npm - @wildo-ai/saas-models - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-models 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (410) hide show

package/dist/esm/applications/applications-context.schemas.d.ts CHANGED Viewed

@@ -147,6 +147,11 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
                     requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                     expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 }, z.core.$strip>>;
+                stepUpAuth: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                    methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").AuthMethod>>>>;
+                }, z.core.$strip>>;
             }, z.core.$strip>>;
             scimProvisioning: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodDefault<z.ZodBoolean>;
@@ -166,10 +171,6 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
         billing: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             providerRef: z.ZodOptional<z.ZodString>;
-            webhooks: z.ZodOptional<z.ZodObject<{
-                path: z.ZodDefault<z.ZodString>;
-                signingSecretRef: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
             defaultCurrency: z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>;
             supportedCurrencies: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>>;
             tax: z.ZodDefault<z.ZodObject<{
@@ -188,7 +189,7 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
                 defaultTrialDays: z.ZodDefault<z.ZodNumber>;
                 paymentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
                 maxPaymentRetries: z.ZodDefault<z.ZodNumber>;
-                defaultProration: z.ZodDefault<z.ZodEnum<typeof import("..").ProrationBehavior>>;
+                defaultProration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
                 defaultCancellation: z.ZodDefault<z.ZodEnum<typeof import("..").BillingTiming>>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
@@ -291,6 +292,7 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
         }, z.core.$strip>>;
         auditTrail: z.ZodOptional<z.ZodObject<{
             archiveAfterDays: z.ZodOptional<z.ZodNumber>;
+            allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
     metadata: z.ZodObject<{
@@ -453,6 +455,11 @@ export declare const ApplicationContextSchema: z.ZodObject<{
                     requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                     expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 }, z.core.$strip>>;
+                stepUpAuth: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                    methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").AuthMethod>>>>;
+                }, z.core.$strip>>;
             }, z.core.$strip>>;
             scimProvisioning: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodDefault<z.ZodBoolean>;
@@ -472,10 +479,6 @@ export declare const ApplicationContextSchema: z.ZodObject<{
         billing: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             providerRef: z.ZodOptional<z.ZodString>;
-            webhooks: z.ZodOptional<z.ZodObject<{
-                path: z.ZodDefault<z.ZodString>;
-                signingSecretRef: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
             defaultCurrency: z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>;
             supportedCurrencies: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>>;
             tax: z.ZodDefault<z.ZodObject<{
@@ -494,7 +497,7 @@ export declare const ApplicationContextSchema: z.ZodObject<{
                 defaultTrialDays: z.ZodDefault<z.ZodNumber>;
                 paymentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
                 maxPaymentRetries: z.ZodDefault<z.ZodNumber>;
-                defaultProration: z.ZodDefault<z.ZodEnum<typeof import("..").ProrationBehavior>>;
+                defaultProration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
                 defaultCancellation: z.ZodDefault<z.ZodEnum<typeof import("..").BillingTiming>>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
@@ -597,6 +600,7 @@ export declare const ApplicationContextSchema: z.ZodObject<{
         }, z.core.$strip>>;
         auditTrail: z.ZodOptional<z.ZodObject<{
             archiveAfterDays: z.ZodOptional<z.ZodNumber>;
+            allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;

package/dist/esm/applications/applications-context.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"applications-context.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications-context.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
1	+ {"version":3,"file":"applications-context.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications-context.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/applications/applications.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"applications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AA+E7E,KAAK,yBAAyB,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,sDAAsD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;~~kBAiNnH~~,CAAC"}
1	+ {"version":3,"file":"applications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AA+E7E,KAAK,yBAAyB,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,sDAAsD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;kBAkNnH,CAAC"}

package/dist/esm/applications/applications.shared.resources-config.schemas.js CHANGED Viewed

@@ -255,9 +255,10 @@ export const applicationResourceConfiguration_InitializationFactory = (resources
                     // deleting one destroys everything scoped beneath it. Same reasoning as
                     // `ORGANIZATIONS | DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`
                     // policy is opt-in, off by default, and freshness-satisfied — neither challenges the
-                    // caller here. Carries the same accepted audience limitation (re-auth is PASSWORD-only,
-                    // and directory-managed users have no password by design); see the note on
-                    // `ORGANIZATIONS | DELETE`.
+                    // caller here. Re-authentication itself accepts PASSWORD, an enrolled second factor
+                    // (TOTP or a backup code) and PASSKEY, so a directory-managed user whose local first
+                    // factor the framework destroys can still clear the gate through their second factor;
+                    // see the note on `ORGANIZATIONS | DELETE` for how that came about.
                     //
                     // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.
                     requiresStepUpAuthentication: true,

package/dist/esm/applications/applications.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"applications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAE7I,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,2CAA2C;AAC3C,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,mFAAmF;AACnF,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,mFAAmF;AACnF,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sEAAsE;AACtE,wFAAwF;AACxF,uFAAuF;AACvF,2FAA2F;AAC3F,gGAAgG;AAChG,6DAA6D;AAC7D,qFAAqF;AACrF,yFAAyF;AACzF,6FAA6F;AAC7F,qBAAqB;AACrB,0FAA0F;AAC1F,+EAA+E;AAC/E,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iGAAiG;AACjG,8DAA8D;AAC9D,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,yEAAyE;AACzE,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AACzF,kEAAkE;AAElE,MAAM,uBAAuB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE9D,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAUF;;EAEE;AACF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIlK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,yEAAyE;oBACzE,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,oCAAoC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4GAA4G;oBAChJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;oBACjD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,wEAAwE;oBACxE,sFAAsF;oBACtF,qFAAqF;oBACrF,wFAAwF;oBACxF,2EAA2E;oBAC3E,4BAA4B;oBAC5B,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0EAA0E;oBAC1E,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CAEF,CAAC,CAAC","sourcesContent":["/*\n Application Shared Resource Configuration\n \n Resource configuration for application management.\n * Supports both organization self-management and platform admin oversight.\n /\n\nimport { z } from 'zod';\nimport { ApplicationSchema } from './applications.shared.schemas';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for applications.\n//\n// CROSS-ORGANIZATION APPLICATION TRANSFER IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY.\n// `TRANSFER` was declared here in two variants (`ORG_ADMIN` default at `riskLevel: CRITICAL`, and\n// an `APP_ADMIN_SUPER_ADMIN` `admin` variant adding `bypassOwnerApproval`), taking\n// `{ targetOrganizationId, transferReason }`. Both were ROUTED but never implemented, so each\n// request fell through to the generic core UPDATE, which persists only fields the resource schema\n// declares. Neither `targetOrganizationId` nor `transferReason` is one, so every call answered\n// HTTP 200 having changed nothing* — an operator was told a CRITICAL cross-tenant move had\n// succeeded while the application stayed exactly where it was. Removed 2026-08-01.\n//\n// It was REMOVED rather than implemented on five independent grounds:\n//\n// 1. NO FIELD TO WRITE. `ApplicationSchema` carries no owning-organization field.\n// 2. NO RELATIONSHIP TO RE-POINT. The resources registry declares no\n// `ORGANIZATIONS → APPLICATION` edge; applications are not organization-owned here.\n// 3. THE OWNERSHIP DIRECTION IS INVERTED. `APPLICATION` is a top-level, self-anchored\n// `ResourcePrimaryScope`. The application IS the tenant container; organizations are a\n// sibling scope living inside its tenancy. \"Transferring\" the application to one of its own\n// organizations is incoherent, not merely unimplemented.\n// 4. WHERE ORGANIZATION OWNERSHIP DOES EXIST, IT IS ALREADY IMMUTABLE. The platform\n// app-factory's own application record binds `organizationId` at create and marks it\n// `excludeFromUpdate()` — a different resource, on a different service, already refusing\n// this mutation.\n// 5. FRAMEWORK PRECEDENT. Cross-organization MEMBER transfer is refused for exactly this\n// reason — a tenant-boundary crossing the framework does not sanction (see\n// `organization-members.shared.resources-config.schemas.ts`). An application is the tenant\n// container itself, so the argument applies with more force, not less.\n//\n// `bypassOwnerApproval` additionally named an approval flow that does not exist, and neither\n// variant emitted an audit event despite being cross-tenant and CRITICAL. Re-declaring an\n// application re-parenting verb would require, at minimum: a persisted ownership edge, an\n// approval flow for the flag to bypass, a custom implementation that writes the edge, and\n// audit/SIEM emission on both request and completion.\n//\n// APPLICATION STATUS LIFECYCLE IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY EITHER.\n// `ACTIVATE` and `SUSPEND` were declared here as `APP_ADMIN_SUPER_ADMIN` verbs (`MEDIUM` and\n// `CRITICAL` respectively, both with a generated bulk variant) taking `{ reason }` and\n// `{ suspensionReason, notifyOwners }`. Like TRANSFER they were ROUTED but never implemented, so\n// each fell through to the generic core UPDATE and answered HTTP 200 having changed nothing —\n// an operator was told a CRITICAL application suspension had taken effect while the application\n// kept serving. Removed 2026-08-01, on grounds that compound with TRANSFER's:\n//\n// 1. NO FIELD TO WRITE — and no plausible one. `ApplicationSchema` is\n// `{_id, appSlug, appDisplayName, lastVersion, platformAppId}`: an identity row, carrying no\n// lifecycle state at all. There is nothing to transition.\n// 2. THE LIFECYCLE IS OWNED ONE TIER UP. An application's real operational state lives at the\n// platform tier (`PLATFORM_APPLICATIONS` / `Wildo_Application_Config`), provisioned and\n// managed by the platform apps-manager. This row is the in-app registry entry an application\n// reads to know its own identity — halting an application is a platform-tier action, not a\n// self-service field flip on the application's own copy of its name.\n// 3. SAME INVERTED OWNERSHIP AS TRANSFER (ground 3 above). `APPLICATION` is a top-level\n// `ResourcePrimaryScope`; suspending the tenant container from inside its own tenancy is\n// incoherent, and the suspending super-admin's own session lives in that container.\n//\n// The resource specification's framing — \"Created per org, managed by admins, and may be\n// transferred or suspended under governance\", with 409s for destination-org slug collisions —\n// describes a per-organization application marketplace. The framework does not implement one, and\n// inventing an `ApplicationStatus` to satisfy two unimplemented buttons would have built that\n// model backwards from its UI. Re-declaring these verbs requires the ownership model first.\n//\n// Applications consequently declare NO custom operations (hence the `undefined` custom-operation\n// type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and\n// `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n\nconst APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];\n\nconst APPLICATION_FILTER_FIELDS = {\n appSlug: z.string(),\n appDisplayName: z.string(),\n};\n\ntype ApplicationCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE;\n\n/\nApplications Resource Configuration Factory\n/\nexport const applicationResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n undefined,\n ApplicationCoreOperations,\n typeof ApplicationSchema\n>({\n mainSchema: ApplicationSchema,\n resourceIdentifier: CoreResourceType.APPLICATION,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Applications are core system resources\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE\n ],\n\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can create applications\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // Use database definition so platformAppId and lastVersion are preserved\n // requestDto auto-derived from decorators\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can create applications for any org\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can view any application\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n /*\n ⚠️ NOTHING CONFINES THIS QUERY — and that is safe for a reason worth stating, because the\n * comment on the default variant used to imply a mechanism that does not exist.\n \n `applications` is its own scope ROOT, so both repositories blacklist the APPLICATIONS axis and\n * this LIST compiles to the EMPTY filter (measured 2026-08-12,\n * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep). The\n * old wording — \"Org members can list their applications\" — is exactly the shape of the claim\n * that was FALSE on `organizations` and cost a full tenant-isolation investigation, one role tier\n * higher.\n \n What makes it safe here is ARCHITECTURE, not a predicate: one database per application.\n * \"An application's organizations live in that application's own database\"\n * (`organizations.shared.schemas.ts`, on `slug` uniqueness), so this collection holds that\n * application's own row and a caller can only ever see the application they are already using.\n * Measured: an ordinary `ORG_MEMBER` receives 1 of 1 rows, projected to four summary fields.\n \n So the two variants below differ in ROLE, not in reach — `admin` exists for the fields and\n * operations it unlocks elsewhere, not because it sees more rows here.\n \n ⚠️ This rests on the one-database-per-application invariant. `CREATE` is super-admin gated, so\n * a second application row COULD be written into this database; if that ever becomes a real\n * deployment shape, this resource inherits the `organizations` defect at the `ORG_MEMBER` tier\n * and must be confined on `initiatorIds.applicationId`. Tracked as SEC-SCOPEROOT-3.\n */\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Unconfined by construction; safe because the collection holds this application only — see the block above\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can list all applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'slug'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ]\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update their applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n // requestDto auto-derived from decorators\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can update any application\n riskLevel: ResourceOperationRiskLevel.LOW,\n // requestDto auto-derived from decorators\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can delete their applications\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n // An APPLICATION is a top-level scope in this framework, not an org-owned artifact, so\n // deleting one destroys everything scoped beneath it. Same reasoning as\n // `ORGANIZATIONS \| DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`\n // policy is opt-in, off by default, and freshness-satisfied — neither challenges the\n // caller here. Carries the same accepted audience limitation (re-auth is PASSWORD-only,\n // and directory-managed users have no password by design); see the note on\n // `ORGANIZATIONS \| DELETE`.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n requiresStepUpAuthentication: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can delete any application\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-VARIANT flag — nothing is inherited from the default variant above.\n requiresStepUpAuthentication: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n }\n },\n\n});\n"]}
1	+ {"version":3,"file":"applications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAE7I,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,2CAA2C;AAC3C,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,mFAAmF;AACnF,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,mFAAmF;AACnF,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sEAAsE;AACtE,wFAAwF;AACxF,uFAAuF;AACvF,2FAA2F;AAC3F,gGAAgG;AAChG,6DAA6D;AAC7D,qFAAqF;AACrF,yFAAyF;AACzF,6FAA6F;AAC7F,qBAAqB;AACrB,0FAA0F;AAC1F,+EAA+E;AAC/E,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iGAAiG;AACjG,8DAA8D;AAC9D,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,yEAAyE;AACzE,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AACzF,kEAAkE;AAElE,MAAM,uBAAuB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE9D,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAUF;;EAEE;AACF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIlK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,yEAAyE;oBACzE,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,oCAAoC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4GAA4G;oBAChJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;oBACjD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,wEAAwE;oBACxE,sFAAsF;oBACtF,qFAAqF;oBACrF,oFAAoF;oBACpF,qFAAqF;oBACrF,sFAAsF;oBACtF,oEAAoE;oBACpE,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0EAA0E;oBAC1E,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CAEF,CAAC,CAAC","sourcesContent":["/*\n Application Shared Resource Configuration\n \n Resource configuration for application management.\n * Supports both organization self-management and platform admin oversight.\n /\n\nimport { z } from 'zod';\nimport { ApplicationSchema } from './applications.shared.schemas';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for applications.\n//\n// CROSS-ORGANIZATION APPLICATION TRANSFER IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY.\n// `TRANSFER` was declared here in two variants (`ORG_ADMIN` default at `riskLevel: CRITICAL`, and\n// an `APP_ADMIN_SUPER_ADMIN` `admin` variant adding `bypassOwnerApproval`), taking\n// `{ targetOrganizationId, transferReason }`. Both were ROUTED but never implemented, so each\n// request fell through to the generic core UPDATE, which persists only fields the resource schema\n// declares. Neither `targetOrganizationId` nor `transferReason` is one, so every call answered\n// HTTP 200 having changed nothing* — an operator was told a CRITICAL cross-tenant move had\n// succeeded while the application stayed exactly where it was. Removed 2026-08-01.\n//\n// It was REMOVED rather than implemented on five independent grounds:\n//\n// 1. NO FIELD TO WRITE. `ApplicationSchema` carries no owning-organization field.\n// 2. NO RELATIONSHIP TO RE-POINT. The resources registry declares no\n// `ORGANIZATIONS → APPLICATION` edge; applications are not organization-owned here.\n// 3. THE OWNERSHIP DIRECTION IS INVERTED. `APPLICATION` is a top-level, self-anchored\n// `ResourcePrimaryScope`. The application IS the tenant container; organizations are a\n// sibling scope living inside its tenancy. \"Transferring\" the application to one of its own\n// organizations is incoherent, not merely unimplemented.\n// 4. WHERE ORGANIZATION OWNERSHIP DOES EXIST, IT IS ALREADY IMMUTABLE. The platform\n// app-factory's own application record binds `organizationId` at create and marks it\n// `excludeFromUpdate()` — a different resource, on a different service, already refusing\n// this mutation.\n// 5. FRAMEWORK PRECEDENT. Cross-organization MEMBER transfer is refused for exactly this\n// reason — a tenant-boundary crossing the framework does not sanction (see\n// `organization-members.shared.resources-config.schemas.ts`). An application is the tenant\n// container itself, so the argument applies with more force, not less.\n//\n// `bypassOwnerApproval` additionally named an approval flow that does not exist, and neither\n// variant emitted an audit event despite being cross-tenant and CRITICAL. Re-declaring an\n// application re-parenting verb would require, at minimum: a persisted ownership edge, an\n// approval flow for the flag to bypass, a custom implementation that writes the edge, and\n// audit/SIEM emission on both request and completion.\n//\n// APPLICATION STATUS LIFECYCLE IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY EITHER.\n// `ACTIVATE` and `SUSPEND` were declared here as `APP_ADMIN_SUPER_ADMIN` verbs (`MEDIUM` and\n// `CRITICAL` respectively, both with a generated bulk variant) taking `{ reason }` and\n// `{ suspensionReason, notifyOwners }`. Like TRANSFER they were ROUTED but never implemented, so\n// each fell through to the generic core UPDATE and answered HTTP 200 having changed nothing —\n// an operator was told a CRITICAL application suspension had taken effect while the application\n// kept serving. Removed 2026-08-01, on grounds that compound with TRANSFER's:\n//\n// 1. NO FIELD TO WRITE — and no plausible one. `ApplicationSchema` is\n// `{_id, appSlug, appDisplayName, lastVersion, platformAppId}`: an identity row, carrying no\n// lifecycle state at all. There is nothing to transition.\n// 2. THE LIFECYCLE IS OWNED ONE TIER UP. An application's real operational state lives at the\n// platform tier (`PLATFORM_APPLICATIONS` / `Wildo_Application_Config`), provisioned and\n// managed by the platform apps-manager. This row is the in-app registry entry an application\n// reads to know its own identity — halting an application is a platform-tier action, not a\n// self-service field flip on the application's own copy of its name.\n// 3. SAME INVERTED OWNERSHIP AS TRANSFER (ground 3 above). `APPLICATION` is a top-level\n// `ResourcePrimaryScope`; suspending the tenant container from inside its own tenancy is\n// incoherent, and the suspending super-admin's own session lives in that container.\n//\n// The resource specification's framing — \"Created per org, managed by admins, and may be\n// transferred or suspended under governance\", with 409s for destination-org slug collisions —\n// describes a per-organization application marketplace. The framework does not implement one, and\n// inventing an `ApplicationStatus` to satisfy two unimplemented buttons would have built that\n// model backwards from its UI. Re-declaring these verbs requires the ownership model first.\n//\n// Applications consequently declare NO custom operations (hence the `undefined` custom-operation\n// type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and\n// `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n\nconst APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];\n\nconst APPLICATION_FILTER_FIELDS = {\n appSlug: z.string(),\n appDisplayName: z.string(),\n};\n\ntype ApplicationCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE;\n\n/\nApplications Resource Configuration Factory\n/\nexport const applicationResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n undefined,\n ApplicationCoreOperations,\n typeof ApplicationSchema\n>({\n mainSchema: ApplicationSchema,\n resourceIdentifier: CoreResourceType.APPLICATION,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Applications are core system resources\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE\n ],\n\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can create applications\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // Use database definition so platformAppId and lastVersion are preserved\n // requestDto auto-derived from decorators\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can create applications for any org\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can view any application\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n /*\n ⚠️ NOTHING CONFINES THIS QUERY — and that is safe for a reason worth stating, because the\n * comment on the default variant used to imply a mechanism that does not exist.\n \n `applications` is its own scope ROOT, so both repositories blacklist the APPLICATIONS axis and\n * this LIST compiles to the EMPTY filter (measured 2026-08-12,\n * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep). The\n * old wording — \"Org members can list their applications\" — is exactly the shape of the claim\n * that was FALSE on `organizations` and cost a full tenant-isolation investigation, one role tier\n * higher.\n \n What makes it safe here is ARCHITECTURE, not a predicate: one database per application.\n * \"An application's organizations live in that application's own database\"\n * (`organizations.shared.schemas.ts`, on `slug` uniqueness), so this collection holds that\n * application's own row and a caller can only ever see the application they are already using.\n * Measured: an ordinary `ORG_MEMBER` receives 1 of 1 rows, projected to four summary fields.\n \n So the two variants below differ in ROLE, not in reach — `admin` exists for the fields and\n * operations it unlocks elsewhere, not because it sees more rows here.\n \n ⚠️ This rests on the one-database-per-application invariant. `CREATE` is super-admin gated, so\n * a second application row COULD be written into this database; if that ever becomes a real\n * deployment shape, this resource inherits the `organizations` defect at the `ORG_MEMBER` tier\n * and must be confined on `initiatorIds.applicationId`. Tracked as SEC-SCOPEROOT-3.\n */\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Unconfined by construction; safe because the collection holds this application only — see the block above\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can list all applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'slug'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ]\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update their applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n // requestDto auto-derived from decorators\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can update any application\n riskLevel: ResourceOperationRiskLevel.LOW,\n // requestDto auto-derived from decorators\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can delete their applications\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n // An APPLICATION is a top-level scope in this framework, not an org-owned artifact, so\n // deleting one destroys everything scoped beneath it. Same reasoning as\n // `ORGANIZATIONS \| DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`\n // policy is opt-in, off by default, and freshness-satisfied — neither challenges the\n // caller here. Re-authentication itself accepts PASSWORD, an enrolled second factor\n // (TOTP or a backup code) and PASSKEY, so a directory-managed user whose local first\n // factor the framework destroys can still clear the gate through their second factor;\n // see the note on `ORGANIZATIONS \| DELETE` for how that came about.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n requiresStepUpAuthentication: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can delete any application\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-VARIANT flag — nothing is inherited from the default variant above.\n requiresStepUpAuthentication: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n }\n },\n\n});\n"]}

package/dist/esm/billing/billing-configuration.shared.schemas.d.ts CHANGED Viewed

@@ -13,10 +13,6 @@ import { TaxCalculationMode, TaxDisplayMode, ProrationBehavior, BillingTiming }
 export declare const BillingConfigurationSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     providerRef: z.ZodOptional<z.ZodString>;
-    webhooks: z.ZodOptional<z.ZodObject<{
-        path: z.ZodDefault<z.ZodString>;
-        signingSecretRef: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
     defaultCurrency: z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>;
     supportedCurrencies: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>>;
     tax: z.ZodDefault<z.ZodObject<{

package/dist/esm/billing/billing-configuration.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"billing-configuration.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACd,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,0BAA0B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4FrC~~,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
1	+ {"version":3,"file":"billing-configuration.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACd,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;iBAsIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/esm/billing/billing-configuration.shared.schemas.js CHANGED Viewed

@@ -16,23 +16,41 @@ export const BillingConfigurationSchema = z.object({
     enabled: z.boolean().default(false),
     /** Which billing provider to use (e.g., 'stripe') */
     providerRef: z.string().optional(),
-    /** Webhook configuration */
-    webhooks: z.object({
-        /** Path for billing webhook endpoint */
-        path: z.string().default('/api/v1/webhooks/billing'),
-        /** Reference to the webhook signing secret (resolved from secrets at runtime) */
-        signingSecretRef: z.string().optional(),
-    }).optional(),
-    /** Default ISO 4217 currency for new billing accounts / products */
+    /*
+     * NO `webhooks` block. `path` and `signingSecretRef` were declared here and read by NOTHING —
+     * `signingSecretRef` had zero references outside its own declaration — and they were removed on
+     * 2026-09-08 (#408) rather than relabelled, because unlike the commercial-intent keys below they
+     * were not even an input to anything.
+     *
+     * The route and the signing secret both come from the provider module's `WEBHOOK_ORIGINATOR`
+     * contract: `buildWebhookEndpoints` mounts it at `/api/v1/webhooks/<provider>/billing`. That is
+     * the single authority, and `webhook-auto-controller.backend.service.ts` already recorded the
+     * same conclusion when endpoint-level path/secret extras were dropped as dead in the 2026-05-06
+     * reshape. This block was the copy that survived that sweep.
+     */
+    /**
+     * DECLARATION-ONLY (#408, 2026-09-08). Read by the application-creation commercial-model brief and
+     * by no runtime billing path: nothing validates a product's currency against these, and what
+     * reaches the provider is each price's own `currency`. Authoring them records the commercial
+     * intent a reviewer reads; it enforces nothing.
+     */
     defaultCurrency: CurrencySchema.default('USD'),
-    /** Supported currencies (for multi-currency apps) */
+    /** DECLARATION-ONLY — see `defaultCurrency`. */
     supportedCurrencies: z.array(CurrencySchema).default(['USD']),
     /**
      * Tax configuration — calculation is ALWAYS delegated to provider (Stripe Tax, etc.).
      * We never calculate tax locally.
      */
     tax: z.object({
-        /** How the provider handles tax calculation */
+        /**
+         * Whether the PROVIDER computes tax on a purchase. READ since 2026-09-08 (#408): the checkout
+         * path — the only production purchase route — sends `automaticTax` from this value.
+         *
+         * It reached nothing before that, so `PROVIDER_MANAGED` changed no behaviour and the provider
+         * account's own configuration silently decided. Enabling it changes invoice totals and the tax
+         * amounts persisted against them, which is why it is a decision an application makes rather
+         * than a default the framework picks.
+         */
         calculationMode: z.enum(TaxCalculationMode).default(TaxCalculationMode.DISABLED),
         /**
          * How prices are DISPLAYED to users (does not affect provider calculation).
@@ -41,7 +59,10 @@ export const BillingConfigurationSchema = z.object({
          * - 'inclusive': Prices shown including tax (TTC / inc-VAT). Tax is embedded.
          *   Common for consumer-facing. Shows "€49/mo TTC" and tax is extracted at checkout.
          *
-         * Overridable per product (product.taxDisplayMode) and per price (price.taxBehavior).
+         * DECLARATIVE ONLY: nothing reads this value. It is not an application-wide default that
+         * `product.taxDisplayMode` and `price.taxBehavior` override, because there is no resolution
+         * chain between the three. What reaches the billing provider is each price's own
+         * `taxBehavior`, and only that.
          */
         defaultDisplayMode: z.enum(TaxDisplayMode).default(TaxDisplayMode.EXCLUSIVE),
     }).default(() => ({
@@ -58,7 +79,12 @@ export const BillingConfigurationSchema = z.object({
      * Controls whether the promotions subsystem is active.
      */
     promotions: z.object({
-        /** Whether promotions/coupons are enabled */
+        /**
+         * DECLARATION-ONLY (#408, 2026-09-08), and the sharpest of them: the promotions subsystem runs
+         * UNCONDITIONALLY. Promotion codes are applied at `billing-account.mutations` and resolved in
+         * `billing-state`, neither of which consults this flag — so setting it `false` disables
+         * nothing, which is a stronger statement than "is not read".
+         */
         enabled: z.boolean().default(true),
     }).default(() => ({
         enabled: true,
@@ -68,7 +94,10 @@ export const BillingConfigurationSchema = z.object({
      * Controls whether credit pools are enabled and defines default pool behavior.
      */
     creditPools: z.object({
-        /** Whether credit pool functionality is enabled (auto-creation on CREDIT_PACK purchase) */
+        /**
+         * DECLARATION-ONLY (#408, 2026-09-08) — same shape as `promotions.enabled` above, and the same
+         * correction: credit pools run unconditionally in `billing-state`, so `false` disables nothing.
+         */
         enabled: z.boolean().default(true),
         /** Default initial balance for auto-created pools (default 0) */
         defaultInitialBalance: z.number().min(0).default(0),
@@ -80,13 +109,26 @@ export const BillingConfigurationSchema = z.object({
     defaultBehaviorPolicy: z.object({
         /** Default trial days for new subscriptions (0 = no trial) */
         defaultTrialDays: z.number().min(0).default(0),
-        /** Grace period before marking subscription as past_due after failed payment */
+        /**
+         * DECLARATION-ONLY (#408, 2026-09-08). Dunning — how long to wait and how often to retry after a
+         * failed payment — is configured at the PROVIDER, on its own schedule, and nothing here reaches
+         * it. Binding them would mean writing a provider's retry settings from application config, which
+         * is a different feature from reading a policy at a call site.
+         */
         paymentGracePeriodDays: z.number().min(0).default(3),
-        /** Maximum automatic payment retries before giving up */
+        /** DECLARATION-ONLY — see `paymentGracePeriodDays`. */
         maxPaymentRetries: z.number().min(0).default(3),
-        /** Default proration when no product-specific policy */
+        /** Default proration when no product-specific policy. READ by the change-plan path. */
         defaultProration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),
-        /** Default cancellation behavior */
+        /**
+         * Default cancellation timing when neither the caller nor the plan product names one.
+         *
+         * READ since 2026-09-08 (#408). It was dead until then, and it is bound rather than relabelled
+         * because — unlike its neighbours above — it needs no provider call at all: cancellation timing
+         * is resolved locally, so the only thing standing between this key and meaning something was a
+         * reader. The chain is caller → product `behaviorPolicy.cancellation.defaultBehavior` → this →
+         * period-end.
+         */
         defaultCancellation: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),
     }).default(() => ({
         defaultTrialDays: 0,

package/dist/esm/billing/billing-configuration.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"billing-configuration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sDAAsD;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,4BAA4B;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,wCAAwC;QACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;QACpD,iFAAiF;QACjF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,oEAAoE;IACpE,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IAE7D;;;OAGG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,+CAA+C;QAC/C,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QAEhF;;;;;;;;WAQG;QACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;KAC7E,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,eAAe,EAAE,kBAAkB,CAAC,QAAQ;QAC5C,kBAAkB,EAAE,cAAc,CAAC,SAAS;KAC7C,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAElG;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,6CAA6C;QAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,2FAA2F;QAC3F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,iEAAiE;QACjE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACpD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC;IAEH,uFAAuF;IACvF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,8DAA8D;QAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,gFAAgF;QAChF,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,yDAAyD;QACzD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,wDAAwD;QACxD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACxF,oCAAoC;QACpC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAChF,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB;QACrD,mBAAmB,EAAE,aAAa,CAAC,aAAa;KACjD,CAAC,CAAC;CACJ,CAAC,CAAC","sourcesContent":["/*\n Billing Configuration Schema (Shared)\n \n Top-level billing configuration that custom apps provide at startup.\n * Controls: provider selection, currency, tax policy, enabled scopes,\n * and default behavior policies.\n \n @see billing-and-features-system.md §6.7 (Billing Configuration)\n /\n\nimport { z } from 'zod';\nimport { CurrencySchema } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n TaxCalculationMode,\n TaxDisplayMode,\n ProrationBehavior,\n BillingTiming,\n} from './billing-enums.shared.schemas';\n\nexport const BillingConfigurationSchema = z.object({\n /* Master switch: is billing enabled for this app? /\n enabled: z.boolean().default(false),\n /* Which billing provider to use (e.g., 'stripe') /\n providerRef: z.string().optional(),\n\n /* Webhook configuration /\n webhooks: z.object({\n /* Path for billing webhook endpoint /\n path: z.string().default('/api/v1/webhooks/billing'),\n /* Reference to the webhook signing secret (resolved from secrets at runtime) /\n signingSecretRef: z.string().optional(),\n }).optional(),\n\n /* Default ISO 4217 currency for new billing accounts / products /\n defaultCurrency: CurrencySchema.default('USD'),\n /* Supported currencies (for multi-currency apps) /\n supportedCurrencies: z.array(CurrencySchema).default(['USD']),\n\n /\n Tax configuration — calculation is ALWAYS delegated to provider (Stripe Tax, etc.).\n * We never calculate tax locally.\n /\n tax: z.object({\n /* How the provider handles tax calculation /\n calculationMode: z.enum(TaxCalculationMode).default(TaxCalculationMode.DISABLED),\n\n /\n How prices are DISPLAYED to users (does not affect provider calculation).\n * - 'exclusive': Prices shown excluding tax (HT / ex-VAT). Tax added at checkout.\n * Common for B2B. Shows \"$49/mo\" and tax is added separately.\n * - 'inclusive': Prices shown including tax (TTC / inc-VAT). Tax is embedded.\n * Common for consumer-facing. Shows \"€49/mo TTC\" and tax is extracted at checkout.\n \n Overridable per product (product.taxDisplayMode) and per price (price.taxBehavior).\n /\n defaultDisplayMode: z.enum(TaxDisplayMode).default(TaxDisplayMode.EXCLUSIVE),\n }).default(() => ({\n calculationMode: TaxCalculationMode.DISABLED,\n defaultDisplayMode: TaxDisplayMode.EXCLUSIVE,\n })),\n\n /\n Which scopes can have billing accounts (default: ORGANIZATIONS only).\n * Can be extended to include USER_SELF (personal billing).\n /\n enabledScopes: z.array(z.enum(ResourcePrimaryScope)).default([ResourcePrimaryScope.ORGANIZATIONS]),\n\n /\n Promotions configuration.\n * Controls whether the promotions subsystem is active.\n /\n promotions: z.object({\n /* Whether promotions/coupons are enabled /\n enabled: z.boolean().default(true),\n }).default(() => ({\n enabled: true,\n })),\n\n /\n Credit pool configuration.\n * Controls whether credit pools are enabled and defines default pool behavior.\n /\n creditPools: z.object({\n /* Whether credit pool functionality is enabled (auto-creation on CREDIT_PACK purchase) /\n enabled: z.boolean().default(true),\n /* Default initial balance for auto-created pools (default 0) /\n defaultInitialBalance: z.number().min(0).default(0),\n }).default(() => ({\n enabled: true,\n defaultInitialBalance: 0,\n })),\n\n /* Global billing policy defaults (overridden by ProductBehaviorPolicy per product) /\n defaultBehaviorPolicy: z.object({\n /* Default trial days for new subscriptions (0 = no trial) /\n defaultTrialDays: z.number().min(0).default(0),\n /* Grace period before marking subscription as past_due after failed payment /\n paymentGracePeriodDays: z.number().min(0).default(3),\n /* Maximum automatic payment retries before giving up /\n maxPaymentRetries: z.number().min(0).default(3),\n /* Default proration when no product-specific policy /\n defaultProration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n /* Default cancellation behavior */\n defaultCancellation: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n }).default(() => ({\n defaultTrialDays: 0,\n paymentGracePeriodDays: 3,\n maxPaymentRetries: 3,\n defaultProration: ProrationBehavior.CREATE_PRORATIONS,\n defaultCancellation: BillingTiming.AT_PERIOD_END,\n })),\n});\nexport type BillingConfiguration = z.infer<typeof BillingConfigurationSchema>;\n"]}
1	+ {"version":3,"file":"billing-configuration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sDAAsD;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC;;;;;;;;;;;OAWG;IAEH;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,gDAAgD;IAChD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IAE7D;;;OAGG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ;;;;;;;;WAQG;QACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QAEhF;;;;;;;;;;;WAWG;QACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;KAC7E,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,eAAe,EAAE,kBAAkB,CAAC,QAAQ;QAC5C,kBAAkB,EAAE,cAAc,CAAC,SAAS;KAC7C,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAElG;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB;;;;;WAKG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB;;;WAGG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,iEAAiE;QACjE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACpD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC;IAEH,uFAAuF;IACvF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,8DAA8D;QAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C;;;;;WAKG;QACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,uDAAuD;QACvD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,uFAAuF;QACvF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACxF;;;;;;;;WAQG;QACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAChF,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB;QACrD,mBAAmB,EAAE,aAAa,CAAC,aAAa;KACjD,CAAC,CAAC;CACJ,CAAC,CAAC","sourcesContent":["/*\n Billing Configuration Schema (Shared)\n \n Top-level billing configuration that custom apps provide at startup.\n * Controls: provider selection, currency, tax policy, enabled scopes,\n * and default behavior policies.\n \n @see billing-and-features-system.md §6.7 (Billing Configuration)\n /\n\nimport { z } from 'zod';\nimport { CurrencySchema } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n TaxCalculationMode,\n TaxDisplayMode,\n ProrationBehavior,\n BillingTiming,\n} from './billing-enums.shared.schemas';\n\nexport const BillingConfigurationSchema = z.object({\n /* Master switch: is billing enabled for this app? /\n enabled: z.boolean().default(false),\n /* Which billing provider to use (e.g., 'stripe') /\n providerRef: z.string().optional(),\n\n /\n * NO `webhooks` block. `path` and `signingSecretRef` were declared here and read by NOTHING —\n * `signingSecretRef` had zero references outside its own declaration — and they were removed on\n * 2026-09-08 (#408) rather than relabelled, because unlike the commercial-intent keys below they\n * were not even an input to anything.\n \n The route and the signing secret both come from the provider module's `WEBHOOK_ORIGINATOR`\n * contract: `buildWebhookEndpoints` mounts it at `/api/v1/webhooks/<provider>/billing`. That is\n * the single authority, and `webhook-auto-controller.backend.service.ts` already recorded the\n * same conclusion when endpoint-level path/secret extras were dropped as dead in the 2026-05-06\n * reshape. This block was the copy that survived that sweep.\n /\n\n /\n DECLARATION-ONLY (#408, 2026-09-08). Read by the application-creation commercial-model brief and\n * by no runtime billing path: nothing validates a product's currency against these, and what\n * reaches the provider is each price's own `currency`. Authoring them records the commercial\n * intent a reviewer reads; it enforces nothing.\n /\n defaultCurrency: CurrencySchema.default('USD'),\n /* DECLARATION-ONLY — see `defaultCurrency`. /\n supportedCurrencies: z.array(CurrencySchema).default(['USD']),\n\n /\n Tax configuration — calculation is ALWAYS delegated to provider (Stripe Tax, etc.).\n * We never calculate tax locally.\n /\n tax: z.object({\n /\n Whether the PROVIDER computes tax on a purchase. READ since 2026-09-08 (#408): the checkout\n * path — the only production purchase route — sends `automaticTax` from this value.\n \n It reached nothing before that, so `PROVIDER_MANAGED` changed no behaviour and the provider\n * account's own configuration silently decided. Enabling it changes invoice totals and the tax\n * amounts persisted against them, which is why it is a decision an application makes rather\n * than a default the framework picks.\n /\n calculationMode: z.enum(TaxCalculationMode).default(TaxCalculationMode.DISABLED),\n\n /\n How prices are DISPLAYED to users (does not affect provider calculation).\n * - 'exclusive': Prices shown excluding tax (HT / ex-VAT). Tax added at checkout.\n * Common for B2B. Shows \"$49/mo\" and tax is added separately.\n * - 'inclusive': Prices shown including tax (TTC / inc-VAT). Tax is embedded.\n * Common for consumer-facing. Shows \"€49/mo TTC\" and tax is extracted at checkout.\n \n DECLARATIVE ONLY: nothing reads this value. It is not an application-wide default that\n * `product.taxDisplayMode` and `price.taxBehavior` override, because there is no resolution\n * chain between the three. What reaches the billing provider is each price's own\n * `taxBehavior`, and only that.\n /\n defaultDisplayMode: z.enum(TaxDisplayMode).default(TaxDisplayMode.EXCLUSIVE),\n }).default(() => ({\n calculationMode: TaxCalculationMode.DISABLED,\n defaultDisplayMode: TaxDisplayMode.EXCLUSIVE,\n })),\n\n /\n Which scopes can have billing accounts (default: ORGANIZATIONS only).\n * Can be extended to include USER_SELF (personal billing).\n /\n enabledScopes: z.array(z.enum(ResourcePrimaryScope)).default([ResourcePrimaryScope.ORGANIZATIONS]),\n\n /\n Promotions configuration.\n * Controls whether the promotions subsystem is active.\n /\n promotions: z.object({\n /\n DECLARATION-ONLY (#408, 2026-09-08), and the sharpest of them: the promotions subsystem runs\n * UNCONDITIONALLY. Promotion codes are applied at `billing-account.mutations` and resolved in\n * `billing-state`, neither of which consults this flag — so setting it `false` disables\n * nothing, which is a stronger statement than \"is not read\".\n /\n enabled: z.boolean().default(true),\n }).default(() => ({\n enabled: true,\n })),\n\n /\n Credit pool configuration.\n * Controls whether credit pools are enabled and defines default pool behavior.\n /\n creditPools: z.object({\n /\n DECLARATION-ONLY (#408, 2026-09-08) — same shape as `promotions.enabled` above, and the same\n * correction: credit pools run unconditionally in `billing-state`, so `false` disables nothing.\n /\n enabled: z.boolean().default(true),\n /* Default initial balance for auto-created pools (default 0) /\n defaultInitialBalance: z.number().min(0).default(0),\n }).default(() => ({\n enabled: true,\n defaultInitialBalance: 0,\n })),\n\n /* Global billing policy defaults (overridden by ProductBehaviorPolicy per product) /\n defaultBehaviorPolicy: z.object({\n /* Default trial days for new subscriptions (0 = no trial) /\n defaultTrialDays: z.number().min(0).default(0),\n /\n DECLARATION-ONLY (#408, 2026-09-08). Dunning — how long to wait and how often to retry after a\n * failed payment — is configured at the PROVIDER, on its own schedule, and nothing here reaches\n * it. Binding them would mean writing a provider's retry settings from application config, which\n * is a different feature from reading a policy at a call site.\n /\n paymentGracePeriodDays: z.number().min(0).default(3),\n /* DECLARATION-ONLY — see `paymentGracePeriodDays`. /\n maxPaymentRetries: z.number().min(0).default(3),\n /* Default proration when no product-specific policy. READ by the change-plan path. /\n defaultProration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n /\n Default cancellation timing when neither the caller nor the plan product names one.\n \n READ since 2026-09-08 (#408). It was dead until then, and it is bound rather than relabelled\n * because — unlike its neighbours above — it needs no provider call at all: cancellation timing\n * is resolved locally, so the only thing standing between this key and meaning something was a\n * reader. The chain is caller → product `behaviorPolicy.cancellation.defaultBehavior` → this →\n * period-end.\n */\n defaultCancellation: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n }).default(() => ({\n defaultTrialDays: 0,\n paymentGracePeriodDays: 3,\n maxPaymentRetries: 3,\n defaultProration: ProrationBehavior.CREATE_PRORATIONS,\n defaultCancellation: BillingTiming.AT_PERIOD_END,\n })),\n});\nexport type BillingConfiguration = z.infer<typeof BillingConfigurationSchema>;\n"]}

package/dist/esm/billing/billing-enums.shared.schemas.d.ts CHANGED Viewed

@@ -5,13 +5,27 @@
  * These supersede the legacy enums from billing.shared.schemas.ts.
  *
  * Enums shared with the standard billing interface (PricingModel, BillingInterval,
- * TaxDisplayMode, SubscriptionStatus) are defined in @wildo-ai/external-connectors-models
- * and re-exported here for convenience.
+ * TaxDisplayMode, SubscriptionStatus, InvoiceStatus, ProrationBehavior) are defined in
+ * @wildo-ai/external-connectors-models and re-exported here for convenience.
  *
  * @see billing-and-features-system.md §6 (Billing Schemas)
  */
-export { PricingModel, BillingInterval, TaxDisplayMode, SubscriptionStatus } from '@wildo-ai/external-connectors-models';
+export { PricingModel, BillingInterval, TaxDisplayMode, SubscriptionStatus, InvoiceStatus, ProrationBehavior } from '@wildo-ai/external-connectors-models';
 /**
+ * @wildo_source:part:start saas.models.billing.catalog-vocabularies facet:layer:shared facet:audience:app-developer
+ *
+ * The vocabularies an application types into its own product catalogue — the `ProductDefinition[]`
+ * it exports from its shared library and hands to the engine with its module declarations.
+ *
+ * Imported from `@wildo-ai/saas-models`. `PricingModel`, `BillingInterval` and `ProrationBehavior`
+ * are re-exported from the connector models, because their values ARE the provider's wire values.
+ *
+ * ⚠️ **The catalogue is ONE-WAY.** Sync pushes only rows that have no provider link yet, so a product
+ * or price edited in the provider's own dashboard is never read back, never reconciled, and never
+ * reported. Removing a product from the array does not retire it at the provider and does not
+ * deactivate the existing row — nothing detects that a previously synced key has disappeared. Treat
+ * the array as the source of truth and make every change through it.
+ *
  * Product types available in the billing catalog.
  *
  * | Type        | Creates subscription? | Repeatable? | Grants features? | Usage tracked? |
@@ -49,11 +63,6 @@ export declare enum LimitGrantMode {
 /**
  * Proration behavior for plan changes (upgrade/downgrade).
  */
-export declare enum ProrationBehavior {
-    CREATE_PRORATIONS = "create_prorations",
-    NONE = "none",
-    ALWAYS_INVOICE = "always_invoice"
-}
 /**
  * Billing timing: when to apply plan changes.
  */
@@ -61,6 +70,7 @@ export declare enum BillingTiming {
     IMMEDIATE = "immediate",
     AT_PERIOD_END = "at_period_end"
 }
+/** @wildo_source:part:end saas.models.billing.catalog-vocabularies */
 /**
  * Metering aggregation window for usage records.
  */
@@ -85,24 +95,56 @@ export declare enum UsageSourceType {
     CUSTOM = "custom"
 }
 /**
- * Tax calculation mode: provider-managed or disabled.
+ * Where one metered usage row stands with respect to the provider flush.
+ *
+ * This was a BOOLEAN (`reportedToProvider`) until 2026-09-09, and the third state is the whole
+ * reason it is an enum now (#512). A boolean can say "not yet reported" and "reported", and the
+ * flush selects on the first — so a row that can NEVER be reported has nowhere to go. It stays
+ * pending, is re-selected by every run, fails identically, and grows an error backlog that no
+ * operator action can drain, on a five-minute schedule.
+ *
+ * The three states are genuinely distinct and must not be collapsed:
+ *
+ * - {@link PENDING} — the flush will try again. Every newly recorded row starts here.
+ * - {@link REPORTED} — the provider acknowledged the quantity. `reportedAt` says when. Terminal,
+ *   and money has moved: never move a row back out of this state.
+ * - {@link UNREPORTABLE} — the flush determined the row can never be reported, for a reason named
+ *   in `unreportableReason`. Terminal, and NO money moved. Marking such a row `REPORTED` instead
+ *   would drain the backlog just as well and would be a lie no later reader could detect, which is
+ *   exactly why the state exists rather than a shortcut.
  */
-export declare enum TaxCalculationMode {
-    PROVIDER_MANAGED = "provider_managed",
-    DISABLED = "disabled"
+export declare enum UsageRecordFlushState {
+    PENDING = "pending",
+    REPORTED = "reported",
+    UNREPORTABLE = "unreportable"
 }
 /**
- * Invoice status values (maps to Stripe invoice statuses).
+ * Why a usage row was determined to be permanently unreportable.
  *
- * Invoices are created and managed entirely by the billing provider.
- * We store a thin reference for status tracking and quick display.
+ * One member today, and it is a closed vocabulary rather than a free string because the operator
+ * reading a retained financial record needs to know which permanent condition applies — and because
+ * the distinction between a PERMANENT and a TRANSIENT failure is the judgement this whole state
+ * turns on. A billing account that merely has no `providerCustomerId` yet is transient: the account
+ * exists, provisioning may still complete, and such a row stays {@link UsageRecordFlushState.PENDING}.
+ * Only a condition that cannot resolve itself belongs here.
  */
-export declare enum InvoiceStatus {
-    DRAFT = "draft",
-    OPEN = "open",
-    PAID = "paid",
-    VOID = "void",
-    UNCOLLECTIBLE = "uncollectible"
+export declare enum UsageRecordUnreportableReason {
+    /**
+     * The billing account row no longer exists.
+     *
+     * Reachable by design: usage rows are RETAINED when their subject is erased (the tax/audit
+     * obligation on `usage-record.shared.schemas.ts`), so a deleted account legitimately leaves rows
+     * behind with no provider customer to report them to. Nothing can restore the mapping, so the
+     * quantity will never be billed and saying so on the row is the only honest outcome.
+     */
+    BILLING_ACCOUNT_DELETED = "billing_account_deleted"
+}
+/**
+ * Tax calculation mode: provider-managed or disabled.
+ */
+export declare enum TaxCalculationMode {
+    PROVIDER_MANAGED = "provider_managed",
+    DISABLED = "disabled"
 }
 /**
  * Billing-compatible scope types.
@@ -224,6 +266,20 @@ export declare enum BillingCheckoutMetadataKey {
     BILLING_ACCOUNT_ID = "wildo_billingAccountId",
     /** The catalog product key purchased — selects the credit pool and credits-per-unit on top-up. */
     PRODUCT_KEY = "wildo_productKey",
+    /**
+     * The PROMOTION row whose code the framework validated when it opened this checkout, so the
+     * redemption can be counted when the session COMPLETES (#518).
+     *
+     * Absent when the purchase used no code, which is the common case.
+     *
+     * Stamped rather than re-derived from the completed session, because the provider reports the
+     * DISCOUNT it applied and not the Wildo row that authorised it — and the row is what carries
+     * `maxRedemptions`. Like every key here it is written for the framework's own reconciliation and is
+     * never trusted as authority on its own: the redemption is counted with a compare-and-swap that
+     * refuses past the cap, so a tampered value can at worst count a redemption against a promotion
+     * that has room for one.
+     */
+    PROMOTION_ID = "wildo_promotionId",
     /**
      * The purchased quantity, as a decimal integer string (provider metadata values are strings).
      * Strictly parsed and bounded by {@link BILLING_CHECKOUT_MAX_QUANTITY} on the way back in.

package/dist/esm/billing/billing-enums.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"billing-enums.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-enums.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;~~AAIzH;;;;;;;;;;;GAWG~~;AACH,oBAAY,WAAW;IACrB,gEAAgE;IAChE,IAAI,SAAS;IACb,6DAA6D;IAC7D,KAAK,UAAU;IACf,kEAAkE;IAClE,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,sEAAsE;IACtE,WAAW,gBAAgB;IAC3B,0EAA0E;IAC1E,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAID;;GAEG;~~AACH,oBAAY,iBAAiB;IAC3B,iBAAiB,sBAAsB;IACvC,IAAI,SAAS;IACb,cAAc,mBAAmB;CAClC;AAED~~;;GAEG;AACH,oBAAY,aAAa;IACvB,SAAS,cAAc;IACvB,aAAa,kBAAkB;CAChC;~~AAMD~~;;GAEG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;CAC1C;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,cAAc,mBAAmB;IACjC,MAAM,WAAW;CAClB;~~AAMD;;GAEG~~;AACH,oBAAY,~~kBAAkB~~;~~IAC5B~~,~~gBAAgB~~,~~qBAAqB~~;~~IACrC~~,QAAQ,aAAa;~~CACtB~~;~~AAMD;;;;;GAKG~~;AACH,oBAAY,~~aAAa~~;~~IACvB~~,~~KAAK~~,~~UAAU~~;~~IACf~~,~~IAAI~~,~~SAAS~~;~~IACb~~,~~IAAI~~,~~SAAS~~;~~IACb~~,~~IAAI~~,~~SAAS;IACb,~~aAAa~~,kBAAkB~~;~~CAChC~~;~~AAID~~;;;;;GAKG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,SAAS,cAAc;CACxB;AAID;;GAEG;AACH,oBAAY,aAAa;IACvB,sBAAsB;IACtB,MAAM,WAAW;IACjB,0BAA0B;IAC1B,cAAc,mBAAmB;IACjC,uBAAuB;IACvB,QAAQ,aAAa;IACrB,yBAAyB;IACzB,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,YAAY;IACtB,UAAU,eAAe;IACzB,YAAY,iBAAiB;CAC9B;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,eAAe,oBAAoB;CACpC;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC,WAAW,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC;;;;;;OAMG;IACH,kBAAkB,2BAA2B;IAC7C,kGAAkG;IAClG,WAAW,qBAAqB;IAChC;;;OAGG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,SAAU,CAAC"}
1	+ {"version":3,"file":"billing-enums.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-enums.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAI3J;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,oBAAY,WAAW;IACrB,gEAAgE;IAChE,IAAI,SAAS;IACb,6DAA6D;IAC7D,KAAK,UAAU;IACf,kEAAkE;IAClE,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,sEAAsE;IACtE,WAAW,gBAAgB;IAC3B,0EAA0E;IAC1E,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAID;;GAEG;AAKH;;GAEG;AACH,oBAAY,aAAa;IACvB,SAAS,cAAc;IACvB,aAAa,kBAAkB;CAChC;AACD,sEAAsE;AAMtE;;GAEG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;CAC1C;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,cAAc,mBAAmB;IACjC,MAAM,WAAW;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;GASG;AACH,oBAAY,6BAA6B;IACvC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAMD;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;CACtB;AAYD;;;;;GAKG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,SAAS,cAAc;CACxB;AAID;;GAEG;AACH,oBAAY,aAAa;IACvB,sBAAsB;IACtB,MAAM,WAAW;IACjB,0BAA0B;IAC1B,cAAc,mBAAmB;IACjC,uBAAuB;IACvB,QAAQ,aAAa;IACrB,yBAAyB;IACzB,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,YAAY;IACtB,UAAU,eAAe;IACzB,YAAY,iBAAiB;CAC9B;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,eAAe,oBAAoB;CACpC;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC,WAAW,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC;;;;;;OAMG;IACH,kBAAkB,2BAA2B;IAC7C,kGAAkG;IAClG,WAAW,qBAAqB;IAChC;;;;;;;;;;;;OAYG;IACH,YAAY,sBAAsB;IAClC;;;OAGG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,SAAU,CAAC"}