleading way\n * available: `POST /auth/authenticate` answers 200 with a valid token, the very next request goes out\n * with no `Authorization` header, the 401 that follows is read as an expired session, and the user\n * lands back on the login form. The only trace is one `warn`.\n *\n * That is why this is a floor the engine ENFORCES rather than a line in an application's\n * documentation. An application cannot see this dependency — `restoreUserSession` is engine-internal\n * — so an exclusion set derived from the application's own vocabulary (which is the correct way to\n * write one) has no way to know it must carve this out. Measured on the application-creation\n * workbench, whose exclusion is derived exactly that way: login succeeded and bounced, every time.\n *\n * `ORGANIZATIONS` is deliberately NOT here. `loadOrganizations` also reads the registry, but it warns\n * and returns an empty list, so excluding it degrades the organization switcher and nothing else —\n * a legitimate choice for a console with no tenant vocabulary. The floor is what BREAKS when absent,\n * not everything the engine happens to read; a floor that grows past that would quietly re-impose the\n * whole core catalog on every application.\n */\nexport const ENGINE_RUNTIME_REQUIRED_RESOURCE_TYPES: ReadonlySet<string> = new Set<string>([\n  CoreResourceType.USER_SELF,\n]);\n\n\n/**\n * Set of all billing resource types.\n * Used by the resource exclusion mechanism to conditionally exclude\n * all billing resources when billing is disabled in app config.\n */\nexport const BILLING_RESOURCE_TYPES: ReadonlySet<CoreResourceType> = new Set([\n  // Polymorphic billing account variants\n  CoreResourceType.ORGANIZATION_BILLING_ACCOUNTS,\n  CoreResourceType.USER_BILLING_ACCOUNTS,\n  // Polymorphic subscription variants\n  CoreResourceType.ORGANIZATION_SUBSCRIPTIONS,\n  CoreResourceType.USER_SUBSCRIPTIONS,\n  // Polymorphic invoice ref variants\n  CoreResourceType.ORGANIZATION_INVOICE_REFS,\n  CoreResourceType.USER_INVOICE_REFS,\n  // Polymorphic usage record variants\n  CoreResourceType.ORGANIZATION_USAGE_RECORDS,\n  CoreResourceType.USER_USAGE_RECORDS,\n  // Polymorphic credit pool variants\n  CoreResourceType.ORGANIZATION_CREDIT_POOLS,\n  CoreResourceType.USER_CREDIT_POOLS,\n  // Non-polymorphic billing resources\n  CoreResourceType.PRODUCTS,\n  CoreResourceType.PRICES,\n  CoreResourceType.PROMOTIONS,\n  CoreResourceType.REFERRALS,\n]);\n\n/**\n * @wildo_source:part:start saas.models.resource-type facet:layer:shared facet:family:resource-config\n *\n * Resource Type Schema (Core + Custom)\n *\n * @remarks Import from `@wildo-ai/saas-models`. Custom app resources use\n * string literals beyond `CoreResourceType`.\n */\nexport const ResourceTypeSchema = z.union([\n  z.enum(CoreResourceType),\n  z.string() // Custom resource types\n]);\n\nexport type ResourceType = z.infer<typeof ResourceTypeSchema>;\n/** @wildo_source:part:end saas.models.resource-type */\n\n/**\n * When multiple resource types share the same field identifier (e.g., USERS and\n * USER_SELF both use \"userId\"), this map declares which resource type is the\n * canonical FK resolution target. Without this, the winner would depend on\n * relationship declaration order — a latent fragility.\n *\n * Used by both frontend and backend registry builds as a post-enrichment fixup.\n */\nexport const coreResourceShared_FieldIdentifierPriority: Record<string, CoreResourceType> = {\n    userId: CoreResourceType.USERS,\n};\n\nexport const coreResourceShared_FieldIdentifier: { [key in CoreResourceType]: string } = {\n    [CoreResourceType.ORGANIZATIONS]: 'organizationId',\n    [CoreResourceType.USERS]: 'userId',\n    [CoreResourceType.USER_CREDENTIALS]: 'userCredentialsId',\n    [CoreResourceType.USER_SELF]: 'userId', // Same as USERS but different context\n    [CoreResourceType.USER_PROFILES]: 'userProfileId',\n    [CoreResourceType.USER_PREFERENCES]: 'userPreferencesId',\n    [CoreResourceType.USER_SELF_PROFILES]: 'userSelfProfileId',\n    [CoreResourceType.USER_SELF_PREFERENCES]: 'userSelfPreferencesId',\n    [CoreResourceType.APPLICATION]: 'applicationId',\n    [CoreResourceType.APPLICATION_SSO_CONFIG]: 'applicationSsoConfigId',\n    [CoreResourceType.APPLICATION_SSO_CONNECTIONS]: 'applicationSsoConnectionId',\n    [CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG]: 'applicationSiemExportConfigId',\n    [CoreResourceType.APPLICATION_SIEM_DELIVERY_DLQ]: 'applicationSiemDeliveryDlqId',\n    [CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG]: 'applicationScimProvisioningConfigId',\n    [CoreResourceType.APPLICATION_METADATA]: 'applicationMetadataId',\n    [CoreResourceType.APPLICATION_VERSIONS]: 'applicationVersionId',\n    [CoreResourceType.APPLICATION_FEATURES]: 'applicationFeaturesId',\n\n    [CoreResourceType.ORGANIZATION_UNITS]: 'organizationUnitId',\n    [CoreResourceType.ORGANIZATION_PROFILES]: 'organizationProfileId',\n    [CoreResourceType.ORGANIZATION_PREFERENCES]: 'organizationPreferencesId',\n    [CoreResourceType.PLATFORM_ACCESS_GRANTS]: 'platformAccessGrantId',\n    [CoreResourceType.ORGANIZATION_NOTIFICATIONS]: 'organizationNotificationsId',\n    [CoreResourceType.ORGANIZATION_FEATURES]: 'organizationFeaturesId',\n    [CoreResourceType.USER_FEATURES]: 'userFeaturesId',\n    [CoreResourceType.ORGANIZATION_MEMBERS]: 'organizationMemberId',\n    [CoreResourceType.ORGANIZATION_UNIT_MEMBERS]: 'organizationUnitMemberId',\n\n    [CoreResourceType.ORG_API_KEYS]: 'orgApiKeyId',\n    [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: 'orgOAuthClientId',\n    [CoreResourceType.ORG_PROVIDER_CREDENTIALS]: 'orgProviderCredentialId',\n    [CoreResourceType.USER_PROVIDER_CREDENTIALS]: 'userProviderCredentialId',\n    [CoreResourceType.ORGANIZATION_SCIM_TOKENS]: 'organizationScimTokenId',\n    [CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG]: 'organizationScimProvisioningConfigId',\n    [CoreResourceType.APPLICATION_API_KEYS]: 'appApiKeyId',\n    [CoreResourceType.OAUTH_CLIENTS_APPLICATION]: 'appOAuthClientId',\n    // SSO Resources\n    [CoreResourceType.ORGANIZATION_SSO_CONNECTIONS]: 'organizationSsoConnectionId',\n    [CoreResourceType.ORGANIZATION_SSO_CONFIG]: 'organizationSsoConfigId',\n    // SIEM / Compliance Resources\n    [CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG]: 'organizationSiemExportConfigId',\n    [CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ]: 'organizationSiemDeliveryDlqId',\n\n    // Billing Accounts — polymorphic variants\n    [CoreResourceType.ORGANIZATION_BILLING_ACCOUNTS]: 'organizationBillingAccountId',\n    [CoreResourceType.USER_BILLING_ACCOUNTS]: 'userBillingAccountId',\n    // Subscriptions — polymorphic variants\n    [CoreResourceType.ORGANIZATION_SUBSCRIPTIONS]: 'organizationSubscriptionId',\n    [CoreResourceType.USER_SUBSCRIPTIONS]: 'userSubscriptionId',\n    // Invoice Refs — polymorphic variants\n    [CoreResourceType.ORGANIZATION_INVOICE_REFS]: 'organizationInvoiceRefId',\n    [CoreResourceType.USER_INVOICE_REFS]: 'userInvoiceRefId',\n    // Usage Records — polymorphic variants\n    [CoreResourceType.ORGANIZATION_USAGE_RECORDS]: 'organizationUsageRecordId',\n    [CoreResourceType.USER_USAGE_RECORDS]: 'userUsageRecordId',\n    // Credit Pools — polymorphic variants\n    [CoreResourceType.ORGANIZATION_CREDIT_POOLS]: 'organizationCreditPoolId',\n    [CoreResourceType.USER_CREDIT_POOLS]: 'userCreditPoolId',\n    // Non-polymorphic billing resources\n    [CoreResourceType.PRODUCTS]: 'productId',\n    [CoreResourceType.PRICES]: 'priceId',\n    [CoreResourceType.PROMOTIONS]: 'promotionId',\n    [CoreResourceType.REFERRALS]: 'referralId',\n    [CoreResourceType.AUDIT_LOGS]: 'auditLogId',\n    [CoreResourceType.APPLICATION_AUDIT_LOGS]: 'applicationAuditLogId',\n    // Notification Badges — polymorphic dual-scope variants\n    [CoreResourceType.USER_NOTIFICATION_BADGES]: 'userNotificationBadgeId',\n    [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: 'organizationNotificationBadgeId',\n    // M2M Outbound Webhook Resources — polymorphic dual-scope\n    [CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG]: 'organizationWebhookConfigId',\n    [CoreResourceType.APPLICATION_WEBHOOK_CONFIG]: 'applicationWebhookConfigId',\n    [CoreResourceType.ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG]: 'organizationM2mWebhookDeliveryLogId',\n    [CoreResourceType.APPLICATION_M2M_WEBHOOK_DELIVERY_LOG]: 'applicationM2mWebhookDeliveryLogId',\n    [CoreResourceType.FILES]: 'fileId',\n    [CoreResourceType.JOB_EXECUTIONS]: 'jobExecutionId',\n    [CoreResourceType.JOB_PAYLOAD_STORAGE]: 'jobPayloadStorageId',\n    [CoreResourceType.USER_IDENTITY_LINKS]: 'userIdentityLinkId',\n    [CoreResourceType.OAUTH_CONSENT_GRANTS]: 'oauthConsentGrantId',\n    // Anonymous Session Resources\n    [CoreResourceType.ANONYMOUS_USERS]: 'anonymousUserId',\n    // Marketing / Lead Capture Resources\n    [CoreResourceType.INBOUND_CONTACTS]: 'inboundContactId',\n    // Guidance State Resources\n    [CoreResourceType.USER_GUIDANCE_STATE]: 'userGuidanceStateId',\n    [CoreResourceType.ORGANIZATION_GUIDANCE_STATE]: 'organizationGuidanceStateId',\n    // Progression State Resources\n    [CoreResourceType.USER_PROGRESSION_STATE]: 'userProgressionStateId',\n    [CoreResourceType.ORGANIZATION_PROGRESSION_STATE]: 'organizationProgressionStateId',\n    // Lifecycle State Resources\n    [CoreResourceType.USER_LIFECYCLE_STATE]: 'userLifecycleStateId',\n    [CoreResourceType.ORGANIZATION_LIFECYCLE_STATE]: 'organizationLifecycleStateId',\n    // Flows-Actors Execution Resources (polymorphic — one per owner scope)\n    [CoreResourceType.USER_FLOW_ACTOR_EXECUTIONS]: 'userFlowActorExecutionId',\n    [CoreResourceType.ORGANIZATION_FLOW_ACTOR_EXECUTIONS]: 'organizationFlowActorExecutionId',\n    [CoreResourceType.APPLICATION_FLOW_ACTOR_EXECUTIONS]: 'applicationFlowActorExecutionId',\n    // Flows-Actors Task Resources (polymorphic — one per owner scope)\n    [CoreResourceType.USER_FLOW_ACTOR_TASKS]: 'userFlowActorTaskId',\n    [CoreResourceType.ORGANIZATION_FLOW_ACTOR_TASKS]: 'organizationFlowActorTaskId',\n    [CoreResourceType.APPLICATION_FLOW_ACTOR_TASKS]: 'applicationFlowActorTaskId',\n    // A2A Push Notification Delivery Log (polymorphic — one per owner scope)\n    [CoreResourceType.USER_A2A_PUSH_DELIVERY_LOG]: 'userA2aPushDeliveryLogId',\n    [CoreResourceType.ORGANIZATION_A2A_PUSH_DELIVERY_LOG]: 'organizationA2aPushDeliveryLogId',\n    [CoreResourceType.APPLICATION_A2A_PUSH_DELIVERY_LOG]: 'applicationA2aPushDeliveryLogId',\n    // A2A Token Budget State Resources (polymorphic singleton — one per owner scope)\n    [CoreResourceType.USER_A2A_TOKEN_BUDGET_STATE]: 'userA2aTokenBudgetStateId',\n    [CoreResourceType.ORGANIZATION_A2A_TOKEN_BUDGET_STATE]: 'organizationA2aTokenBudgetStateId',\n    [CoreResourceType.APPLICATION_A2A_TOKEN_BUDGET_STATE]: 'applicationA2aTokenBudgetStateId',\n};\n\n/**\n * @wildo_source:part:start saas.models.resource-field-identifier facet:layer:shared facet:family:resource-config\n *\n * FK / primary-key field identifier string for a resource (core or custom).\n *\n * @remarks Import from `@wildo-ai/saas-models`.\n */\nexport const ResourceFieldIdentifierSchema = z.union([\n  z.string().refine((value) => Object.values(coreResourceShared_FieldIdentifier).includes(value), {\n    message: \"Must be a valid core resource field identifier\"\n  }),\n  z.string() // Custom resource field identifiers\n]);\n\nexport type ResourceFieldIdentifier = z.infer<typeof ResourceFieldIdentifierSchema>;\n/** @wildo_source:part:end saas.models.resource-field-identifier */\n\n/**\n * Cascade direction for self-referencing relationships.\n * Used when resourceType1 === resourceType2 to disambiguate parent vs child.\n */\nexport enum CascadeDirection {\n  /** Standard parent→child — declaring resource is ancestor */\n  FORWARD = 'forward',\n  /** Reverse child→parent — related resource is ancestor */\n  BACKWARD = 'backward',\n}\n"]}

package/dist/esm/resources/resources.shared.schemas.d.ts

@@ -89,14 +89,23 @@ export declare enum ResourcePrimaryScope {
 /**
  * W7.3a: Controls how anonymous resources are handled during transposition
  * (when an anonymous user registers/logs in as an authenticated user).
+ *
+ * A `MERGE` member — "delegate to a custom service hook" — was declared here until 2026-09-08 and
+ * REMOVED because it never had one. `transposeOwnership` logged a warning and fell through to
+ * `ADD`, so a resource selecting it got plain reassignment and no application merge logic ever ran.
+ * It was selectable, validated, and silent: the shape this framework treats as a defect rather than
+ * a gap. Nothing selected it, so removing it needed no migration.
+ *
+ * Identity merge is not foreclosed, but it is not a member of this enum: it needs a per-resource
+ * hook that resolves conflicts an application defines, and a cross-resource transaction the
+ * framework does not have (see the note in `users.shared.resources-config.schemas.ts`). Re-add a
+ * member here when that primitive exists, not before.
  */
 export declare enum ResourceTranspositionPolicy {
     /** Simply reassign ownership (anonymousUserId → userId). No conflict check. Default. */
     ADD = "ADD",
     /** Delete the authenticated user's existing records of this type, then reassign anonymous ones. */
     REPLACE = "REPLACE",
-    /** Delegate to a custom service hook (app-developer-defined merge logic). */
-    MERGE = "MERGE",
     /** Skip transposition entirely — anonymous records are not carried over. */
     DISCARD = "DISCARD"
 }