@wildo-ai/saas-models 1.1.2 → 1.1.3

package/dist/esm/resources/resources-registry.shared.core.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-registry.shared.core.definitions.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources-registry.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,oBAAoB,EAA+G,MAAM,4BAA4B,CAAC;AAKnM,OAAO,EAAE,gBAAgB,EAAgB,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAA+C,8CAA8C,EAAE,MAAM,mCAAmC,CAAC;AAyGhJ,eAAO,MAAM,8BAA8B,EAAG,oBAAoB,EAo+CjE,CAAC;AAEF,eAAO,MAAM,6CAA6C,EAAE,8CAA8C,CAAC,gBAAgB,CAqG1H,CAAC"}
+{"version":3,"file":"resources-registry.shared.core.definitions.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources-registry.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,oBAAoB,EAA+G,MAAM,4BAA4B,CAAC;AAKnM,OAAO,EAAE,gBAAgB,EAAgB,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAA+C,8CAA8C,EAAE,MAAM,mCAAmC,CAAC;AA4GhJ,eAAO,MAAM,8BAA8B,EAAG,oBAAoB,EAskDjE,CAAC;AAEF,eAAO,MAAM,6CAA6C,EAAE,8CAA8C,CAAC,gBAAgB,CA0G1H,CAAC"}

package/dist/esm/resources/resources-registry.shared.core.definitions.js

@@ -7,6 +7,7 @@ import { CoreResourceType } from "./resources.shared.core.definitions.js";
 import { usersResourceConfiguration_InitializationFactory } from "../users/users.shared.resources-config.schemas.js";
 import { userCredentialsResourceConfiguration_InitializationFactory } from "../users/user-credentials.shared.resources-config.schemas.js";
 import { auditLogsResourceConfiguration_InitializationFactory } from "../compliance/audit-trails/audit-logs.shared.resources-config.schemas.js";
+import { applicationAuditLogsResourceConfiguration_InitializationFactory } from "../compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.js";
 import { filesResourceConfiguration_InitializationFactory } from "../files/files.shared.resources-config.schemas.js";
 import { userSelfResourceConfiguration_InitializationFactory } from "../users/user-self.shared.resources-config.schemas.js";
 import { userProfilesResourceConfiguration_InitializationFactory } from "../users/user-profiles.shared.resources-config.schemas.js";
@@ -26,6 +27,8 @@ import { userFeaturesResourceConfiguration_InitializationFactory } from "../feat
 import { applicationFeaturesResourceConfiguration_InitializationFactory } from "../features/application-features.shared.resources-config.schemas.js";
 import { organizationMembersResourceConfiguration_InitializationFactory } from "../organizations/organization-members.shared.resources-config.schemas.js";
 import { orgApiKeysResourceConfiguration_InitializationFactory } from "../security/api-keys/api-keys-organization.shared.resources-config.schemas.js";
+import { orgProviderCredentialsResourceConfiguration_InitializationFactory } from "../security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js";
+import { userProviderCredentialsResourceConfiguration_InitializationFactory } from "../security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js";
 import { appApiKeysResourceConfiguration_InitializationFactory } from "../security/api-keys/api-keys-application.shared.resources-config.schemas.js";
 import { orgOAuthClientsResourceConfiguration_InitializationFactory } from "../security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js";
 import { appOAuthClientsResourceConfiguration_InitializationFactory } from "../security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.js";
@@ -612,6 +615,46 @@ export const coreSharedResourceRelationship = [
         // SECURITY: API keys should never be fetched via context
         contextPolicy: { enabled: false }
     }),
+    // Provider credentials — an organization's own credential toward a third party.
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORG_PROVIDER_CREDENTIALS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        /*
+         * COMPOSITION, and the cascade is the point rather than a detail.
+         *
+         * A tenant's credentials must not outlive the tenant: a purged organization leaving a live
+         * Slack token in the store is a credential nobody owns, nobody can rotate and nothing will
+         * ever delete. Only COMPOSITION resolves to a DEPENDENT lifecycle — a REFERENCE edge cannot
+         * carry `onParentDelete` at all (the framework refuses it), so "enable the cascade later"
+         * is not a one-line change and the edge has to be right the first time.
+         */
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // SECURITY: a credential must never be fetched via context — context objects ride along in
+        // DTOs the client receives, and this row's whole reason to exist is that it holds a secret.
+        contextPolicy: { enabled: false }
+    }),
+    // Provider credentials — a PERSON's own credential toward a third party.
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_PROVIDER_CREDENTIALS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        /*
+         * This edge does two jobs and both are load-bearing.
+         *
+         * It is what gives the resource its USER_SELF primary scope, so the framework's own filter
+         * restricts every read to the authenticated caller's own credentials — nobody can reach
+         * another person's key, structurally, rather than because a role list happens to be narrow.
+         *
+         * And its COMPOSITION cascade is what stops a personal credential outliving the person. The
+         * retention policy deliberately scrubs nothing (a secret is not pseudonymised, it is
+         * destroyed), so the DELETE dispatched here IS the erasure answer for this resource. A
+         * REFERENCE edge cannot carry `onParentDelete` at all, so getting the nature wrong would
+         * leave a live third-party credential belonging to somebody who asked to be forgotten.
+         */
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // SECURITY: as the organization-owned sibling — a row holding a secret must never ride in a
+        // context DTO the client receives.
+        contextPolicy: { enabled: false }
+    }),
     createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.APPLICATION_API_KEYS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
@@ -675,6 +718,43 @@ export const coreSharedResourceRelationship = [
         nature: RelationshipNature.REFERENCE,
         contextPolicy: { enabled: false }
     }),
+    // ── Application-scoped audit door (#317) ─────────────────────────────
+    // ONE parent, deliberately. `accessScopeStrategy` is REQUIRES_CONTEXT so this resource is ROUTED
+    // at `/applications/{applicationId}/application-audit-logs` — the shape `APPLICATION_API_KEYS`
+    // already uses. A second parent must NEVER be added here: two always-on parents collapse into a
+    // single fully-nested route, because `generateParentCombinations` puts every primary-scope and
+    // every REQUIRES_CONTEXT edge into EVERY combination. That collapse is precisely why this is a
+    // sibling type instead of a second route on AUDIT_LOGS.
+    //
+    // `parentResourceRequirement: OPTIONAL`, matching the `APPLICATION -> AUDIT_LOGS` edge above on
+    // the SAME `applicationId` column. This flag is a claim about the ROWS, not about the route:
+    // `deriveRelationshipPersistenceContract` reads it as "the holder's FK column is non-nullable for
+    // every holder row". This door owns no rows of its own — both types resolve to the `auditLogs`
+    // collection through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES`, and every row is written
+    // through the organization door's `REPOSITORY_ONLY` CREATE against `AuditableEvent_BaseSchema`,
+    // where `applicationId` is `.optional()`. Organization-scoped, user-only and system events
+    // legitimately omit it (the sibling edge says so in as many words), and it is otherwise supplied
+    // only opportunistically by primary-scope context enrichment, which needs a seeded APPLICATION row.
+    //
+    // MANDATORY here was really a statement about ADDRESSING — this parent IS the route segment — and
+    // that is carried entirely by `isPrimaryScope` + `accessScopeStrategy: REQUIRES_CONTEXT`, which is
+    // what `generateParentCombinations` reads. The derived `isOptional` is assigned and never read by
+    // the URL builder, so the route is identical either way. Declared MANDATORY the resource does not
+    // load AT ALL: the ZodToMongoose convertor refuses it (`Align parentResourceRequirement with the
+    // resource schema`), so a Mongo-persisted deployment gets no model and INIT dies on
+    // `zod_converter_schema_conversion_failed`. `PLATFORM_APPLICATIONS` in apps-manager is the same
+    // shape — primary scope + REQUIRES_CONTEXT + OPTIONAL on this very column.
+    //
+    // `contextPolicy` disabled for the reason API keys disable it: an audit row must never be fetched
+    // as ambient context.
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.APPLICATION_AUDIT_LOGS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        foreignKeyField: 'applicationId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false },
+    }),
     // ── Notification Badges (Dual-Scope Polymorphic) ─────────────────────
     // Each scope owns its own resource type and its own MongoDB collection.
     // Accessed internally via `NotificationBadgeBackendService`, which dispatches
@@ -854,11 +934,18 @@ export const coreSharedResourceRelationship = [
     //     against the provider defeats the purpose of retaining it. Nothing provider-side is cleaned
     //     up on delete either (no customer deletion, no subscription cancellation), so this was a
     //     purely LOCAL mapping being thrown away while the provider-side record lived on.
-    //   • The usage-flush sweep (`UsageMeteringBackendService.flushScopeToProvider`) selects on
-    //     `reportedToProvider: false`, groups by this FK, and skips its "mark as reported" write when
-    //     the customer id cannot be resolved. Retained usage rows whose account was deleted are
-    //     therefore re-selected by EVERY subsequent sweep and can never drain — a permanent,
-    //     monotonically growing error backlog. (Latent today: no cron calls `flushToProvider` yet.)
+    //   • The usage-flush sweep (`UsageMeteringBackendService.flushScopeToProvider`) selects unreported
+    //     rows and groups by this FK. It USED to skip its marking write whenever the customer id could
+    //     not be resolved, so retained rows whose account was deleted were re-selected by EVERY
+    //     subsequent sweep and could never drain — a permanent, monotonically growing error backlog,
+    //     which stopped being latent on 2026-09-08 (#415) when the `usage-flush` batch began calling
+    //     `flushToProvider` on a schedule. FIXED 2026-09-09 (#512): the sweep now distinguishes a
+    //     DELETED account (permanent) from one merely awaiting a `providerCustomerId` (transient), and
+    //     moves the former's rows to the terminal `flushState: unreportable` with a recorded reason.
+    //     The rows are still retained and still unbillable — what changed is that the run says so ONCE
+    //     and then leaves them alone. This bullet is kept in full because the dangling-reference
+    //     argument above still holds: it is why the account must not be hard-deleted in the first
+    //     place, and the fix only makes the aftermath survivable.
     //   • `onSubscriptionChanged` (feature sync, fired by the subscription post-operation hook) and
     //     the webhook router's `emitBillingEvent` both dereference this FK off a retained child; both
     //     are null-guarded, so they degrade to a warn + silent no-op rather than crashing.
@@ -1316,6 +1403,8 @@ export const coreShared_ResourcesConfigurations_FactoryMap = {
     [CoreResourceType.APPLICATION_FEATURES]: applicationFeaturesResourceConfiguration_InitializationFactory,
     // API Keys
     [CoreResourceType.ORG_API_KEYS]: orgApiKeysResourceConfiguration_InitializationFactory,
+    [CoreResourceType.ORG_PROVIDER_CREDENTIALS]: orgProviderCredentialsResourceConfiguration_InitializationFactory,
+    [CoreResourceType.USER_PROVIDER_CREDENTIALS]: userProviderCredentialsResourceConfiguration_InitializationFactory,
     [CoreResourceType.APPLICATION_API_KEYS]: appApiKeysResourceConfiguration_InitializationFactory,
     // OAuth Clients (registered client-credentials front — mirrors API Keys)
     [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: orgOAuthClientsResourceConfiguration_InitializationFactory,
@@ -1333,6 +1422,9 @@ export const coreShared_ResourcesConfigurations_FactoryMap = {
     [CoreResourceType.REFERRALS]: referralsResourceConfiguration_InitializationFactory,
     // Audit and Compliance
     [CoreResourceType.AUDIT_LOGS]: auditLogsResourceConfiguration_InitializationFactory,
+    // The APPLICATION-scoped door onto the SAME rows (#317). A separate type because the URL
+    // combinator would otherwise rewrite the organization route — see the config's header.
+    [CoreResourceType.APPLICATION_AUDIT_LOGS]: applicationAuditLogsResourceConfiguration_InitializationFactory,
     // Notification Badges — polymorphic dual-scope (USER + ORG)
     [CoreResourceType.USER_NOTIFICATION_BADGES]: userNotificationBadgesResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: organizationNotificationBadgesResourceConfiguration_InitializationFactory,