@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/__tests__/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/setup.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../src/__tests__/setup.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC"}

package/dist/esm/_inspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_inspect.d.ts","sourceRoot":"","sources":["../../../src/_inspect.ts"],"names":[],"mappings":""}
+{"version":3,"file":"_inspect.d.ts","sourceRoot":"","sources":["../../src/_inspect.ts"],"names":[],"mappings":""}

package/dist/esm/applications/application-metadata.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-metadata.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/application-metadata.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAwB,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAUnG,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;kBAsF3H,CAAC"}
+{"version":3,"file":"application-metadata.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/applications/application-metadata.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAwB,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAUnG,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;kBAsF3H,CAAC"}

package/dist/esm/applications/application-subject.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-subject.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/application-subject.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,8DAGL,CAAC;AAGnC,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,iFAAiF;AACjF,oBAAY,4BAA4B;IACtC,WAAW,gBAAgB;IAC3B,IAAI,SAAS;CACd;AAED,eAAO,MAAM,8BAA8B;;;;;;;4BAYzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;kBAgB5C,CAAC;AACJ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC"}
+{"version":3,"file":"application-subject.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/applications/application-subject.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,8DAGL,CAAC;AAGnC,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,iFAAiF;AACjF,oBAAY,4BAA4B;IACtC,WAAW,gBAAgB;IAC3B,IAAI,SAAS;CACd;AAED,eAAO,MAAM,8BAA8B;;;;;;;4BAYzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;kBAgB5C,CAAC;AACJ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC"}

package/dist/esm/applications/application-versions.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-versions.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/application-versions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AA8CvI,KAAK,gCAAgC,GACjC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;kBAuH3H,CAAC"}
+{"version":3,"file":"application-versions.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/applications/application-versions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AA8CvI,KAAK,gCAAgC,GACjC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;kBAuH3H,CAAC"}

package/dist/esm/applications/applications-context.schemas.d.ts

@@ -147,6 +147,11 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
                     requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                     expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 }, z.core.$strip>>;
+                stepUpAuth: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                    methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").AuthMethod>>>>;
+                }, z.core.$strip>>;
             }, z.core.$strip>>;
             scimProvisioning: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodDefault<z.ZodBoolean>;
@@ -166,10 +171,6 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
         billing: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             providerRef: z.ZodOptional<z.ZodString>;
-            webhooks: z.ZodOptional<z.ZodObject<{
-                path: z.ZodDefault<z.ZodString>;
-                signingSecretRef: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
             defaultCurrency: z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>;
             supportedCurrencies: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>>;
             tax: z.ZodDefault<z.ZodObject<{
@@ -188,7 +189,7 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
                 defaultTrialDays: z.ZodDefault<z.ZodNumber>;
                 paymentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
                 maxPaymentRetries: z.ZodDefault<z.ZodNumber>;
-                defaultProration: z.ZodDefault<z.ZodEnum<typeof import("..").ProrationBehavior>>;
+                defaultProration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
                 defaultCancellation: z.ZodDefault<z.ZodEnum<typeof import("..").BillingTiming>>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
@@ -291,6 +292,7 @@ export declare const ApplicationFullCurrentContextSchema: z.ZodObject<{
         }, z.core.$strip>>;
         auditTrail: z.ZodOptional<z.ZodObject<{
             archiveAfterDays: z.ZodOptional<z.ZodNumber>;
+            allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
     metadata: z.ZodObject<{
@@ -453,6 +455,11 @@ export declare const ApplicationContextSchema: z.ZodObject<{
                     requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                     expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 }, z.core.$strip>>;
+                stepUpAuth: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                    methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").AuthMethod>>>>;
+                }, z.core.$strip>>;
             }, z.core.$strip>>;
             scimProvisioning: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodDefault<z.ZodBoolean>;
@@ -472,10 +479,6 @@ export declare const ApplicationContextSchema: z.ZodObject<{
         billing: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             providerRef: z.ZodOptional<z.ZodString>;
-            webhooks: z.ZodOptional<z.ZodObject<{
-                path: z.ZodDefault<z.ZodString>;
-                signingSecretRef: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
             defaultCurrency: z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>;
             supportedCurrencies: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>>;
             tax: z.ZodDefault<z.ZodObject<{
@@ -494,7 +497,7 @@ export declare const ApplicationContextSchema: z.ZodObject<{
                 defaultTrialDays: z.ZodDefault<z.ZodNumber>;
                 paymentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
                 maxPaymentRetries: z.ZodDefault<z.ZodNumber>;
-                defaultProration: z.ZodDefault<z.ZodEnum<typeof import("..").ProrationBehavior>>;
+                defaultProration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
                 defaultCancellation: z.ZodDefault<z.ZodEnum<typeof import("..").BillingTiming>>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
@@ -597,6 +600,7 @@ export declare const ApplicationContextSchema: z.ZodObject<{
         }, z.core.$strip>>;
         auditTrail: z.ZodOptional<z.ZodObject<{
             archiveAfterDays: z.ZodOptional<z.ZodNumber>;
+            allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;

package/dist/esm/applications/applications-context.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"applications-context.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications-context.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"applications-context.schemas.d.ts","sourceRoot":"","sources":["../../../src/applications/applications-context.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/applications/applications.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"applications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AA+E7E,KAAK,yBAAyB,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,sDAAsD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;kBAiNnH,CAAC"}
+{"version":3,"file":"applications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AA+E7E,KAAK,yBAAyB,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,sDAAsD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;kBAkNnH,CAAC"}

package/dist/esm/applications/applications.shared.resources-config.schemas.js

@@ -255,9 +255,10 @@ export const applicationResourceConfiguration_InitializationFactory = (resources
                     // deleting one destroys everything scoped beneath it. Same reasoning as
                     // `ORGANIZATIONS | DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`
                     // policy is opt-in, off by default, and freshness-satisfied — neither challenges the
-                    // caller here. Carries the same accepted audience limitation (re-auth is PASSWORD-only,
-                    // and directory-managed users have no password by design); see the note on
-                    // `ORGANIZATIONS | DELETE`.
+                    // caller here. Re-authentication itself accepts PASSWORD, an enrolled second factor
+                    // (TOTP or a backup code) and PASSKEY, so a directory-managed user whose local first
+                    // factor the framework destroys can still clear the gate through their second factor;
+                    // see the note on `ORGANIZATIONS | DELETE` for how that came about.
                     //
                     // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.
                     requiresStepUpAuthentication: true,

package/dist/esm/applications/applications.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"applications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAE7I,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,2CAA2C;AAC3C,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,mFAAmF;AACnF,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,mFAAmF;AACnF,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sEAAsE;AACtE,wFAAwF;AACxF,uFAAuF;AACvF,2FAA2F;AAC3F,gGAAgG;AAChG,6DAA6D;AAC7D,qFAAqF;AACrF,yFAAyF;AACzF,6FAA6F;AAC7F,qBAAqB;AACrB,0FAA0F;AAC1F,+EAA+E;AAC/E,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iGAAiG;AACjG,8DAA8D;AAC9D,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,yEAAyE;AACzE,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AACzF,kEAAkE;AAElE,MAAM,uBAAuB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE9D,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAUF;;EAEE;AACF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIlK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,yEAAyE;oBACzE,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,oCAAoC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4GAA4G;oBAChJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;oBACjD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,wEAAwE;oBACxE,sFAAsF;oBACtF,qFAAqF;oBACrF,wFAAwF;oBACxF,2EAA2E;oBAC3E,4BAA4B;oBAC5B,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0EAA0E;oBAC1E,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CAEF,CAAC,CAAC","sourcesContent":["/**\n * Application Shared Resource Configuration\n *\n * Resource configuration for application management.\n * Supports both organization self-management and platform admin oversight.\n */\n\nimport { z } from 'zod';\nimport { ApplicationSchema } from './applications.shared.schemas';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for applications.\n//\n// CROSS-ORGANIZATION APPLICATION TRANSFER IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY.\n// `TRANSFER` was declared here in two variants (`ORG_ADMIN` default at `riskLevel: CRITICAL`, and\n// an `APP_ADMIN_SUPER_ADMIN` `admin` variant adding `bypassOwnerApproval`), taking\n// `{ targetOrganizationId, transferReason }`. Both were ROUTED but never implemented, so each\n// request fell through to the generic core UPDATE, which persists only fields the resource schema\n// declares. Neither `targetOrganizationId` nor `transferReason` is one, so every call answered\n// **HTTP 200 having changed nothing** — an operator was told a CRITICAL cross-tenant move had\n// succeeded while the application stayed exactly where it was. Removed 2026-08-01.\n//\n// It was REMOVED rather than implemented on five independent grounds:\n//\n//  1. NO FIELD TO WRITE. `ApplicationSchema` carries no owning-organization field.\n//  2. NO RELATIONSHIP TO RE-POINT. The resources registry declares no\n//     `ORGANIZATIONS → APPLICATION` edge; applications are not organization-owned here.\n//  3. THE OWNERSHIP DIRECTION IS INVERTED. `APPLICATION` is a top-level, self-anchored\n//     `ResourcePrimaryScope`. The application IS the tenant container; organizations are a\n//     sibling scope living inside its tenancy. \"Transferring\" the application to one of its own\n//     organizations is incoherent, not merely unimplemented.\n//  4. WHERE ORGANIZATION OWNERSHIP DOES EXIST, IT IS ALREADY IMMUTABLE. The platform\n//     app-factory's own application record binds `organizationId` at create and marks it\n//     `excludeFromUpdate()` — a different resource, on a different service, already refusing\n//     this mutation.\n//  5. FRAMEWORK PRECEDENT. Cross-organization MEMBER transfer is refused for exactly this\n//     reason — a tenant-boundary crossing the framework does not sanction (see\n//     `organization-members.shared.resources-config.schemas.ts`). An application is the tenant\n//     container itself, so the argument applies with more force, not less.\n//\n// `bypassOwnerApproval` additionally named an approval flow that does not exist, and neither\n// variant emitted an audit event despite being cross-tenant and CRITICAL. Re-declaring an\n// application re-parenting verb would require, at minimum: a persisted ownership edge, an\n// approval flow for the flag to bypass, a custom implementation that writes the edge, and\n// audit/SIEM emission on both request and completion.\n//\n// APPLICATION STATUS LIFECYCLE IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY EITHER.\n// `ACTIVATE` and `SUSPEND` were declared here as `APP_ADMIN_SUPER_ADMIN` verbs (`MEDIUM` and\n// `CRITICAL` respectively, both with a generated bulk variant) taking `{ reason }` and\n// `{ suspensionReason, notifyOwners }`. Like TRANSFER they were ROUTED but never implemented, so\n// each fell through to the generic core UPDATE and answered **HTTP 200 having changed nothing** —\n// an operator was told a CRITICAL application suspension had taken effect while the application\n// kept serving. Removed 2026-08-01, on grounds that compound with TRANSFER's:\n//\n//  1. NO FIELD TO WRITE — and no plausible one. `ApplicationSchema` is\n//     `{_id, appSlug, appDisplayName, lastVersion, platformAppId}`: an identity row, carrying no\n//     lifecycle state at all. There is nothing to transition.\n//  2. THE LIFECYCLE IS OWNED ONE TIER UP. An application's real operational state lives at the\n//     platform tier (`PLATFORM_APPLICATIONS` / `Wildo_Application_Config`), provisioned and\n//     managed by the platform apps-manager. This row is the in-app registry entry an application\n//     reads to know its own identity — halting an application is a platform-tier action, not a\n//     self-service field flip on the application's own copy of its name.\n//  3. SAME INVERTED OWNERSHIP AS TRANSFER (ground 3 above). `APPLICATION` is a top-level\n//     `ResourcePrimaryScope`; suspending the tenant container from inside its own tenancy is\n//     incoherent, and the suspending super-admin's own session lives in that container.\n//\n// The resource specification's framing — \"Created per org, managed by admins, and may be\n// transferred or suspended under governance\", with 409s for destination-org slug collisions —\n// describes a per-organization application marketplace. The framework does not implement one, and\n// inventing an `ApplicationStatus` to satisfy two unimplemented buttons would have built that\n// model backwards from its UI. Re-declaring these verbs requires the ownership model first.\n//\n// Applications consequently declare NO custom operations (hence the `undefined` custom-operation\n// type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and\n// `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n\nconst APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];\n\nconst APPLICATION_FILTER_FIELDS = {\n  appSlug: z.string(),\n  appDisplayName: z.string(),\n};\n\ntype ApplicationCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplications Resource Configuration Factory\n*/\nexport const applicationResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  ApplicationCoreOperations,\n  typeof ApplicationSchema\n>({\n  mainSchema: ApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Applications are core system resources\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can create applications\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // Use database definition so platformAppId and lastVersion are preserved\n          // requestDto auto-derived from decorators\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can create applications for any org\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can view any application\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    /**\n     * ⚠️ NOTHING CONFINES THIS QUERY — and that is safe for a reason worth stating, because the\n     * comment on the default variant used to imply a mechanism that does not exist.\n     *\n     * `applications` is its own scope ROOT, so both repositories blacklist the APPLICATIONS axis and\n     * this LIST compiles to the EMPTY filter (measured 2026-08-12,\n     * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep). The\n     * old wording — \"Org members can list *their* applications\" — is exactly the shape of the claim\n     * that was FALSE on `organizations` and cost a full tenant-isolation investigation, one role tier\n     * higher.\n     *\n     * What makes it safe here is ARCHITECTURE, not a predicate: **one database per application.**\n     * \"An application's organizations live in that application's own database\"\n     * (`organizations.shared.schemas.ts`, on `slug` uniqueness), so this collection holds that\n     * application's own row and a caller can only ever see the application they are already using.\n     * Measured: an ordinary `ORG_MEMBER` receives 1 of 1 rows, projected to four summary fields.\n     *\n     * So the two variants below differ in ROLE, not in reach — `admin` exists for the fields and\n     * operations it unlocks elsewhere, not because it sees more rows here.\n     *\n     * ⚠️ This rests on the one-database-per-application invariant. `CREATE` is super-admin gated, so\n     * a second application row COULD be written into this database; if that ever becomes a real\n     * deployment shape, this resource inherits the `organizations` defect at the `ORG_MEMBER` tier\n     * and must be confined on `initiatorIds.applicationId`. Tracked as SEC-SCOPEROOT-3.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Unconfined by construction; safe because the collection holds this application only — see the block above\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can list all applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description', 'slug'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update their applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can update any application\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can delete their applications\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // An APPLICATION is a top-level scope in this framework, not an org-owned artifact, so\n          // deleting one destroys everything scoped beneath it. Same reasoning as\n          // `ORGANIZATIONS | DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`\n          // policy is opt-in, off by default, and freshness-satisfied — neither challenges the\n          // caller here. Carries the same accepted audience limitation (re-auth is PASSWORD-only,\n          // and directory-managed users have no password by design); see the note on\n          // `ORGANIZATIONS | DELETE`.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n          requiresStepUpAuthentication: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can delete any application\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-VARIANT flag — nothing is inherited from the default variant above.\n          requiresStepUpAuthentication: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    }\n  },\n\n});\n"]}
+{"version":3,"file":"applications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAE7I,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,2CAA2C;AAC3C,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,mFAAmF;AACnF,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,mFAAmF;AACnF,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sEAAsE;AACtE,wFAAwF;AACxF,uFAAuF;AACvF,2FAA2F;AAC3F,gGAAgG;AAChG,6DAA6D;AAC7D,qFAAqF;AACrF,yFAAyF;AACzF,6FAA6F;AAC7F,qBAAqB;AACrB,0FAA0F;AAC1F,+EAA+E;AAC/E,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iGAAiG;AACjG,8DAA8D;AAC9D,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,yEAAyE;AACzE,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AACzF,kEAAkE;AAElE,MAAM,uBAAuB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE9D,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAUF;;EAEE;AACF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIlK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,yEAAyE;oBACzE,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,oCAAoC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4GAA4G;oBAChJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;oBACjD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,wEAAwE;oBACxE,sFAAsF;oBACtF,qFAAqF;oBACrF,oFAAoF;oBACpF,qFAAqF;oBACrF,sFAAsF;oBACtF,oEAAoE;oBACpE,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0EAA0E;oBAC1E,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CAEF,CAAC,CAAC","sourcesContent":["/**\n * Application Shared Resource Configuration\n *\n * Resource configuration for application management.\n * Supports both organization self-management and platform admin oversight.\n */\n\nimport { z } from 'zod';\nimport { ApplicationSchema } from './applications.shared.schemas';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for applications.\n//\n// CROSS-ORGANIZATION APPLICATION TRANSFER IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY.\n// `TRANSFER` was declared here in two variants (`ORG_ADMIN` default at `riskLevel: CRITICAL`, and\n// an `APP_ADMIN_SUPER_ADMIN` `admin` variant adding `bypassOwnerApproval`), taking\n// `{ targetOrganizationId, transferReason }`. Both were ROUTED but never implemented, so each\n// request fell through to the generic core UPDATE, which persists only fields the resource schema\n// declares. Neither `targetOrganizationId` nor `transferReason` is one, so every call answered\n// **HTTP 200 having changed nothing** — an operator was told a CRITICAL cross-tenant move had\n// succeeded while the application stayed exactly where it was. Removed 2026-08-01.\n//\n// It was REMOVED rather than implemented on five independent grounds:\n//\n//  1. NO FIELD TO WRITE. `ApplicationSchema` carries no owning-organization field.\n//  2. NO RELATIONSHIP TO RE-POINT. The resources registry declares no\n//     `ORGANIZATIONS → APPLICATION` edge; applications are not organization-owned here.\n//  3. THE OWNERSHIP DIRECTION IS INVERTED. `APPLICATION` is a top-level, self-anchored\n//     `ResourcePrimaryScope`. The application IS the tenant container; organizations are a\n//     sibling scope living inside its tenancy. \"Transferring\" the application to one of its own\n//     organizations is incoherent, not merely unimplemented.\n//  4. WHERE ORGANIZATION OWNERSHIP DOES EXIST, IT IS ALREADY IMMUTABLE. The platform\n//     app-factory's own application record binds `organizationId` at create and marks it\n//     `excludeFromUpdate()` — a different resource, on a different service, already refusing\n//     this mutation.\n//  5. FRAMEWORK PRECEDENT. Cross-organization MEMBER transfer is refused for exactly this\n//     reason — a tenant-boundary crossing the framework does not sanction (see\n//     `organization-members.shared.resources-config.schemas.ts`). An application is the tenant\n//     container itself, so the argument applies with more force, not less.\n//\n// `bypassOwnerApproval` additionally named an approval flow that does not exist, and neither\n// variant emitted an audit event despite being cross-tenant and CRITICAL. Re-declaring an\n// application re-parenting verb would require, at minimum: a persisted ownership edge, an\n// approval flow for the flag to bypass, a custom implementation that writes the edge, and\n// audit/SIEM emission on both request and completion.\n//\n// APPLICATION STATUS LIFECYCLE IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY EITHER.\n// `ACTIVATE` and `SUSPEND` were declared here as `APP_ADMIN_SUPER_ADMIN` verbs (`MEDIUM` and\n// `CRITICAL` respectively, both with a generated bulk variant) taking `{ reason }` and\n// `{ suspensionReason, notifyOwners }`. Like TRANSFER they were ROUTED but never implemented, so\n// each fell through to the generic core UPDATE and answered **HTTP 200 having changed nothing** —\n// an operator was told a CRITICAL application suspension had taken effect while the application\n// kept serving. Removed 2026-08-01, on grounds that compound with TRANSFER's:\n//\n//  1. NO FIELD TO WRITE — and no plausible one. `ApplicationSchema` is\n//     `{_id, appSlug, appDisplayName, lastVersion, platformAppId}`: an identity row, carrying no\n//     lifecycle state at all. There is nothing to transition.\n//  2. THE LIFECYCLE IS OWNED ONE TIER UP. An application's real operational state lives at the\n//     platform tier (`PLATFORM_APPLICATIONS` / `Wildo_Application_Config`), provisioned and\n//     managed by the platform apps-manager. This row is the in-app registry entry an application\n//     reads to know its own identity — halting an application is a platform-tier action, not a\n//     self-service field flip on the application's own copy of its name.\n//  3. SAME INVERTED OWNERSHIP AS TRANSFER (ground 3 above). `APPLICATION` is a top-level\n//     `ResourcePrimaryScope`; suspending the tenant container from inside its own tenancy is\n//     incoherent, and the suspending super-admin's own session lives in that container.\n//\n// The resource specification's framing — \"Created per org, managed by admins, and may be\n// transferred or suspended under governance\", with 409s for destination-org slug collisions —\n// describes a per-organization application marketplace. The framework does not implement one, and\n// inventing an `ApplicationStatus` to satisfy two unimplemented buttons would have built that\n// model backwards from its UI. Re-declaring these verbs requires the ownership model first.\n//\n// Applications consequently declare NO custom operations (hence the `undefined` custom-operation\n// type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and\n// `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n\nconst APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];\n\nconst APPLICATION_FILTER_FIELDS = {\n  appSlug: z.string(),\n  appDisplayName: z.string(),\n};\n\ntype ApplicationCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplications Resource Configuration Factory\n*/\nexport const applicationResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  ApplicationCoreOperations,\n  typeof ApplicationSchema\n>({\n  mainSchema: ApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Applications are core system resources\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can create applications\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // Use database definition so platformAppId and lastVersion are preserved\n          // requestDto auto-derived from decorators\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can create applications for any org\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can view any application\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    /**\n     * ⚠️ NOTHING CONFINES THIS QUERY — and that is safe for a reason worth stating, because the\n     * comment on the default variant used to imply a mechanism that does not exist.\n     *\n     * `applications` is its own scope ROOT, so both repositories blacklist the APPLICATIONS axis and\n     * this LIST compiles to the EMPTY filter (measured 2026-08-12,\n     * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep). The\n     * old wording — \"Org members can list *their* applications\" — is exactly the shape of the claim\n     * that was FALSE on `organizations` and cost a full tenant-isolation investigation, one role tier\n     * higher.\n     *\n     * What makes it safe here is ARCHITECTURE, not a predicate: **one database per application.**\n     * \"An application's organizations live in that application's own database\"\n     * (`organizations.shared.schemas.ts`, on `slug` uniqueness), so this collection holds that\n     * application's own row and a caller can only ever see the application they are already using.\n     * Measured: an ordinary `ORG_MEMBER` receives 1 of 1 rows, projected to four summary fields.\n     *\n     * So the two variants below differ in ROLE, not in reach — `admin` exists for the fields and\n     * operations it unlocks elsewhere, not because it sees more rows here.\n     *\n     * ⚠️ This rests on the one-database-per-application invariant. `CREATE` is super-admin gated, so\n     * a second application row COULD be written into this database; if that ever becomes a real\n     * deployment shape, this resource inherits the `organizations` defect at the `ORG_MEMBER` tier\n     * and must be confined on `initiatorIds.applicationId`. Tracked as SEC-SCOPEROOT-3.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Unconfined by construction; safe because the collection holds this application only — see the block above\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can list all applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description', 'slug'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update their applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can update any application\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can delete their applications\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // An APPLICATION is a top-level scope in this framework, not an org-owned artifact, so\n          // deleting one destroys everything scoped beneath it. Same reasoning as\n          // `ORGANIZATIONS | DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`\n          // policy is opt-in, off by default, and freshness-satisfied — neither challenges the\n          // caller here. Re-authentication itself accepts PASSWORD, an enrolled second factor\n          // (TOTP or a backup code) and PASSKEY, so a directory-managed user whose local first\n          // factor the framework destroys can still clear the gate through their second factor;\n          // see the note on `ORGANIZATIONS | DELETE` for how that came about.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n          requiresStepUpAuthentication: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can delete any application\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-VARIANT flag — nothing is inherited from the default variant above.\n          requiresStepUpAuthentication: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    }\n  },\n\n});\n"]}

package/dist/esm/applications/applications.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"applications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;IACnB,uBAAuB,4BAA4B;CACpD;AAED,oBAAY,cAAc;IACxB,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,4GAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,4KAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,yBAAyB;;;;iBAwBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"applications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;IACnB,uBAAuB,4BAA4B;CACpD;AAED,oBAAY,cAAc;IACxB,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,4GAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,4KAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,yBAAyB;;;;iBAwBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/billing/billing-account.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-account.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAgBzG,oBAAY,yBAAyB;IACnC,wEAAwE;IACxE,aAAa,kBAAkB;IAC/B,kEAAkE;IAClE,WAAW,gBAAgB;IAC3B,6FAA6F;IAC7F,SAAS,cAAc;CACxB;AAID,8CAA8C;AAC9C,eAAO,MAAM,qCAAqC;;;;;;;;;iBAqChD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,2SAiM/C,CAAC"}
+{"version":3,"file":"billing-account.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAgBzG,oBAAY,yBAAyB;IACnC,wEAAwE;IACxE,aAAa,kBAAkB;IAC/B,kEAAkE;IAClE,WAAW,gBAAgB;IAC3B,6FAA6F;IAC7F,SAAS,cAAc;CACxB;AAID,8CAA8C;AAC9C,eAAO,MAAM,qCAAqC;;;;;;;;;iBAqChD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,2SAiM/C,CAAC"}

package/dist/esm/billing/billing-account.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-account.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,OAAO,EAA6B,KAAK,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAShI;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,4BAA4B,EAGhE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,oBAAoB,EAGzD,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,uCAAuC,EAAE,oBAAoB,EAWzE,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAkDnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;kBAMhD,CAAC;AAMH,eAAO,MAAM,oBAAoB;;;;;;;;iBAA2B,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"billing-account.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/billing-account.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,OAAO,EAA6B,KAAK,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAShI;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,4BAA4B,EAGhE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,oBAAoB,EAGzD,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,uCAAuC,EAAE,oBAAoB,EAWzE,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAkDnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;kBAMhD,CAAC;AAMH,eAAO,MAAM,oBAAoB;;;;;;;;iBAA2B,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/billing/billing-configuration.shared.schemas.d.ts

@@ -13,10 +13,6 @@ import { TaxCalculationMode, TaxDisplayMode, ProrationBehavior, BillingTiming }
 export declare const BillingConfigurationSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     providerRef: z.ZodOptional<z.ZodString>;
-    webhooks: z.ZodOptional<z.ZodObject<{
-        path: z.ZodDefault<z.ZodString>;
-        signingSecretRef: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
     defaultCurrency: z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>;
     supportedCurrencies: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>>;
     tax: z.ZodDefault<z.ZodObject<{

package/dist/esm/billing/billing-configuration.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-configuration.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACd,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4FrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
+{"version":3,"file":"billing-configuration.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACd,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;iBAsIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/esm/billing/billing-configuration.shared.schemas.js

@@ -16,23 +16,41 @@ export const BillingConfigurationSchema = z.object({
     enabled: z.boolean().default(false),
     /** Which billing provider to use (e.g., 'stripe') */
     providerRef: z.string().optional(),
-    /** Webhook configuration */
-    webhooks: z.object({
-        /** Path for billing webhook endpoint */
-        path: z.string().default('/api/v1/webhooks/billing'),
-        /** Reference to the webhook signing secret (resolved from secrets at runtime) */
-        signingSecretRef: z.string().optional(),
-    }).optional(),
-    /** Default ISO 4217 currency for new billing accounts / products */
+    /*
+     * NO `webhooks` block. `path` and `signingSecretRef` were declared here and read by NOTHING —
+     * `signingSecretRef` had zero references outside its own declaration — and they were removed on
+     * 2026-09-08 (#408) rather than relabelled, because unlike the commercial-intent keys below they
+     * were not even an input to anything.
+     *
+     * The route and the signing secret both come from the provider module's `WEBHOOK_ORIGINATOR`
+     * contract: `buildWebhookEndpoints` mounts it at `/api/v1/webhooks/<provider>/billing`. That is
+     * the single authority, and `webhook-auto-controller.backend.service.ts` already recorded the
+     * same conclusion when endpoint-level path/secret extras were dropped as dead in the 2026-05-06
+     * reshape. This block was the copy that survived that sweep.
+     */
+    /**
+     * DECLARATION-ONLY (#408, 2026-09-08). Read by the application-creation commercial-model brief and
+     * by no runtime billing path: nothing validates a product's currency against these, and what
+     * reaches the provider is each price's own `currency`. Authoring them records the commercial
+     * intent a reviewer reads; it enforces nothing.
+     */
     defaultCurrency: CurrencySchema.default('USD'),
-    /** Supported currencies (for multi-currency apps) */
+    /** DECLARATION-ONLY — see `defaultCurrency`. */
     supportedCurrencies: z.array(CurrencySchema).default(['USD']),
     /**
      * Tax configuration — calculation is ALWAYS delegated to provider (Stripe Tax, etc.).
      * We never calculate tax locally.
      */
     tax: z.object({
-        /** How the provider handles tax calculation */
+        /**
+         * Whether the PROVIDER computes tax on a purchase. READ since 2026-09-08 (#408): the checkout
+         * path — the only production purchase route — sends `automaticTax` from this value.
+         *
+         * It reached nothing before that, so `PROVIDER_MANAGED` changed no behaviour and the provider
+         * account's own configuration silently decided. Enabling it changes invoice totals and the tax
+         * amounts persisted against them, which is why it is a decision an application makes rather
+         * than a default the framework picks.
+         */
         calculationMode: z.enum(TaxCalculationMode).default(TaxCalculationMode.DISABLED),
         /**
          * How prices are DISPLAYED to users (does not affect provider calculation).
@@ -41,7 +59,10 @@ export const BillingConfigurationSchema = z.object({
          * - 'inclusive': Prices shown including tax (TTC / inc-VAT). Tax is embedded.
          *   Common for consumer-facing. Shows "€49/mo TTC" and tax is extracted at checkout.
          *
-         * Overridable per product (product.taxDisplayMode) and per price (price.taxBehavior).
+         * DECLARATIVE ONLY: nothing reads this value. It is not an application-wide default that
+         * `product.taxDisplayMode` and `price.taxBehavior` override, because there is no resolution
+         * chain between the three. What reaches the billing provider is each price's own
+         * `taxBehavior`, and only that.
          */
         defaultDisplayMode: z.enum(TaxDisplayMode).default(TaxDisplayMode.EXCLUSIVE),
     }).default(() => ({
@@ -58,7 +79,12 @@ export const BillingConfigurationSchema = z.object({
      * Controls whether the promotions subsystem is active.
      */
     promotions: z.object({
-        /** Whether promotions/coupons are enabled */
+        /**
+         * DECLARATION-ONLY (#408, 2026-09-08), and the sharpest of them: the promotions subsystem runs
+         * UNCONDITIONALLY. Promotion codes are applied at `billing-account.mutations` and resolved in
+         * `billing-state`, neither of which consults this flag — so setting it `false` disables
+         * nothing, which is a stronger statement than "is not read".
+         */
         enabled: z.boolean().default(true),
     }).default(() => ({
         enabled: true,
@@ -68,7 +94,10 @@ export const BillingConfigurationSchema = z.object({
      * Controls whether credit pools are enabled and defines default pool behavior.
      */
     creditPools: z.object({
-        /** Whether credit pool functionality is enabled (auto-creation on CREDIT_PACK purchase) */
+        /**
+         * DECLARATION-ONLY (#408, 2026-09-08) — same shape as `promotions.enabled` above, and the same
+         * correction: credit pools run unconditionally in `billing-state`, so `false` disables nothing.
+         */
         enabled: z.boolean().default(true),
         /** Default initial balance for auto-created pools (default 0) */
         defaultInitialBalance: z.number().min(0).default(0),
@@ -80,13 +109,26 @@ export const BillingConfigurationSchema = z.object({
     defaultBehaviorPolicy: z.object({
         /** Default trial days for new subscriptions (0 = no trial) */
         defaultTrialDays: z.number().min(0).default(0),
-        /** Grace period before marking subscription as past_due after failed payment */
+        /**
+         * DECLARATION-ONLY (#408, 2026-09-08). Dunning — how long to wait and how often to retry after a
+         * failed payment — is configured at the PROVIDER, on its own schedule, and nothing here reaches
+         * it. Binding them would mean writing a provider's retry settings from application config, which
+         * is a different feature from reading a policy at a call site.
+         */
         paymentGracePeriodDays: z.number().min(0).default(3),
-        /** Maximum automatic payment retries before giving up */
+        /** DECLARATION-ONLY — see `paymentGracePeriodDays`. */
         maxPaymentRetries: z.number().min(0).default(3),
-        /** Default proration when no product-specific policy */
+        /** Default proration when no product-specific policy. READ by the change-plan path. */
         defaultProration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),
-        /** Default cancellation behavior */
+        /**
+         * Default cancellation timing when neither the caller nor the plan product names one.
+         *
+         * READ since 2026-09-08 (#408). It was dead until then, and it is bound rather than relabelled
+         * because — unlike its neighbours above — it needs no provider call at all: cancellation timing
+         * is resolved locally, so the only thing standing between this key and meaning something was a
+         * reader. The chain is caller → product `behaviorPolicy.cancellation.defaultBehavior` → this →
+         * period-end.
+         */
         defaultCancellation: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),
     }).default(() => ({
         defaultTrialDays: 0,

package/dist/esm/billing/billing-configuration.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-configuration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sDAAsD;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,4BAA4B;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,wCAAwC;QACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;QACpD,iFAAiF;QACjF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,oEAAoE;IACpE,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IAE7D;;;OAGG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,+CAA+C;QAC/C,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QAEhF;;;;;;;;WAQG;QACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;KAC7E,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,eAAe,EAAE,kBAAkB,CAAC,QAAQ;QAC5C,kBAAkB,EAAE,cAAc,CAAC,SAAS;KAC7C,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAElG;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,6CAA6C;QAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,2FAA2F;QAC3F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,iEAAiE;QACjE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACpD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC;IAEH,uFAAuF;IACvF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,8DAA8D;QAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,gFAAgF;QAChF,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,yDAAyD;QACzD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,wDAAwD;QACxD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACxF,oCAAoC;QACpC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAChF,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB;QACrD,mBAAmB,EAAE,aAAa,CAAC,aAAa;KACjD,CAAC,CAAC;CACJ,CAAC,CAAC","sourcesContent":["/**\n * Billing Configuration Schema (Shared)\n *\n * Top-level billing configuration that custom apps provide at startup.\n * Controls: provider selection, currency, tax policy, enabled scopes,\n * and default behavior policies.\n *\n * @see billing-and-features-system.md §6.7 (Billing Configuration)\n */\n\nimport { z } from 'zod';\nimport { CurrencySchema } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  TaxCalculationMode,\n  TaxDisplayMode,\n  ProrationBehavior,\n  BillingTiming,\n} from './billing-enums.shared.schemas';\n\nexport const BillingConfigurationSchema = z.object({\n  /** Master switch: is billing enabled for this app? */\n  enabled: z.boolean().default(false),\n  /** Which billing provider to use (e.g., 'stripe') */\n  providerRef: z.string().optional(),\n\n  /** Webhook configuration */\n  webhooks: z.object({\n    /** Path for billing webhook endpoint */\n    path: z.string().default('/api/v1/webhooks/billing'),\n    /** Reference to the webhook signing secret (resolved from secrets at runtime) */\n    signingSecretRef: z.string().optional(),\n  }).optional(),\n\n  /** Default ISO 4217 currency for new billing accounts / products */\n  defaultCurrency: CurrencySchema.default('USD'),\n  /** Supported currencies (for multi-currency apps) */\n  supportedCurrencies: z.array(CurrencySchema).default(['USD']),\n\n  /**\n   * Tax configuration — calculation is ALWAYS delegated to provider (Stripe Tax, etc.).\n   * We never calculate tax locally.\n   */\n  tax: z.object({\n    /** How the provider handles tax calculation */\n    calculationMode: z.enum(TaxCalculationMode).default(TaxCalculationMode.DISABLED),\n\n    /**\n     * How prices are DISPLAYED to users (does not affect provider calculation).\n     * - 'exclusive': Prices shown excluding tax (HT / ex-VAT). Tax added at checkout.\n     *   Common for B2B. Shows \"$49/mo\" and tax is added separately.\n     * - 'inclusive': Prices shown including tax (TTC / inc-VAT). Tax is embedded.\n     *   Common for consumer-facing. Shows \"€49/mo TTC\" and tax is extracted at checkout.\n     *\n     * Overridable per product (product.taxDisplayMode) and per price (price.taxBehavior).\n     */\n    defaultDisplayMode: z.enum(TaxDisplayMode).default(TaxDisplayMode.EXCLUSIVE),\n  }).default(() => ({\n    calculationMode: TaxCalculationMode.DISABLED,\n    defaultDisplayMode: TaxDisplayMode.EXCLUSIVE,\n  })),\n\n  /**\n   * Which scopes can have billing accounts (default: ORGANIZATIONS only).\n   * Can be extended to include USER_SELF (personal billing).\n   */\n  enabledScopes: z.array(z.enum(ResourcePrimaryScope)).default([ResourcePrimaryScope.ORGANIZATIONS]),\n\n  /**\n   * Promotions configuration.\n   * Controls whether the promotions subsystem is active.\n   */\n  promotions: z.object({\n    /** Whether promotions/coupons are enabled */\n    enabled: z.boolean().default(true),\n  }).default(() => ({\n    enabled: true,\n  })),\n\n  /**\n   * Credit pool configuration.\n   * Controls whether credit pools are enabled and defines default pool behavior.\n   */\n  creditPools: z.object({\n    /** Whether credit pool functionality is enabled (auto-creation on CREDIT_PACK purchase) */\n    enabled: z.boolean().default(true),\n    /** Default initial balance for auto-created pools (default 0) */\n    defaultInitialBalance: z.number().min(0).default(0),\n  }).default(() => ({\n    enabled: true,\n    defaultInitialBalance: 0,\n  })),\n\n  /** Global billing policy defaults (overridden by ProductBehaviorPolicy per product) */\n  defaultBehaviorPolicy: z.object({\n    /** Default trial days for new subscriptions (0 = no trial) */\n    defaultTrialDays: z.number().min(0).default(0),\n    /** Grace period before marking subscription as past_due after failed payment */\n    paymentGracePeriodDays: z.number().min(0).default(3),\n    /** Maximum automatic payment retries before giving up */\n    maxPaymentRetries: z.number().min(0).default(3),\n    /** Default proration when no product-specific policy */\n    defaultProration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n    /** Default cancellation behavior */\n    defaultCancellation: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).default(() => ({\n    defaultTrialDays: 0,\n    paymentGracePeriodDays: 3,\n    maxPaymentRetries: 3,\n    defaultProration: ProrationBehavior.CREATE_PRORATIONS,\n    defaultCancellation: BillingTiming.AT_PERIOD_END,\n  })),\n});\nexport type BillingConfiguration = z.infer<typeof BillingConfigurationSchema>;\n"]}
+{"version":3,"file":"billing-configuration.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sDAAsD;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC;;;;;;;;;;;OAWG;IAEH;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,gDAAgD;IAChD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IAE7D;;;OAGG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ;;;;;;;;WAQG;QACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QAEhF;;;;;;;;;;;WAWG;QACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;KAC7E,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,eAAe,EAAE,kBAAkB,CAAC,QAAQ;QAC5C,kBAAkB,EAAE,cAAc,CAAC,SAAS;KAC7C,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAElG;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB;;;;;WAKG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB;;;WAGG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,iEAAiE;QACjE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACpD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC;IAEH,uFAAuF;IACvF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,8DAA8D;QAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C;;;;;WAKG;QACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,uDAAuD;QACvD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,uFAAuF;QACvF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACxF;;;;;;;;WAQG;QACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAChF,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB;QACrD,mBAAmB,EAAE,aAAa,CAAC,aAAa;KACjD,CAAC,CAAC;CACJ,CAAC,CAAC","sourcesContent":["/**\n * Billing Configuration Schema (Shared)\n *\n * Top-level billing configuration that custom apps provide at startup.\n * Controls: provider selection, currency, tax policy, enabled scopes,\n * and default behavior policies.\n *\n * @see billing-and-features-system.md §6.7 (Billing Configuration)\n */\n\nimport { z } from 'zod';\nimport { CurrencySchema } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  TaxCalculationMode,\n  TaxDisplayMode,\n  ProrationBehavior,\n  BillingTiming,\n} from './billing-enums.shared.schemas';\n\nexport const BillingConfigurationSchema = z.object({\n  /** Master switch: is billing enabled for this app? */\n  enabled: z.boolean().default(false),\n  /** Which billing provider to use (e.g., 'stripe') */\n  providerRef: z.string().optional(),\n\n  /*\n   * NO `webhooks` block. `path` and `signingSecretRef` were declared here and read by NOTHING —\n   * `signingSecretRef` had zero references outside its own declaration — and they were removed on\n   * 2026-09-08 (#408) rather than relabelled, because unlike the commercial-intent keys below they\n   * were not even an input to anything.\n   *\n   * The route and the signing secret both come from the provider module's `WEBHOOK_ORIGINATOR`\n   * contract: `buildWebhookEndpoints` mounts it at `/api/v1/webhooks/<provider>/billing`. That is\n   * the single authority, and `webhook-auto-controller.backend.service.ts` already recorded the\n   * same conclusion when endpoint-level path/secret extras were dropped as dead in the 2026-05-06\n   * reshape. This block was the copy that survived that sweep.\n   */\n\n  /**\n   * DECLARATION-ONLY (#408, 2026-09-08). Read by the application-creation commercial-model brief and\n   * by no runtime billing path: nothing validates a product's currency against these, and what\n   * reaches the provider is each price's own `currency`. Authoring them records the commercial\n   * intent a reviewer reads; it enforces nothing.\n   */\n  defaultCurrency: CurrencySchema.default('USD'),\n  /** DECLARATION-ONLY — see `defaultCurrency`. */\n  supportedCurrencies: z.array(CurrencySchema).default(['USD']),\n\n  /**\n   * Tax configuration — calculation is ALWAYS delegated to provider (Stripe Tax, etc.).\n   * We never calculate tax locally.\n   */\n  tax: z.object({\n    /**\n     * Whether the PROVIDER computes tax on a purchase. READ since 2026-09-08 (#408): the checkout\n     * path — the only production purchase route — sends `automaticTax` from this value.\n     *\n     * It reached nothing before that, so `PROVIDER_MANAGED` changed no behaviour and the provider\n     * account's own configuration silently decided. Enabling it changes invoice totals and the tax\n     * amounts persisted against them, which is why it is a decision an application makes rather\n     * than a default the framework picks.\n     */\n    calculationMode: z.enum(TaxCalculationMode).default(TaxCalculationMode.DISABLED),\n\n    /**\n     * How prices are DISPLAYED to users (does not affect provider calculation).\n     * - 'exclusive': Prices shown excluding tax (HT / ex-VAT). Tax added at checkout.\n     *   Common for B2B. Shows \"$49/mo\" and tax is added separately.\n     * - 'inclusive': Prices shown including tax (TTC / inc-VAT). Tax is embedded.\n     *   Common for consumer-facing. Shows \"€49/mo TTC\" and tax is extracted at checkout.\n     *\n     * DECLARATIVE ONLY: nothing reads this value. It is not an application-wide default that\n     * `product.taxDisplayMode` and `price.taxBehavior` override, because there is no resolution\n     * chain between the three. What reaches the billing provider is each price's own\n     * `taxBehavior`, and only that.\n     */\n    defaultDisplayMode: z.enum(TaxDisplayMode).default(TaxDisplayMode.EXCLUSIVE),\n  }).default(() => ({\n    calculationMode: TaxCalculationMode.DISABLED,\n    defaultDisplayMode: TaxDisplayMode.EXCLUSIVE,\n  })),\n\n  /**\n   * Which scopes can have billing accounts (default: ORGANIZATIONS only).\n   * Can be extended to include USER_SELF (personal billing).\n   */\n  enabledScopes: z.array(z.enum(ResourcePrimaryScope)).default([ResourcePrimaryScope.ORGANIZATIONS]),\n\n  /**\n   * Promotions configuration.\n   * Controls whether the promotions subsystem is active.\n   */\n  promotions: z.object({\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08), and the sharpest of them: the promotions subsystem runs\n     * UNCONDITIONALLY. Promotion codes are applied at `billing-account.mutations` and resolved in\n     * `billing-state`, neither of which consults this flag — so setting it `false` disables\n     * nothing, which is a stronger statement than \"is not read\".\n     */\n    enabled: z.boolean().default(true),\n  }).default(() => ({\n    enabled: true,\n  })),\n\n  /**\n   * Credit pool configuration.\n   * Controls whether credit pools are enabled and defines default pool behavior.\n   */\n  creditPools: z.object({\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08) — same shape as `promotions.enabled` above, and the same\n     * correction: credit pools run unconditionally in `billing-state`, so `false` disables nothing.\n     */\n    enabled: z.boolean().default(true),\n    /** Default initial balance for auto-created pools (default 0) */\n    defaultInitialBalance: z.number().min(0).default(0),\n  }).default(() => ({\n    enabled: true,\n    defaultInitialBalance: 0,\n  })),\n\n  /** Global billing policy defaults (overridden by ProductBehaviorPolicy per product) */\n  defaultBehaviorPolicy: z.object({\n    /** Default trial days for new subscriptions (0 = no trial) */\n    defaultTrialDays: z.number().min(0).default(0),\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08). Dunning — how long to wait and how often to retry after a\n     * failed payment — is configured at the PROVIDER, on its own schedule, and nothing here reaches\n     * it. Binding them would mean writing a provider's retry settings from application config, which\n     * is a different feature from reading a policy at a call site.\n     */\n    paymentGracePeriodDays: z.number().min(0).default(3),\n    /** DECLARATION-ONLY — see `paymentGracePeriodDays`. */\n    maxPaymentRetries: z.number().min(0).default(3),\n    /** Default proration when no product-specific policy. READ by the change-plan path. */\n    defaultProration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n    /**\n     * Default cancellation timing when neither the caller nor the plan product names one.\n     *\n     * READ since 2026-09-08 (#408). It was dead until then, and it is bound rather than relabelled\n     * because — unlike its neighbours above — it needs no provider call at all: cancellation timing\n     * is resolved locally, so the only thing standing between this key and meaning something was a\n     * reader. The chain is caller → product `behaviorPolicy.cancellation.defaultBehavior` → this →\n     * period-end.\n     */\n    defaultCancellation: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).default(() => ({\n    defaultTrialDays: 0,\n    paymentGracePeriodDays: 3,\n    maxPaymentRetries: 3,\n    defaultProration: ProrationBehavior.CREATE_PRORATIONS,\n    defaultCancellation: BillingTiming.AT_PERIOD_END,\n  })),\n});\nexport type BillingConfiguration = z.infer<typeof BillingConfigurationSchema>;\n"]}

package/dist/esm/billing/billing-enums.shared.schemas.d.ts

@@ -5,13 +5,27 @@
  * These supersede the legacy enums from billing.shared.schemas.ts.
  *
  * Enums shared with the standard billing interface (PricingModel, BillingInterval,
- * TaxDisplayMode, SubscriptionStatus) are defined in @wildo-ai/external-connectors-models
- * and re-exported here for convenience.
+ * TaxDisplayMode, SubscriptionStatus, InvoiceStatus, ProrationBehavior) are defined in
+ * @wildo-ai/external-connectors-models and re-exported here for convenience.
  *
  * @see billing-and-features-system.md §6 (Billing Schemas)
  */
-export { PricingModel, BillingInterval, TaxDisplayMode, SubscriptionStatus } from '@wildo-ai/external-connectors-models';
+export { PricingModel, BillingInterval, TaxDisplayMode, SubscriptionStatus, InvoiceStatus, ProrationBehavior } from '@wildo-ai/external-connectors-models';
 /**
+ * @wildo_source:part:start saas.models.billing.catalog-vocabularies facet:layer:shared facet:audience:app-developer
+ *
+ * The vocabularies an application types into its own product catalogue — the `ProductDefinition[]`
+ * it exports from its shared library and hands to the engine with its module declarations.
+ *
+ * Imported from `@wildo-ai/saas-models`. `PricingModel`, `BillingInterval` and `ProrationBehavior`
+ * are re-exported from the connector models, because their values ARE the provider's wire values.
+ *
+ * ⚠️ **The catalogue is ONE-WAY.** Sync pushes only rows that have no provider link yet, so a product
+ * or price edited in the provider's own dashboard is never read back, never reconciled, and never
+ * reported. Removing a product from the array does not retire it at the provider and does not
+ * deactivate the existing row — nothing detects that a previously synced key has disappeared. Treat
+ * the array as the source of truth and make every change through it.
+ *
  * Product types available in the billing catalog.
  *
  * | Type        | Creates subscription? | Repeatable? | Grants features? | Usage tracked? |
@@ -49,11 +63,6 @@ export declare enum LimitGrantMode {
 /**
  * Proration behavior for plan changes (upgrade/downgrade).
  */
-export declare enum ProrationBehavior {
-    CREATE_PRORATIONS = "create_prorations",
-    NONE = "none",
-    ALWAYS_INVOICE = "always_invoice"
-}
 /**
  * Billing timing: when to apply plan changes.
  */
@@ -61,6 +70,7 @@ export declare enum BillingTiming {
     IMMEDIATE = "immediate",
     AT_PERIOD_END = "at_period_end"
 }
+/** @wildo_source:part:end saas.models.billing.catalog-vocabularies */
 /**
  * Metering aggregation window for usage records.
  */
@@ -85,24 +95,56 @@ export declare enum UsageSourceType {
     CUSTOM = "custom"
 }
 /**
- * Tax calculation mode: provider-managed or disabled.
+ * Where one metered usage row stands with respect to the provider flush.
+ *
+ * This was a BOOLEAN (`reportedToProvider`) until 2026-09-09, and the third state is the whole
+ * reason it is an enum now (#512). A boolean can say "not yet reported" and "reported", and the
+ * flush selects on the first — so a row that can NEVER be reported has nowhere to go. It stays
+ * pending, is re-selected by every run, fails identically, and grows an error backlog that no
+ * operator action can drain, on a five-minute schedule.
+ *
+ * The three states are genuinely distinct and must not be collapsed:
+ *
+ * - {@link PENDING} — the flush will try again. Every newly recorded row starts here.
+ * - {@link REPORTED} — the provider acknowledged the quantity. `reportedAt` says when. Terminal,
+ *   and money has moved: never move a row back out of this state.
+ * - {@link UNREPORTABLE} — the flush determined the row can never be reported, for a reason named
+ *   in `unreportableReason`. Terminal, and NO money moved. Marking such a row `REPORTED` instead
+ *   would drain the backlog just as well and would be a lie no later reader could detect, which is
+ *   exactly why the state exists rather than a shortcut.
  */
-export declare enum TaxCalculationMode {
-    PROVIDER_MANAGED = "provider_managed",
-    DISABLED = "disabled"
+export declare enum UsageRecordFlushState {
+    PENDING = "pending",
+    REPORTED = "reported",
+    UNREPORTABLE = "unreportable"
 }
 /**
- * Invoice status values (maps to Stripe invoice statuses).
+ * Why a usage row was determined to be permanently unreportable.
  *
- * Invoices are created and managed entirely by the billing provider.
- * We store a thin reference for status tracking and quick display.
+ * One member today, and it is a closed vocabulary rather than a free string because the operator
+ * reading a retained financial record needs to know which permanent condition applies — and because
+ * the distinction between a PERMANENT and a TRANSIENT failure is the judgement this whole state
+ * turns on. A billing account that merely has no `providerCustomerId` yet is transient: the account
+ * exists, provisioning may still complete, and such a row stays {@link UsageRecordFlushState.PENDING}.
+ * Only a condition that cannot resolve itself belongs here.
  */
-export declare enum InvoiceStatus {
-    DRAFT = "draft",
-    OPEN = "open",
-    PAID = "paid",
-    VOID = "void",
-    UNCOLLECTIBLE = "uncollectible"
+export declare enum UsageRecordUnreportableReason {
+    /**
+     * The billing account row no longer exists.
+     *
+     * Reachable by design: usage rows are RETAINED when their subject is erased (the tax/audit
+     * obligation on `usage-record.shared.schemas.ts`), so a deleted account legitimately leaves rows
+     * behind with no provider customer to report them to. Nothing can restore the mapping, so the
+     * quantity will never be billed and saying so on the row is the only honest outcome.
+     */
+    BILLING_ACCOUNT_DELETED = "billing_account_deleted"
+}
+/**
+ * Tax calculation mode: provider-managed or disabled.
+ */
+export declare enum TaxCalculationMode {
+    PROVIDER_MANAGED = "provider_managed",
+    DISABLED = "disabled"
 }
 /**
  * Billing-compatible scope types.
@@ -224,6 +266,20 @@ export declare enum BillingCheckoutMetadataKey {
     BILLING_ACCOUNT_ID = "wildo_billingAccountId",
     /** The catalog product key purchased — selects the credit pool and credits-per-unit on top-up. */
     PRODUCT_KEY = "wildo_productKey",
+    /**
+     * The PROMOTION row whose code the framework validated when it opened this checkout, so the
+     * redemption can be counted when the session COMPLETES (#518).
+     *
+     * Absent when the purchase used no code, which is the common case.
+     *
+     * Stamped rather than re-derived from the completed session, because the provider reports the
+     * DISCOUNT it applied and not the Wildo row that authorised it — and the row is what carries
+     * `maxRedemptions`. Like every key here it is written for the framework's own reconciliation and is
+     * never trusted as authority on its own: the redemption is counted with a compare-and-swap that
+     * refuses past the cap, so a tampered value can at worst count a redemption against a promotion
+     * that has room for one.
+     */
+    PROMOTION_ID = "wildo_promotionId",
     /**
      * The purchased quantity, as a decimal integer string (provider metadata values are strings).
      * Strictly parsed and bounded by {@link BILLING_CHECKOUT_MAX_QUANTITY} on the way back in.