@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/resources/resources-registry.shared.core.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-registry.shared.core.definitions.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources-registry.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,oBAAoB,EAA+G,MAAM,4BAA4B,CAAC;AAKnM,OAAO,EAAE,gBAAgB,EAAgB,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAA+C,8CAA8C,EAAE,MAAM,mCAAmC,CAAC;AAyGhJ,eAAO,MAAM,8BAA8B,EAAG,oBAAoB,EAo+CjE,CAAC;AAEF,eAAO,MAAM,6CAA6C,EAAE,8CAA8C,CAAC,gBAAgB,CAqG1H,CAAC"}
+{"version":3,"file":"resources-registry.shared.core.definitions.d.ts","sourceRoot":"","sources":["../../../src/resources/resources-registry.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,oBAAoB,EAA+G,MAAM,4BAA4B,CAAC;AAKnM,OAAO,EAAE,gBAAgB,EAAgB,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAA+C,8CAA8C,EAAE,MAAM,mCAAmC,CAAC;AA6GhJ,eAAO,MAAM,8BAA8B,EAAG,oBAAoB,EAuoDjE,CAAC;AAEF,eAAO,MAAM,6CAA6C,EAAE,8CAA8C,CAAC,gBAAgB,CA2G1H,CAAC"}

package/dist/esm/resources/resources-registry.shared.core.definitions.js

@@ -7,6 +7,7 @@ import { CoreResourceType } from "./resources.shared.core.definitions.js";
 import { usersResourceConfiguration_InitializationFactory } from "../users/users.shared.resources-config.schemas.js";
 import { userCredentialsResourceConfiguration_InitializationFactory } from "../users/user-credentials.shared.resources-config.schemas.js";
 import { auditLogsResourceConfiguration_InitializationFactory } from "../compliance/audit-trails/audit-logs.shared.resources-config.schemas.js";
+import { applicationAuditLogsResourceConfiguration_InitializationFactory } from "../compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.js";
 import { filesResourceConfiguration_InitializationFactory } from "../files/files.shared.resources-config.schemas.js";
 import { userSelfResourceConfiguration_InitializationFactory } from "../users/user-self.shared.resources-config.schemas.js";
 import { userProfilesResourceConfiguration_InitializationFactory } from "../users/user-profiles.shared.resources-config.schemas.js";
@@ -19,6 +20,7 @@ import { organizationUnitResourceConfiguration_InitializationFactory } from "../
 import { organizationUnitMemberResourceConfiguration_InitializationFactory } from "../organizations/organization-unit-members.shared.resources-config.schemas.js";
 import { organizationProfileResourceConfiguration_InitializationFactory } from "../organizations/organization-profile.shared.resources-config.schemas.js";
 import { organizationPreferencesResourceConfiguration_InitializationFactory } from "../organizations/organization-preferences.shared.resources-config.schemas.js";
+import { applicationAccessGrantsResourceConfiguration_InitializationFactory } from '../security/authorizations/application-access-grants.shared.resources-config.schemas.js';
 import { platformAccessGrantsResourceConfiguration_InitializationFactory } from '../security/authorizations/platform-access-grants.shared.resources-config.schemas.js';
 import { organizationNotificationsResourceConfiguration_InitializationFactory } from "../organizations/organization-notifications.shared.resources-config.schemas.js";
 import { organizationFeaturesResourceConfiguration_InitializationFactory } from "../organizations/organization-features.shared.resources-config.schemas.js";
@@ -26,6 +28,8 @@ import { userFeaturesResourceConfiguration_InitializationFactory } from "../feat
 import { applicationFeaturesResourceConfiguration_InitializationFactory } from "../features/application-features.shared.resources-config.schemas.js";
 import { organizationMembersResourceConfiguration_InitializationFactory } from "../organizations/organization-members.shared.resources-config.schemas.js";
 import { orgApiKeysResourceConfiguration_InitializationFactory } from "../security/api-keys/api-keys-organization.shared.resources-config.schemas.js";
+import { orgProviderCredentialsResourceConfiguration_InitializationFactory } from "../security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js";
+import { userProviderCredentialsResourceConfiguration_InitializationFactory } from "../security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js";
 import { appApiKeysResourceConfiguration_InitializationFactory } from "../security/api-keys/api-keys-application.shared.resources-config.schemas.js";
 import { orgOAuthClientsResourceConfiguration_InitializationFactory } from "../security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js";
 import { appOAuthClientsResourceConfiguration_InitializationFactory } from "../security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.js";
@@ -454,6 +458,58 @@ export const coreSharedResourceRelationship = [
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
         foreignKeyField: 'organizationId',
     }),
+    // ── APPLICATION-WIDE grants ──────────────────────────────────────────
+    //
+    // The APPLICATION-scoped sibling. Same lifecycle, no tenant: an elevation that reaches every
+    // tenant at once cannot be a COMPOSITION child of any one of them, which is the structural fact
+    // that made a second resource type necessary rather than a `scope` field on the row above.
+    //
+    // OPTIONAL + REQUIRES_CONTEXT + `isPrimaryScope`, copied from `APPLICATION → APPLICATION_AUDIT_LOGS`
+    // and for the reason stated there: MANDATORY makes the ZodToMongoose convertor refuse the resource
+    // outright, so a Mongo-persisted deployment gets no model and INIT dies. Addressing is carried by
+    // `isPrimaryScope` + `REQUIRES_CONTEXT`, which is what the URL builder reads.
+    //
+    // REFERENCE rather than COMPOSITION, and there is no `onParentDelete`: the APPLICATION row is the
+    // deployment itself and is not purged, so a cascade here would describe an event that cannot
+    // happen. `contextPolicy` disabled for the reason the audit door disables it — an elevation record
+    // must never be fetched as ambient context.
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.APPLICATION_ACCESS_GRANTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        foreignKeyField: 'applicationId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false },
+    }),
+    // The two PEOPLE an application-wide grant names — the operator who asked and the SECOND
+    // administrator who signed. Both are `.isForeignKey()`, so the registry must resolve each to a
+    // resource type or the frontend registry refuses to initialise.
+    //
+    // REFERENCE with `onParentDelete.enabled: false`, exactly as on the tenant grant and for the same
+    // reason: making a user the owner resolves `lifecycleModelMode` to DEPENDENT, which is the value
+    // `classifySubjectErasureDisposition` reads — a user erasure would then own the row's fate, and the
+    // one thing a privileged-access ledger must survive is the erasure of the person it monitors.
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.APPLICATION_ACCESS_GRANTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        nature: RelationshipNature.REFERENCE,
+        foreignKeyField: 'operatorUserId',
+        // Server-authored from the session on every grant, so the pointer is always present.
+        parentResourceRequirement: ResourceParentResourceRequirement.MANDATORY,
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.APPLICATION_ACCESS_GRANTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        nature: RelationshipNature.REFERENCE,
+        foreignKeyField: 'approvedByUserId',
+        // OPTIONAL because the field is `.optional()`: unset while the request is pending and
+        // permanently unset on a denied or revoked grant. MANDATORY would assert an approver every
+        // grant must have — true of ACTIVE ones only, which is a lifecycle fact rather than a
+        // schema one.
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
+        contextPolicy: { enabled: false },
+    }),
     // ── The two PEOPLE a grant names ─────────────────────────────────────
     //
     // `operatorUserId` (who asked) and `approvedByUserId` (who agreed) are both `.isForeignKey()` on
@@ -612,6 +668,46 @@ export const coreSharedResourceRelationship = [
         // SECURITY: API keys should never be fetched via context
         contextPolicy: { enabled: false }
     }),
+    // Provider credentials — an organization's own credential toward a third party.
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORG_PROVIDER_CREDENTIALS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        /*
+         * COMPOSITION, and the cascade is the point rather than a detail.
+         *
+         * A tenant's credentials must not outlive the tenant: a purged organization leaving a live
+         * Slack token in the store is a credential nobody owns, nobody can rotate and nothing will
+         * ever delete. Only COMPOSITION resolves to a DEPENDENT lifecycle — a REFERENCE edge cannot
+         * carry `onParentDelete` at all (the framework refuses it), so "enable the cascade later"
+         * is not a one-line change and the edge has to be right the first time.
+         */
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // SECURITY: a credential must never be fetched via context — context objects ride along in
+        // DTOs the client receives, and this row's whole reason to exist is that it holds a secret.
+        contextPolicy: { enabled: false }
+    }),
+    // Provider credentials — a PERSON's own credential toward a third party.
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_PROVIDER_CREDENTIALS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        /*
+         * This edge does two jobs and both are load-bearing.
+         *
+         * It is what gives the resource its USER_SELF primary scope, so the framework's own filter
+         * restricts every read to the authenticated caller's own credentials — nobody can reach
+         * another person's key, structurally, rather than because a role list happens to be narrow.
+         *
+         * And its COMPOSITION cascade is what stops a personal credential outliving the person. The
+         * retention policy deliberately scrubs nothing (a secret is not pseudonymised, it is
+         * destroyed), so the DELETE dispatched here IS the erasure answer for this resource. A
+         * REFERENCE edge cannot carry `onParentDelete` at all, so getting the nature wrong would
+         * leave a live third-party credential belonging to somebody who asked to be forgotten.
+         */
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // SECURITY: as the organization-owned sibling — a row holding a secret must never ride in a
+        // context DTO the client receives.
+        contextPolicy: { enabled: false }
+    }),
     createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.APPLICATION_API_KEYS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
@@ -675,6 +771,43 @@ export const coreSharedResourceRelationship = [
         nature: RelationshipNature.REFERENCE,
         contextPolicy: { enabled: false }
     }),
+    // ── Application-scoped audit door (#317) ─────────────────────────────
+    // ONE parent, deliberately. `accessScopeStrategy` is REQUIRES_CONTEXT so this resource is ROUTED
+    // at `/applications/{applicationId}/application-audit-logs` — the shape `APPLICATION_API_KEYS`
+    // already uses. A second parent must NEVER be added here: two always-on parents collapse into a
+    // single fully-nested route, because `generateParentCombinations` puts every primary-scope and
+    // every REQUIRES_CONTEXT edge into EVERY combination. That collapse is precisely why this is a
+    // sibling type instead of a second route on AUDIT_LOGS.
+    //
+    // `parentResourceRequirement: OPTIONAL`, matching the `APPLICATION -> AUDIT_LOGS` edge above on
+    // the SAME `applicationId` column. This flag is a claim about the ROWS, not about the route:
+    // `deriveRelationshipPersistenceContract` reads it as "the holder's FK column is non-nullable for
+    // every holder row". This door owns no rows of its own — both types resolve to the `auditLogs`
+    // collection through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES`, and every row is written
+    // through the organization door's `REPOSITORY_ONLY` CREATE against `AuditableEvent_BaseSchema`,
+    // where `applicationId` is `.optional()`. Organization-scoped, user-only and system events
+    // legitimately omit it (the sibling edge says so in as many words), and it is otherwise supplied
+    // only opportunistically by primary-scope context enrichment, which needs a seeded APPLICATION row.
+    //
+    // MANDATORY here was really a statement about ADDRESSING — this parent IS the route segment — and
+    // that is carried entirely by `isPrimaryScope` + `accessScopeStrategy: REQUIRES_CONTEXT`, which is
+    // what `generateParentCombinations` reads. The derived `isOptional` is assigned and never read by
+    // the URL builder, so the route is identical either way. Declared MANDATORY the resource does not
+    // load AT ALL: the ZodToMongoose convertor refuses it (`Align parentResourceRequirement with the
+    // resource schema`), so a Mongo-persisted deployment gets no model and INIT dies on
+    // `zod_converter_schema_conversion_failed`. `PLATFORM_APPLICATIONS` in apps-manager is the same
+    // shape — primary scope + REQUIRES_CONTEXT + OPTIONAL on this very column.
+    //
+    // `contextPolicy` disabled for the reason API keys disable it: an audit row must never be fetched
+    // as ambient context.
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.APPLICATION_AUDIT_LOGS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        foreignKeyField: 'applicationId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false },
+    }),
     // ── Notification Badges (Dual-Scope Polymorphic) ─────────────────────
     // Each scope owns its own resource type and its own MongoDB collection.
     // Accessed internally via `NotificationBadgeBackendService`, which dispatches
@@ -854,11 +987,18 @@ export const coreSharedResourceRelationship = [
     //     against the provider defeats the purpose of retaining it. Nothing provider-side is cleaned
     //     up on delete either (no customer deletion, no subscription cancellation), so this was a
     //     purely LOCAL mapping being thrown away while the provider-side record lived on.
-    //   • The usage-flush sweep (`UsageMeteringBackendService.flushScopeToProvider`) selects on
-    //     `reportedToProvider: false`, groups by this FK, and skips its "mark as reported" write when
-    //     the customer id cannot be resolved. Retained usage rows whose account was deleted are
-    //     therefore re-selected by EVERY subsequent sweep and can never drain — a permanent,
-    //     monotonically growing error backlog. (Latent today: no cron calls `flushToProvider` yet.)
+    //   • The usage-flush sweep (`UsageMeteringBackendService.flushScopeToProvider`) selects unreported
+    //     rows and groups by this FK. It USED to skip its marking write whenever the customer id could
+    //     not be resolved, so retained rows whose account was deleted were re-selected by EVERY
+    //     subsequent sweep and could never drain — a permanent, monotonically growing error backlog,
+    //     which stopped being latent on 2026-09-08 (#415) when the `usage-flush` batch began calling
+    //     `flushToProvider` on a schedule. FIXED 2026-09-09 (#512): the sweep now distinguishes a
+    //     DELETED account (permanent) from one merely awaiting a `providerCustomerId` (transient), and
+    //     moves the former's rows to the terminal `flushState: unreportable` with a recorded reason.
+    //     The rows are still retained and still unbillable — what changed is that the run says so ONCE
+    //     and then leaves them alone. This bullet is kept in full because the dangling-reference
+    //     argument above still holds: it is why the account must not be hard-deleted in the first
+    //     place, and the fix only makes the aftermath survivable.
     //   • `onSubscriptionChanged` (feature sync, fired by the subscription post-operation hook) and
     //     the webhook router's `emitBillingEvent` both dereference this FK off a retained child; both
     //     are null-guarded, so they degrade to a warn + silent no-op rather than crashing.
@@ -1305,6 +1445,7 @@ export const coreShared_ResourcesConfigurations_FactoryMap = {
     [CoreResourceType.ORGANIZATION_PROFILES]: organizationProfileResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_PREFERENCES]: organizationPreferencesResourceConfiguration_InitializationFactory,
     [CoreResourceType.PLATFORM_ACCESS_GRANTS]: platformAccessGrantsResourceConfiguration_InitializationFactory,
+    [CoreResourceType.APPLICATION_ACCESS_GRANTS]: applicationAccessGrantsResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_NOTIFICATIONS]: organizationNotificationsResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_FEATURES]: organizationFeaturesResourceConfiguration_InitializationFactory,
     [CoreResourceType.USER_FEATURES]: userFeaturesResourceConfiguration_InitializationFactory,
@@ -1316,6 +1457,8 @@ export const coreShared_ResourcesConfigurations_FactoryMap = {
     [CoreResourceType.APPLICATION_FEATURES]: applicationFeaturesResourceConfiguration_InitializationFactory,
     // API Keys
     [CoreResourceType.ORG_API_KEYS]: orgApiKeysResourceConfiguration_InitializationFactory,
+    [CoreResourceType.ORG_PROVIDER_CREDENTIALS]: orgProviderCredentialsResourceConfiguration_InitializationFactory,
+    [CoreResourceType.USER_PROVIDER_CREDENTIALS]: userProviderCredentialsResourceConfiguration_InitializationFactory,
     [CoreResourceType.APPLICATION_API_KEYS]: appApiKeysResourceConfiguration_InitializationFactory,
     // OAuth Clients (registered client-credentials front — mirrors API Keys)
     [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: orgOAuthClientsResourceConfiguration_InitializationFactory,
@@ -1333,6 +1476,9 @@ export const coreShared_ResourcesConfigurations_FactoryMap = {
     [CoreResourceType.REFERRALS]: referralsResourceConfiguration_InitializationFactory,
     // Audit and Compliance
     [CoreResourceType.AUDIT_LOGS]: auditLogsResourceConfiguration_InitializationFactory,
+    // The APPLICATION-scoped door onto the SAME rows (#317). A separate type because the URL
+    // combinator would otherwise rewrite the organization route — see the config's header.
+    [CoreResourceType.APPLICATION_AUDIT_LOGS]: applicationAuditLogsResourceConfiguration_InitializationFactory,
     // Notification Badges — polymorphic dual-scope (USER + ORG)
     [CoreResourceType.USER_NOTIFICATION_BADGES]: userNotificationBadgesResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: organizationNotificationBadgesResourceConfiguration_InitializationFactory,