@wildo-ai/saas-models 1.1.2 → 1.1.3

package/dist/esm/resources/utils/field-value-disclosure.utils.js

@@ -0,0 +1,53 @@
+import { isBackendOnlyField, isWriteOnlySecretField } from '@wildo-ai/zod-decorators';
+/**
+ * THE ONE RULE for "may this field's VALUE leave the backend?" — the disclosure seam every
+ * outward-facing surface derives from, rather than restating.
+ *
+ * ## What it answers, and what it deliberately does not
+ *
+ * A field's value is non-disclosable when it is `.isBackendOnly()` (the response DTO drops it) or
+ * `.isWriteOnlySecret()` (the response DTO masks it). Those two decorators ARE the disclosure
+ * boundary; nothing else is. In particular:
+ *
+ *  - `.isHidden()` gates CHART AGGREGATES (`field-access-validator`), which is a question about
+ *    which aggregate may expose a value, not about whether the value may be disclosed at all;
+ *  - `.isEphemeral()` gates the audit field-access trail and a one-time frontend display. An
+ *    ephemeral field is RETURNED — once, deliberately — so withholding it here would withhold
+ *    something the response contract promises.
+ *
+ * Adding either to this predicate would silently narrow surfaces that are working as designed, so
+ * they are named here as considered-and-excluded rather than left to the next reader to re-derive.
+ *
+ * ## Why BOTH decorators are tested, rather than one implying the other
+ *
+ * They are independent decorators. A future authoring form — or an application — may set one
+ * without the other, and a predicate that assumed the implication would open a disclosure path the
+ * day that happened. This reasoning is not new: `isFieldWithheldFromSubjectExport` wrote it down
+ * for the subject-export surface first, and this module is that rule extracted so the two surfaces
+ * cannot drift apart.
+ *
+ * ## Why it exists as its own module (issue #95)
+ *
+ * The rule had TWO independent hand-written copies and one surface that carried only half of it:
+ *
+ * | surface | `.isBackendOnly()` | `.isWriteOnlySecret()` |
+ * |---|---|---|
+ * | response DTO / `toResponseSafeToolOutput` (REST, MCP `tools/call`, A2A resource tools) | dropped | masked |
+ * | subject export (`isFieldWithheldFromSubjectExport`) | withheld | withheld |
+ * | RAG retrieval row header (`getSummaryFieldNames`) | excluded | **rendered in full** |
+ *
+ * The third row is the defect this module closes. A resource may declare a field BOTH
+ * `.isSummaryField()` and `.isWriteOnlySecret()` — nothing forbids it — and the retrieval header
+ * would then render, verbatim and into a provider payload, the value the response DTO exists to
+ * mask. No resource declares that pair today, so the hole was latent; the header is assembled from
+ * declarations an application controls, so it stays latent only until one does.
+ *
+ * assurance-control: WILDO.DATA.CONFIDENTIALITY — material a schema declares non-disclosable does
+ * not cross the client boundary. The registered objective names `.isBackendOnly()`; this rule is
+ * where its sibling decorator `.isWriteOnlySecret()` is held to the same boundary, since both
+ * describe a value the response DTO refuses to emit as authored.
+ */
+export function isNonDisclosableFieldValue(fieldSchema) {
+    return isBackendOnlyField(fieldSchema) || isWriteOnlySecretField(fieldSchema);
+}
+//# sourceMappingURL=field-value-disclosure.utils.js.map

package/dist/esm/resources/utils/field-value-disclosure.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-value-disclosure.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/field-value-disclosure.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAyB;IAClE,OAAO,kBAAkB,CAAC,WAAW,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { isBackendOnlyField, isWriteOnlySecretField } from '@wildo-ai/zod-decorators';\n\n/**\n * THE ONE RULE for \"may this field's VALUE leave the backend?\" — the disclosure seam every\n * outward-facing surface derives from, rather than restating.\n *\n * ## What it answers, and what it deliberately does not\n *\n * A field's value is non-disclosable when it is `.isBackendOnly()` (the response DTO drops it) or\n * `.isWriteOnlySecret()` (the response DTO masks it). Those two decorators ARE the disclosure\n * boundary; nothing else is. In particular:\n *\n *  - `.isHidden()` gates CHART AGGREGATES (`field-access-validator`), which is a question about\n *    which aggregate may expose a value, not about whether the value may be disclosed at all;\n *  - `.isEphemeral()` gates the audit field-access trail and a one-time frontend display. An\n *    ephemeral field is RETURNED — once, deliberately — so withholding it here would withhold\n *    something the response contract promises.\n *\n * Adding either to this predicate would silently narrow surfaces that are working as designed, so\n * they are named here as considered-and-excluded rather than left to the next reader to re-derive.\n *\n * ## Why BOTH decorators are tested, rather than one implying the other\n *\n * They are independent decorators. A future authoring form — or an application — may set one\n * without the other, and a predicate that assumed the implication would open a disclosure path the\n * day that happened. This reasoning is not new: `isFieldWithheldFromSubjectExport` wrote it down\n * for the subject-export surface first, and this module is that rule extracted so the two surfaces\n * cannot drift apart.\n *\n * ## Why it exists as its own module (issue #95)\n *\n * The rule had TWO independent hand-written copies and one surface that carried only half of it:\n *\n * | surface | `.isBackendOnly()` | `.isWriteOnlySecret()` |\n * |---|---|---|\n * | response DTO / `toResponseSafeToolOutput` (REST, MCP `tools/call`, A2A resource tools) | dropped | masked |\n * | subject export (`isFieldWithheldFromSubjectExport`) | withheld | withheld |\n * | RAG retrieval row header (`getSummaryFieldNames`) | excluded | **rendered in full** |\n *\n * The third row is the defect this module closes. A resource may declare a field BOTH\n * `.isSummaryField()` and `.isWriteOnlySecret()` — nothing forbids it — and the retrieval header\n * would then render, verbatim and into a provider payload, the value the response DTO exists to\n * mask. No resource declares that pair today, so the hole was latent; the header is assembled from\n * declarations an application controls, so it stays latent only until one does.\n *\n * assurance-control: WILDO.DATA.CONFIDENTIALITY — material a schema declares non-disclosable does\n * not cross the client boundary. The registered objective names `.isBackendOnly()`; this rule is\n * where its sibling decorator `.isWriteOnlySecret()` is held to the same boundary, since both\n * describe a value the response DTO refuses to emit as authored.\n */\nexport function isNonDisclosableFieldValue(fieldSchema: z.ZodTypeAny): boolean {\n  return isBackendOnlyField(fieldSchema) || isWriteOnlySecretField(fieldSchema);\n}\n"]}

package/dist/esm/resources/utils/resources-summary.utils.d.ts

@@ -70,11 +70,25 @@ export declare class ResourcesSummaryUtils {
      */
     static deriveSummarySchemaForDiscriminatedUnion<TMainSchema extends z.ZodObject<z.ZodRawShape>>(mainSchema: TMainSchema, inheritanceDefinition: ResourceConfiguration_InheritanceSchemaDefinition<any, TMainSchema>, options?: DeriveSummaryOptions): z.ZodTypeAny;
     /**
-     * Check if a field is a valid summary field (has decorator and is not backend-only).
+     * Is this a summary field whose VALUE may be disclosed?
+     *
+     * Both halves are load-bearing. `isSummaryField` is the application's declaration that the field
+     * is the human-readable face of a row; {@link isNonDisclosableFieldValue} is the framework's
+     * answer to whether that value may leave the backend at all — and the application's declaration
+     * never overrides it. A field declared BOTH `.isSummaryField()` and `.isWriteOnlySecret()` is
+     * legal to author and must not be rendered anywhere a response DTO would have masked it.
+     *
+     * The disclosure half is DERIVED, never restated here: it is the same predicate the subject-export
+     * surface withholds on, so the two cannot drift (issue #95).
      */
     static isValidSummaryField(fieldSchema: z.ZodTypeAny): boolean;
     /**
-     * Get all summary field names from a schema.
+     * Get all summary field names from a schema whose values may be disclosed.
+     *
+     * Routed through {@link isValidSummaryField} rather than repeating its test — the two said the
+     * same thing in two places, and when the disclosure rule grew from "not backend-only" to the full
+     * boundary, one of them would have been updated and the other left behind. That is the defect
+     * class this whole change is about, in miniature.
      */
     static getSummaryFieldNames(schema: z.ZodTypeAny): string[];
 }

package/dist/esm/resources/utils/resources-summary.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-summary.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/resources-summary.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,iDAAiD,EAAE,MAAM,oCAAoC,CAAC;AAEvG;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAiBD;;GAEG;AACH,qBAAa,qBAAqB;IAEhC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,mBAAmB,CACxB,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IA0C7B;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAC1B,aAAa,EAAE,CAAC,CAAC,UAAU,EAC3B,UAAU,EAAE,CAAC,CAAC,UAAU,GACvB,uBAAuB;IA0B1B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,wCAAwC,CAC7C,WAAW,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAE9C,UAAU,EAAE,WAAW,EACvB,qBAAqB,EAAE,iDAAiD,CAAC,GAAG,EAAE,WAAW,CAAC,EAC1F,OAAO,CAAC,EAAE,oBAAoB,GAC7B,CAAC,CAAC,UAAU;IA6Df;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO;IAI9D;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE;CAoB5D"}
+{"version":3,"file":"resources-summary.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/resources-summary.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,iDAAiD,EAAE,MAAM,oCAAoC,CAAC;AAGvG;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAiBD;;GAEG;AACH,qBAAa,qBAAqB;IAEhC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,mBAAmB,CACxB,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IA0C7B;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAC1B,aAAa,EAAE,CAAC,CAAC,UAAU,EAC3B,UAAU,EAAE,CAAC,CAAC,UAAU,GACvB,uBAAuB;IA0B1B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,wCAAwC,CAC7C,WAAW,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAE9C,UAAU,EAAE,WAAW,EACvB,qBAAqB,EAAE,iDAAiD,CAAC,GAAG,EAAE,WAAW,CAAC,EAC1F,OAAO,CAAC,EAAE,oBAAoB,GAC7B,CAAC,CAAC,UAAU;IA6Df;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO;IAI9D;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE;CAkB5D"}

package/dist/esm/resources/utils/resources-summary.utils.js

@@ -8,6 +8,7 @@
  */
 import { z } from 'zod';
 import { getZodObjectShape, isSummaryField, isBackendOnlyField, } from '@wildo-ai/zod-decorators';
+import { isNonDisclosableFieldValue } from './field-value-disclosure.utils.js';
 /**
  * Default summary derivation options
  */
@@ -155,21 +156,34 @@ export class ResourcesSummaryUtils {
         return baseSummary;
     }
     /**
-     * Check if a field is a valid summary field (has decorator and is not backend-only).
+     * Is this a summary field whose VALUE may be disclosed?
+     *
+     * Both halves are load-bearing. `isSummaryField` is the application's declaration that the field
+     * is the human-readable face of a row; {@link isNonDisclosableFieldValue} is the framework's
+     * answer to whether that value may leave the backend at all — and the application's declaration
+     * never overrides it. A field declared BOTH `.isSummaryField()` and `.isWriteOnlySecret()` is
+     * legal to author and must not be rendered anywhere a response DTO would have masked it.
+     *
+     * The disclosure half is DERIVED, never restated here: it is the same predicate the subject-export
+     * surface withholds on, so the two cannot drift (issue #95).
      */
     static isValidSummaryField(fieldSchema) {
-        return isSummaryField(fieldSchema) && !isBackendOnlyField(fieldSchema);
+        return isSummaryField(fieldSchema) && !isNonDisclosableFieldValue(fieldSchema);
     }
     /**
-     * Get all summary field names from a schema.
+     * Get all summary field names from a schema whose values may be disclosed.
+     *
+     * Routed through {@link isValidSummaryField} rather than repeating its test — the two said the
+     * same thing in two places, and when the disclosure rule grew from "not backend-only" to the full
+     * boundary, one of them would have been updated and the other left behind. That is the defect
+     * class this whole change is about, in miniature.
      */
     static getSummaryFieldNames(schema) {
         const result = [];
         try {
             const shape = getZodObjectShape(schema);
             for (const [fieldName, fieldSchema] of Object.entries(shape)) {
-                const typedSchema = fieldSchema;
-                if (isSummaryField(typedSchema) && !isBackendOnlyField(typedSchema)) {
+                if (ResourcesSummaryUtils.isValidSummaryField(fieldSchema)) {
                     result.push(fieldName);
                 }
             }

package/dist/esm/resources/utils/resources-summary.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-summary.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/resources-summary.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAyBlC;;GAEG;AACH,MAAM,sBAAsB,GAAyB;IACnD,SAAS,EAAE,IAAI;IACf,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,EAAE;IACpB,aAAa,EAAE,EAAE;CAClB,CAAC;AAOF;;GAEG;AACH,MAAM,OAAO,qBAAqB;IAEhC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,mBAAmB,CACxB,UAAwB,EACxB,OAA8B;QAE9B,MAAM,IAAI,GAAG,EAAE,GAAG,sBAAsB,EAAE,GAAG,OAAO,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAoB,EAAE,CAAC;QAEzC,kCAAkC;QAClC,IAAI,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YAChC,YAAY,CAAC,GAAG,GAAG,KAAK,CAAC,GAAmB,CAAC;QAC/C,CAAC;QAED,iDAAiD;QACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzD,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAiB,CAAC;YACrD,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,oCAAoC;YACpC,IAAI,YAAY,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,WAA2B,CAAC;YAEhD,2BAA2B;YAC3B,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,0CAA0C;YAC1C,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,uDAAuD;gBACvD,6DAA6D;gBAC7D,YAAY,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,MAAM,CAAC,YAA6B,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAC1B,aAA2B,EAC3B,UAAwB;QAExB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAEhD,KAAK,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvD,MAAM,eAAe,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;gBAE7C,IAAI,eAAe,IAAI,kBAAkB,CAAC,eAA+B,CAAC,EAAE,CAAC;oBAC3E,MAAM,CAAC,IAAI,CACT,UAAU,SAAS,iEAAiE,CACrF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,wCAAwC,CAG7C,UAAuB,EACvB,qBAA0F,EAC1F,OAA8B;QAG9B,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,kBAAkB,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEjD,+DAA+D;QAC/D,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,gBAAgB,GAAoB,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,gBAAgB,CAAC,GAAG,CAAC,GAAG,KAAqB,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3E,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC,kBAAkB,CAAiB,CAAC;QACvF,CAAC;QAED,MAAM,gBAAgB,GAAiC,EAAE,CAAC;QAE1D,iDAAiD;QACjD,MAAM,UAAU,GAAG,qBAAqB,CAAC,0CAA0C,IAAI,EAAE,CAAC;QAC1F,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,gBAAgB,CAAC,IAAI,CACnB,CAAC,CAAC,MAAM,CAAC;gBACP,GAAG,gBAAgB;gBACnB,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;aACtB,CAAC,CACpB,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,SAAS,IAAI,qBAAqB,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YACrE,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7E,MAAM,cAAc,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YAE3D,4CAA4C;YAC5C,MAAM,WAAW,GAAoB,EAAE,GAAG,gBAAgB,EAAE,CAAC;YAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC1D,WAAW,CAAC,GAAG,CAAC,GAAG,KAAqB,CAAC;YAC3C,CAAC;YACD,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YAE/E,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAA4B,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,0CAA0C;QAC1C,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,sEAAsE;QACtE,IAAI,gBAAgB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,kBAAkB,CACzB,kBAAkB,EAClB,gBAAuB,CACxB,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,WAAyB;QAClD,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,MAAoB;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAExC,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;gBAEhD,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACpE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CAEF","sourcesContent":["/**\n * Resource Summary Utilities\n *\n * Utilities for deriving summary schemas from main schemas using decorators.\n * Summary schemas are lighter versions used for list/search operations.\n *\n * @see Section 4.3 of RESOURCE_DERIVED_OBJECTS_RATIONALIZATION.md\n */\n\nimport { z } from 'zod';\nimport {\n  getZodObjectShape,\n  isSummaryField,\n  isBackendOnlyField,\n} from '@wildo-ai/zod-decorators';\nimport { ResourceConfiguration_InheritanceSchemaDefinition } from '../resources-config.shared.schemas';\n\n/**\n * Options for deriving a summary schema\n */\nexport interface DeriveSummaryOptions {\n  /** Always include _id field (default: true) */\n  includeId?: boolean;\n  /** Include foreign key fields automatically (default: false) */\n  includeForeignKeys?: boolean;\n  /** Additional fields to include regardless of decorators */\n  additionalFields?: string[];\n  /** Fields to exclude regardless of decorators */\n  excludeFields?: string[];\n}\n\n/**\n * Result of summary schema validation\n */\nexport interface SummaryValidationResult {\n  valid: boolean;\n  issues: string[];\n}\n\n/**\n * Default summary derivation options\n */\nconst DEFAULT_DERIVE_OPTIONS: DeriveSummaryOptions = {\n  includeId: true,\n  includeForeignKeys: false,\n  additionalFields: [],\n  excludeFields: [],\n};\n\n/**\n * Mutable shape type for building schemas\n */\ntype MutableZodShape = Record<string, z.ZodTypeAny>;\n\n/**\n * Utility class for deriving and validating summary schemas.\n */\nexport class ResourcesSummaryUtils {\n\n  /**\n   * Derive a summary schema from a main schema using decorator metadata.\n   *\n   * Rules:\n   * - Include fields with `isSummaryField` decorator\n   * - Include virtual fields that have BOTH `isVirtual` AND `isSummaryField` decorators\n   * - Skip `isBackendOnly` fields\n   * - Always include `_id` (unless explicitly excluded)\n   * - Do NOT auto-include `isForeignKey` fields (must be explicit)\n   *\n   * @param mainSchema - The main schema to derive from\n   * @param options - Configuration options\n   * @returns A new Zod schema containing only summary fields\n   */\n  static deriveSummarySchema(\n    mainSchema: z.ZodTypeAny,\n    options?: DeriveSummaryOptions\n  ): z.ZodObject<z.ZodRawShape> {\n    const opts = { ...DEFAULT_DERIVE_OPTIONS, ...options };\n    const shape = getZodObjectShape(mainSchema);\n    const summaryShape: MutableZodShape = {};\n\n    // Always include _id if requested\n    if (opts.includeId && shape._id) {\n      summaryShape._id = shape._id as z.ZodTypeAny;\n    }\n\n    // Include additional explicitly requested fields\n    for (const field of opts.additionalFields || []) {\n      if (shape[field] && !opts.excludeFields?.includes(field)) {\n        summaryShape[field] = shape[field] as z.ZodTypeAny;\n      }\n    }\n\n    // Scan all fields for isSummaryField decorator\n    for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n      // Skip if already added or excluded\n      if (summaryShape[fieldName] || opts.excludeFields?.includes(fieldName)) {\n        continue;\n      }\n\n      const typedSchema = fieldSchema as z.ZodTypeAny;\n\n      // Skip backend-only fields\n      if (isBackendOnlyField(typedSchema)) {\n        continue;\n      }\n\n      // Include if has isSummaryField decorator\n      if (isSummaryField(typedSchema)) {\n        // Virtual fields with isSummaryField are also included\n        // The virtual field computation happens at the service layer\n        summaryShape[fieldName] = typedSchema;\n      }\n    }\n\n    return z.object(summaryShape as z.ZodRawShape);\n  }\n\n  /**\n   * Validate that a summary schema does not contain backend-only fields.\n   *\n   * @param summarySchema - The summary schema to validate\n   * @param mainSchema - The main schema for reference\n   * @returns Validation result with issues list\n   */\n  static validateSummarySchema(\n    summarySchema: z.ZodTypeAny,\n    mainSchema: z.ZodTypeAny\n  ): SummaryValidationResult {\n    const issues: string[] = [];\n\n    try {\n      const summaryShape = getZodObjectShape(summarySchema);\n      const mainShape = getZodObjectShape(mainSchema);\n\n      for (const [fieldName] of Object.entries(summaryShape)) {\n        const mainFieldSchema = mainShape[fieldName];\n\n        if (mainFieldSchema && isBackendOnlyField(mainFieldSchema as z.ZodTypeAny)) {\n          issues.push(\n            `Field '${fieldName}' has isBackendOnly decorator but is included in summary schema`\n          );\n        }\n      }\n    } catch (error) {\n      issues.push(`Failed to validate summary schema: ${error}`);\n    }\n\n    return {\n      valid: issues.length === 0,\n      issues,\n    };\n  }\n\n  /**\n   * Derive summary schema for a discriminated union (inheritance).\n   *\n   * Creates a discriminated union of summary schemas where:\n   * - Base summary fields apply to all variants\n   * - Variant-specific summary fields apply only to that variant\n   * - Discriminator field is always included in all variants\n   *\n   * @param mainSchema - The base schema\n   * @param inheritanceDefinition - The inheritance schema definition\n   * @param options - Derivation options\n   * @returns A discriminated union summary schema or base summary\n   */\n  static deriveSummarySchemaForDiscriminatedUnion<\n    TMainSchema extends z.ZodObject<z.ZodRawShape>\n  >(\n    mainSchema: TMainSchema,\n    inheritanceDefinition: ResourceConfiguration_InheritanceSchemaDefinition<any, TMainSchema>,\n    options?: DeriveSummaryOptions\n  ): z.ZodTypeAny {\n\n    const discriminatorField = inheritanceDefinition.discriminatorField;\n    const baseSummary = this.deriveSummarySchema(mainSchema, options);\n    const baseShape = getZodObjectShape(baseSummary);\n\n    // Ensure discriminator field is included - create mutable copy\n    const mainShape = getZodObjectShape(mainSchema);\n    const mutableBaseShape: MutableZodShape = {};\n    for (const [key, value] of Object.entries(baseShape)) {\n      mutableBaseShape[key] = value as z.ZodTypeAny;\n    }\n    if (!mutableBaseShape[discriminatorField] && mainShape[discriminatorField]) {\n      mutableBaseShape[discriminatorField] = mainShape[discriminatorField] as z.ZodTypeAny;\n    }\n\n    const variantSummaries: z.ZodObject<z.ZodRawShape>[] = [];\n\n    // Add base variants (values without inheritance)\n    const baseValues = inheritanceDefinition.withoutInheritanceDiscriminatorFieldValues || [];\n    for (const value of baseValues) {\n      variantSummaries.push(\n        z.object({\n          ...mutableBaseShape,\n          [discriminatorField]: z.literal(value),\n        } as z.ZodRawShape)\n      );\n    }\n\n    // Add inherited variant summaries\n    for (const inherited of inheritanceDefinition.inheritedSchemas || []) {\n      const inheritedSummary = this.deriveSummarySchema(inherited.schema, options);\n      const inheritedShape = getZodObjectShape(inheritedSummary);\n\n      // Merge base summary with inherited summary\n      const mergedShape: MutableZodShape = { ...mutableBaseShape };\n      for (const [key, value] of Object.entries(inheritedShape)) {\n        mergedShape[key] = value as z.ZodTypeAny;\n      }\n      mergedShape[discriminatorField] = z.literal(inherited.discriminatorFieldValue);\n\n      variantSummaries.push(z.object(mergedShape as z.ZodRawShape));\n    }\n\n    // If only one variant, return it directly\n    if (variantSummaries.length === 1) {\n      return variantSummaries[0];\n    }\n\n    // Create discriminated union (use any to avoid Zod 4 type complexity)\n    if (variantSummaries.length >= 2) {\n      return z.discriminatedUnion(\n        discriminatorField,\n        variantSummaries as any\n      );\n    }\n\n    // Fallback to base summary if no variants\n    return baseSummary;\n  }\n\n  /**\n   * Check if a field is a valid summary field (has decorator and is not backend-only).\n   */\n  static isValidSummaryField(fieldSchema: z.ZodTypeAny): boolean {\n    return isSummaryField(fieldSchema) && !isBackendOnlyField(fieldSchema);\n  }\n\n  /**\n   * Get all summary field names from a schema.\n   */\n  static getSummaryFieldNames(schema: z.ZodTypeAny): string[] {\n    const result: string[] = [];\n\n    try {\n      const shape = getZodObjectShape(schema);\n\n      for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n        const typedSchema = fieldSchema as z.ZodTypeAny;\n\n        if (isSummaryField(typedSchema) && !isBackendOnlyField(typedSchema)) {\n          result.push(fieldName);\n        }\n      }\n    } catch {\n      // Schema may not be an object\n    }\n\n    return result;\n  }\n\n}\n"]}
+{"version":3,"file":"resources-summary.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/resources-summary.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAwB5E;;GAEG;AACH,MAAM,sBAAsB,GAAyB;IACnD,SAAS,EAAE,IAAI;IACf,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,EAAE;IACpB,aAAa,EAAE,EAAE;CAClB,CAAC;AAOF;;GAEG;AACH,MAAM,OAAO,qBAAqB;IAEhC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,mBAAmB,CACxB,UAAwB,EACxB,OAA8B;QAE9B,MAAM,IAAI,GAAG,EAAE,GAAG,sBAAsB,EAAE,GAAG,OAAO,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAoB,EAAE,CAAC;QAEzC,kCAAkC;QAClC,IAAI,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YAChC,YAAY,CAAC,GAAG,GAAG,KAAK,CAAC,GAAmB,CAAC;QAC/C,CAAC;QAED,iDAAiD;QACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzD,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAiB,CAAC;YACrD,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,oCAAoC;YACpC,IAAI,YAAY,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,WAA2B,CAAC;YAEhD,2BAA2B;YAC3B,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,0CAA0C;YAC1C,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,uDAAuD;gBACvD,6DAA6D;gBAC7D,YAAY,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,MAAM,CAAC,YAA6B,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAC1B,aAA2B,EAC3B,UAAwB;QAExB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAEhD,KAAK,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvD,MAAM,eAAe,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;gBAE7C,IAAI,eAAe,IAAI,kBAAkB,CAAC,eAA+B,CAAC,EAAE,CAAC;oBAC3E,MAAM,CAAC,IAAI,CACT,UAAU,SAAS,iEAAiE,CACrF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,wCAAwC,CAG7C,UAAuB,EACvB,qBAA0F,EAC1F,OAA8B;QAG9B,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,kBAAkB,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEjD,+DAA+D;QAC/D,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,gBAAgB,GAAoB,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,gBAAgB,CAAC,GAAG,CAAC,GAAG,KAAqB,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3E,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC,kBAAkB,CAAiB,CAAC;QACvF,CAAC;QAED,MAAM,gBAAgB,GAAiC,EAAE,CAAC;QAE1D,iDAAiD;QACjD,MAAM,UAAU,GAAG,qBAAqB,CAAC,0CAA0C,IAAI,EAAE,CAAC;QAC1F,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,gBAAgB,CAAC,IAAI,CACnB,CAAC,CAAC,MAAM,CAAC;gBACP,GAAG,gBAAgB;gBACnB,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;aACtB,CAAC,CACpB,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,SAAS,IAAI,qBAAqB,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YACrE,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7E,MAAM,cAAc,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YAE3D,4CAA4C;YAC5C,MAAM,WAAW,GAAoB,EAAE,GAAG,gBAAgB,EAAE,CAAC;YAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC1D,WAAW,CAAC,GAAG,CAAC,GAAG,KAAqB,CAAC;YAC3C,CAAC;YACD,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YAE/E,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAA4B,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,0CAA0C;QAC1C,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,sEAAsE;QACtE,IAAI,gBAAgB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,kBAAkB,CACzB,kBAAkB,EAClB,gBAAuB,CACxB,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,mBAAmB,CAAC,WAAyB;QAClD,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAAC,MAAoB;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAExC,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,IAAI,qBAAqB,CAAC,mBAAmB,CAAC,WAA2B,CAAC,EAAE,CAAC;oBAC3E,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CAEF","sourcesContent":["/**\n * Resource Summary Utilities\n *\n * Utilities for deriving summary schemas from main schemas using decorators.\n * Summary schemas are lighter versions used for list/search operations.\n *\n * @see Section 4.3 of RESOURCE_DERIVED_OBJECTS_RATIONALIZATION.md\n */\n\nimport { z } from 'zod';\nimport {\n  getZodObjectShape,\n  isSummaryField,\n  isBackendOnlyField,\n} from '@wildo-ai/zod-decorators';\nimport { ResourceConfiguration_InheritanceSchemaDefinition } from '../resources-config.shared.schemas';\nimport { isNonDisclosableFieldValue } from './field-value-disclosure.utils';\n\n/**\n * Options for deriving a summary schema\n */\nexport interface DeriveSummaryOptions {\n  /** Always include _id field (default: true) */\n  includeId?: boolean;\n  /** Include foreign key fields automatically (default: false) */\n  includeForeignKeys?: boolean;\n  /** Additional fields to include regardless of decorators */\n  additionalFields?: string[];\n  /** Fields to exclude regardless of decorators */\n  excludeFields?: string[];\n}\n\n/**\n * Result of summary schema validation\n */\nexport interface SummaryValidationResult {\n  valid: boolean;\n  issues: string[];\n}\n\n/**\n * Default summary derivation options\n */\nconst DEFAULT_DERIVE_OPTIONS: DeriveSummaryOptions = {\n  includeId: true,\n  includeForeignKeys: false,\n  additionalFields: [],\n  excludeFields: [],\n};\n\n/**\n * Mutable shape type for building schemas\n */\ntype MutableZodShape = Record<string, z.ZodTypeAny>;\n\n/**\n * Utility class for deriving and validating summary schemas.\n */\nexport class ResourcesSummaryUtils {\n\n  /**\n   * Derive a summary schema from a main schema using decorator metadata.\n   *\n   * Rules:\n   * - Include fields with `isSummaryField` decorator\n   * - Include virtual fields that have BOTH `isVirtual` AND `isSummaryField` decorators\n   * - Skip `isBackendOnly` fields\n   * - Always include `_id` (unless explicitly excluded)\n   * - Do NOT auto-include `isForeignKey` fields (must be explicit)\n   *\n   * @param mainSchema - The main schema to derive from\n   * @param options - Configuration options\n   * @returns A new Zod schema containing only summary fields\n   */\n  static deriveSummarySchema(\n    mainSchema: z.ZodTypeAny,\n    options?: DeriveSummaryOptions\n  ): z.ZodObject<z.ZodRawShape> {\n    const opts = { ...DEFAULT_DERIVE_OPTIONS, ...options };\n    const shape = getZodObjectShape(mainSchema);\n    const summaryShape: MutableZodShape = {};\n\n    // Always include _id if requested\n    if (opts.includeId && shape._id) {\n      summaryShape._id = shape._id as z.ZodTypeAny;\n    }\n\n    // Include additional explicitly requested fields\n    for (const field of opts.additionalFields || []) {\n      if (shape[field] && !opts.excludeFields?.includes(field)) {\n        summaryShape[field] = shape[field] as z.ZodTypeAny;\n      }\n    }\n\n    // Scan all fields for isSummaryField decorator\n    for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n      // Skip if already added or excluded\n      if (summaryShape[fieldName] || opts.excludeFields?.includes(fieldName)) {\n        continue;\n      }\n\n      const typedSchema = fieldSchema as z.ZodTypeAny;\n\n      // Skip backend-only fields\n      if (isBackendOnlyField(typedSchema)) {\n        continue;\n      }\n\n      // Include if has isSummaryField decorator\n      if (isSummaryField(typedSchema)) {\n        // Virtual fields with isSummaryField are also included\n        // The virtual field computation happens at the service layer\n        summaryShape[fieldName] = typedSchema;\n      }\n    }\n\n    return z.object(summaryShape as z.ZodRawShape);\n  }\n\n  /**\n   * Validate that a summary schema does not contain backend-only fields.\n   *\n   * @param summarySchema - The summary schema to validate\n   * @param mainSchema - The main schema for reference\n   * @returns Validation result with issues list\n   */\n  static validateSummarySchema(\n    summarySchema: z.ZodTypeAny,\n    mainSchema: z.ZodTypeAny\n  ): SummaryValidationResult {\n    const issues: string[] = [];\n\n    try {\n      const summaryShape = getZodObjectShape(summarySchema);\n      const mainShape = getZodObjectShape(mainSchema);\n\n      for (const [fieldName] of Object.entries(summaryShape)) {\n        const mainFieldSchema = mainShape[fieldName];\n\n        if (mainFieldSchema && isBackendOnlyField(mainFieldSchema as z.ZodTypeAny)) {\n          issues.push(\n            `Field '${fieldName}' has isBackendOnly decorator but is included in summary schema`\n          );\n        }\n      }\n    } catch (error) {\n      issues.push(`Failed to validate summary schema: ${error}`);\n    }\n\n    return {\n      valid: issues.length === 0,\n      issues,\n    };\n  }\n\n  /**\n   * Derive summary schema for a discriminated union (inheritance).\n   *\n   * Creates a discriminated union of summary schemas where:\n   * - Base summary fields apply to all variants\n   * - Variant-specific summary fields apply only to that variant\n   * - Discriminator field is always included in all variants\n   *\n   * @param mainSchema - The base schema\n   * @param inheritanceDefinition - The inheritance schema definition\n   * @param options - Derivation options\n   * @returns A discriminated union summary schema or base summary\n   */\n  static deriveSummarySchemaForDiscriminatedUnion<\n    TMainSchema extends z.ZodObject<z.ZodRawShape>\n  >(\n    mainSchema: TMainSchema,\n    inheritanceDefinition: ResourceConfiguration_InheritanceSchemaDefinition<any, TMainSchema>,\n    options?: DeriveSummaryOptions\n  ): z.ZodTypeAny {\n\n    const discriminatorField = inheritanceDefinition.discriminatorField;\n    const baseSummary = this.deriveSummarySchema(mainSchema, options);\n    const baseShape = getZodObjectShape(baseSummary);\n\n    // Ensure discriminator field is included - create mutable copy\n    const mainShape = getZodObjectShape(mainSchema);\n    const mutableBaseShape: MutableZodShape = {};\n    for (const [key, value] of Object.entries(baseShape)) {\n      mutableBaseShape[key] = value as z.ZodTypeAny;\n    }\n    if (!mutableBaseShape[discriminatorField] && mainShape[discriminatorField]) {\n      mutableBaseShape[discriminatorField] = mainShape[discriminatorField] as z.ZodTypeAny;\n    }\n\n    const variantSummaries: z.ZodObject<z.ZodRawShape>[] = [];\n\n    // Add base variants (values without inheritance)\n    const baseValues = inheritanceDefinition.withoutInheritanceDiscriminatorFieldValues || [];\n    for (const value of baseValues) {\n      variantSummaries.push(\n        z.object({\n          ...mutableBaseShape,\n          [discriminatorField]: z.literal(value),\n        } as z.ZodRawShape)\n      );\n    }\n\n    // Add inherited variant summaries\n    for (const inherited of inheritanceDefinition.inheritedSchemas || []) {\n      const inheritedSummary = this.deriveSummarySchema(inherited.schema, options);\n      const inheritedShape = getZodObjectShape(inheritedSummary);\n\n      // Merge base summary with inherited summary\n      const mergedShape: MutableZodShape = { ...mutableBaseShape };\n      for (const [key, value] of Object.entries(inheritedShape)) {\n        mergedShape[key] = value as z.ZodTypeAny;\n      }\n      mergedShape[discriminatorField] = z.literal(inherited.discriminatorFieldValue);\n\n      variantSummaries.push(z.object(mergedShape as z.ZodRawShape));\n    }\n\n    // If only one variant, return it directly\n    if (variantSummaries.length === 1) {\n      return variantSummaries[0];\n    }\n\n    // Create discriminated union (use any to avoid Zod 4 type complexity)\n    if (variantSummaries.length >= 2) {\n      return z.discriminatedUnion(\n        discriminatorField,\n        variantSummaries as any\n      );\n    }\n\n    // Fallback to base summary if no variants\n    return baseSummary;\n  }\n\n  /**\n   * Is this a summary field whose VALUE may be disclosed?\n   *\n   * Both halves are load-bearing. `isSummaryField` is the application's declaration that the field\n   * is the human-readable face of a row; {@link isNonDisclosableFieldValue} is the framework's\n   * answer to whether that value may leave the backend at all — and the application's declaration\n   * never overrides it. A field declared BOTH `.isSummaryField()` and `.isWriteOnlySecret()` is\n   * legal to author and must not be rendered anywhere a response DTO would have masked it.\n   *\n   * The disclosure half is DERIVED, never restated here: it is the same predicate the subject-export\n   * surface withholds on, so the two cannot drift (issue #95).\n   */\n  static isValidSummaryField(fieldSchema: z.ZodTypeAny): boolean {\n    return isSummaryField(fieldSchema) && !isNonDisclosableFieldValue(fieldSchema);\n  }\n\n  /**\n   * Get all summary field names from a schema whose values may be disclosed.\n   *\n   * Routed through {@link isValidSummaryField} rather than repeating its test — the two said the\n   * same thing in two places, and when the disclosure rule grew from \"not backend-only\" to the full\n   * boundary, one of them would have been updated and the other left behind. That is the defect\n   * class this whole change is about, in miniature.\n   */\n  static getSummaryFieldNames(schema: z.ZodTypeAny): string[] {\n    const result: string[] = [];\n\n    try {\n      const shape = getZodObjectShape(schema);\n\n      for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n        if (ResourcesSummaryUtils.isValidSummaryField(fieldSchema as z.ZodTypeAny)) {\n          result.push(fieldName);\n        }\n      }\n    } catch {\n      // Schema may not be an object\n    }\n\n    return result;\n  }\n\n}\n"]}

package/dist/esm/resources/utils/shared-persistence-collection.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared-persistence-collection.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,eAAO,MAAM,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI3F,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CAAC,YAAY,EAAE,YAAY,GAAG,MAAM,CAEzF;AAED,iGAAiG;AACjG,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAClE;AAED,gFAAgF;AAChF,MAAM,WAAW,6CAA6C;IAC5D,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,EAAE,CAAC;IAC9F,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,kDAAkD,CAChE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,EACnF,yBAAyB,EAAE,sBAAsB,GAChD,6CAA6C,EAAE,CAsDjD;AAED,mGAAmG;AACnG,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,oBAAoB,CAAA;KAAE,GAAG,SAAS,CAAC;CACxE;AAyBD,iFAAiF;AACjF,MAAM,WAAW,+CAA+C;IAC9D,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CAAA;KAAE,EAAE,CAAC;IACrG,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,oDAAoD,CAClE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,6CAA6C,CAAC,GACpF,+CAA+C,EAAE,CA0DnD"}
+{"version":3,"file":"shared-persistence-collection.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,eAAO,MAAM,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAe3F,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CAAC,YAAY,EAAE,YAAY,GAAG,MAAM,CAEzF;AAED,iGAAiG;AACjG,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAClE;AAED,gFAAgF;AAChF,MAAM,WAAW,6CAA6C;IAC5D,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,EAAE,CAAC;IAC9F,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,kDAAkD,CAChE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,EACnF,yBAAyB,EAAE,sBAAsB,GAChD,6CAA6C,EAAE,CAsDjD;AAED,mGAAmG;AACnG,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,oBAAoB,CAAA;KAAE,GAAG,SAAS,CAAC;CACxE;AAyBD,iFAAiF;AACjF,MAAM,WAAW,+CAA+C;IAC9D,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CAAA;KAAE,EAAE,CAAC;IACrG,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,oDAAoD,CAClE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,6CAA6C,CAAC,GACpF,+CAA+C,EAAE,CA0DnD"}

package/dist/esm/resources/utils/shared-persistence-collection.utils.js

@@ -53,6 +53,17 @@ export const RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES = {
     [CoreResourceType.USER_SELF]: CoreResourceType.USERS,
     [CoreResourceType.USER_SELF_PROFILES]: CoreResourceType.USER_PROFILES,
     [CoreResourceType.USER_SELF_PREFERENCES]: CoreResourceType.USER_PREFERENCES,
+    /*
+     * The application-scoped audit door addresses the organization-scoped resource's rows (#317).
+     *
+     * Unlike the `USER_SELF` group above — where the alias exists so a principal can address its OWN
+     * row through a narrower door — this pair exists because the two doors see DIFFERENT SUBSETS of
+     * one set: the organization door is tenant-filtered and structurally cannot return the rows that
+     * carry no organization (logins, session evictions, application-wide policy changes), which is
+     * 74% of them on a measured dogfood application. Splitting the storage would split the audit
+     * trail itself, so the alias is load-bearing rather than a convenience.
+     */
+    [CoreResourceType.APPLICATION_AUDIT_LOGS]: CoreResourceType.AUDIT_LOGS,
 };
 /**
  * The persistence collection a resource type's rows live in — its alias target

package/dist/esm/resources/utils/shared-persistence-collection.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared-persistence-collection.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAKxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK;IACpD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,aAAa;IACrE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,gBAAgB,CAAC,gBAAgB;CAC5E,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,YAA0B;IAC/E,OAAO,8CAA8C,CAAC,YAAsB,CAAC,IAAK,YAAuB,CAAC;AAC5G,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,kDAAkD,CAChE,sBAAmF,EACnF,yBAAiD;IAEjD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,2FAA2F;QAC3F,0EAA0E;QAC1E,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG;YACZ,YAAY;YACZ,OAAO,EAAE,cAAc,EAAE,kBAAkB,IAAI,yBAAyB;SACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAoD,EAAE,CAAC;IAEzE,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,sBAAsB,cAAc,+BAA+B;gBAChG,8FAA8F;gBAC9F,gGAAgG;gBAChG,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,+FAA+F;gBAC/F,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAAC,eAA4D;IAC5F,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAA0C,CAAC;SACvE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,oDAAoD,CAClE,sBAAqF;IAErF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG;YACd,YAAY;YACZ,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI;YAC3C,UAAU,EAAE,wBAAwB,CAAC,cAAc,EAAE,eAAe,CAAC;SACtE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAsD,EAAE,CAAC;IAE3E,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;aACnG,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,uBAAuB,cAAc,2BAA2B;gBAC7F,gGAAgG;gBAChG,+FAA+F;gBAC/F,iGAAiG;gBACjG,+FAA+F;gBAC/F,2FAA2F;gBAC3F,6FAA6F;gBAC7F,gGAAgG;gBAChG,6FAA6F;gBAC7F,8BAA8B;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import { CoreResourceType } from '../resources.shared.core.definitions';\nimport type { ResourceType } from '../resources.shared.schemas';\nimport type { PersistenceAdapterType } from '../resources-config.shared.schemas';\nimport { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Resource types that deliberately project onto ANOTHER resource type's\n * persistence collection — THE authority for \"which configs address the same\n * physical rows?\".\n *\n * ## What this expresses\n *\n * A `USER_SELF*` resource is not a different record set; it is a different DOOR\n * onto the SAME record set, with its own operations, roles and scoping. The\n * `USERS` door is the admin surface (list every user, delete a user); the\n * `USER_SELF` door is the self surface (read/update MY row). They intentionally\n * share `UserSchema` and they intentionally share storage — the persistence\n * layer builds a SEPARATE model per resource config over ONE collection.\n *\n * Anything not listed here stores under its own resource type.\n *\n * ## Why it is a single named authority\n *\n * This mapping had already been copied twice inside the backend (the\n * zod→mongoose model builder, which is what actually creates and reads the\n * collection, and the aggregation collection resolver — whose earlier\n * divergence made every aggregation query a non-existent collection and return\n * zero rows). It now has a third consumer of a completely different kind:\n * {@link findSharedPersistenceCollectionRetentionIncoherences}, a boot-time\n * coherence guard. A per-resource config factory structurally cannot see this\n * relationship — it validates ONE config at a time — so the fact has to live\n * where every layer can read it, and it has to live exactly once.\n *\n * ## The alias belongs to the RESOURCE, not to the storage adapter\n *\n * Every persistence path resolves through this map, and each adapter has\n * exactly ONE composition point that does so: MongoDB's model builder and its\n * aggregation resolver, and — on the SQL side — the single\n * `resolveTableNameForResource` helper that the hybrid planner, the PostgreSQL\n * repository and the boot-time table verifier all call.\n *\n * This was NOT always true, and the way it failed is the reason to keep it\n * true: PostgreSQL used to derive its table name straight from\n * `resourceIdentifier`, so `USER_SELF` planned, wrote and verified a `userself`\n * table while `USERS` used `users`. An adapter choice must never silently\n * change WHICH RECORDS a resource addresses — that is not a storage detail, it\n * is the \"two doors, one record set\" contract itself. On the SQL side the\n * resolved name is additionally normalised into a SQL identifier; casing is an\n * adapter concern, the alias is not.\n *\n * The one thing a shared resolver still cannot see is an alias group whose\n * members are pointed at DIFFERENT adapters — each config is individually\n * valid, and only the pair is wrong. That is what\n * {@link findSharedPersistenceCollectionAdapterIncoherences} fails closed on.\n */\nexport const RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES: Readonly<Record<string, string>> = {\n  [CoreResourceType.USER_SELF]: CoreResourceType.USERS,\n  [CoreResourceType.USER_SELF_PROFILES]: CoreResourceType.USER_PROFILES,\n  [CoreResourceType.USER_SELF_PREFERENCES]: CoreResourceType.USER_PREFERENCES,\n};\n\n/**\n * The persistence collection a resource type's rows live in — its alias target\n * when it declares one, otherwise the resource type itself.\n *\n * @param resourceType - the resource type whose storage location is wanted.\n * @returns the collection name, as a plain string.\n */\nexport function resolveSharedPersistenceCollectionName(resourceType: ResourceType): string {\n  return RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES[resourceType as string] ?? (resourceType as string);\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionAdapterIncoherences} reads. */\nexport interface SharedPersistenceCollectionAdapterCandidate {\n  readonly resourceIdentifier: ResourceType;\n  /** The config's OWN declaration; `undefined` means \"inherit the application default\". */\n  readonly persistenceAdapter?: PersistenceAdapterType | undefined;\n}\n\n/** One collection whose resource configs are pointed at different databases. */\nexport interface SharedPersistenceCollectionAdapterIncoherence {\n  /** The shared collection the disagreeing configs claim to address. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the adapter it RESOLVED to. */\n  readonly adapters: readonly { resourceType: ResourceType; adapter: PersistenceAdapterType }[];\n  /** Operator-facing explanation naming the consequence and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must resolve to the SAME persistence adapter.\n *\n * ## Why the shared resolver cannot cover this on its own\n *\n * {@link resolveSharedPersistenceCollectionName} makes the alias\n * adapter-independent: whichever database a resource lands in, it addresses the\n * aliased NAME. That is necessary and not sufficient. A name is only an address\n * WITHIN one database, so pointing `USERS` at PostgreSQL while `USER_SELF`\n * inherits MongoDB yields two stores that both believe they own the same rows.\n * Nothing downstream can detect it: each config is individually valid, each\n * repository is correctly built, and every per-resource check passes.\n *\n * ## The failure it prevents\n *\n * The doors silently stop sharing records. The admin door lists users the self\n * door cannot read; a self-service update writes to a row the admin door will\n * never see; and — because retention is enforced against ROWS — an erasure\n * performed through one door leaves the other door's copy completely\n * untouched, which is the same compliance-grade lie that\n * {@link findSharedPersistenceCollectionRetentionIncoherences} exists to\n * prevent, arrived at from a different direction.\n *\n * The table name is not the only thing that follows from the adapter. Id FORMAT\n * does too — the PostgreSQL repository validates ids as UUIDs while Mongo\n * expects ObjectIds, each resolved from its OWN resource's adapter — so a split\n * group would also reject through one door the very ids the other door mints.\n * Anything keyed on \"this resource's adapter\" inherits this invariant.\n *\n * ## Why this is permanent, not a capability gate\n *\n * Unlike adapter gaps that close when the missing support is implemented, this\n * one has no future in which it becomes valid: two databases cannot hold one\n * set of rows. It is deliberately NOT a ban on aliased resources using\n * PostgreSQL — an alias group that agrees on PostgreSQL resolves to one shared\n * table, and whether that table was actually provisioned is a separate,\n * already-enforced question (the boot-time table verifier).\n *\n * Resources inherit the application default when they declare nothing, so the\n * caller supplies the resolved default rather than this function guessing it.\n *\n * Pure and side-effect free: it reports, the caller throws.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @param defaultPersistenceAdapter - the adapter a config with no declaration inherits.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionAdapterIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionAdapterCandidate>,\n  defaultPersistenceAdapter: PersistenceAdapterType,\n): SharedPersistenceCollectionAdapterIncoherence[] {\n  const adaptersByCollection = new Map<\n    string,\n    { resourceType: ResourceType; adapter: PersistenceAdapterType }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Same reasoning as the retention guard: prefer the config's OWN identifier so a mis-keyed\n    // registry entry is diagnosed against the name its author actually wrote.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const entry = {\n      resourceType,\n      adapter: resourceConfig?.persistenceAdapter ?? defaultPersistenceAdapter,\n    };\n\n    const existing = adaptersByCollection.get(collectionName);\n    if (existing) {\n      existing.push(entry);\n    } else {\n      adaptersByCollection.set(collectionName, [entry]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionAdapterIncoherence[] = [];\n\n  for (const [collectionName, adapters] of adaptersByCollection) {\n    if (adapters.length < 2) {\n      continue;\n    }\n    if (new Set(adapters.map((entry) => entry.adapter)).size < 2) {\n      continue;\n    }\n\n    const declared = adapters\n      .map((entry) => `'${String(entry.resourceType)}' → ${entry.adapter}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      adapters,\n      message:\n        `Resource configs [${declared}] all address the '${collectionName}' persistence collection but ` +\n        `resolve to DIFFERENT persistence adapters. These configs are separate doors onto ONE set of ` +\n        `rows, and a collection name only addresses rows within a single database, so this splits them ` +\n        `across two stores that each believe they own the records: the admin door lists rows the self ` +\n        `door cannot read, a self-service write lands where the admin door will never see it, and an ` +\n        `erasure performed through one door leaves the other door's copy fully intact. Give every ` +\n        `config listed above the same persistenceAdapter (a resource sharing a collection cannot pick ` +\n        `its database alone), or stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionRetentionIncoherences} reads. */\nexport interface SharedPersistenceCollectionRetentionCandidate {\n  readonly resourceIdentifier: ResourceType;\n  readonly retentionPolicy?: { mode?: ErasureRetentionMode } | undefined;\n}\n\n/**\n * Canonical comparison key for a resource's retention POSTURE.\n *\n * Compares the WHOLE resolved policy, not just `mode`. `ResourceRetentionPolicy` carries a single\n * axis today, so `mode` alone would be exhaustive — but this guard exists precisely because config\n * checks that look sufficient go quietly wrong later, and a second axis (a disposal clock, a\n * jurisdiction) added to the policy would otherwise escape the comparison with no compile-time\n * signal. Two configs over one collection must agree on ALL of it.\n *\n * Key order is normalised so authoring order cannot masquerade as a disagreement. `undefined` gets\n * its own key rather than being skipped: \"rows of this resource are hard-deleted\" is a positive\n * claim, and the in-vs-out asymmetry is what produces both failure modes documented below.\n */\nfunction buildRetentionPostureKey(retentionPolicy: { mode?: ErasureRetentionMode } | undefined): string {\n  if (retentionPolicy === undefined || retentionPolicy === null) {\n    return 'NOT_GOVERNED';\n  }\n  const entries = Object.entries(retentionPolicy as Record<string, unknown>)\n    .filter(([, value]) => value !== undefined)\n    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n  return entries.length === 0 ? 'NOT_GOVERNED' : JSON.stringify(entries);\n}\n\n/** One collection whose resource configs disagree about retention governance. */\nexport interface SharedPersistenceCollectionRetentionIncoherence {\n  /** The shared collection the disagreeing configs write to. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the posture it declared. */\n  readonly postures: readonly { resourceType: ResourceType; mode: ErasureRetentionMode | undefined }[];\n  /** Operator-facing explanation naming both failure modes and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must declare the SAME retention posture.\n *\n * ## Why a config that passes every per-resource check can still be broken\n *\n * `retentionPolicy` is validated PER RESOURCE CONFIG by the config factory: it\n * checks that resource's operations, its field treatments, its system-access\n * grants. It cannot check what a SIBLING config declares, because a factory\n * invocation never sees one. But retention is enforced against ROWS, and two\n * configs can own the same rows (see\n * {@link RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES}). So a pair that\n * disagrees produces a config where every individual resource is valid and the\n * COLLECTION is not.\n *\n * ## The two concrete failure modes\n *\n * **1. Fail-open erasure.** The retention hide filter (rows marked `RETAINED`\n * are invisible) and the immutability freeze are injected per resource config,\n * in `buildContextualFilter`. A row erased through the governed door stays\n * fully READABLE and UPDATABLE through the ungoverned one. For the\n * `USERS`/`USER_SELF` pair that ungoverned door exposes READ + UPDATE to\n * `APP_USER` — i.e. the erased subject can still read and edit their own\n * \"erased\" record. The row is erased only from the door that was opted in,\n * which is a compliance-grade lie about the record.\n *\n * **2. Unique-index collision — a hard functional abort.** A retention-governed\n * config scopes each unique index to NON-retained rows (a partial filter on the\n * retention marker), precisely so scrubbed rows leave the index and cannot\n * collide on the shared mask value. An ungoverned config over the same\n * collection emits a PLAIN unique index on the same field. The FIRST erasure\n * succeeds; the SECOND writes the same mask value, hits the plain index, and\n * fails E11000 — inside the erasure transaction, so the whole erasure rolls\n * back. The capability is silently single-use.\n *\n * Both modes are invisible until a real erasure runs, which is why this is a\n * BOOT-time guard and not a test: the point is that a config which passes at\n * boot must actually be able to perform an erasure.\n *\n * ## Why \"one opted in, one not\" is a disagreement, not a default\n *\n * An absent `retentionPolicy` is a positive statement — \"rows of this resource\n * are hard-deleted\" — not an unset value the governed sibling can supply. Both\n * failure modes above are produced by exactly that asymmetry, so `undefined`\n * participates in the comparison as its own posture rather than being skipped.\n *\n * Pure and side-effect free: it reports, the caller throws. That keeps the\n * shared-collection fact and its invariant in the layer both persistence and\n * validation can import, while the registry owns the error shape.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionRetentionIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionRetentionCandidate>,\n): SharedPersistenceCollectionRetentionIncoherence[] {\n  const posturesByCollection = new Map<\n    string,\n    { resourceType: ResourceType; mode: ErasureRetentionMode | undefined; postureKey: string }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Prefer the config's OWN identifier over the map key: the registry keys by resource type, but a\n    // host that mis-keyed an entry would otherwise be diagnosed against a name it never authored.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const posture = {\n      resourceType,\n      mode: resourceConfig?.retentionPolicy?.mode,\n      postureKey: buildRetentionPostureKey(resourceConfig?.retentionPolicy),\n    };\n\n    const existing = posturesByCollection.get(collectionName);\n    if (existing) {\n      existing.push(posture);\n    } else {\n      posturesByCollection.set(collectionName, [posture]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionRetentionIncoherence[] = [];\n\n  for (const [collectionName, postures] of posturesByCollection) {\n    if (postures.length < 2) {\n      continue;\n    }\n    const distinctPostures = new Set(postures.map((posture) => posture.postureKey));\n    if (distinctPostures.size < 2) {\n      continue;\n    }\n\n    const declared = postures\n      .map((posture) => `'${String(posture.resourceType)}' → ${posture.mode ?? 'NOT retention-governed'}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      postures,\n      message:\n        `Resource configs [${declared}] all store in the '${collectionName}' collection but declare ` +\n        `DIFFERENT retention postures. They are separate models over ONE set of rows, and retention is ` +\n        `enforced per resource config, so this ships two defects that only appear when a real erasure ` +\n        `runs: (1) FAIL-OPEN ERASURE — the retention hide filter and the immutability freeze are absent ` +\n        `on the ungoverned door, leaving an erased row readable and updatable there; (2) UNIQUE-INDEX ` +\n        `COLLISION — the governed config scopes its unique indexes to non-retained rows while the ` +\n        `ungoverned one emits plain unique indexes on the same collection, so the SECOND erased row ` +\n        `collides (E11000) and the erasure transaction rolls back. Declare the SAME retentionPolicy on ` +\n        `every config listed above (a resource sharing a collection cannot opt in or out alone), or ` +\n        `stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n"]}
+{"version":3,"file":"shared-persistence-collection.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAKxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK;IACpD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,aAAa;IACrE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,gBAAgB,CAAC,gBAAgB;IAC3E;;;;;;;;;OASG;IACH,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,UAAU;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,YAA0B;IAC/E,OAAO,8CAA8C,CAAC,YAAsB,CAAC,IAAK,YAAuB,CAAC;AAC5G,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,kDAAkD,CAChE,sBAAmF,EACnF,yBAAiD;IAEjD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,2FAA2F;QAC3F,0EAA0E;QAC1E,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG;YACZ,YAAY;YACZ,OAAO,EAAE,cAAc,EAAE,kBAAkB,IAAI,yBAAyB;SACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAoD,EAAE,CAAC;IAEzE,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,sBAAsB,cAAc,+BAA+B;gBAChG,8FAA8F;gBAC9F,gGAAgG;gBAChG,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,+FAA+F;gBAC/F,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAAC,eAA4D;IAC5F,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAA0C,CAAC;SACvE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,oDAAoD,CAClE,sBAAqF;IAErF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG;YACd,YAAY;YACZ,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI;YAC3C,UAAU,EAAE,wBAAwB,CAAC,cAAc,EAAE,eAAe,CAAC;SACtE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAsD,EAAE,CAAC;IAE3E,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;aACnG,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,uBAAuB,cAAc,2BAA2B;gBAC7F,gGAAgG;gBAChG,+FAA+F;gBAC/F,iGAAiG;gBACjG,+FAA+F;gBAC/F,2FAA2F;gBAC3F,6FAA6F;gBAC7F,gGAAgG;gBAChG,6FAA6F;gBAC7F,8BAA8B;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import { CoreResourceType } from '../resources.shared.core.definitions';\nimport type { ResourceType } from '../resources.shared.schemas';\nimport type { PersistenceAdapterType } from '../resources-config.shared.schemas';\nimport { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Resource types that deliberately project onto ANOTHER resource type's\n * persistence collection — THE authority for \"which configs address the same\n * physical rows?\".\n *\n * ## What this expresses\n *\n * A `USER_SELF*` resource is not a different record set; it is a different DOOR\n * onto the SAME record set, with its own operations, roles and scoping. The\n * `USERS` door is the admin surface (list every user, delete a user); the\n * `USER_SELF` door is the self surface (read/update MY row). They intentionally\n * share `UserSchema` and they intentionally share storage — the persistence\n * layer builds a SEPARATE model per resource config over ONE collection.\n *\n * Anything not listed here stores under its own resource type.\n *\n * ## Why it is a single named authority\n *\n * This mapping had already been copied twice inside the backend (the\n * zod→mongoose model builder, which is what actually creates and reads the\n * collection, and the aggregation collection resolver — whose earlier\n * divergence made every aggregation query a non-existent collection and return\n * zero rows). It now has a third consumer of a completely different kind:\n * {@link findSharedPersistenceCollectionRetentionIncoherences}, a boot-time\n * coherence guard. A per-resource config factory structurally cannot see this\n * relationship — it validates ONE config at a time — so the fact has to live\n * where every layer can read it, and it has to live exactly once.\n *\n * ## The alias belongs to the RESOURCE, not to the storage adapter\n *\n * Every persistence path resolves through this map, and each adapter has\n * exactly ONE composition point that does so: MongoDB's model builder and its\n * aggregation resolver, and — on the SQL side — the single\n * `resolveTableNameForResource` helper that the hybrid planner, the PostgreSQL\n * repository and the boot-time table verifier all call.\n *\n * This was NOT always true, and the way it failed is the reason to keep it\n * true: PostgreSQL used to derive its table name straight from\n * `resourceIdentifier`, so `USER_SELF` planned, wrote and verified a `userself`\n * table while `USERS` used `users`. An adapter choice must never silently\n * change WHICH RECORDS a resource addresses — that is not a storage detail, it\n * is the \"two doors, one record set\" contract itself. On the SQL side the\n * resolved name is additionally normalised into a SQL identifier; casing is an\n * adapter concern, the alias is not.\n *\n * The one thing a shared resolver still cannot see is an alias group whose\n * members are pointed at DIFFERENT adapters — each config is individually\n * valid, and only the pair is wrong. That is what\n * {@link findSharedPersistenceCollectionAdapterIncoherences} fails closed on.\n */\nexport const RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES: Readonly<Record<string, string>> = {\n  [CoreResourceType.USER_SELF]: CoreResourceType.USERS,\n  [CoreResourceType.USER_SELF_PROFILES]: CoreResourceType.USER_PROFILES,\n  [CoreResourceType.USER_SELF_PREFERENCES]: CoreResourceType.USER_PREFERENCES,\n  /*\n   * The application-scoped audit door addresses the organization-scoped resource's rows (#317).\n   *\n   * Unlike the `USER_SELF` group above — where the alias exists so a principal can address its OWN\n   * row through a narrower door — this pair exists because the two doors see DIFFERENT SUBSETS of\n   * one set: the organization door is tenant-filtered and structurally cannot return the rows that\n   * carry no organization (logins, session evictions, application-wide policy changes), which is\n   * 74% of them on a measured dogfood application. Splitting the storage would split the audit\n   * trail itself, so the alias is load-bearing rather than a convenience.\n   */\n  [CoreResourceType.APPLICATION_AUDIT_LOGS]: CoreResourceType.AUDIT_LOGS,\n};\n\n/**\n * The persistence collection a resource type's rows live in — its alias target\n * when it declares one, otherwise the resource type itself.\n *\n * @param resourceType - the resource type whose storage location is wanted.\n * @returns the collection name, as a plain string.\n */\nexport function resolveSharedPersistenceCollectionName(resourceType: ResourceType): string {\n  return RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES[resourceType as string] ?? (resourceType as string);\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionAdapterIncoherences} reads. */\nexport interface SharedPersistenceCollectionAdapterCandidate {\n  readonly resourceIdentifier: ResourceType;\n  /** The config's OWN declaration; `undefined` means \"inherit the application default\". */\n  readonly persistenceAdapter?: PersistenceAdapterType | undefined;\n}\n\n/** One collection whose resource configs are pointed at different databases. */\nexport interface SharedPersistenceCollectionAdapterIncoherence {\n  /** The shared collection the disagreeing configs claim to address. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the adapter it RESOLVED to. */\n  readonly adapters: readonly { resourceType: ResourceType; adapter: PersistenceAdapterType }[];\n  /** Operator-facing explanation naming the consequence and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must resolve to the SAME persistence adapter.\n *\n * ## Why the shared resolver cannot cover this on its own\n *\n * {@link resolveSharedPersistenceCollectionName} makes the alias\n * adapter-independent: whichever database a resource lands in, it addresses the\n * aliased NAME. That is necessary and not sufficient. A name is only an address\n * WITHIN one database, so pointing `USERS` at PostgreSQL while `USER_SELF`\n * inherits MongoDB yields two stores that both believe they own the same rows.\n * Nothing downstream can detect it: each config is individually valid, each\n * repository is correctly built, and every per-resource check passes.\n *\n * ## The failure it prevents\n *\n * The doors silently stop sharing records. The admin door lists users the self\n * door cannot read; a self-service update writes to a row the admin door will\n * never see; and — because retention is enforced against ROWS — an erasure\n * performed through one door leaves the other door's copy completely\n * untouched, which is the same compliance-grade lie that\n * {@link findSharedPersistenceCollectionRetentionIncoherences} exists to\n * prevent, arrived at from a different direction.\n *\n * The table name is not the only thing that follows from the adapter. Id FORMAT\n * does too — the PostgreSQL repository validates ids as UUIDs while Mongo\n * expects ObjectIds, each resolved from its OWN resource's adapter — so a split\n * group would also reject through one door the very ids the other door mints.\n * Anything keyed on \"this resource's adapter\" inherits this invariant.\n *\n * ## Why this is permanent, not a capability gate\n *\n * Unlike adapter gaps that close when the missing support is implemented, this\n * one has no future in which it becomes valid: two databases cannot hold one\n * set of rows. It is deliberately NOT a ban on aliased resources using\n * PostgreSQL — an alias group that agrees on PostgreSQL resolves to one shared\n * table, and whether that table was actually provisioned is a separate,\n * already-enforced question (the boot-time table verifier).\n *\n * Resources inherit the application default when they declare nothing, so the\n * caller supplies the resolved default rather than this function guessing it.\n *\n * Pure and side-effect free: it reports, the caller throws.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @param defaultPersistenceAdapter - the adapter a config with no declaration inherits.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionAdapterIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionAdapterCandidate>,\n  defaultPersistenceAdapter: PersistenceAdapterType,\n): SharedPersistenceCollectionAdapterIncoherence[] {\n  const adaptersByCollection = new Map<\n    string,\n    { resourceType: ResourceType; adapter: PersistenceAdapterType }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Same reasoning as the retention guard: prefer the config's OWN identifier so a mis-keyed\n    // registry entry is diagnosed against the name its author actually wrote.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const entry = {\n      resourceType,\n      adapter: resourceConfig?.persistenceAdapter ?? defaultPersistenceAdapter,\n    };\n\n    const existing = adaptersByCollection.get(collectionName);\n    if (existing) {\n      existing.push(entry);\n    } else {\n      adaptersByCollection.set(collectionName, [entry]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionAdapterIncoherence[] = [];\n\n  for (const [collectionName, adapters] of adaptersByCollection) {\n    if (adapters.length < 2) {\n      continue;\n    }\n    if (new Set(adapters.map((entry) => entry.adapter)).size < 2) {\n      continue;\n    }\n\n    const declared = adapters\n      .map((entry) => `'${String(entry.resourceType)}' → ${entry.adapter}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      adapters,\n      message:\n        `Resource configs [${declared}] all address the '${collectionName}' persistence collection but ` +\n        `resolve to DIFFERENT persistence adapters. These configs are separate doors onto ONE set of ` +\n        `rows, and a collection name only addresses rows within a single database, so this splits them ` +\n        `across two stores that each believe they own the records: the admin door lists rows the self ` +\n        `door cannot read, a self-service write lands where the admin door will never see it, and an ` +\n        `erasure performed through one door leaves the other door's copy fully intact. Give every ` +\n        `config listed above the same persistenceAdapter (a resource sharing a collection cannot pick ` +\n        `its database alone), or stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionRetentionIncoherences} reads. */\nexport interface SharedPersistenceCollectionRetentionCandidate {\n  readonly resourceIdentifier: ResourceType;\n  readonly retentionPolicy?: { mode?: ErasureRetentionMode } | undefined;\n}\n\n/**\n * Canonical comparison key for a resource's retention POSTURE.\n *\n * Compares the WHOLE resolved policy, not just `mode`. `ResourceRetentionPolicy` carries a single\n * axis today, so `mode` alone would be exhaustive — but this guard exists precisely because config\n * checks that look sufficient go quietly wrong later, and a second axis (a disposal clock, a\n * jurisdiction) added to the policy would otherwise escape the comparison with no compile-time\n * signal. Two configs over one collection must agree on ALL of it.\n *\n * Key order is normalised so authoring order cannot masquerade as a disagreement. `undefined` gets\n * its own key rather than being skipped: \"rows of this resource are hard-deleted\" is a positive\n * claim, and the in-vs-out asymmetry is what produces both failure modes documented below.\n */\nfunction buildRetentionPostureKey(retentionPolicy: { mode?: ErasureRetentionMode } | undefined): string {\n  if (retentionPolicy === undefined || retentionPolicy === null) {\n    return 'NOT_GOVERNED';\n  }\n  const entries = Object.entries(retentionPolicy as Record<string, unknown>)\n    .filter(([, value]) => value !== undefined)\n    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n  return entries.length === 0 ? 'NOT_GOVERNED' : JSON.stringify(entries);\n}\n\n/** One collection whose resource configs disagree about retention governance. */\nexport interface SharedPersistenceCollectionRetentionIncoherence {\n  /** The shared collection the disagreeing configs write to. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the posture it declared. */\n  readonly postures: readonly { resourceType: ResourceType; mode: ErasureRetentionMode | undefined }[];\n  /** Operator-facing explanation naming both failure modes and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must declare the SAME retention posture.\n *\n * ## Why a config that passes every per-resource check can still be broken\n *\n * `retentionPolicy` is validated PER RESOURCE CONFIG by the config factory: it\n * checks that resource's operations, its field treatments, its system-access\n * grants. It cannot check what a SIBLING config declares, because a factory\n * invocation never sees one. But retention is enforced against ROWS, and two\n * configs can own the same rows (see\n * {@link RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES}). So a pair that\n * disagrees produces a config where every individual resource is valid and the\n * COLLECTION is not.\n *\n * ## The two concrete failure modes\n *\n * **1. Fail-open erasure.** The retention hide filter (rows marked `RETAINED`\n * are invisible) and the immutability freeze are injected per resource config,\n * in `buildContextualFilter`. A row erased through the governed door stays\n * fully READABLE and UPDATABLE through the ungoverned one. For the\n * `USERS`/`USER_SELF` pair that ungoverned door exposes READ + UPDATE to\n * `APP_USER` — i.e. the erased subject can still read and edit their own\n * \"erased\" record. The row is erased only from the door that was opted in,\n * which is a compliance-grade lie about the record.\n *\n * **2. Unique-index collision — a hard functional abort.** A retention-governed\n * config scopes each unique index to NON-retained rows (a partial filter on the\n * retention marker), precisely so scrubbed rows leave the index and cannot\n * collide on the shared mask value. An ungoverned config over the same\n * collection emits a PLAIN unique index on the same field. The FIRST erasure\n * succeeds; the SECOND writes the same mask value, hits the plain index, and\n * fails E11000 — inside the erasure transaction, so the whole erasure rolls\n * back. The capability is silently single-use.\n *\n * Both modes are invisible until a real erasure runs, which is why this is a\n * BOOT-time guard and not a test: the point is that a config which passes at\n * boot must actually be able to perform an erasure.\n *\n * ## Why \"one opted in, one not\" is a disagreement, not a default\n *\n * An absent `retentionPolicy` is a positive statement — \"rows of this resource\n * are hard-deleted\" — not an unset value the governed sibling can supply. Both\n * failure modes above are produced by exactly that asymmetry, so `undefined`\n * participates in the comparison as its own posture rather than being skipped.\n *\n * Pure and side-effect free: it reports, the caller throws. That keeps the\n * shared-collection fact and its invariant in the layer both persistence and\n * validation can import, while the registry owns the error shape.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionRetentionIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionRetentionCandidate>,\n): SharedPersistenceCollectionRetentionIncoherence[] {\n  const posturesByCollection = new Map<\n    string,\n    { resourceType: ResourceType; mode: ErasureRetentionMode | undefined; postureKey: string }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Prefer the config's OWN identifier over the map key: the registry keys by resource type, but a\n    // host that mis-keyed an entry would otherwise be diagnosed against a name it never authored.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const posture = {\n      resourceType,\n      mode: resourceConfig?.retentionPolicy?.mode,\n      postureKey: buildRetentionPostureKey(resourceConfig?.retentionPolicy),\n    };\n\n    const existing = posturesByCollection.get(collectionName);\n    if (existing) {\n      existing.push(posture);\n    } else {\n      posturesByCollection.set(collectionName, [posture]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionRetentionIncoherence[] = [];\n\n  for (const [collectionName, postures] of posturesByCollection) {\n    if (postures.length < 2) {\n      continue;\n    }\n    const distinctPostures = new Set(postures.map((posture) => posture.postureKey));\n    if (distinctPostures.size < 2) {\n      continue;\n    }\n\n    const declared = postures\n      .map((posture) => `'${String(posture.resourceType)}' → ${posture.mode ?? 'NOT retention-governed'}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      postures,\n      message:\n        `Resource configs [${declared}] all store in the '${collectionName}' collection but declare ` +\n        `DIFFERENT retention postures. They are separate models over ONE set of rows, and retention is ` +\n        `enforced per resource config, so this ships two defects that only appear when a real erasure ` +\n        `runs: (1) FAIL-OPEN ERASURE — the retention hide filter and the immutability freeze are absent ` +\n        `on the ungoverned door, leaving an erased row readable and updatable there; (2) UNIQUE-INDEX ` +\n        `COLLISION — the governed config scopes its unique indexes to non-retained rows while the ` +\n        `ungoverned one emits plain unique indexes on the same collection, so the SECOND erased row ` +\n        `collides (E11000) and the erasure transaction rolls back. Declare the SAME retentionPolicy on ` +\n        `every config listed above (a resource sharing a collection cannot opt in or out alone), or ` +\n        `stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n"]}

package/dist/esm/runtime/domain-module.shared.definitions.d.ts

@@ -36,6 +36,18 @@ export interface SharedSaaSModule extends SharedDomainModule {
         defaultProfile?: string;
         unavailabilityPolicy?: Partial<FeatureConfiguration['unavailabilityPolicy']>;
     };
+    /**
+     * Progression milestones this module owns.
+     *
+     * ⚠️ **Milestones need the ANALYTICS capability enabled to appear at all.** The frontend fetches
+     * milestone definitions only when analytics is on and returns an empty list otherwise, so with it
+     * off the definitions never arrive and the progression tracker renders nothing — declared
+     * correctly, and invisible.
+     *
+     * Enabling analytics with an EMPTY provider list is what lights up the internal progression plane
+     * without any telemetry leaving the application. That is the configuration to reach for when an
+     * application wants progression and not tracking.
+     */
     customMilestoneDefinitions?: MilestoneDefinition[];
     productDefinitions?: ProductDefinition[];
     /**
@@ -44,6 +56,19 @@ export interface SharedSaaSModule extends SharedDomainModule {
      * an "incomplete todos" count). Aggregated across modules by
      * `buildSharedSaaSModulesRegistry` and threaded into the app init config, so a
      * module owns its badge concern end-to-end with no app-level wiring.
+     *
+     * The framework ships NO badges of its own — every badge in an application is one that application
+     * declared.
+     *
+     * Two limits worth knowing before designing around one. A badge is scoped to a USER or to an
+     * ORGANIZATION and to nothing else; there is no application-wide scope. And a DERIVED badge is
+     * recomputed off the resource operation's own dispatch, so a change written by some other route
+     * does not move it — a client sees the corrected count on its next connection rather than
+     * immediately.
+     *
+     * A badge reference that does not resolve renders nothing, deliberately. The configuration
+     * verifier is what makes that loud: an unresolvable badge reference on a launcher item is reported
+     * when the application's navigation content is checked.
      */
     notificationBadgeDefinitions?: NotificationBadgeDefinition[];
 }

package/dist/esm/runtime/domain-module.shared.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain-module.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../src/runtime/domain-module.shared.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAiC,MAAM,+CAA+C,CAAC;AAKzH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EACV,2CAA2C,EAC3C,8CAA8C,EAC/C,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAE1F;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAChD;AAED,wBAAgB,wBAAwB,CACtC,GAAG,OAAO,EAAE,kBAAkB,EAAE,GAC/B,kBAAkB,CAYpB;AACD,8DAA8D;AAE9D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,wBAAwB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IAC/D,0BAA0B,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;KAC9E,CAAC;IACF,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACnD,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC;;;;;;OAMG;IACH,4BAA4B,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAC9D;AACD,4DAA4D;AAE5D,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sBAAsB,EAAE,8CAA8C,CAAC;IACvE,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;IAC9C,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,wBAAwB,EAAE,iCAAiC,EAAE,CAAC;IAC9D,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;IAC5E,0BAA0B,EAAE,mBAAmB,EAAE,CAAC;IAClD,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,4BAA4B,EAAE,2BAA2B,EAAE,CAAC;CAC7D;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,OAAO,EAAE,gBAAgB,EAAE,GAC7B,yBAAyB,CAgD3B;AAED,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,yBAAyB,GAClC,+BAA+B,GAAG,SAAS,CAuC7C"}
+{"version":3,"file":"domain-module.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../src/runtime/domain-module.shared.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAiC,MAAM,+CAA+C,CAAC;AAKzH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EACV,2CAA2C,EAC3C,8CAA8C,EAC/C,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAE1F;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAChD;AAED,wBAAgB,wBAAwB,CACtC,GAAG,OAAO,EAAE,kBAAkB,EAAE,GAC/B,kBAAkB,CAYpB;AACD,8DAA8D;AAE9D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,wBAAwB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IAC/D,0BAA0B,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;KAC9E,CAAC;IACF;;;;;;;;;;;OAWG;IACH,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACnD,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,4BAA4B,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAC9D;AACD,4DAA4D;AAE5D,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sBAAsB,EAAE,8CAA8C,CAAC;IACvE,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;IAC9C,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,wBAAwB,EAAE,iCAAiC,EAAE,CAAC;IAC9D,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;IAC5E,0BAA0B,EAAE,mBAAmB,EAAE,CAAC;IAClD,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,4BAA4B,EAAE,2BAA2B,EAAE,CAAC;CAC7D;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,OAAO,EAAE,gBAAgB,EAAE,GAC7B,yBAAyB,CAgD3B;AAED,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,yBAAyB,GAClC,+BAA+B,GAAG,SAAS,CAuC7C"}

package/dist/esm/runtime/domain-module.shared.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-module.shared.definitions.js","sourceRoot":"","sources":["../../../../src/runtime/domain-module.shared.definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,IAAI,iCAAiC,EAClE,2BAA2B,GAC5B,MAAM,+CAA+C,CAAC;AAwBvD,MAAM,UAAU,wBAAwB,CACtC,GAAG,OAA6B;IAEhC,OAAO;QACL,sBAAsB,EAAE,MAAM,CAAC,MAAM,CACnC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACgB;QAC/E,wBAAwB,EAAE,MAAM,CAAC,MAAM,CACrC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACtC;QAC3B,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AA8CD,MAAM,UAAU,8BAA8B,CAC5C,GAAG,OAA2B;IAE9B,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,GAAG,OAAO,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CACzC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAC7C,CAAC;IACnC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAC9C,EAAE,EACF,GAAG,OAAO;SACP,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;SACxE,MAAM,CAAC,OAAO,CAAC,CACsC,CAAC;IAC3D,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEnF,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC;SAChC,OAAO,EAAE;SACT,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,cAAc,CAAC;QACpE,EAAE,0BAA0B,EAAE,cAAc,CAAC;IAE/C,MAAM,0BAA0B,GAAG,kBAAkB,IAAI,cAAc,IAAI,uBAAuB;QAChG,CAAC,CAAC;YACE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;YAChE,cAAc;YACd,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS;SACvF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAC/B,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAC/B,CAAC;IAExB,OAAO;QACL,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;aAC5C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnC,sBAAsB,EAAE,CAAC,kBAAkB,CAAC,sBAAsB,IAAI,EAAE,CAAmD;QAC3H,wBAAwB,EAAE,kBAAkB,CAAC,wBAAwB,IAAI,EAAE;QAC3E,qBAAqB,EAAE,kBAAkB,CAAC,qBAAqB,IAAI,EAAE;QACrE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC1E,wBAAwB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;QAC5F,0BAA0B;QAC1B,0BAA0B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAChG,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAChF,4BAA4B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,4BAA4B,IAAI,EAAE,CAAC;KACrG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,QAAmC;IAEnC,MAAM,cAAc,GAAG,QAAQ,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC;WACrE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;WAC/E,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAE7F,MAAM,4BAA4B,GAA6D,SAAS;QACtG,CAAC,CAAC;YACE,eAAe,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,eAAe;mBACtF,iCAAiC,CAAC,cAAc;YACrD,mBAAmB,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,mBAAmB;mBAC9F,iCAAiC,CAAC,IAAI;YAC3C,YAAY,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,YAAY,IAAI,EAAE;YAC3F,cAAc,EAAE;gBACd,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAC/C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;uBACzH,iCAAiC,CAAC,cAAc;gBACrD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAC1C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,cAAc,CAAC;uBACpH,iCAAiC,CAAC,oBAAoB;gBAC3D,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAC1C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,cAAc,CAAC;uBACpH,iCAAiC,CAAC,IAAI;aAC5C;SACF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS;QAC3E,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;QACjF,cAAc,EAAE,QAAQ,CAAC,0BAA0B,EAAE,cAAc;QACnE,oBAAoB,EAAE,4BAA4B;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import type { ProductDefinition } from '../billing/product-definition.shared.schemas';\nimport type { FeatureConfiguration, FeatureUnavailabilityBehavior } from '../features/feature-definition.shared.schemas';\nimport {\n  FeatureUnavailabilityBehavior as FeatureUnavailabilityBehaviorEnum,\n  FeatureUnavailabilityReason,\n} from '../features/feature-definition.shared.schemas';\nimport type { FeatureDefinitionWithAutoRegister } from '../features/feature-builders.shared';\nimport type { CustomFeatureConfigurationInput } from '../features/feature-registry.shared';\nimport type { ScopeFeatures } from '../features/scope-features.shared.schemas';\nimport type { MilestoneDefinition } from '../guidance/milestone-definition.shared.schemas';\nimport type { NotificationBadgeDefinition } from '../notifications/notification-badges.schemas';\nimport type {\n  ResourceConfiguration_InitializationFactory,\n  ResourceConfiguration_InitializationFactoryMap,\n} from '../resources/resources-config.shared.schemas';\nimport type { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport type { RolesConfiguration } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.shared-domain-module facet:layer:shared facet:family:module\n *\n * Cross-runtime module slice: resource factories, field identifiers, and relationship declarations merged across packages.\n */\nexport interface SharedDomainModule {\n  resourceConfigurations?: Record<string, ResourceConfiguration_InitializationFactory<any, any, any>>;\n  resourceFieldIdentifiers?: Record<string, string>;\n  resourceRelationships?: ResourceRelationship[];\n}\n\nexport function mergeSharedDomainModules(\n  ...modules: SharedDomainModule[]\n): SharedDomainModule {\n  return {\n    resourceConfigurations: Object.assign(\n      {},\n      ...modules.map(m => m.resourceConfigurations).filter(Boolean),\n    ) as Record<string, ResourceConfiguration_InitializationFactory<any, any, any>>,\n    resourceFieldIdentifiers: Object.assign(\n      {},\n      ...modules.map(m => m.resourceFieldIdentifiers).filter(Boolean),\n    ) as Record<string, string>,\n    resourceRelationships: modules.flatMap(m => m.resourceRelationships ?? []),\n  };\n}\n/** @wildo_source:part:end saas.models.shared-domain-module */\n\nexport type ApplicationModuleKind = 'domain' | 'engine';\n\n/**\n * @wildo_source:part:start saas.models.shared-saas-module facet:layer:shared facet:family:module\n *\n * App module contract: id, kind, roles, feature/milestone/product/notification-badge definition hooks layered on shared resources.\n */\nexport interface SharedSaaSModule extends SharedDomainModule {\n  moduleId: string;\n  kind?: ApplicationModuleKind;\n  customRoles?: RolesConfiguration;\n  customFeatureDefinitions?: FeatureDefinitionWithAutoRegister[];\n  customFeatureConfiguration?: {\n    profiles?: Record<string, ScopeFeatures>;\n    defaultProfile?: string;\n    unavailabilityPolicy?: Partial<FeatureConfiguration['unavailabilityPolicy']>;\n  };\n  customMilestoneDefinitions?: MilestoneDefinition[];\n  productDefinitions?: ProductDefinition[];\n  /**\n   * Notification badge definitions owned by this module (a module declares the\n   * badges derived from / driven by its own resources — e.g. a tasks module owns\n   * an \"incomplete todos\" count). Aggregated across modules by\n   * `buildSharedSaaSModulesRegistry` and threaded into the app init config, so a\n   * module owns its badge concern end-to-end with no app-level wiring.\n   */\n  notificationBadgeDefinitions?: NotificationBadgeDefinition[];\n}\n/** @wildo_source:part:end saas.models.shared-saas-module */\n\nexport interface SharedSaaSModulesRegistry {\n  moduleIds: string[];\n  resourceConfigurations: ResourceConfiguration_InitializationFactoryMap;\n  resourceFieldIdentifiers: Record<string, string>;\n  resourceRelationships: ResourceRelationship[];\n  customRoles?: RolesConfiguration;\n  customFeatureDefinitions: FeatureDefinitionWithAutoRegister[];\n  customFeatureConfiguration?: SharedSaaSModule['customFeatureConfiguration'];\n  customMilestoneDefinitions: MilestoneDefinition[];\n  productDefinitions: ProductDefinition[];\n  notificationBadgeDefinitions: NotificationBadgeDefinition[];\n}\n\nexport function buildSharedSaaSModulesRegistry(\n  ...modules: SharedSaaSModule[]\n): SharedSaaSModulesRegistry {\n  const mergedSharedModule = mergeSharedDomainModules(...modules);\n  const mergedFeatureProfiles = Object.assign(\n    {},\n    ...modules.map((module) => module.customFeatureConfiguration?.profiles ?? {}),\n  ) as Record<string, ScopeFeatures>;\n  const hasFeatureProfiles = Object.keys(mergedFeatureProfiles).length > 0;\n\n  const mergedUnavailabilityPolicy = Object.assign(\n    {},\n    ...modules\n      .map((module) => module.customFeatureConfiguration?.unavailabilityPolicy)\n      .filter(Boolean),\n  ) as Partial<FeatureConfiguration['unavailabilityPolicy']>;\n  const hasUnavailabilityPolicy = Object.keys(mergedUnavailabilityPolicy).length > 0;\n\n  const defaultProfile = [...modules]\n    .reverse()\n    .find((module) => module.customFeatureConfiguration?.defaultProfile)\n    ?.customFeatureConfiguration?.defaultProfile;\n\n  const customFeatureConfiguration = hasFeatureProfiles || defaultProfile || hasUnavailabilityPolicy\n    ? {\n        profiles: hasFeatureProfiles ? mergedFeatureProfiles : undefined,\n        defaultProfile,\n        unavailabilityPolicy: hasUnavailabilityPolicy ? mergedUnavailabilityPolicy : undefined,\n      }\n    : undefined;\n\n  const mergedRoles = Object.assign(\n    {},\n    ...modules.map((module) => module.customRoles ?? {}),\n  ) as RolesConfiguration;\n\n  return {\n    moduleIds: modules\n      .filter((module) => module.kind !== 'engine')\n      .map((module) => module.moduleId),\n    resourceConfigurations: (mergedSharedModule.resourceConfigurations ?? {}) as ResourceConfiguration_InitializationFactoryMap,\n    resourceFieldIdentifiers: mergedSharedModule.resourceFieldIdentifiers ?? {},\n    resourceRelationships: mergedSharedModule.resourceRelationships ?? [],\n    customRoles: Object.keys(mergedRoles).length > 0 ? mergedRoles : undefined,\n    customFeatureDefinitions: modules.flatMap((module) => module.customFeatureDefinitions ?? []),\n    customFeatureConfiguration,\n    customMilestoneDefinitions: modules.flatMap((module) => module.customMilestoneDefinitions ?? []),\n    productDefinitions: modules.flatMap((module) => module.productDefinitions ?? []),\n    notificationBadgeDefinitions: modules.flatMap((module) => module.notificationBadgeDefinitions ?? []),\n  };\n}\n\nexport function buildFrontendFeatureConfigurationInput(\n  registry: SharedSaaSModulesRegistry,\n): CustomFeatureConfigurationInput | undefined {\n  const hasDefinitions = registry.customFeatureDefinitions.length > 0;\n  const hasProfiles = Boolean(registry.customFeatureConfiguration?.profiles)\n    && Object.keys(registry.customFeatureConfiguration?.profiles ?? {}).length > 0;\n  const hasDefaultProfile = Boolean(registry.customFeatureConfiguration?.defaultProfile);\n  const hasPolicy = Boolean(registry.customFeatureConfiguration?.unavailabilityPolicy)\n    && Object.keys(registry.customFeatureConfiguration?.unavailabilityPolicy ?? {}).length > 0;\n\n  const resolvedUnavailabilityPolicy: FeatureConfiguration['unavailabilityPolicy'] | undefined = hasPolicy\n    ? {\n        defaultBehavior: registry.customFeatureConfiguration?.unavailabilityPolicy?.defaultBehavior\n          ?? FeatureUnavailabilityBehaviorEnum.UPGRADE_PROMPT,\n        whenBillingDisabled: registry.customFeatureConfiguration?.unavailabilityPolicy?.whenBillingDisabled\n          ?? FeatureUnavailabilityBehaviorEnum.HIDE,\n        roleDefaults: registry.customFeatureConfiguration?.unavailabilityPolicy?.roleDefaults ?? {},\n        reasonDefaults: {\n          [FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]\n            ?? FeatureUnavailabilityBehaviorEnum.UPGRADE_PROMPT,\n          [FeatureUnavailabilityReason.LIMIT_EXCEEDED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.LIMIT_EXCEEDED]\n            ?? FeatureUnavailabilityBehaviorEnum.LIMIT_UPGRADE_PROMPT,\n          [FeatureUnavailabilityReason.NOT_CONFIGURED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.NOT_CONFIGURED]\n            ?? FeatureUnavailabilityBehaviorEnum.HIDE,\n        },\n      }\n    : undefined;\n\n  if (!hasDefinitions && !hasProfiles && !hasDefaultProfile && !hasPolicy) {\n    return undefined;\n  }\n\n  return {\n    definitions: hasDefinitions ? registry.customFeatureDefinitions : undefined,\n    profiles: hasProfiles ? registry.customFeatureConfiguration?.profiles : undefined,\n    defaultProfile: registry.customFeatureConfiguration?.defaultProfile,\n    unavailabilityPolicy: resolvedUnavailabilityPolicy,\n  };\n}\n"]}
+{"version":3,"file":"domain-module.shared.definitions.js","sourceRoot":"","sources":["../../../../src/runtime/domain-module.shared.definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,IAAI,iCAAiC,EAClE,2BAA2B,GAC5B,MAAM,+CAA+C,CAAC;AAwBvD,MAAM,UAAU,wBAAwB,CACtC,GAAG,OAA6B;IAEhC,OAAO;QACL,sBAAsB,EAAE,MAAM,CAAC,MAAM,CACnC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACgB;QAC/E,wBAAwB,EAAE,MAAM,CAAC,MAAM,CACrC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACtC;QAC3B,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAuED,MAAM,UAAU,8BAA8B,CAC5C,GAAG,OAA2B;IAE9B,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,GAAG,OAAO,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CACzC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAC7C,CAAC;IACnC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAC9C,EAAE,EACF,GAAG,OAAO;SACP,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;SACxE,MAAM,CAAC,OAAO,CAAC,CACsC,CAAC;IAC3D,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEnF,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC;SAChC,OAAO,EAAE;SACT,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,cAAc,CAAC;QACpE,EAAE,0BAA0B,EAAE,cAAc,CAAC;IAE/C,MAAM,0BAA0B,GAAG,kBAAkB,IAAI,cAAc,IAAI,uBAAuB;QAChG,CAAC,CAAC;YACE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;YAChE,cAAc;YACd,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS;SACvF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAC/B,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAC/B,CAAC;IAExB,OAAO;QACL,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;aAC5C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnC,sBAAsB,EAAE,CAAC,kBAAkB,CAAC,sBAAsB,IAAI,EAAE,CAAmD;QAC3H,wBAAwB,EAAE,kBAAkB,CAAC,wBAAwB,IAAI,EAAE;QAC3E,qBAAqB,EAAE,kBAAkB,CAAC,qBAAqB,IAAI,EAAE;QACrE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC1E,wBAAwB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;QAC5F,0BAA0B;QAC1B,0BAA0B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAChG,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAChF,4BAA4B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,4BAA4B,IAAI,EAAE,CAAC;KACrG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,QAAmC;IAEnC,MAAM,cAAc,GAAG,QAAQ,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC;WACrE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;WAC/E,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAE7F,MAAM,4BAA4B,GAA6D,SAAS;QACtG,CAAC,CAAC;YACE,eAAe,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,eAAe;mBACtF,iCAAiC,CAAC,cAAc;YACrD,mBAAmB,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,mBAAmB;mBAC9F,iCAAiC,CAAC,IAAI;YAC3C,YAAY,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,YAAY,IAAI,EAAE;YAC3F,cAAc,EAAE;gBACd,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAC/C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;uBACzH,iCAAiC,CAAC,cAAc;gBACrD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAC1C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,cAAc,CAAC;uBACpH,iCAAiC,CAAC,oBAAoB;gBAC3D,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAC1C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,cAAc,CAAC;uBACpH,iCAAiC,CAAC,IAAI;aAC5C;SACF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS;QAC3E,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;QACjF,cAAc,EAAE,QAAQ,CAAC,0BAA0B,EAAE,cAAc;QACnE,oBAAoB,EAAE,4BAA4B;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import type { ProductDefinition } from '../billing/product-definition.shared.schemas';\nimport type { FeatureConfiguration, FeatureUnavailabilityBehavior } from '../features/feature-definition.shared.schemas';\nimport {\n  FeatureUnavailabilityBehavior as FeatureUnavailabilityBehaviorEnum,\n  FeatureUnavailabilityReason,\n} from '../features/feature-definition.shared.schemas';\nimport type { FeatureDefinitionWithAutoRegister } from '../features/feature-builders.shared';\nimport type { CustomFeatureConfigurationInput } from '../features/feature-registry.shared';\nimport type { ScopeFeatures } from '../features/scope-features.shared.schemas';\nimport type { MilestoneDefinition } from '../guidance/milestone-definition.shared.schemas';\nimport type { NotificationBadgeDefinition } from '../notifications/notification-badges.schemas';\nimport type {\n  ResourceConfiguration_InitializationFactory,\n  ResourceConfiguration_InitializationFactoryMap,\n} from '../resources/resources-config.shared.schemas';\nimport type { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport type { RolesConfiguration } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.shared-domain-module facet:layer:shared facet:family:module\n *\n * Cross-runtime module slice: resource factories, field identifiers, and relationship declarations merged across packages.\n */\nexport interface SharedDomainModule {\n  resourceConfigurations?: Record<string, ResourceConfiguration_InitializationFactory<any, any, any>>;\n  resourceFieldIdentifiers?: Record<string, string>;\n  resourceRelationships?: ResourceRelationship[];\n}\n\nexport function mergeSharedDomainModules(\n  ...modules: SharedDomainModule[]\n): SharedDomainModule {\n  return {\n    resourceConfigurations: Object.assign(\n      {},\n      ...modules.map(m => m.resourceConfigurations).filter(Boolean),\n    ) as Record<string, ResourceConfiguration_InitializationFactory<any, any, any>>,\n    resourceFieldIdentifiers: Object.assign(\n      {},\n      ...modules.map(m => m.resourceFieldIdentifiers).filter(Boolean),\n    ) as Record<string, string>,\n    resourceRelationships: modules.flatMap(m => m.resourceRelationships ?? []),\n  };\n}\n/** @wildo_source:part:end saas.models.shared-domain-module */\n\nexport type ApplicationModuleKind = 'domain' | 'engine';\n\n/**\n * @wildo_source:part:start saas.models.shared-saas-module facet:layer:shared facet:family:module\n *\n * App module contract: id, kind, roles, feature/milestone/product/notification-badge definition hooks layered on shared resources.\n */\nexport interface SharedSaaSModule extends SharedDomainModule {\n  moduleId: string;\n  kind?: ApplicationModuleKind;\n  customRoles?: RolesConfiguration;\n  customFeatureDefinitions?: FeatureDefinitionWithAutoRegister[];\n  customFeatureConfiguration?: {\n    profiles?: Record<string, ScopeFeatures>;\n    defaultProfile?: string;\n    unavailabilityPolicy?: Partial<FeatureConfiguration['unavailabilityPolicy']>;\n  };\n  /**\n   * Progression milestones this module owns.\n   *\n   * ⚠️ **Milestones need the ANALYTICS capability enabled to appear at all.** The frontend fetches\n   * milestone definitions only when analytics is on and returns an empty list otherwise, so with it\n   * off the definitions never arrive and the progression tracker renders nothing — declared\n   * correctly, and invisible.\n   *\n   * Enabling analytics with an EMPTY provider list is what lights up the internal progression plane\n   * without any telemetry leaving the application. That is the configuration to reach for when an\n   * application wants progression and not tracking.\n   */\n  customMilestoneDefinitions?: MilestoneDefinition[];\n  productDefinitions?: ProductDefinition[];\n  /**\n   * Notification badge definitions owned by this module (a module declares the\n   * badges derived from / driven by its own resources — e.g. a tasks module owns\n   * an \"incomplete todos\" count). Aggregated across modules by\n   * `buildSharedSaaSModulesRegistry` and threaded into the app init config, so a\n   * module owns its badge concern end-to-end with no app-level wiring.\n   *\n   * The framework ships NO badges of its own — every badge in an application is one that application\n   * declared.\n   *\n   * Two limits worth knowing before designing around one. A badge is scoped to a USER or to an\n   * ORGANIZATION and to nothing else; there is no application-wide scope. And a DERIVED badge is\n   * recomputed off the resource operation's own dispatch, so a change written by some other route\n   * does not move it — a client sees the corrected count on its next connection rather than\n   * immediately.\n   *\n   * A badge reference that does not resolve renders nothing, deliberately. The configuration\n   * verifier is what makes that loud: an unresolvable badge reference on a launcher item is reported\n   * when the application's navigation content is checked.\n   */\n  notificationBadgeDefinitions?: NotificationBadgeDefinition[];\n}\n/** @wildo_source:part:end saas.models.shared-saas-module */\n\nexport interface SharedSaaSModulesRegistry {\n  moduleIds: string[];\n  resourceConfigurations: ResourceConfiguration_InitializationFactoryMap;\n  resourceFieldIdentifiers: Record<string, string>;\n  resourceRelationships: ResourceRelationship[];\n  customRoles?: RolesConfiguration;\n  customFeatureDefinitions: FeatureDefinitionWithAutoRegister[];\n  customFeatureConfiguration?: SharedSaaSModule['customFeatureConfiguration'];\n  customMilestoneDefinitions: MilestoneDefinition[];\n  productDefinitions: ProductDefinition[];\n  notificationBadgeDefinitions: NotificationBadgeDefinition[];\n}\n\nexport function buildSharedSaaSModulesRegistry(\n  ...modules: SharedSaaSModule[]\n): SharedSaaSModulesRegistry {\n  const mergedSharedModule = mergeSharedDomainModules(...modules);\n  const mergedFeatureProfiles = Object.assign(\n    {},\n    ...modules.map((module) => module.customFeatureConfiguration?.profiles ?? {}),\n  ) as Record<string, ScopeFeatures>;\n  const hasFeatureProfiles = Object.keys(mergedFeatureProfiles).length > 0;\n\n  const mergedUnavailabilityPolicy = Object.assign(\n    {},\n    ...modules\n      .map((module) => module.customFeatureConfiguration?.unavailabilityPolicy)\n      .filter(Boolean),\n  ) as Partial<FeatureConfiguration['unavailabilityPolicy']>;\n  const hasUnavailabilityPolicy = Object.keys(mergedUnavailabilityPolicy).length > 0;\n\n  const defaultProfile = [...modules]\n    .reverse()\n    .find((module) => module.customFeatureConfiguration?.defaultProfile)\n    ?.customFeatureConfiguration?.defaultProfile;\n\n  const customFeatureConfiguration = hasFeatureProfiles || defaultProfile || hasUnavailabilityPolicy\n    ? {\n        profiles: hasFeatureProfiles ? mergedFeatureProfiles : undefined,\n        defaultProfile,\n        unavailabilityPolicy: hasUnavailabilityPolicy ? mergedUnavailabilityPolicy : undefined,\n      }\n    : undefined;\n\n  const mergedRoles = Object.assign(\n    {},\n    ...modules.map((module) => module.customRoles ?? {}),\n  ) as RolesConfiguration;\n\n  return {\n    moduleIds: modules\n      .filter((module) => module.kind !== 'engine')\n      .map((module) => module.moduleId),\n    resourceConfigurations: (mergedSharedModule.resourceConfigurations ?? {}) as ResourceConfiguration_InitializationFactoryMap,\n    resourceFieldIdentifiers: mergedSharedModule.resourceFieldIdentifiers ?? {},\n    resourceRelationships: mergedSharedModule.resourceRelationships ?? [],\n    customRoles: Object.keys(mergedRoles).length > 0 ? mergedRoles : undefined,\n    customFeatureDefinitions: modules.flatMap((module) => module.customFeatureDefinitions ?? []),\n    customFeatureConfiguration,\n    customMilestoneDefinitions: modules.flatMap((module) => module.customMilestoneDefinitions ?? []),\n    productDefinitions: modules.flatMap((module) => module.productDefinitions ?? []),\n    notificationBadgeDefinitions: modules.flatMap((module) => module.notificationBadgeDefinitions ?? []),\n  };\n}\n\nexport function buildFrontendFeatureConfigurationInput(\n  registry: SharedSaaSModulesRegistry,\n): CustomFeatureConfigurationInput | undefined {\n  const hasDefinitions = registry.customFeatureDefinitions.length > 0;\n  const hasProfiles = Boolean(registry.customFeatureConfiguration?.profiles)\n    && Object.keys(registry.customFeatureConfiguration?.profiles ?? {}).length > 0;\n  const hasDefaultProfile = Boolean(registry.customFeatureConfiguration?.defaultProfile);\n  const hasPolicy = Boolean(registry.customFeatureConfiguration?.unavailabilityPolicy)\n    && Object.keys(registry.customFeatureConfiguration?.unavailabilityPolicy ?? {}).length > 0;\n\n  const resolvedUnavailabilityPolicy: FeatureConfiguration['unavailabilityPolicy'] | undefined = hasPolicy\n    ? {\n        defaultBehavior: registry.customFeatureConfiguration?.unavailabilityPolicy?.defaultBehavior\n          ?? FeatureUnavailabilityBehaviorEnum.UPGRADE_PROMPT,\n        whenBillingDisabled: registry.customFeatureConfiguration?.unavailabilityPolicy?.whenBillingDisabled\n          ?? FeatureUnavailabilityBehaviorEnum.HIDE,\n        roleDefaults: registry.customFeatureConfiguration?.unavailabilityPolicy?.roleDefaults ?? {},\n        reasonDefaults: {\n          [FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]\n            ?? FeatureUnavailabilityBehaviorEnum.UPGRADE_PROMPT,\n          [FeatureUnavailabilityReason.LIMIT_EXCEEDED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.LIMIT_EXCEEDED]\n            ?? FeatureUnavailabilityBehaviorEnum.LIMIT_UPGRADE_PROMPT,\n          [FeatureUnavailabilityReason.NOT_CONFIGURED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.NOT_CONFIGURED]\n            ?? FeatureUnavailabilityBehaviorEnum.HIDE,\n        },\n      }\n    : undefined;\n\n  if (!hasDefinitions && !hasProfiles && !hasDefaultProfile && !hasPolicy) {\n    return undefined;\n  }\n\n  return {\n    definitions: hasDefinitions ? registry.customFeatureDefinitions : undefined,\n    profiles: hasProfiles ? registry.customFeatureConfiguration?.profiles : undefined,\n    defaultProfile: registry.customFeatureConfiguration?.defaultProfile,\n    unavailabilityPolicy: resolvedUnavailabilityPolicy,\n  };\n}\n"]}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts

@@ -15,6 +15,7 @@ export declare enum AppApiKeys_Operations {
     DEACTIVATE = "deactivate",// Deactivate key
     REACTIVATE = "reactivate",// Reactivate key
     EXTEND_EXPIRY = "extend_expiry",// Extend expiration date
+    EXPIRE = "expire",// ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)
     USAGE_STATS = "usage_stats"
 }
 type AppApiKeysCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE;

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAmRlH,CAAC"}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAyTlH,CAAC"}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js

@@ -31,6 +31,7 @@ export var AppApiKeys_Operations;
     AppApiKeys_Operations["DEACTIVATE"] = "deactivate";
     AppApiKeys_Operations["REACTIVATE"] = "reactivate";
     AppApiKeys_Operations["EXTEND_EXPIRY"] = "extend_expiry";
+    AppApiKeys_Operations["EXPIRE"] = "expire";
     AppApiKeys_Operations["USAGE_STATS"] = "usage_stats";
 })(AppApiKeys_Operations || (AppApiKeys_Operations = {}));
 /*
@@ -254,6 +255,43 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 }
             ]
         },
+        /**
+         * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed
+         * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:
+         * the sweep is the only caller.
+         *
+         * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and
+         * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare
+         * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the
+         * hazard DEACTIVATE documents at length — with no route there is no request contract to
+         * auto-derive and no `PUT .../expire` that could carry `status: active`.
+         *
+         * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a
+         * direct write would be a second authority over the field and would skip the ACTIVE-only
+         * precondition, which lives in the paired prefix implementation
+         * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an
+         * `enabledCondition` cannot be.
+         */
+        [AppApiKeys_Operations.EXPIRE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
+                    // and the paired prefix implementation forces the status transition itself, so there is no field
+                    // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without
+                    // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL
+                    // that accepts nothing advertise every field — `status` included, the one field this verb owns.
+                    requestDto: z.object({}),
+                }
+            ],
+            // No notification: expiry is the scheduled consequence of a date the administrator set, not
+            // an event. The signal that would be worth sending — a key ABOUT to expire — is a different
+            // feature and is not this one.
+        },
         [AppApiKeys_Operations.EXTEND_EXPIRY]: {
             variants: [
                 {