@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/resources/resources-relationships.shared.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-relationships.shared.factory.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources-relationships.shared.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,kBAAkB,EAClB,KAAK,gCAAgC,EACrC,iCAAiC,EAEjC,oBAAoB,EAEpB,uCAAuC,EACvC,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAA+B,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AAC1I,OAAO,EAAE,yBAAyB,EAAmC,MAAM,uCAAuC,CAAC;AAYnH;;;;GAIG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,UAAU,CAAC,EAAG,OAAO,CAAC;IACtB,cAAc,CAAC,EAAG,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAG,iCAAiC,CAAC;IAC/D,mBAAmB,CAAC,EAAG,uCAAuC,CAAC;IAC/D,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wFAAwF;IACxF,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,gCAAgC,CAAC;IACxC;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC;;;;OAIG;IACH,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,+BAA+B,CAAC;IAC5C;;;OAGG;IACH,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,CAAC;AACF,kFAAkF;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,wBAAgB,2BAA2B,CACvC,aAAa,EAAE,YAAY,EAC3B,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,+BAA+B,EAC7C,YAAY,EAAE,+BAA+B,EAC7C,OAAO,EAAE,sCAAsC,GAC7C,oBAAoB,CA0PvB"}
+{"version":3,"file":"resources-relationships.shared.factory.d.ts","sourceRoot":"","sources":["../../../src/resources/resources-relationships.shared.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,kBAAkB,EAClB,KAAK,gCAAgC,EACrC,iCAAiC,EAEjC,oBAAoB,EAEpB,uCAAuC,EACvC,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAA+B,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AAC1I,OAAO,EAAE,yBAAyB,EAAmC,MAAM,uCAAuC,CAAC;AAYnH;;;;GAIG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,UAAU,CAAC,EAAG,OAAO,CAAC;IACtB,cAAc,CAAC,EAAG,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAG,iCAAiC,CAAC;IAC/D,mBAAmB,CAAC,EAAG,uCAAuC,CAAC;IAC/D,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wFAAwF;IACxF,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,gCAAgC,CAAC;IACxC;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC;;;;OAIG;IACH,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,+BAA+B,CAAC;IAC5C;;;OAGG;IACH,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,CAAC;AACF,kFAAkF;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,wBAAgB,2BAA2B,CACvC,aAAa,EAAE,YAAY,EAC3B,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,+BAA+B,EAC7C,YAAY,EAAE,+BAA+B,EAC7C,OAAO,EAAE,sCAAsC,GAC7C,oBAAoB,CAyQvB"}

package/dist/esm/resources/resources-relationships.shared.factory.js

@@ -109,6 +109,19 @@ export function createResourcesRelationship(resourceType1, resourceType2, cardin
     // ========================================
     // VALIDATION GUARDS
     // ========================================
+    //
+    // The numbers below are STABLE LABELS, not a count and not a sequence. They are cited from
+    // `resources-relationships-factory.test.ts`, from `resources-registry.shared.core.definitions.ts`
+    // and from sibling packages, so renumbering them breaks those references. Two consequences a
+    // reader has to know before counting anything here:
+    //
+    //   - there is no Guard 4, and no commit touching this file has ever added or removed one;
+    //   - three refusals in this sequence carry no number at all (self-referencing MANY-to-MANY
+    //     below Guard 2, the unresolvable primary scope, and the post-default-resolution repeat of
+    //     Guard 1 near the end of the function).
+    //
+    // So "the guards" is a larger set than "the numbered guards". Enumerate the `throw` statements,
+    // not the labels.
     // Guard 1: `isPrimaryScope` cannot be paired with `OPTIONAL_CONTEXT`.
     //
     // ## Why this guard exists (and why it only forbids OPTIONAL_CONTEXT, not STANDALONE)
@@ -163,6 +176,8 @@ export function createResourcesRelationship(resourceType1, resourceType2, cardin
             `Self-referencing MANY-to-MANY relationships cannot be authored as one association declaration.\n` +
             `Declare explicit junction-resource relationships so source and target edge identity stay explicit.`);
     }
+    // (The refusal immediately above carries no guard number: self-referencing MANY-to-MANY.)
+    //
     // Note: foreignKeyField IS valid with isPrimaryScope - it specifies the FK field on the child
     // resource that points back to the parent, which is useful for 1:1 relationships
     // Guard 3: jointResourceType should not be combined with foreignKeyField.

package/dist/esm/resources/resources-relationships.shared.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-relationships.shared.factory.js","sourceRoot":"","sources":["../../../../src/resources/resources-relationships.shared.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,kBAAkB,EAElB,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,GAGhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE5D,OAAO,EAAyB,2BAA2B,EAAqC,MAAM,mCAAmC,CAAC;AAC1I,OAAO,EAA6B,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;GAEG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAa,CAAC,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AA4FD,kFAAkF;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,UAAU,2BAA2B,CACvC,aAA2B,EAC3B,aAA2B,EAC3B,YAA6C,EAC7C,YAA6C,EAC7C,OAA+C;IAG/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,4DAA4D;YAC5D,sGAAsG,CACvG,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,oBAAoB;IACpB,2CAA2C;IAE3C,sEAAsE;IACtE,EAAE;IACF,sFAAsF;IACtF,EAAE;IACF,6EAA6E;IAC7E,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,sEAAsE;IACtE,EAAE;IACF,iEAAiE;IACjE,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,iEAAiE;IACjE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,mBAAmB,KAAK,uCAAuC,CAAC,gBAAgB,EAAE,CAAC;QAC9F,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,mEAAmE;YACnE,+EAA+E;YAC/E,4EAA4E;YAC5E,sEAAsE;YACtE,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAChC,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,IACE,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,OAAO,EAAE,iBAAiB;QAC1B,aAAa,KAAK,aAAa,EAC/B,CAAC;QACD,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,kGAAkG;YAClG,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,iFAAiF;IAEjF,0EAA0E;IAC1E,mEAAmE;IACnE,0EAA0E;IAC1E,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,eAAe,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QAC9F,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,sFAAsF;YACtF,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,oBAAoB,OAAO,sEAAsE;gBACjG,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,uFAAuF;IACvF,uFAAuF;IACvF,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,aAAa,KAAK,aAAa,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,mFAAmF;gBACnF,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,yFAAyF;QACzF,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,EAAE,yBAAyB,IAAI,iCAAiC,CAAC,SAAS,CAAC;QAC7G,IAAI,kBAAkB,KAAK,iCAAiC,CAAC,SAAS,EAAE,CAAC;YACvE,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,wFAAwF;gBACxF,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACvG,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,yEAAyE;YACzE,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,EAAE,MAAM,KAAK,kBAAkB,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACtF,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,kDAAkD;YAClD,kGAAkG,CACnG,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,wBAAwB;IACxB,2CAA2C;IAE3C,IAAI,YAA+C,CAAC;IACpD,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;QAE5B,MAAM,eAAe,GAAG;YACtB,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC,aAAa;YACpE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,SAAS;YACxD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,SAAS;YAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,WAAW;YAChE,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,SAAS;SACnE,CAAA;QACD,YAAY,GAAG,eAAe,CAAC,aAAiC,CAAC,CAAC;QAElE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,wBAAwB,CAAC,iBAAiB,aAAa,oCAAoC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,iCAAiC;IACjC,2CAA2C;IAE3C,MAAM,yBAAyB,GAAG,OAAO,EAAE,yBAAyB,IAAI,iCAAiC,CAAC,SAAS,CAAC;IACpH,IAAI,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;IAEnF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAClC,IAAI,yBAAyB,KAAK,iCAAiC,CAAC,SAAS,EAAE,CAAC;YAC9E,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IACpD,CAAC;IAED,mFAAmF;IACnF,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,sBAAsB;IACtB,IAAI,OAAO,EAAE,cAAc;QACvB,mBAAmB,KAAK,uCAAuC,CAAC,gBAAgB,EAAE,CAAC;QACrF,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,uEAAuE;YACvE,gFAAgF;YAChF,8EAA8E;YAC9E,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,qBAAqB,GAAG,OAAO,EAAE,eAAe;QACpD,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO;QACpC,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,uBAAuB,GAAoC;QAC/D,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,aAAa;QACb,mBAAmB;QACnB,yBAAyB;QACzB,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,KAAK;QAChD,YAAY;QACZ,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,IAAI,SAAS;QAC1D,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;QACxC,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;QACxC,4CAA4C;QAC5C,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,iEAAiE;QACjE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,qEAAqE;QACrE,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,sFAAsF;QACtF,eAAe,EAAE,qBAAqB;QACtC,4DAA4D;QAC5D,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,yDAAyD;QACzD,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,4DAA4D;QAC5D,OAAO,EAAE,aAAa;QACtB,8DAA8D;QAC9D,eAAe,EAAE,OAAO,EAAE,eAAe;QACzC,gGAAgG;QAChG,eAAe,EAAE,OAAO,EAAE,eAAe;KAC1C,CAAC;IAEF,OAAO,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { CoreResourceType, ResourceType } from \"./resources.shared.core.definitions\";\nimport {\n  RelationshipNature,\n  type RelationshipHandlingReadSettings,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceRelationshipConditionFn,\n  type ScopeMembership,\n} from \"./resources.shared.schemas\";\nimport { ErrorType } from \"../errors/errors.shared.schemas\";\nimport { RelationshipContextPolicy } from \"./context-policy.shared.schemas\";\nimport { ChildOperationsConfig, ChildOperationsConfigSchema, ResourceRelationshipDiscriminator } from \"./child-operations.shared.schemas\";\nimport { RelationshipDisplayConfig, RelationshipDisplayConfigSchema } from \"./relationship-display.shared.schemas\";\nimport { Resources_SharedUtils } from \"./resources.shared.utils\";\n\n/**\n * Creates a configuration error with ErrorType.CONFIGURATION\n */\nfunction createConfigurationError(message: string): Error {\n  const error = new Error(message);\n  (error as any).type = ErrorType.CONFIGURATION;\n  return error;\n}\n\n/**\n * @wildo_source:part:start saas.models.resource-relationship-builder-parameters facet:layer:shared facet:family:resource-config\n *\n * Parameters accepted by `createResourcesRelationship()` (app registry authoring).\n */\nexport type ResourceRelationship_BuilderParameters = {\n  isDisabled? : boolean,\n  isPrimaryScope? : boolean,\n  parentResourceRequirement? : ResourceParentResourceRequirement,\n  accessScopeStrategy? : ResourceRelationshipAccessScopeStrategy,\n  jointResourceType?: ResourceType,\n  /**\n   * Opt-in flag for relationships that form cycles in the resource graph.\n   * Required on every edge in a cycle for schema-level validation to pass.\n   * @see ResourceRelationshipSchema.allowCycle\n   */\n  allowCycle?: boolean,\n  /** Context policy for this relationship - controls how related resources are fetched */\n  contextPolicy?: RelationshipContextPolicy,\n  /**\n   * High-level shared meaning of the relationship.\n   *\n   * This is the primary semantic field app developers should author. The\n   * framework derives the deeper internal handling contract from it plus the\n   * optional explicit read intent when present.\n   */\n  nature: RelationshipNature,\n  /**\n   * Optional explicit semantic read intent.\n   *\n   * This does not replace `childOperations.nested.onRead`; it only declares the\n   * semantic read model the framework should resolve.\n   */\n  read?: RelationshipHandlingReadSettings,\n  /**\n   * Child operations configuration for this relationship.\n   * Handles BACKEND concerns: lifecycle cascade and nested DTO aggregation.\n   */\n  childOperations?: ChildOperationsConfig,\n  /**\n   * Static discriminator filter for conditional relationships.\n   * When specified, this relationship only applies when the parent resource's\n   * discriminator field matches one of the specified values.\n   */\n  discriminator?: ResourceRelationshipDiscriminator,\n  /**\n   * Function-based condition for conditional relationships.\n   * Evaluated at runtime with the parent resource data.\n   * Unlike the static `discriminator`, this allows arbitrary logic.\n   */\n  condition?: ResourceRelationshipConditionFn,\n  /**\n   * Frontend display configuration for this relationship.\n   * Defines how related resources are displayed in the UI.\n   */\n  display?: RelationshipDisplayConfig,\n  /**\n   * Foreign key field name for this relationship.\n   *\n   * When omitted: Inferred from parent's resourceFieldIdentifier via allResourceFieldIdentifiers map.\n   * When specified: Used for disambiguation when multiple FKs point to same resource type,\n   *                 or when FK field name differs from standard naming convention.\n   *\n   * Examples:\n   * - Standard: ORGANIZATIONS → TODOS uses organizationId (inferred, no foreignKeyField needed)\n   * - Disambiguation: TODOS → USERS via assignedToUserId vs createdByUserId (explicit)\n   * - Self-referencing M:N is not expressed as one relationship declaration;\n   *   declare two explicit junction-resource edges so source and target FK\n   *   identities remain distinct.\n   */\n  foreignKeyField?: string,\n  /**\n   * Write-time SCOPE CONFINEMENT for a REFERENCE foreign key: the referenced target must be linked to\n   * the writing row's scope through a junction, enforced on CREATE and UPDATE. Opt-in and additive —\n   * omit for unchanged behavior.\n   *\n   * STRUCTURE only. `scopeMembership: true` is the simple case (junction auto-resolved from the M:N\n   * scope-junction map); the object form names the junction / its columns when convention cannot — a\n   * SELF-REFERENTIAL junction (organizations ↔ organizations). Per-variant POLICY (status, roles, typed\n   * junction rows) is declared on the operation config's `referenceConstraints`.\n   *\n   * @example todos.assignedToUserId must be a member of the row's organization:\n   * { nature: RelationshipNature.REFERENCE, foreignKeyField: 'assignedToUserId', scopeMembership: true }\n   *\n   * @example todos.sharedWithOrganizationId must be a partner of the row's organization:\n   * { nature: RelationshipNature.REFERENCE, foreignKeyField: 'sharedWithOrganizationId',\n   *   scopeMembership: { junction: CoreResourceType.ORGANIZATION_PARTNERSHIPS } }\n   */\n  scopeMembership?: ScopeMembership,\n};\n/** @wildo_source:part:end saas.models.resource-relationship-builder-parameters */\n\n\n\n/**\n * Create a resource relationship declaration between two resource types.\n *\n * This is the primary entry point for declaring relationships in the resource registry.\n * Returns a `ResourceRelationship` object that is spread into the registry's relationship\n * array and later categorized by `transformResourceRelationships()` at factory time.\n *\n * ## Conditional Relationships\n *\n * Relationships can optionally carry runtime conditions via `discriminator` and/or `condition`:\n *\n * - **`discriminator`** (static): A simple `{ discriminatorField, values }` object.\n *   The relationship is active only when `String(parent[discriminatorField])` is in `values`.\n *   Useful for discriminated union patterns (e.g., recurring vs. one-time todos).\n *\n * - **`condition`** (dynamic): An arbitrary `(parentResource) => boolean` function.\n *   Allows cross-field logic, computed checks, etc. Cannot be serialized to Zod.\n *\n * When both are provided, AND semantics apply — both must pass for the relationship\n * to be active at runtime.\n *\n * These conditions are NOT evaluated at startup/factory time. They are stored inline\n * on the relationship object and evaluated at runtime by:\n * - `ResourceContextBackendService.fetchChildResourcesWithPolicy()` — backend context building\n * - `ServicesRegistryHandler.filterRelationshipsByParent()` — nested CRUD + lifecycle\n * - `ResourceLayout_ContainerNested` — frontend display filtering\n *\n * @param resourceType1 - The parent resource type in 1:N/1:1, or the first entity side in M:N\n * @param resourceType2 - The child resource type in 1:N/1:1, or the second entity side in M:N\n * @param cardinality1 - Cardinality from the perspective of resourceType1\n * @param cardinality2 - Cardinality from the perspective of resourceType2\n * @param options - Required relationship options; must include `nature`.\n *   Other relationship fields remain optional as needed (discriminator,\n *   condition, childOperations, display, etc.)\n * @returns A fully constructed `ResourceRelationship` object\n *\n * ## M:N developer mental model\n *\n * For `MANY <-> MANY`, the declaration is still authored at the association level:\n * developers declare the two peer entity types plus `jointResourceType`.\n *\n * The framework may later decompose non-self associations into synthetic\n * entity->junction and junction->entity edges for DTO, routing, and runtime\n * processing, but that decomposition is an internal implementation detail.\n * App-facing meaning should stay association-centric, not \"manually declare the\n * synthetic edges yourself.\"\n *\n * Self-referencing M:N is the exception: one declaration cannot carry two\n * distinct source/target FK identities for the same resource type. Model it with\n * explicit junction-resource relationships instead.\n *\n * ## Semantic Resolution Order\n *\n * Relationship declarations now have an explicit semantic precedence:\n *\n * 1. structural topology (`cardinality*`, `jointResourceType`, `foreignKeyField`, ...)\n * 2. `nature`\n * 3. explicit semantic read intent (`read`) when authored\n * 4. derived handling contract (future resolver step, internal)\n * 5. current low-level operational projection (`childOperations`)\n *\n * `nature` is therefore the primary semantic declaration for app developers.\n * The fuller handling contract belongs to framework internals, not the authored\n * relationship API.\n *\n * ## Greenfield Direction\n *\n * Relationship declarations must define explicit `nature`. Missing annotations\n * are configuration bugs, not a compatibility target.\n *\n * @example Static discriminator (recurring todos → occurrences)\n * ```typescript\n * createResourcesRelationship(TODOS, RECURRING_OCCURRENCES, ONE, MANY, {\n *   nature: RelationshipNature.COMPOSITION,\n *   discriminator: { discriminatorField: 'recurringType', values: ['RECURRING'] },\n *   childOperations: { lifecycle: { onParentDelete: { enabled: true } } },\n * })\n * ```\n *\n * @example Function-based condition\n * ```typescript\n * createResourcesRelationship(ORDERS, REFUND_RECORDS, ONE, MANY, {\n *   nature: RelationshipNature.COMPOSITION,\n *   condition: (parent) => parent.status === 'COMPLETED' && parent.totalAmount > 0,\n * })\n * ```\n */\nexport function createResourcesRelationship(\n    resourceType1: ResourceType, \n    resourceType2: ResourceType, \n    cardinality1: ResourceRelationshipCardinality, \n    cardinality2: ResourceRelationshipCardinality, \n    options: ResourceRelationship_BuilderParameters\n  ) : ResourceRelationship {\n\n    if (!options?.nature) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Relationship declarations must define nature explicitly.\\n` +\n        `Greenfield relationship semantics no longer infer meaning from childOperations or jointResourceType.`\n      );\n    }\n    \n    // ========================================\n    // VALIDATION GUARDS\n    // ========================================\n\n    // Guard 1: `isPrimaryScope` cannot be paired with `OPTIONAL_CONTEXT`.\n    //\n    // ## Why this guard exists (and why it only forbids OPTIONAL_CONTEXT, not STANDALONE)\n    //\n    // `isPrimaryScope` and `accessScopeStrategy` govern two ORTHOGONAL concerns:\n    //\n    // - `isPrimaryScope`        — ownership graph anchor: \"this parent is the\n    //                             row's structural scope root\". Drives the\n    //                             resource's `resourcePrimaryScope` enum, which\n    //                             in turn drives scope-aware services (auth,\n    //                             notifications, execution context, etc).\n    // - `accessScopeStrategy`   — URL routing + fetch-time context gating.\n    //                             STANDALONE  → no URL segment, no context gate\n    //                             REQUIRES_CONTEXT → mandatory URL segment + gate\n    //                             OPTIONAL_CONTEXT → optional URL segment\n    //\n    // The two concerns are already orthogonalized in the URL builder\n    // (`generateParentCombinations` filters out STANDALONE parents *before*\n    // bucketing the rest by `isPrimaryScope`), so a `STANDALONE + isPrimaryScope`\n    // rel is URL-inert by construction — it contributes zero path segments and\n    // simply anchors the scope enum. That is a coherent, intended configuration\n    // (e.g. internal ledgers like `jobExecutions` that are APP-scoped but not\n    // routed under `/applications/:id/…`, user-owned credential stores that are\n    // USER_SELF-scoped but not exposed as routable child resources).\n    //\n    // `OPTIONAL_CONTEXT + isPrimaryScope` is however INCOHERENT under the current\n    // combinator: `generateParentCombinations` puts every `isPrimaryScope` edge\n    // into the always-on bucket, which would force an \"optional\" primary parent\n    // to appear in every URL combination — contradicting its optionality. That\n    // redesign is out of scope here; until then the guard remains.\n    if (options?.isPrimaryScope &&\n        options?.accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Primary scope cannot have accessScopeStrategy=OPTIONAL_CONTEXT.\\n` +\n        `A primary-scope rel marks the structural ownership anchor; OPTIONAL_CONTEXT\\n` +\n        `would make the anchor optional in URLs, which the current URL combinator\\n` +\n        `cannot express coherently. Use REQUIRES_CONTEXT (routed anchor) or\\n` +\n        `STANDALONE (logical anchor, not routed).`\n      );\n    }\n    \n    // Guard 2: MANY-to-MANY requires jointResourceType (junction table)\n    if (cardinality1 === ResourceRelationshipCardinality.MANY && \n        cardinality2 === ResourceRelationshipCardinality.MANY &&\n        !options?.jointResourceType) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `MANY-to-MANY relationships require a jointResourceType (junction table).`\n      );\n    }\n\n    if (\n      cardinality1 === ResourceRelationshipCardinality.MANY &&\n      cardinality2 === ResourceRelationshipCardinality.MANY &&\n      options?.jointResourceType &&\n      resourceType1 === resourceType2\n    ) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Self-referencing MANY-to-MANY relationships cannot be authored as one association declaration.\\n` +\n        `Declare explicit junction-resource relationships so source and target edge identity stay explicit.`\n      );\n    }\n    \n    // Note: foreignKeyField IS valid with isPrimaryScope - it specifies the FK field on the child\n    // resource that points back to the parent, which is useful for 1:1 relationships\n    \n    // Guard 3: jointResourceType should not be combined with foreignKeyField.\n    // Self-referencing many-to-many is rejected above because a single\n    // declaration cannot encode two FK identities for the same peer resource.\n    if (options?.jointResourceType && options?.foreignKeyField && resourceType1 !== resourceType2) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Cannot combine jointResourceType and foreignKeyField for non-self-referencing M:N.\\n` +\n        `Use jointResourceType for MANY-to-MANY via junction table.`\n      );\n    }\n    \n    // Guard 5: foreignKeyField must end with 'Id' or 'Ids' (reserved for FK naming convention)\n    if (options?.foreignKeyField) {\n      const fkField = options.foreignKeyField;\n      if (!fkField.endsWith('Id') && !fkField.endsWith('Ids')) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `foreignKeyField \"${fkField}\" must end with 'Id' or 'Ids' (e.g., assignedToUserId, memberIds).\\n` +\n          `This naming convention is reserved for foreign key fields.`\n        );\n      }\n    }\n    \n    // Guard 6: Self-referencing 1:N/1:1 relationships require explicit foreignKeyField.\n    // Without it, the default FK (derived from resourceFieldIdentifier) would collide with\n    // itself in URL param generation — e.g., /resource/{resourceId}/resource/{resourceId}.\n    // M:N self-refs are rejected above: one declaration cannot encode distinct\n    // source/target FK identities for the same peer resource.\n    if (resourceType1 === resourceType2 && !options?.jointResourceType) {\n      if (!options?.foreignKeyField) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `Self-referencing 1:N/1:1 relationships MUST specify foreignKeyField explicitly.\\n` +\n          `Without it, URL parameter names collide (same resource type on both sides).`\n        );\n      }\n\n      // Guard 7: Self-referencing 1:N/1:1 relationships must have OPTIONAL parent requirement.\n      // Tree roots have no parent — MANDATORY would make root-level access impossible.\n      const effectiveParentReq = options?.parentResourceRequirement || ResourceParentResourceRequirement.MANDATORY;\n      if (effectiveParentReq === ResourceParentResourceRequirement.MANDATORY) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `Self-referencing 1:N/1:1 relationships MUST have parentResourceRequirement=OPTIONAL.\\n` +\n          `Tree/graph roots have no parent — MANDATORY would make root-level access impossible.`\n        );\n      }\n    }\n\n    // Guard 8: junction-backed relationships are association semantics when nature is explicit.\n    if (options?.jointResourceType && options?.nature && options.nature !== RelationshipNature.ASSOCIATION) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Relationships with jointResourceType must declare nature=ASSOCIATION.\\n` +\n        `Junction-backed relationships are association-centric in the shared model.`\n      );\n    }\n\n    // Guard 9: explicit association semantics require a junction resource.\n    if (options?.nature === RelationshipNature.ASSOCIATION && !options?.jointResourceType) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `nature=ASSOCIATION requires jointResourceType.\\n` +\n        `Association semantics are reserved for explicit link-management / junction-backed relationships.`\n      );\n    }\n    \n    // ========================================\n    // PRIMARY SCOPE MAPPING\n    // ========================================\n    \n    let primaryScope : ResourcePrimaryScope | undefined;\n    if (options?.isPrimaryScope) {\n     \n      const primaryScopeMap = {\n        [CoreResourceType.ORGANIZATIONS]: ResourcePrimaryScope.ORGANIZATIONS,\n        [CoreResourceType.USERS]: ResourcePrimaryScope.USER_SELF,\n        [CoreResourceType.USER_SELF]: ResourcePrimaryScope.USER_SELF,\n        [CoreResourceType.APPLICATION]: ResourcePrimaryScope.APPLICATION,\n        [CoreResourceType.ANONYMOUS_USERS]: ResourcePrimaryScope.ANONYMOUS,\n      }\n      primaryScope = primaryScopeMap[resourceType1 as CoreResourceType];\n  \n      if (!primaryScope) {\n        throw createConfigurationError(`Resource type ${resourceType1} is not related to a primary scope`);\n      }\n    }\n    \n    // ========================================\n    // ACCESS SCOPE STRATEGY DEFAULTS\n    // ========================================\n\n    const parentResourceRequirement = options?.parentResourceRequirement || ResourceParentResourceRequirement.MANDATORY;\n    let accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT;\n\n    if (!options?.accessScopeStrategy) {\n      if (parentResourceRequirement === ResourceParentResourceRequirement.MANDATORY) {\n        accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT;\n      } else {\n        accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT;\n      }\n    } else {\n      accessScopeStrategy = options.accessScopeStrategy;\n    }\n\n    // Post-default-resolution check: `isPrimaryScope` must resolve to REQUIRES_CONTEXT\n    // or STANDALONE, never OPTIONAL_CONTEXT. See Guard 1 above for the full\n    // rationale (ownership graph vs URL routing are orthogonal, except for the\n    // OPTIONAL_CONTEXT incoherence).\n    //\n    // This second gate exists because `accessScopeStrategy` may be filled in by\n    // the DEFAULTS block above (lines 332-340) rather than authored explicitly.\n    // Guard 1 only fires on explicit authoring; this one catches the defaulted\n    // case where `parentResourceRequirement=OPTIONAL` silently resolves to\n    // `OPTIONAL_CONTEXT`.\n    if (options?.isPrimaryScope &&\n        accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Primary scope rel defaulted to accessScopeStrategy=OPTIONAL_CONTEXT\\n` +\n        `(triggered by parentResourceRequirement=OPTIONAL without explicit strategy).\\n` +\n        `Declare accessScopeStrategy=REQUIRES_CONTEXT (routed anchor) or STANDALONE\\n` +\n        `(logical anchor, not routed) explicitly.`\n      );\n    }\n  \n    // Parse childOperations and display to apply defaults and convert to parsed types\n    const parsedChildOperations = options?.childOperations \n      ? ChildOperationsConfigSchema.parse(options.childOperations)\n      : undefined;\n    \n    const parsedDisplay = options?.display\n      ? RelationshipDisplayConfigSchema.parse(options.display)\n      : undefined;\n\n    const relationshipDeclaration: ResourceRelationshipDeclaration = {\n      cardinality1,\n      cardinality2,\n      resourceType1,\n      resourceType2,\n      accessScopeStrategy,\n      parentResourceRequirement,\n      isPrimaryScope: options?.isPrimaryScope || false,\n      primaryScope,\n      jointResourceType: options?.jointResourceType || undefined,\n      allowCycle: options?.allowCycle || false,\n      isDisabled: options?.isDisabled || false,\n      // Context policy for relationship traversal\n      contextPolicy: options?.contextPolicy,\n      // High-level shared semantic meaning authored by app developers.\n      nature: options.nature,\n      // Optional explicit semantic read intent authored by app developers.\n      read: options?.read,\n      // Child operations configuration (lifecycle + nested DTOs) - parsed to apply defaults\n      childOperations: parsedChildOperations,\n      // Static discriminator filter for conditional relationships\n      discriminator: options?.discriminator,\n      // Function-based condition for conditional relationships\n      condition: options?.condition,\n      // Frontend display configuration - parsed to apply defaults\n      display: parsedDisplay,\n      // Foreign key field for disambiguation or non-standard naming\n      foreignKeyField: options?.foreignKeyField,\n      // Write-time scope-membership constraint (opt-in; enforced on CREATE/UPDATE by write-integrity)\n      scopeMembership: options?.scopeMembership,\n    };\n\n    return Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n  }\n"]}
+{"version":3,"file":"resources-relationships.shared.factory.js","sourceRoot":"","sources":["../../../src/resources/resources-relationships.shared.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,kBAAkB,EAElB,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,GAGhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE5D,OAAO,EAAyB,2BAA2B,EAAqC,MAAM,mCAAmC,CAAC;AAC1I,OAAO,EAA6B,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;GAEG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAa,CAAC,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AA4FD,kFAAkF;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,UAAU,2BAA2B,CACvC,aAA2B,EAC3B,aAA2B,EAC3B,YAA6C,EAC7C,YAA6C,EAC7C,OAA+C;IAG/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,4DAA4D;YAC5D,sGAAsG,CACvG,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,oBAAoB;IACpB,2CAA2C;IAC3C,EAAE;IACF,2FAA2F;IAC3F,kGAAkG;IAClG,6FAA6F;IAC7F,oDAAoD;IACpD,EAAE;IACF,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,6CAA6C;IAC7C,EAAE;IACF,gGAAgG;IAChG,kBAAkB;IAElB,sEAAsE;IACtE,EAAE;IACF,sFAAsF;IACtF,EAAE;IACF,6EAA6E;IAC7E,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,sEAAsE;IACtE,EAAE;IACF,iEAAiE;IACjE,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,iEAAiE;IACjE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,mBAAmB,KAAK,uCAAuC,CAAC,gBAAgB,EAAE,CAAC;QAC9F,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,mEAAmE;YACnE,+EAA+E;YAC/E,4EAA4E;YAC5E,sEAAsE;YACtE,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAChC,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,IACE,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACrD,OAAO,EAAE,iBAAiB;QAC1B,aAAa,KAAK,aAAa,EAC/B,CAAC;QACD,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,kGAAkG;YAClG,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,0FAA0F;IAC1F,EAAE;IACF,8FAA8F;IAC9F,iFAAiF;IAEjF,0EAA0E;IAC1E,mEAAmE;IACnE,0EAA0E;IAC1E,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,eAAe,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QAC9F,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,sFAAsF;YACtF,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,oBAAoB,OAAO,sEAAsE;gBACjG,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,uFAAuF;IACvF,uFAAuF;IACvF,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,aAAa,KAAK,aAAa,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,mFAAmF;gBACnF,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,yFAAyF;QACzF,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,EAAE,yBAAyB,IAAI,iCAAiC,CAAC,SAAS,CAAC;QAC7G,IAAI,kBAAkB,KAAK,iCAAiC,CAAC,SAAS,EAAE,CAAC;YACvE,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;gBAC3E,wFAAwF;gBACxF,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACvG,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,yEAAyE;YACzE,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,EAAE,MAAM,KAAK,kBAAkB,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACtF,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,kDAAkD;YAClD,kGAAkG,CACnG,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,wBAAwB;IACxB,2CAA2C;IAE3C,IAAI,YAA+C,CAAC;IACpD,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;QAE5B,MAAM,eAAe,GAAG;YACtB,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC,aAAa;YACpE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,SAAS;YACxD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,SAAS;YAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,WAAW;YAChE,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,SAAS;SACnE,CAAA;QACD,YAAY,GAAG,eAAe,CAAC,aAAiC,CAAC,CAAC;QAElE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,wBAAwB,CAAC,iBAAiB,aAAa,oCAAoC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,iCAAiC;IACjC,2CAA2C;IAE3C,MAAM,yBAAyB,GAAG,OAAO,EAAE,yBAAyB,IAAI,iCAAiC,CAAC,SAAS,CAAC;IACpH,IAAI,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;IAEnF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAClC,IAAI,yBAAyB,KAAK,iCAAiC,CAAC,SAAS,EAAE,CAAC;YAC9E,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,mBAAmB,GAAG,uCAAuC,CAAC,gBAAgB,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IACpD,CAAC;IAED,mFAAmF;IACnF,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,sBAAsB;IACtB,IAAI,OAAO,EAAE,cAAc;QACvB,mBAAmB,KAAK,uCAAuC,CAAC,gBAAgB,EAAE,CAAC;QACrF,MAAM,wBAAwB,CAC5B,uCAAuC,aAAa,MAAM,aAAa,IAAI;YAC3E,uEAAuE;YACvE,gFAAgF;YAChF,8EAA8E;YAC9E,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,qBAAqB,GAAG,OAAO,EAAE,eAAe;QACpD,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO;QACpC,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,uBAAuB,GAAoC;QAC/D,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,aAAa;QACb,mBAAmB;QACnB,yBAAyB;QACzB,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,KAAK;QAChD,YAAY;QACZ,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,IAAI,SAAS;QAC1D,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;QACxC,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;QACxC,4CAA4C;QAC5C,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,iEAAiE;QACjE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,qEAAqE;QACrE,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,sFAAsF;QACtF,eAAe,EAAE,qBAAqB;QACtC,4DAA4D;QAC5D,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,yDAAyD;QACzD,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,4DAA4D;QAC5D,OAAO,EAAE,aAAa;QACtB,8DAA8D;QAC9D,eAAe,EAAE,OAAO,EAAE,eAAe;QACzC,gGAAgG;QAChG,eAAe,EAAE,OAAO,EAAE,eAAe;KAC1C,CAAC;IAEF,OAAO,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { CoreResourceType, ResourceType } from \"./resources.shared.core.definitions\";\nimport {\n  RelationshipNature,\n  type RelationshipHandlingReadSettings,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceRelationshipConditionFn,\n  type ScopeMembership,\n} from \"./resources.shared.schemas\";\nimport { ErrorType } from \"../errors/errors.shared.schemas\";\nimport { RelationshipContextPolicy } from \"./context-policy.shared.schemas\";\nimport { ChildOperationsConfig, ChildOperationsConfigSchema, ResourceRelationshipDiscriminator } from \"./child-operations.shared.schemas\";\nimport { RelationshipDisplayConfig, RelationshipDisplayConfigSchema } from \"./relationship-display.shared.schemas\";\nimport { Resources_SharedUtils } from \"./resources.shared.utils\";\n\n/**\n * Creates a configuration error with ErrorType.CONFIGURATION\n */\nfunction createConfigurationError(message: string): Error {\n  const error = new Error(message);\n  (error as any).type = ErrorType.CONFIGURATION;\n  return error;\n}\n\n/**\n * @wildo_source:part:start saas.models.resource-relationship-builder-parameters facet:layer:shared facet:family:resource-config\n *\n * Parameters accepted by `createResourcesRelationship()` (app registry authoring).\n */\nexport type ResourceRelationship_BuilderParameters = {\n  isDisabled? : boolean,\n  isPrimaryScope? : boolean,\n  parentResourceRequirement? : ResourceParentResourceRequirement,\n  accessScopeStrategy? : ResourceRelationshipAccessScopeStrategy,\n  jointResourceType?: ResourceType,\n  /**\n   * Opt-in flag for relationships that form cycles in the resource graph.\n   * Required on every edge in a cycle for schema-level validation to pass.\n   * @see ResourceRelationshipSchema.allowCycle\n   */\n  allowCycle?: boolean,\n  /** Context policy for this relationship - controls how related resources are fetched */\n  contextPolicy?: RelationshipContextPolicy,\n  /**\n   * High-level shared meaning of the relationship.\n   *\n   * This is the primary semantic field app developers should author. The\n   * framework derives the deeper internal handling contract from it plus the\n   * optional explicit read intent when present.\n   */\n  nature: RelationshipNature,\n  /**\n   * Optional explicit semantic read intent.\n   *\n   * This does not replace `childOperations.nested.onRead`; it only declares the\n   * semantic read model the framework should resolve.\n   */\n  read?: RelationshipHandlingReadSettings,\n  /**\n   * Child operations configuration for this relationship.\n   * Handles BACKEND concerns: lifecycle cascade and nested DTO aggregation.\n   */\n  childOperations?: ChildOperationsConfig,\n  /**\n   * Static discriminator filter for conditional relationships.\n   * When specified, this relationship only applies when the parent resource's\n   * discriminator field matches one of the specified values.\n   */\n  discriminator?: ResourceRelationshipDiscriminator,\n  /**\n   * Function-based condition for conditional relationships.\n   * Evaluated at runtime with the parent resource data.\n   * Unlike the static `discriminator`, this allows arbitrary logic.\n   */\n  condition?: ResourceRelationshipConditionFn,\n  /**\n   * Frontend display configuration for this relationship.\n   * Defines how related resources are displayed in the UI.\n   */\n  display?: RelationshipDisplayConfig,\n  /**\n   * Foreign key field name for this relationship.\n   *\n   * When omitted: Inferred from parent's resourceFieldIdentifier via allResourceFieldIdentifiers map.\n   * When specified: Used for disambiguation when multiple FKs point to same resource type,\n   *                 or when FK field name differs from standard naming convention.\n   *\n   * Examples:\n   * - Standard: ORGANIZATIONS → TODOS uses organizationId (inferred, no foreignKeyField needed)\n   * - Disambiguation: TODOS → USERS via assignedToUserId vs createdByUserId (explicit)\n   * - Self-referencing M:N is not expressed as one relationship declaration;\n   *   declare two explicit junction-resource edges so source and target FK\n   *   identities remain distinct.\n   */\n  foreignKeyField?: string,\n  /**\n   * Write-time SCOPE CONFINEMENT for a REFERENCE foreign key: the referenced target must be linked to\n   * the writing row's scope through a junction, enforced on CREATE and UPDATE. Opt-in and additive —\n   * omit for unchanged behavior.\n   *\n   * STRUCTURE only. `scopeMembership: true` is the simple case (junction auto-resolved from the M:N\n   * scope-junction map); the object form names the junction / its columns when convention cannot — a\n   * SELF-REFERENTIAL junction (organizations ↔ organizations). Per-variant POLICY (status, roles, typed\n   * junction rows) is declared on the operation config's `referenceConstraints`.\n   *\n   * @example todos.assignedToUserId must be a member of the row's organization:\n   * { nature: RelationshipNature.REFERENCE, foreignKeyField: 'assignedToUserId', scopeMembership: true }\n   *\n   * @example todos.sharedWithOrganizationId must be a partner of the row's organization:\n   * { nature: RelationshipNature.REFERENCE, foreignKeyField: 'sharedWithOrganizationId',\n   *   scopeMembership: { junction: CoreResourceType.ORGANIZATION_PARTNERSHIPS } }\n   */\n  scopeMembership?: ScopeMembership,\n};\n/** @wildo_source:part:end saas.models.resource-relationship-builder-parameters */\n\n\n\n/**\n * Create a resource relationship declaration between two resource types.\n *\n * This is the primary entry point for declaring relationships in the resource registry.\n * Returns a `ResourceRelationship` object that is spread into the registry's relationship\n * array and later categorized by `transformResourceRelationships()` at factory time.\n *\n * ## Conditional Relationships\n *\n * Relationships can optionally carry runtime conditions via `discriminator` and/or `condition`:\n *\n * - **`discriminator`** (static): A simple `{ discriminatorField, values }` object.\n *   The relationship is active only when `String(parent[discriminatorField])` is in `values`.\n *   Useful for discriminated union patterns (e.g., recurring vs. one-time todos).\n *\n * - **`condition`** (dynamic): An arbitrary `(parentResource) => boolean` function.\n *   Allows cross-field logic, computed checks, etc. Cannot be serialized to Zod.\n *\n * When both are provided, AND semantics apply — both must pass for the relationship\n * to be active at runtime.\n *\n * These conditions are NOT evaluated at startup/factory time. They are stored inline\n * on the relationship object and evaluated at runtime by:\n * - `ResourceContextBackendService.fetchChildResourcesWithPolicy()` — backend context building\n * - `ServicesRegistryHandler.filterRelationshipsByParent()` — nested CRUD + lifecycle\n * - `ResourceLayout_ContainerNested` — frontend display filtering\n *\n * @param resourceType1 - The parent resource type in 1:N/1:1, or the first entity side in M:N\n * @param resourceType2 - The child resource type in 1:N/1:1, or the second entity side in M:N\n * @param cardinality1 - Cardinality from the perspective of resourceType1\n * @param cardinality2 - Cardinality from the perspective of resourceType2\n * @param options - Required relationship options; must include `nature`.\n *   Other relationship fields remain optional as needed (discriminator,\n *   condition, childOperations, display, etc.)\n * @returns A fully constructed `ResourceRelationship` object\n *\n * ## M:N developer mental model\n *\n * For `MANY <-> MANY`, the declaration is still authored at the association level:\n * developers declare the two peer entity types plus `jointResourceType`.\n *\n * The framework may later decompose non-self associations into synthetic\n * entity->junction and junction->entity edges for DTO, routing, and runtime\n * processing, but that decomposition is an internal implementation detail.\n * App-facing meaning should stay association-centric, not \"manually declare the\n * synthetic edges yourself.\"\n *\n * Self-referencing M:N is the exception: one declaration cannot carry two\n * distinct source/target FK identities for the same resource type. Model it with\n * explicit junction-resource relationships instead.\n *\n * ## Semantic Resolution Order\n *\n * Relationship declarations now have an explicit semantic precedence:\n *\n * 1. structural topology (`cardinality*`, `jointResourceType`, `foreignKeyField`, ...)\n * 2. `nature`\n * 3. explicit semantic read intent (`read`) when authored\n * 4. derived handling contract (future resolver step, internal)\n * 5. current low-level operational projection (`childOperations`)\n *\n * `nature` is therefore the primary semantic declaration for app developers.\n * The fuller handling contract belongs to framework internals, not the authored\n * relationship API.\n *\n * ## Greenfield Direction\n *\n * Relationship declarations must define explicit `nature`. Missing annotations\n * are configuration bugs, not a compatibility target.\n *\n * @example Static discriminator (recurring todos → occurrences)\n * ```typescript\n * createResourcesRelationship(TODOS, RECURRING_OCCURRENCES, ONE, MANY, {\n *   nature: RelationshipNature.COMPOSITION,\n *   discriminator: { discriminatorField: 'recurringType', values: ['RECURRING'] },\n *   childOperations: { lifecycle: { onParentDelete: { enabled: true } } },\n * })\n * ```\n *\n * @example Function-based condition\n * ```typescript\n * createResourcesRelationship(ORDERS, REFUND_RECORDS, ONE, MANY, {\n *   nature: RelationshipNature.COMPOSITION,\n *   condition: (parent) => parent.status === 'COMPLETED' && parent.totalAmount > 0,\n * })\n * ```\n */\nexport function createResourcesRelationship(\n    resourceType1: ResourceType, \n    resourceType2: ResourceType, \n    cardinality1: ResourceRelationshipCardinality, \n    cardinality2: ResourceRelationshipCardinality, \n    options: ResourceRelationship_BuilderParameters\n  ) : ResourceRelationship {\n\n    if (!options?.nature) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Relationship declarations must define nature explicitly.\\n` +\n        `Greenfield relationship semantics no longer infer meaning from childOperations or jointResourceType.`\n      );\n    }\n    \n    // ========================================\n    // VALIDATION GUARDS\n    // ========================================\n    //\n    // The numbers below are STABLE LABELS, not a count and not a sequence. They are cited from\n    // `resources-relationships-factory.test.ts`, from `resources-registry.shared.core.definitions.ts`\n    // and from sibling packages, so renumbering them breaks those references. Two consequences a\n    // reader has to know before counting anything here:\n    //\n    //   - there is no Guard 4, and no commit touching this file has ever added or removed one;\n    //   - three refusals in this sequence carry no number at all (self-referencing MANY-to-MANY\n    //     below Guard 2, the unresolvable primary scope, and the post-default-resolution repeat of\n    //     Guard 1 near the end of the function).\n    //\n    // So \"the guards\" is a larger set than \"the numbered guards\". Enumerate the `throw` statements,\n    // not the labels.\n\n    // Guard 1: `isPrimaryScope` cannot be paired with `OPTIONAL_CONTEXT`.\n    //\n    // ## Why this guard exists (and why it only forbids OPTIONAL_CONTEXT, not STANDALONE)\n    //\n    // `isPrimaryScope` and `accessScopeStrategy` govern two ORTHOGONAL concerns:\n    //\n    // - `isPrimaryScope`        — ownership graph anchor: \"this parent is the\n    //                             row's structural scope root\". Drives the\n    //                             resource's `resourcePrimaryScope` enum, which\n    //                             in turn drives scope-aware services (auth,\n    //                             notifications, execution context, etc).\n    // - `accessScopeStrategy`   — URL routing + fetch-time context gating.\n    //                             STANDALONE  → no URL segment, no context gate\n    //                             REQUIRES_CONTEXT → mandatory URL segment + gate\n    //                             OPTIONAL_CONTEXT → optional URL segment\n    //\n    // The two concerns are already orthogonalized in the URL builder\n    // (`generateParentCombinations` filters out STANDALONE parents *before*\n    // bucketing the rest by `isPrimaryScope`), so a `STANDALONE + isPrimaryScope`\n    // rel is URL-inert by construction — it contributes zero path segments and\n    // simply anchors the scope enum. That is a coherent, intended configuration\n    // (e.g. internal ledgers like `jobExecutions` that are APP-scoped but not\n    // routed under `/applications/:id/…`, user-owned credential stores that are\n    // USER_SELF-scoped but not exposed as routable child resources).\n    //\n    // `OPTIONAL_CONTEXT + isPrimaryScope` is however INCOHERENT under the current\n    // combinator: `generateParentCombinations` puts every `isPrimaryScope` edge\n    // into the always-on bucket, which would force an \"optional\" primary parent\n    // to appear in every URL combination — contradicting its optionality. That\n    // redesign is out of scope here; until then the guard remains.\n    if (options?.isPrimaryScope &&\n        options?.accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Primary scope cannot have accessScopeStrategy=OPTIONAL_CONTEXT.\\n` +\n        `A primary-scope rel marks the structural ownership anchor; OPTIONAL_CONTEXT\\n` +\n        `would make the anchor optional in URLs, which the current URL combinator\\n` +\n        `cannot express coherently. Use REQUIRES_CONTEXT (routed anchor) or\\n` +\n        `STANDALONE (logical anchor, not routed).`\n      );\n    }\n    \n    // Guard 2: MANY-to-MANY requires jointResourceType (junction table)\n    if (cardinality1 === ResourceRelationshipCardinality.MANY && \n        cardinality2 === ResourceRelationshipCardinality.MANY &&\n        !options?.jointResourceType) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `MANY-to-MANY relationships require a jointResourceType (junction table).`\n      );\n    }\n\n    if (\n      cardinality1 === ResourceRelationshipCardinality.MANY &&\n      cardinality2 === ResourceRelationshipCardinality.MANY &&\n      options?.jointResourceType &&\n      resourceType1 === resourceType2\n    ) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Self-referencing MANY-to-MANY relationships cannot be authored as one association declaration.\\n` +\n        `Declare explicit junction-resource relationships so source and target edge identity stay explicit.`\n      );\n    }\n    \n    // (The refusal immediately above carries no guard number: self-referencing MANY-to-MANY.)\n    //\n    // Note: foreignKeyField IS valid with isPrimaryScope - it specifies the FK field on the child\n    // resource that points back to the parent, which is useful for 1:1 relationships\n    \n    // Guard 3: jointResourceType should not be combined with foreignKeyField.\n    // Self-referencing many-to-many is rejected above because a single\n    // declaration cannot encode two FK identities for the same peer resource.\n    if (options?.jointResourceType && options?.foreignKeyField && resourceType1 !== resourceType2) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Cannot combine jointResourceType and foreignKeyField for non-self-referencing M:N.\\n` +\n        `Use jointResourceType for MANY-to-MANY via junction table.`\n      );\n    }\n    \n    // Guard 5: foreignKeyField must end with 'Id' or 'Ids' (reserved for FK naming convention)\n    if (options?.foreignKeyField) {\n      const fkField = options.foreignKeyField;\n      if (!fkField.endsWith('Id') && !fkField.endsWith('Ids')) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `foreignKeyField \"${fkField}\" must end with 'Id' or 'Ids' (e.g., assignedToUserId, memberIds).\\n` +\n          `This naming convention is reserved for foreign key fields.`\n        );\n      }\n    }\n    \n    // Guard 6: Self-referencing 1:N/1:1 relationships require explicit foreignKeyField.\n    // Without it, the default FK (derived from resourceFieldIdentifier) would collide with\n    // itself in URL param generation — e.g., /resource/{resourceId}/resource/{resourceId}.\n    // M:N self-refs are rejected above: one declaration cannot encode distinct\n    // source/target FK identities for the same peer resource.\n    if (resourceType1 === resourceType2 && !options?.jointResourceType) {\n      if (!options?.foreignKeyField) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `Self-referencing 1:N/1:1 relationships MUST specify foreignKeyField explicitly.\\n` +\n          `Without it, URL parameter names collide (same resource type on both sides).`\n        );\n      }\n\n      // Guard 7: Self-referencing 1:N/1:1 relationships must have OPTIONAL parent requirement.\n      // Tree roots have no parent — MANDATORY would make root-level access impossible.\n      const effectiveParentReq = options?.parentResourceRequirement || ResourceParentResourceRequirement.MANDATORY;\n      if (effectiveParentReq === ResourceParentResourceRequirement.MANDATORY) {\n        throw createConfigurationError(\n          `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n          `Self-referencing 1:N/1:1 relationships MUST have parentResourceRequirement=OPTIONAL.\\n` +\n          `Tree/graph roots have no parent — MANDATORY would make root-level access impossible.`\n        );\n      }\n    }\n\n    // Guard 8: junction-backed relationships are association semantics when nature is explicit.\n    if (options?.jointResourceType && options?.nature && options.nature !== RelationshipNature.ASSOCIATION) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Relationships with jointResourceType must declare nature=ASSOCIATION.\\n` +\n        `Junction-backed relationships are association-centric in the shared model.`\n      );\n    }\n\n    // Guard 9: explicit association semantics require a junction resource.\n    if (options?.nature === RelationshipNature.ASSOCIATION && !options?.jointResourceType) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `nature=ASSOCIATION requires jointResourceType.\\n` +\n        `Association semantics are reserved for explicit link-management / junction-backed relationships.`\n      );\n    }\n    \n    // ========================================\n    // PRIMARY SCOPE MAPPING\n    // ========================================\n    \n    let primaryScope : ResourcePrimaryScope | undefined;\n    if (options?.isPrimaryScope) {\n     \n      const primaryScopeMap = {\n        [CoreResourceType.ORGANIZATIONS]: ResourcePrimaryScope.ORGANIZATIONS,\n        [CoreResourceType.USERS]: ResourcePrimaryScope.USER_SELF,\n        [CoreResourceType.USER_SELF]: ResourcePrimaryScope.USER_SELF,\n        [CoreResourceType.APPLICATION]: ResourcePrimaryScope.APPLICATION,\n        [CoreResourceType.ANONYMOUS_USERS]: ResourcePrimaryScope.ANONYMOUS,\n      }\n      primaryScope = primaryScopeMap[resourceType1 as CoreResourceType];\n  \n      if (!primaryScope) {\n        throw createConfigurationError(`Resource type ${resourceType1} is not related to a primary scope`);\n      }\n    }\n    \n    // ========================================\n    // ACCESS SCOPE STRATEGY DEFAULTS\n    // ========================================\n\n    const parentResourceRequirement = options?.parentResourceRequirement || ResourceParentResourceRequirement.MANDATORY;\n    let accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT;\n\n    if (!options?.accessScopeStrategy) {\n      if (parentResourceRequirement === ResourceParentResourceRequirement.MANDATORY) {\n        accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT;\n      } else {\n        accessScopeStrategy = ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT;\n      }\n    } else {\n      accessScopeStrategy = options.accessScopeStrategy;\n    }\n\n    // Post-default-resolution check: `isPrimaryScope` must resolve to REQUIRES_CONTEXT\n    // or STANDALONE, never OPTIONAL_CONTEXT. See Guard 1 above for the full\n    // rationale (ownership graph vs URL routing are orthogonal, except for the\n    // OPTIONAL_CONTEXT incoherence).\n    //\n    // This second gate exists because `accessScopeStrategy` may be filled in by\n    // the DEFAULTS block above (lines 332-340) rather than authored explicitly.\n    // Guard 1 only fires on explicit authoring; this one catches the defaulted\n    // case where `parentResourceRequirement=OPTIONAL` silently resolves to\n    // `OPTIONAL_CONTEXT`.\n    if (options?.isPrimaryScope &&\n        accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT) {\n      throw createConfigurationError(\n        `Invalid relationship configuration: ${resourceType1} → ${resourceType2}\\n` +\n        `Primary scope rel defaulted to accessScopeStrategy=OPTIONAL_CONTEXT\\n` +\n        `(triggered by parentResourceRequirement=OPTIONAL without explicit strategy).\\n` +\n        `Declare accessScopeStrategy=REQUIRES_CONTEXT (routed anchor) or STANDALONE\\n` +\n        `(logical anchor, not routed) explicitly.`\n      );\n    }\n  \n    // Parse childOperations and display to apply defaults and convert to parsed types\n    const parsedChildOperations = options?.childOperations \n      ? ChildOperationsConfigSchema.parse(options.childOperations)\n      : undefined;\n    \n    const parsedDisplay = options?.display\n      ? RelationshipDisplayConfigSchema.parse(options.display)\n      : undefined;\n\n    const relationshipDeclaration: ResourceRelationshipDeclaration = {\n      cardinality1,\n      cardinality2,\n      resourceType1,\n      resourceType2,\n      accessScopeStrategy,\n      parentResourceRequirement,\n      isPrimaryScope: options?.isPrimaryScope || false,\n      primaryScope,\n      jointResourceType: options?.jointResourceType || undefined,\n      allowCycle: options?.allowCycle || false,\n      isDisabled: options?.isDisabled || false,\n      // Context policy for relationship traversal\n      contextPolicy: options?.contextPolicy,\n      // High-level shared semantic meaning authored by app developers.\n      nature: options.nature,\n      // Optional explicit semantic read intent authored by app developers.\n      read: options?.read,\n      // Child operations configuration (lifecycle + nested DTOs) - parsed to apply defaults\n      childOperations: parsedChildOperations,\n      // Static discriminator filter for conditional relationships\n      discriminator: options?.discriminator,\n      // Function-based condition for conditional relationships\n      condition: options?.condition,\n      // Frontend display configuration - parsed to apply defaults\n      display: parsedDisplay,\n      // Foreign key field for disambiguation or non-standard naming\n      foreignKeyField: options?.foreignKeyField,\n      // Write-time scope-membership constraint (opt-in; enforced on CREATE/UPDATE by write-integrity)\n      scopeMembership: options?.scopeMembership,\n    };\n\n    return Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n  }\n"]}

package/dist/esm/resources/resources-serialization.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-serialization.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources-serialization.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACjI,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAK5C,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;iBAGpB,CAAC;AAGb,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,eAAe;;;;;;;;;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAElC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAKxE;;;;;;;;GAQG;AAEH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC9C,YAAY,GAAG,aAAa,GAAG,YAAY,GAAG,kBAAkB,GAAG,sBAAsB,CAC1F,GAAG;IACF,UAAU,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC1C,WAAW,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C,UAAU,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAE1C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,wBAAwB,EACxB,YAAY,GAAG,YAAY,CAC5B,GAAG;IACF,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC,UAAU,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,WAAW,EAAE,IAAI,CAAA;KAAE,GAAG,SAAS,CAAC;CACzE,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,4BAA4B,EAAE,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;IAChF,qCAAqC,EAAE,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;IAClG,qBAAqB,EAAE,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IAClE,sBAAsB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,iCAAiC,CAAA;KAAE,CAAC;CAC9E,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,CAAC,YAAY,EAAE,MAAM,GAAG,yBAAyB,CAAC;CACnD,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,IAAI,EAAE,GAAG,CAAC;IACV,gBAAgB,EAAE;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC/B,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}
+{"version":3,"file":"resources-serialization.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/resources/resources-serialization.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACjI,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAK5C,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;iBAGpB,CAAC;AAGb,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,eAAe;;;;;;;;;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAElC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAKxE;;;;;;;;GAQG;AAEH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC9C,YAAY,GAAG,aAAa,GAAG,YAAY,GAAG,kBAAkB,GAAG,sBAAsB,CAC1F,GAAG;IACF,UAAU,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC1C,WAAW,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C,UAAU,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAE1C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,wBAAwB,EACxB,YAAY,GAAG,YAAY,CAC5B,GAAG;IACF,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC,UAAU,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,WAAW,EAAE,IAAI,CAAA;KAAE,GAAG,SAAS,CAAC;CACzE,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,4BAA4B,EAAE,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;IAChF,qCAAqC,EAAE,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;IAClG,qBAAqB,EAAE,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IAClE,sBAAsB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,iCAAiC,CAAA;KAAE,CAAC;CAC9E,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,CAAC,YAAY,EAAE,MAAM,GAAG,yBAAyB,CAAC;CACnD,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,IAAI,EAAE,GAAG,CAAC;IACV,gBAAgB,EAAE;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC/B,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}

package/dist/esm/resources/resources.shared.core.definitions.d.ts

@@ -60,6 +60,23 @@ export declare enum CoreResourceType {
     ORGANIZATION_PROFILES = "organizationProfiles",
     ORGANIZATION_PREFERENCES = "organizationPreferences",
     PLATFORM_ACCESS_GRANTS = "platformAccessGrants",
+    /**
+     * The APPLICATION-WIDE sibling of {@link CoreResourceType.PLATFORM_ACCESS_GRANTS}.
+     *
+     * Same lifecycle, same vocabulary, same expiry control — a DIFFERENT scope, and the scope is the
+     * whole reason it is a second resource rather than a field on the first. A platform access grant
+     * is an ORGANIZATIONS-scoped row addressed at `/organizations/{organizationId}/…`, because the
+     * tenant it names is the party that sees, approves and revokes it. An application-wide elevation
+     * names NO tenant, so there is nothing for that route to carry and nobody for the Lockbox posture
+     * to ask.
+     *
+     * Its approval is therefore the TWO-PERSON RULE: a second platform administrator, never the
+     * requester. `.claude/rules/administrative-continuity-floors.md` — "a second factor authenticates
+     * a session; only a second signature constrains an authenticated operator". Customer approval is
+     * the industry ceiling (Lockbox, Access Approval) and is structurally unavailable here, so a
+     * second signature is the strongest control that exists for this act.
+     */
+    APPLICATION_ACCESS_GRANTS = "applicationAccessGrants",
     ORGANIZATION_NOTIFICATIONS = "organizationNotifications",
     ORGANIZATION_FEATURES = "organizationFeatures",
     USER_FEATURES = "userFeatures",
@@ -68,6 +85,14 @@ export declare enum CoreResourceType {
     ORGANIZATION_UNIT_MEMBERS = "organizationUnitMembers",
     ORG_API_KEYS = "organizationApiKeys",
     OAUTH_CLIENTS_ORGANIZATION = "organizationOAuthClients",
+    /**
+     * An organization's OWN credential toward a third-party provider — its Slack workspace token,
+     * its CRM API key. Distinct from the deployment's `process.env` secret, which is one value for
+     * every tenant in the application, and distinct from a user's delegated OAuth grant (#333),
+     * which has a different owner and a different revocation.
+     */
+    ORG_PROVIDER_CREDENTIALS = "organizationProviderCredentials",
+    USER_PROVIDER_CREDENTIALS = "userProviderCredentials",
     ORGANIZATION_SCIM_TOKENS = "organizationScimTokens",
     ORGANIZATION_SCIM_PROVISIONING_CONFIG = "organizationScimProvisioningConfig",
     ORGANIZATION_SSO_CONNECTIONS = "organizationSsoConnections",
@@ -100,6 +125,35 @@ export declare enum CoreResourceType {
     PROMOTIONS = "promotions",
     REFERRALS = "referrals",
     AUDIT_LOGS = "auditLogs",
+    /**
+     * The APPLICATION-scoped door onto the SAME audit rows `AUDIT_LOGS` serves.
+     *
+     * `AUDIT_LOGS` is organization-scoped: its only route is
+     * `/organizations/{organizationId}/audit-logs`, so it can only ever return rows carrying that
+     * tenant. But a security event is frequently application-scoped BY NATURE — `logUserLogin` takes
+     * `organizationId` as OPTIONAL because at login no organization is selected, and the same holds
+     * for session eviction, token refresh and application-wide authentication-policy changes.
+     * Measured on a dogfood application (#317): 94 of 127 rows carried no organization and were
+     * therefore reachable through no API at all.
+     *
+     * This type is that missing door, and it is a SEPARATE type rather than a second route on
+     * `AUDIT_LOGS` because the URL combinator forbids the alternative: `generateParentCombinations`
+     * puts every `isPrimaryScope` and every `REQUIRES_CONTEXT` parent into EVERY combination, so
+     * routing `AUDIT_LOGS`' application edge would rewrite its organization route to
+     * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` and break every
+     * existing consumer. A sibling type with a single application parent takes the route it needs and
+     * leaves the organization door untouched.
+     *
+     * Both types address ONE row set through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES` — the
+     * mechanism `USER_SELF` already uses to address `USERS`' rows. Two doors, one record set: the
+     * organization door stays tenant-filtered, this one is `APP_ADMIN_SUPER_ADMIN`-only, and a read
+     * here that touches a tenant-attributed row emits `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, once per
+     * tenant reached. That emission is NOT inherited: `authorizeOrganizations`, where the event is
+     * otherwise raised, runs only for ORGANIZATIONS-scoped resources. Each read variant here declares
+     * `admitsCrossTenantPlatformAdministration`, and that declaration is what enrols the read in the
+     * trail (`security/authorizations/cross-tenant-read-observation.backend.ts`).
+     */
+    APPLICATION_AUDIT_LOGS = "applicationAuditLogs",
     USER_NOTIFICATION_BADGES = "userNotificationBadges",
     ORGANIZATION_NOTIFICATION_BADGES = "organizationNotificationBadges",
     ORGANIZATION_WEBHOOK_CONFIG = "organizationWebhookConfig",

package/dist/esm/resources/resources.shared.core.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.shared.core.definitions.d.ts","sourceRoot":"","sources":["../../../../src/resources/resources.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;GAOG;AACH,oBAAY,qBAAqB;IAC/B,IAAI,SAAS,CAAS,kCAAkC;IACxD,MAAM,WAAW,CAAO,2BAA2B;IACnD,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,MAAM,WAAW,CAAK,kBAAkB;IACxC,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,MAAM,WAAW,CAAK,sBAAsB;IAC5C,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,IAAI,SAAS,CAAS,iCAAiC;IACvD,MAAM,WAAW,CAAK,2CAA2C;IACjE,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,mBAAmB,yBAAuC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,iCAAiC,EAAE,qBAAqB,EAMpE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAAqB,EAGhE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,qBAAqB,EAG5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,qBAAqB,EAK5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,qBAAqB,EAMlE,CAAC;AACF,iEAAiE;AAEjE,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,gBAAgB,oBAAoB;IACpC,aAAa,iBAAiB;IAC9B,gBAAgB,oBAAoB;IACpC,kBAAkB,qBAAqB;IACvC,qBAAqB,wBAAwB;IAC7C,aAAa,kBAAkB;IAC/B,kBAAkB,sBAAsB;IACxC,qBAAqB,yBAAyB;IAC9C,wBAAwB,4BAA4B;IACpD,sBAAsB,yBAAyB;IAC/C,0BAA0B,8BAA8B;IACxD,qBAAqB,yBAAyB;IAC9C,aAAa,iBAAiB;IAC9B,oBAAoB,wBAAwB;IAC5C,sGAAsG;IACtG,yBAAyB,4BAA4B;IAGrD,YAAY,wBAAwB;IACpC,0BAA0B,6BAA6B;IACvD,wBAAwB,2BAA2B;IACnD,qCAAqC,uCAAuC;IAG5E,4BAA4B,+BAA+B;IAC3D,uBAAuB,0BAA0B;IAGjD,+BAA+B,iCAAiC;IAChE,8BAA8B,gCAAgC;IAE9D,WAAW,iBAAiB;IAC5B,sBAAsB,yBAAyB;IAC/C,2BAA2B,8BAA8B;IACzD,8BAA8B,gCAAgC;IAC9D,6BAA6B,+BAA+B;IAC5D,oCAAoC,sCAAsC;IAC1E,oBAAoB,uBAAuB;IAC3C,yBAAyB,4BAA4B;IACrD,oBAAoB,wBAAwB;IAC5C,oBAAoB,wBAAwB;IAC5C,oBAAoB,wBAAwB;IAG5C,6BAA6B,gCAAgC;IAC7D,qBAAqB,wBAAwB;IAG7C,0BAA0B,8BAA8B;IACxD,kBAAkB,sBAAsB;IAGxC,yBAAyB,4BAA4B;IACrD,iBAAiB,oBAAoB;IAGrC,0BAA0B,6BAA6B;IACvD,kBAAkB,qBAAqB;IAGvC,yBAAyB,4BAA4B;IACrD,iBAAiB,oBAAoB;IAGrC,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,UAAU,eAAe;IACzB,SAAS,cAAc;IAGvB,UAAU,cAAc;IASxB,wBAAwB,2BAA2B;IACnD,gCAAgC,mCAAmC;IAKnE,2BAA2B,8BAA8B;IACzD,0BAA0B,6BAA6B;IACvD,qCAAqC,sCAAsC;IAC3E,oCAAoC,qCAAqC;IAGzE,KAAK,UAAU;IAGf,cAAc,kBAAkB;IAChC,mBAAmB,sBAAsB;IAGzC,mBAAmB,sBAAsB;IAGzC,oBAAoB,uBAAuB;IAG3C,eAAe,oBAAoB;IAKnC,gBAAgB,oBAAoB;IAGpC,mBAAmB,sBAAsB;IACzC,2BAA2B,8BAA8B;IAGzD,sBAAsB,yBAAyB;IAC/C,8BAA8B,iCAAiC;IAG/D,oBAAoB,uBAAuB;IAC3C,4BAA4B,+BAA+B;IAS3D,0BAA0B,4BAA4B;IACtD,kCAAkC,oCAAoC;IACtE,iCAAiC,mCAAmC;IAepE,qBAAqB,uBAAuB;IAC5C,6BAA6B,+BAA+B;IAC5D,4BAA4B,8BAA8B;IAQ1D,0BAA0B,2BAA2B;IACrD,kCAAkC,mCAAmC;IACrE,iCAAiC,kCAAkC;IAOnE,2BAA2B,4BAA4B;IACvD,mCAAmC,oCAAoC;IACvE,kCAAkC,mCAAmC;CACtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,sCAAsC,EAAE,WAAW,CAAC,MAAM,CAErE,CAAC;AAGH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,gBAAgB,CAqB/D,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,wEAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,uDAAuD;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAEvF,CAAC;AAEF,eAAO,MAAM,kCAAkC,EAAE;KAAG,GAAG,IAAI,gBAAgB,GAAG,MAAM;CAyGnF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,iDAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,mEAAmE;AAEnE;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,6DAA6D;IAC7D,OAAO,YAAY;IACnB,0DAA0D;IAC1D,QAAQ,aAAa;CACtB"}
+{"version":3,"file":"resources.shared.core.definitions.d.ts","sourceRoot":"","sources":["../../../src/resources/resources.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;GAOG;AACH,oBAAY,qBAAqB;IAC/B,IAAI,SAAS,CAAS,kCAAkC;IACxD,MAAM,WAAW,CAAO,2BAA2B;IACnD,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,MAAM,WAAW,CAAK,kBAAkB;IACxC,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,MAAM,WAAW,CAAK,sBAAsB;IAC5C,WAAW,gBAAgB,CAAI,4BAA4B;IAC3D,IAAI,SAAS,CAAS,iCAAiC;IACvD,MAAM,WAAW,CAAK,2CAA2C;IACjE,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,mBAAmB,yBAAuC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,iCAAiC,EAAE,qBAAqB,EAMpE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAAqB,EAGhE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,qBAAqB,EAG5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,qBAAqB,EAK5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,qBAAqB,EAMlE,CAAC;AACF,iEAAiE;AAEjE,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,gBAAgB,oBAAoB;IACpC,aAAa,iBAAiB;IAC9B,gBAAgB,oBAAoB;IACpC,kBAAkB,qBAAqB;IACvC,qBAAqB,wBAAwB;IAC7C,aAAa,kBAAkB;IAC/B,kBAAkB,sBAAsB;IACxC,qBAAqB,yBAAyB;IAC9C,wBAAwB,4BAA4B;IACpD,sBAAsB,yBAAyB;IAE/C;;;;;;;;;;;;;;;OAeG;IACH,yBAAyB,4BAA4B;IACrD,0BAA0B,8BAA8B;IACxD,qBAAqB,yBAAyB;IAC9C,aAAa,iBAAiB;IAC9B,oBAAoB,wBAAwB;IAC5C,sGAAsG;IACtG,yBAAyB,4BAA4B;IAGrD,YAAY,wBAAwB;IACpC,0BAA0B,6BAA6B;IACvD;;;;;OAKG;IACH,wBAAwB,oCAAoC;IAC5D,yBAAyB,4BAA4B;IACrD,wBAAwB,2BAA2B;IACnD,qCAAqC,uCAAuC;IAG5E,4BAA4B,+BAA+B;IAC3D,uBAAuB,0BAA0B;IAGjD,+BAA+B,iCAAiC;IAChE,8BAA8B,gCAAgC;IAE9D,WAAW,iBAAiB;IAC5B,sBAAsB,yBAAyB;IAC/C,2BAA2B,8BAA8B;IACzD,8BAA8B,gCAAgC;IAC9D,6BAA6B,+BAA+B;IAC5D,oCAAoC,sCAAsC;IAC1E,oBAAoB,uBAAuB;IAC3C,yBAAyB,4BAA4B;IACrD,oBAAoB,wBAAwB;IAC5C,oBAAoB,wBAAwB;IAC5C,oBAAoB,wBAAwB;IAG5C,6BAA6B,gCAAgC;IAC7D,qBAAqB,wBAAwB;IAG7C,0BAA0B,8BAA8B;IACxD,kBAAkB,sBAAsB;IAGxC,yBAAyB,4BAA4B;IACrD,iBAAiB,oBAAoB;IAGrC,0BAA0B,6BAA6B;IACvD,kBAAkB,qBAAqB;IAGvC,yBAAyB,4BAA4B;IACrD,iBAAiB,oBAAoB;IAGrC,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,UAAU,eAAe;IACzB,SAAS,cAAc;IAGvB,UAAU,cAAc;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAAsB,yBAAyB;IAS/C,wBAAwB,2BAA2B;IACnD,gCAAgC,mCAAmC;IAKnE,2BAA2B,8BAA8B;IACzD,0BAA0B,6BAA6B;IACvD,qCAAqC,sCAAsC;IAC3E,oCAAoC,qCAAqC;IAczE,KAAK,UAAU;IAGf,cAAc,kBAAkB;IAChC,mBAAmB,sBAAsB;IAGzC,mBAAmB,sBAAsB;IAGzC,oBAAoB,uBAAuB;IAG3C,eAAe,oBAAoB;IAKnC,gBAAgB,oBAAoB;IAGpC,mBAAmB,sBAAsB;IACzC,2BAA2B,8BAA8B;IAGzD,sBAAsB,yBAAyB;IAC/C,8BAA8B,iCAAiC;IAG/D,oBAAoB,uBAAuB;IAC3C,4BAA4B,+BAA+B;IAS3D,0BAA0B,4BAA4B;IACtD,kCAAkC,oCAAoC;IACtE,iCAAiC,mCAAmC;IAepE,qBAAqB,uBAAuB;IAC5C,6BAA6B,+BAA+B;IAC5D,4BAA4B,8BAA8B;IAQ1D,0BAA0B,2BAA2B;IACrD,kCAAkC,mCAAmC;IACrE,iCAAiC,kCAAkC;IAOnE,2BAA2B,4BAA4B;IACvD,mCAAmC,oCAAoC;IACvE,kCAAkC,mCAAmC;CACtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,sCAAsC,EAAE,WAAW,CAAC,MAAM,CAErE,CAAC;AAGH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,gBAAgB,CAqB/D,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,wEAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,uDAAuD;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAEvF,CAAC;AAEF,eAAO,MAAM,kCAAkC,EAAE;KAAG,GAAG,IAAI,gBAAgB,GAAG,MAAM;CA6GnF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,iDAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,mEAAmE;AAEnE;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,6DAA6D;IAC7D,OAAO,YAAY;IACnB,0DAA0D;IAC1D,QAAQ,aAAa;CACtB"}

package/dist/esm/resources/resources.shared.core.definitions.js

@@ -85,6 +85,23 @@ export var CoreResourceType;
     CoreResourceType["ORGANIZATION_PROFILES"] = "organizationProfiles";
     CoreResourceType["ORGANIZATION_PREFERENCES"] = "organizationPreferences";
     CoreResourceType["PLATFORM_ACCESS_GRANTS"] = "platformAccessGrants";
+    /**
+     * The APPLICATION-WIDE sibling of {@link CoreResourceType.PLATFORM_ACCESS_GRANTS}.
+     *
+     * Same lifecycle, same vocabulary, same expiry control — a DIFFERENT scope, and the scope is the
+     * whole reason it is a second resource rather than a field on the first. A platform access grant
+     * is an ORGANIZATIONS-scoped row addressed at `/organizations/{organizationId}/…`, because the
+     * tenant it names is the party that sees, approves and revokes it. An application-wide elevation
+     * names NO tenant, so there is nothing for that route to carry and nobody for the Lockbox posture
+     * to ask.
+     *
+     * Its approval is therefore the TWO-PERSON RULE: a second platform administrator, never the
+     * requester. `.claude/rules/administrative-continuity-floors.md` — "a second factor authenticates
+     * a session; only a second signature constrains an authenticated operator". Customer approval is
+     * the industry ceiling (Lockbox, Access Approval) and is structurally unavailable here, so a
+     * second signature is the strongest control that exists for this act.
+     */
+    CoreResourceType["APPLICATION_ACCESS_GRANTS"] = "applicationAccessGrants";
     CoreResourceType["ORGANIZATION_NOTIFICATIONS"] = "organizationNotifications";
     CoreResourceType["ORGANIZATION_FEATURES"] = "organizationFeatures";
     CoreResourceType["USER_FEATURES"] = "userFeatures";
@@ -93,6 +110,14 @@ export var CoreResourceType;
     CoreResourceType["ORGANIZATION_UNIT_MEMBERS"] = "organizationUnitMembers";
     CoreResourceType["ORG_API_KEYS"] = "organizationApiKeys";
     CoreResourceType["OAUTH_CLIENTS_ORGANIZATION"] = "organizationOAuthClients";
+    /**
+     * An organization's OWN credential toward a third-party provider — its Slack workspace token,
+     * its CRM API key. Distinct from the deployment's `process.env` secret, which is one value for
+     * every tenant in the application, and distinct from a user's delegated OAuth grant (#333),
+     * which has a different owner and a different revocation.
+     */
+    CoreResourceType["ORG_PROVIDER_CREDENTIALS"] = "organizationProviderCredentials";
+    CoreResourceType["USER_PROVIDER_CREDENTIALS"] = "userProviderCredentials";
     CoreResourceType["ORGANIZATION_SCIM_TOKENS"] = "organizationScimTokens";
     CoreResourceType["ORGANIZATION_SCIM_PROVISIONING_CONFIG"] = "organizationScimProvisioningConfig";
     // SSO Resources (Phase H-SSO)
@@ -134,6 +159,35 @@ export var CoreResourceType;
     CoreResourceType["REFERRALS"] = "referrals";
     // Audit and Compliance Resources
     CoreResourceType["AUDIT_LOGS"] = "auditLogs";
+    /**
+     * The APPLICATION-scoped door onto the SAME audit rows `AUDIT_LOGS` serves.
+     *
+     * `AUDIT_LOGS` is organization-scoped: its only route is
+     * `/organizations/{organizationId}/audit-logs`, so it can only ever return rows carrying that
+     * tenant. But a security event is frequently application-scoped BY NATURE — `logUserLogin` takes
+     * `organizationId` as OPTIONAL because at login no organization is selected, and the same holds
+     * for session eviction, token refresh and application-wide authentication-policy changes.
+     * Measured on a dogfood application (#317): 94 of 127 rows carried no organization and were
+     * therefore reachable through no API at all.
+     *
+     * This type is that missing door, and it is a SEPARATE type rather than a second route on
+     * `AUDIT_LOGS` because the URL combinator forbids the alternative: `generateParentCombinations`
+     * puts every `isPrimaryScope` and every `REQUIRES_CONTEXT` parent into EVERY combination, so
+     * routing `AUDIT_LOGS`' application edge would rewrite its organization route to
+     * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` and break every
+     * existing consumer. A sibling type with a single application parent takes the route it needs and
+     * leaves the organization door untouched.
+     *
+     * Both types address ONE row set through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES` — the
+     * mechanism `USER_SELF` already uses to address `USERS`' rows. Two doors, one record set: the
+     * organization door stays tenant-filtered, this one is `APP_ADMIN_SUPER_ADMIN`-only, and a read
+     * here that touches a tenant-attributed row emits `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, once per
+     * tenant reached. That emission is NOT inherited: `authorizeOrganizations`, where the event is
+     * otherwise raised, runs only for ORGANIZATIONS-scoped resources. Each read variant here declares
+     * `admitsCrossTenantPlatformAdministration`, and that declaration is what enrols the read in the
+     * trail (`security/authorizations/cross-tenant-read-observation.backend.ts`).
+     */
+    CoreResourceType["APPLICATION_AUDIT_LOGS"] = "applicationAuditLogs";
     // Notification Badges Resources — polymorphic dual-scope (USER + ORG).
     // Each scope owns its own collection and its own access-control surface:
     //   - USER variant: the user themselves reads/lists their badges; CREATE/UPDATE
@@ -150,6 +204,17 @@ export var CoreResourceType;
     CoreResourceType["APPLICATION_WEBHOOK_CONFIG"] = "applicationWebhookConfig";
     CoreResourceType["ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG"] = "organizationM2mWebhookDeliveryLog";
     CoreResourceType["APPLICATION_M2M_WEBHOOK_DELIVERY_LOG"] = "applicationM2mWebhookDeliveryLog";
+    // There is NO email equivalent of these two, and that is a DECISION rather than an oversight
+    // (#412, 2026-09-08). A sent email leaves log lines and nothing else — no resource, no delivery
+    // record — so "did this customer receive it?" is answered with the email provider's own tooling,
+    // never with Wildo. The asymmetry with these webhook logs is what makes the absence look
+    // accidental, which is why it is written down HERE as well as at the email service.
+    //
+    // The cost is not the table. A persisted email record carries retention policy, privacy
+    // classification, subject-export and erasure obligations FOR MESSAGE CONTENT — a new per-user
+    // personal-data store, for an answer a vendor already gives. A metadata-only variant (recipient,
+    // template, timestamp, provider id; no body) was available and also declined, because it is the
+    // same set of obligations over a smaller payload.
     // File Management Resources
     CoreResourceType["FILES"] = "files";
     // Queue/Job Resources (internal, repository-only)
@@ -327,6 +392,7 @@ export const coreResourceShared_FieldIdentifier = {
     [CoreResourceType.ORGANIZATION_PROFILES]: 'organizationProfileId',
     [CoreResourceType.ORGANIZATION_PREFERENCES]: 'organizationPreferencesId',
     [CoreResourceType.PLATFORM_ACCESS_GRANTS]: 'platformAccessGrantId',
+    [CoreResourceType.APPLICATION_ACCESS_GRANTS]: 'applicationAccessGrantId',
     [CoreResourceType.ORGANIZATION_NOTIFICATIONS]: 'organizationNotificationsId',
     [CoreResourceType.ORGANIZATION_FEATURES]: 'organizationFeaturesId',
     [CoreResourceType.USER_FEATURES]: 'userFeaturesId',
@@ -334,6 +400,8 @@ export const coreResourceShared_FieldIdentifier = {
     [CoreResourceType.ORGANIZATION_UNIT_MEMBERS]: 'organizationUnitMemberId',
     [CoreResourceType.ORG_API_KEYS]: 'orgApiKeyId',
     [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: 'orgOAuthClientId',
+    [CoreResourceType.ORG_PROVIDER_CREDENTIALS]: 'orgProviderCredentialId',
+    [CoreResourceType.USER_PROVIDER_CREDENTIALS]: 'userProviderCredentialId',
     [CoreResourceType.ORGANIZATION_SCIM_TOKENS]: 'organizationScimTokenId',
     [CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG]: 'organizationScimProvisioningConfigId',
     [CoreResourceType.APPLICATION_API_KEYS]: 'appApiKeyId',
@@ -365,6 +433,7 @@ export const coreResourceShared_FieldIdentifier = {
     [CoreResourceType.PROMOTIONS]: 'promotionId',
     [CoreResourceType.REFERRALS]: 'referralId',
     [CoreResourceType.AUDIT_LOGS]: 'auditLogId',
+    [CoreResourceType.APPLICATION_AUDIT_LOGS]: 'applicationAuditLogId',
     // Notification Badges — polymorphic dual-scope variants
     [CoreResourceType.USER_NOTIFICATION_BADGES]: 'userNotificationBadgeId',
     [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: 'organizationNotificationBadgeId',