@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/resources/utils/shared-persistence-collection.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared-persistence-collection.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAKxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK;IACpD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,aAAa;IACrE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,gBAAgB,CAAC,gBAAgB;CAC5E,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,YAA0B;IAC/E,OAAO,8CAA8C,CAAC,YAAsB,CAAC,IAAK,YAAuB,CAAC;AAC5G,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,kDAAkD,CAChE,sBAAmF,EACnF,yBAAiD;IAEjD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,2FAA2F;QAC3F,0EAA0E;QAC1E,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG;YACZ,YAAY;YACZ,OAAO,EAAE,cAAc,EAAE,kBAAkB,IAAI,yBAAyB;SACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAoD,EAAE,CAAC;IAEzE,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,sBAAsB,cAAc,+BAA+B;gBAChG,8FAA8F;gBAC9F,gGAAgG;gBAChG,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,+FAA+F;gBAC/F,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAAC,eAA4D;IAC5F,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAA0C,CAAC;SACvE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,oDAAoD,CAClE,sBAAqF;IAErF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG;YACd,YAAY;YACZ,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI;YAC3C,UAAU,EAAE,wBAAwB,CAAC,cAAc,EAAE,eAAe,CAAC;SACtE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAsD,EAAE,CAAC;IAE3E,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;aACnG,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,uBAAuB,cAAc,2BAA2B;gBAC7F,gGAAgG;gBAChG,+FAA+F;gBAC/F,iGAAiG;gBACjG,+FAA+F;gBAC/F,2FAA2F;gBAC3F,6FAA6F;gBAC7F,gGAAgG;gBAChG,6FAA6F;gBAC7F,8BAA8B;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import { CoreResourceType } from '../resources.shared.core.definitions';\nimport type { ResourceType } from '../resources.shared.schemas';\nimport type { PersistenceAdapterType } from '../resources-config.shared.schemas';\nimport { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Resource types that deliberately project onto ANOTHER resource type's\n * persistence collection — THE authority for \"which configs address the same\n * physical rows?\".\n *\n * ## What this expresses\n *\n * A `USER_SELF*` resource is not a different record set; it is a different DOOR\n * onto the SAME record set, with its own operations, roles and scoping. The\n * `USERS` door is the admin surface (list every user, delete a user); the\n * `USER_SELF` door is the self surface (read/update MY row). They intentionally\n * share `UserSchema` and they intentionally share storage — the persistence\n * layer builds a SEPARATE model per resource config over ONE collection.\n *\n * Anything not listed here stores under its own resource type.\n *\n * ## Why it is a single named authority\n *\n * This mapping had already been copied twice inside the backend (the\n * zod→mongoose model builder, which is what actually creates and reads the\n * collection, and the aggregation collection resolver — whose earlier\n * divergence made every aggregation query a non-existent collection and return\n * zero rows). It now has a third consumer of a completely different kind:\n * {@link findSharedPersistenceCollectionRetentionIncoherences}, a boot-time\n * coherence guard. A per-resource config factory structurally cannot see this\n * relationship — it validates ONE config at a time — so the fact has to live\n * where every layer can read it, and it has to live exactly once.\n *\n * ## The alias belongs to the RESOURCE, not to the storage adapter\n *\n * Every persistence path resolves through this map, and each adapter has\n * exactly ONE composition point that does so: MongoDB's model builder and its\n * aggregation resolver, and — on the SQL side — the single\n * `resolveTableNameForResource` helper that the hybrid planner, the PostgreSQL\n * repository and the boot-time table verifier all call.\n *\n * This was NOT always true, and the way it failed is the reason to keep it\n * true: PostgreSQL used to derive its table name straight from\n * `resourceIdentifier`, so `USER_SELF` planned, wrote and verified a `userself`\n * table while `USERS` used `users`. An adapter choice must never silently\n * change WHICH RECORDS a resource addresses — that is not a storage detail, it\n * is the \"two doors, one record set\" contract itself. On the SQL side the\n * resolved name is additionally normalised into a SQL identifier; casing is an\n * adapter concern, the alias is not.\n *\n * The one thing a shared resolver still cannot see is an alias group whose\n * members are pointed at DIFFERENT adapters — each config is individually\n * valid, and only the pair is wrong. That is what\n * {@link findSharedPersistenceCollectionAdapterIncoherences} fails closed on.\n */\nexport const RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES: Readonly<Record<string, string>> = {\n  [CoreResourceType.USER_SELF]: CoreResourceType.USERS,\n  [CoreResourceType.USER_SELF_PROFILES]: CoreResourceType.USER_PROFILES,\n  [CoreResourceType.USER_SELF_PREFERENCES]: CoreResourceType.USER_PREFERENCES,\n};\n\n/**\n * The persistence collection a resource type's rows live in — its alias target\n * when it declares one, otherwise the resource type itself.\n *\n * @param resourceType - the resource type whose storage location is wanted.\n * @returns the collection name, as a plain string.\n */\nexport function resolveSharedPersistenceCollectionName(resourceType: ResourceType): string {\n  return RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES[resourceType as string] ?? (resourceType as string);\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionAdapterIncoherences} reads. */\nexport interface SharedPersistenceCollectionAdapterCandidate {\n  readonly resourceIdentifier: ResourceType;\n  /** The config's OWN declaration; `undefined` means \"inherit the application default\". */\n  readonly persistenceAdapter?: PersistenceAdapterType | undefined;\n}\n\n/** One collection whose resource configs are pointed at different databases. */\nexport interface SharedPersistenceCollectionAdapterIncoherence {\n  /** The shared collection the disagreeing configs claim to address. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the adapter it RESOLVED to. */\n  readonly adapters: readonly { resourceType: ResourceType; adapter: PersistenceAdapterType }[];\n  /** Operator-facing explanation naming the consequence and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must resolve to the SAME persistence adapter.\n *\n * ## Why the shared resolver cannot cover this on its own\n *\n * {@link resolveSharedPersistenceCollectionName} makes the alias\n * adapter-independent: whichever database a resource lands in, it addresses the\n * aliased NAME. That is necessary and not sufficient. A name is only an address\n * WITHIN one database, so pointing `USERS` at PostgreSQL while `USER_SELF`\n * inherits MongoDB yields two stores that both believe they own the same rows.\n * Nothing downstream can detect it: each config is individually valid, each\n * repository is correctly built, and every per-resource check passes.\n *\n * ## The failure it prevents\n *\n * The doors silently stop sharing records. The admin door lists users the self\n * door cannot read; a self-service update writes to a row the admin door will\n * never see; and — because retention is enforced against ROWS — an erasure\n * performed through one door leaves the other door's copy completely\n * untouched, which is the same compliance-grade lie that\n * {@link findSharedPersistenceCollectionRetentionIncoherences} exists to\n * prevent, arrived at from a different direction.\n *\n * The table name is not the only thing that follows from the adapter. Id FORMAT\n * does too — the PostgreSQL repository validates ids as UUIDs while Mongo\n * expects ObjectIds, each resolved from its OWN resource's adapter — so a split\n * group would also reject through one door the very ids the other door mints.\n * Anything keyed on \"this resource's adapter\" inherits this invariant.\n *\n * ## Why this is permanent, not a capability gate\n *\n * Unlike adapter gaps that close when the missing support is implemented, this\n * one has no future in which it becomes valid: two databases cannot hold one\n * set of rows. It is deliberately NOT a ban on aliased resources using\n * PostgreSQL — an alias group that agrees on PostgreSQL resolves to one shared\n * table, and whether that table was actually provisioned is a separate,\n * already-enforced question (the boot-time table verifier).\n *\n * Resources inherit the application default when they declare nothing, so the\n * caller supplies the resolved default rather than this function guessing it.\n *\n * Pure and side-effect free: it reports, the caller throws.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @param defaultPersistenceAdapter - the adapter a config with no declaration inherits.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionAdapterIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionAdapterCandidate>,\n  defaultPersistenceAdapter: PersistenceAdapterType,\n): SharedPersistenceCollectionAdapterIncoherence[] {\n  const adaptersByCollection = new Map<\n    string,\n    { resourceType: ResourceType; adapter: PersistenceAdapterType }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Same reasoning as the retention guard: prefer the config's OWN identifier so a mis-keyed\n    // registry entry is diagnosed against the name its author actually wrote.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const entry = {\n      resourceType,\n      adapter: resourceConfig?.persistenceAdapter ?? defaultPersistenceAdapter,\n    };\n\n    const existing = adaptersByCollection.get(collectionName);\n    if (existing) {\n      existing.push(entry);\n    } else {\n      adaptersByCollection.set(collectionName, [entry]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionAdapterIncoherence[] = [];\n\n  for (const [collectionName, adapters] of adaptersByCollection) {\n    if (adapters.length < 2) {\n      continue;\n    }\n    if (new Set(adapters.map((entry) => entry.adapter)).size < 2) {\n      continue;\n    }\n\n    const declared = adapters\n      .map((entry) => `'${String(entry.resourceType)}' → ${entry.adapter}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      adapters,\n      message:\n        `Resource configs [${declared}] all address the '${collectionName}' persistence collection but ` +\n        `resolve to DIFFERENT persistence adapters. These configs are separate doors onto ONE set of ` +\n        `rows, and a collection name only addresses rows within a single database, so this splits them ` +\n        `across two stores that each believe they own the records: the admin door lists rows the self ` +\n        `door cannot read, a self-service write lands where the admin door will never see it, and an ` +\n        `erasure performed through one door leaves the other door's copy fully intact. Give every ` +\n        `config listed above the same persistenceAdapter (a resource sharing a collection cannot pick ` +\n        `its database alone), or stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionRetentionIncoherences} reads. */\nexport interface SharedPersistenceCollectionRetentionCandidate {\n  readonly resourceIdentifier: ResourceType;\n  readonly retentionPolicy?: { mode?: ErasureRetentionMode } | undefined;\n}\n\n/**\n * Canonical comparison key for a resource's retention POSTURE.\n *\n * Compares the WHOLE resolved policy, not just `mode`. `ResourceRetentionPolicy` carries a single\n * axis today, so `mode` alone would be exhaustive — but this guard exists precisely because config\n * checks that look sufficient go quietly wrong later, and a second axis (a disposal clock, a\n * jurisdiction) added to the policy would otherwise escape the comparison with no compile-time\n * signal. Two configs over one collection must agree on ALL of it.\n *\n * Key order is normalised so authoring order cannot masquerade as a disagreement. `undefined` gets\n * its own key rather than being skipped: \"rows of this resource are hard-deleted\" is a positive\n * claim, and the in-vs-out asymmetry is what produces both failure modes documented below.\n */\nfunction buildRetentionPostureKey(retentionPolicy: { mode?: ErasureRetentionMode } | undefined): string {\n  if (retentionPolicy === undefined || retentionPolicy === null) {\n    return 'NOT_GOVERNED';\n  }\n  const entries = Object.entries(retentionPolicy as Record<string, unknown>)\n    .filter(([, value]) => value !== undefined)\n    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n  return entries.length === 0 ? 'NOT_GOVERNED' : JSON.stringify(entries);\n}\n\n/** One collection whose resource configs disagree about retention governance. */\nexport interface SharedPersistenceCollectionRetentionIncoherence {\n  /** The shared collection the disagreeing configs write to. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the posture it declared. */\n  readonly postures: readonly { resourceType: ResourceType; mode: ErasureRetentionMode | undefined }[];\n  /** Operator-facing explanation naming both failure modes and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must declare the SAME retention posture.\n *\n * ## Why a config that passes every per-resource check can still be broken\n *\n * `retentionPolicy` is validated PER RESOURCE CONFIG by the config factory: it\n * checks that resource's operations, its field treatments, its system-access\n * grants. It cannot check what a SIBLING config declares, because a factory\n * invocation never sees one. But retention is enforced against ROWS, and two\n * configs can own the same rows (see\n * {@link RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES}). So a pair that\n * disagrees produces a config where every individual resource is valid and the\n * COLLECTION is not.\n *\n * ## The two concrete failure modes\n *\n * **1. Fail-open erasure.** The retention hide filter (rows marked `RETAINED`\n * are invisible) and the immutability freeze are injected per resource config,\n * in `buildContextualFilter`. A row erased through the governed door stays\n * fully READABLE and UPDATABLE through the ungoverned one. For the\n * `USERS`/`USER_SELF` pair that ungoverned door exposes READ + UPDATE to\n * `APP_USER` — i.e. the erased subject can still read and edit their own\n * \"erased\" record. The row is erased only from the door that was opted in,\n * which is a compliance-grade lie about the record.\n *\n * **2. Unique-index collision — a hard functional abort.** A retention-governed\n * config scopes each unique index to NON-retained rows (a partial filter on the\n * retention marker), precisely so scrubbed rows leave the index and cannot\n * collide on the shared mask value. An ungoverned config over the same\n * collection emits a PLAIN unique index on the same field. The FIRST erasure\n * succeeds; the SECOND writes the same mask value, hits the plain index, and\n * fails E11000 — inside the erasure transaction, so the whole erasure rolls\n * back. The capability is silently single-use.\n *\n * Both modes are invisible until a real erasure runs, which is why this is a\n * BOOT-time guard and not a test: the point is that a config which passes at\n * boot must actually be able to perform an erasure.\n *\n * ## Why \"one opted in, one not\" is a disagreement, not a default\n *\n * An absent `retentionPolicy` is a positive statement — \"rows of this resource\n * are hard-deleted\" — not an unset value the governed sibling can supply. Both\n * failure modes above are produced by exactly that asymmetry, so `undefined`\n * participates in the comparison as its own posture rather than being skipped.\n *\n * Pure and side-effect free: it reports, the caller throws. That keeps the\n * shared-collection fact and its invariant in the layer both persistence and\n * validation can import, while the registry owns the error shape.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionRetentionIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionRetentionCandidate>,\n): SharedPersistenceCollectionRetentionIncoherence[] {\n  const posturesByCollection = new Map<\n    string,\n    { resourceType: ResourceType; mode: ErasureRetentionMode | undefined; postureKey: string }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Prefer the config's OWN identifier over the map key: the registry keys by resource type, but a\n    // host that mis-keyed an entry would otherwise be diagnosed against a name it never authored.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const posture = {\n      resourceType,\n      mode: resourceConfig?.retentionPolicy?.mode,\n      postureKey: buildRetentionPostureKey(resourceConfig?.retentionPolicy),\n    };\n\n    const existing = posturesByCollection.get(collectionName);\n    if (existing) {\n      existing.push(posture);\n    } else {\n      posturesByCollection.set(collectionName, [posture]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionRetentionIncoherence[] = [];\n\n  for (const [collectionName, postures] of posturesByCollection) {\n    if (postures.length < 2) {\n      continue;\n    }\n    const distinctPostures = new Set(postures.map((posture) => posture.postureKey));\n    if (distinctPostures.size < 2) {\n      continue;\n    }\n\n    const declared = postures\n      .map((posture) => `'${String(posture.resourceType)}' → ${posture.mode ?? 'NOT retention-governed'}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      postures,\n      message:\n        `Resource configs [${declared}] all store in the '${collectionName}' collection but declare ` +\n        `DIFFERENT retention postures. They are separate models over ONE set of rows, and retention is ` +\n        `enforced per resource config, so this ships two defects that only appear when a real erasure ` +\n        `runs: (1) FAIL-OPEN ERASURE — the retention hide filter and the immutability freeze are absent ` +\n        `on the ungoverned door, leaving an erased row readable and updatable there; (2) UNIQUE-INDEX ` +\n        `COLLISION — the governed config scopes its unique indexes to non-retained rows while the ` +\n        `ungoverned one emits plain unique indexes on the same collection, so the SECOND erased row ` +\n        `collides (E11000) and the erasure transaction rolls back. Declare the SAME retentionPolicy on ` +\n        `every config listed above (a resource sharing a collection cannot opt in or out alone), or ` +\n        `stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n"]}
+{"version":3,"file":"shared-persistence-collection.utils.js","sourceRoot":"","sources":["../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAKxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK;IACpD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,aAAa;IACrE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,gBAAgB,CAAC,gBAAgB;IAC3E;;;;;;;;;OASG;IACH,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,UAAU;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,YAA0B;IAC/E,OAAO,8CAA8C,CAAC,YAAsB,CAAC,IAAK,YAAuB,CAAC;AAC5G,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,kDAAkD,CAChE,sBAAmF,EACnF,yBAAiD;IAEjD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,2FAA2F;QAC3F,0EAA0E;QAC1E,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG;YACZ,YAAY;YACZ,OAAO,EAAE,cAAc,EAAE,kBAAkB,IAAI,yBAAyB;SACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAoD,EAAE,CAAC;IAEzE,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,sBAAsB,cAAc,+BAA+B;gBAChG,8FAA8F;gBAC9F,gGAAgG;gBAChG,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,+FAA+F;gBAC/F,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAAC,eAA4D;IAC5F,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAA0C,CAAC;SACvE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,oDAAoD,CAClE,sBAAqF;IAErF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG;YACd,YAAY;YACZ,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI;YAC3C,UAAU,EAAE,wBAAwB,CAAC,cAAc,EAAE,eAAe,CAAC;SACtE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAsD,EAAE,CAAC;IAE3E,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;aACnG,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,uBAAuB,cAAc,2BAA2B;gBAC7F,gGAAgG;gBAChG,+FAA+F;gBAC/F,iGAAiG;gBACjG,+FAA+F;gBAC/F,2FAA2F;gBAC3F,6FAA6F;gBAC7F,gGAAgG;gBAChG,6FAA6F;gBAC7F,8BAA8B;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import { CoreResourceType } from '../resources.shared.core.definitions';\nimport type { ResourceType } from '../resources.shared.schemas';\nimport type { PersistenceAdapterType } from '../resources-config.shared.schemas';\nimport { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Resource types that deliberately project onto ANOTHER resource type's\n * persistence collection — THE authority for \"which configs address the same\n * physical rows?\".\n *\n * ## What this expresses\n *\n * A `USER_SELF*` resource is not a different record set; it is a different DOOR\n * onto the SAME record set, with its own operations, roles and scoping. The\n * `USERS` door is the admin surface (list every user, delete a user); the\n * `USER_SELF` door is the self surface (read/update MY row). They intentionally\n * share `UserSchema` and they intentionally share storage — the persistence\n * layer builds a SEPARATE model per resource config over ONE collection.\n *\n * Anything not listed here stores under its own resource type.\n *\n * ## Why it is a single named authority\n *\n * This mapping had already been copied twice inside the backend (the\n * zod→mongoose model builder, which is what actually creates and reads the\n * collection, and the aggregation collection resolver — whose earlier\n * divergence made every aggregation query a non-existent collection and return\n * zero rows). It now has a third consumer of a completely different kind:\n * {@link findSharedPersistenceCollectionRetentionIncoherences}, a boot-time\n * coherence guard. A per-resource config factory structurally cannot see this\n * relationship — it validates ONE config at a time — so the fact has to live\n * where every layer can read it, and it has to live exactly once.\n *\n * ## The alias belongs to the RESOURCE, not to the storage adapter\n *\n * Every persistence path resolves through this map, and each adapter has\n * exactly ONE composition point that does so: MongoDB's model builder and its\n * aggregation resolver, and — on the SQL side — the single\n * `resolveTableNameForResource` helper that the hybrid planner, the PostgreSQL\n * repository and the boot-time table verifier all call.\n *\n * This was NOT always true, and the way it failed is the reason to keep it\n * true: PostgreSQL used to derive its table name straight from\n * `resourceIdentifier`, so `USER_SELF` planned, wrote and verified a `userself`\n * table while `USERS` used `users`. An adapter choice must never silently\n * change WHICH RECORDS a resource addresses — that is not a storage detail, it\n * is the \"two doors, one record set\" contract itself. On the SQL side the\n * resolved name is additionally normalised into a SQL identifier; casing is an\n * adapter concern, the alias is not.\n *\n * The one thing a shared resolver still cannot see is an alias group whose\n * members are pointed at DIFFERENT adapters — each config is individually\n * valid, and only the pair is wrong. That is what\n * {@link findSharedPersistenceCollectionAdapterIncoherences} fails closed on.\n */\nexport const RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES: Readonly<Record<string, string>> = {\n  [CoreResourceType.USER_SELF]: CoreResourceType.USERS,\n  [CoreResourceType.USER_SELF_PROFILES]: CoreResourceType.USER_PROFILES,\n  [CoreResourceType.USER_SELF_PREFERENCES]: CoreResourceType.USER_PREFERENCES,\n  /*\n   * The application-scoped audit door addresses the organization-scoped resource's rows (#317).\n   *\n   * Unlike the `USER_SELF` group above — where the alias exists so a principal can address its OWN\n   * row through a narrower door — this pair exists because the two doors see DIFFERENT SUBSETS of\n   * one set: the organization door is tenant-filtered and structurally cannot return the rows that\n   * carry no organization (logins, session evictions, application-wide policy changes), which is\n   * 74% of them on a measured dogfood application. Splitting the storage would split the audit\n   * trail itself, so the alias is load-bearing rather than a convenience.\n   */\n  [CoreResourceType.APPLICATION_AUDIT_LOGS]: CoreResourceType.AUDIT_LOGS,\n};\n\n/**\n * The persistence collection a resource type's rows live in — its alias target\n * when it declares one, otherwise the resource type itself.\n *\n * @param resourceType - the resource type whose storage location is wanted.\n * @returns the collection name, as a plain string.\n */\nexport function resolveSharedPersistenceCollectionName(resourceType: ResourceType): string {\n  return RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES[resourceType as string] ?? (resourceType as string);\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionAdapterIncoherences} reads. */\nexport interface SharedPersistenceCollectionAdapterCandidate {\n  readonly resourceIdentifier: ResourceType;\n  /** The config's OWN declaration; `undefined` means \"inherit the application default\". */\n  readonly persistenceAdapter?: PersistenceAdapterType | undefined;\n}\n\n/** One collection whose resource configs are pointed at different databases. */\nexport interface SharedPersistenceCollectionAdapterIncoherence {\n  /** The shared collection the disagreeing configs claim to address. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the adapter it RESOLVED to. */\n  readonly adapters: readonly { resourceType: ResourceType; adapter: PersistenceAdapterType }[];\n  /** Operator-facing explanation naming the consequence and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must resolve to the SAME persistence adapter.\n *\n * ## Why the shared resolver cannot cover this on its own\n *\n * {@link resolveSharedPersistenceCollectionName} makes the alias\n * adapter-independent: whichever database a resource lands in, it addresses the\n * aliased NAME. That is necessary and not sufficient. A name is only an address\n * WITHIN one database, so pointing `USERS` at PostgreSQL while `USER_SELF`\n * inherits MongoDB yields two stores that both believe they own the same rows.\n * Nothing downstream can detect it: each config is individually valid, each\n * repository is correctly built, and every per-resource check passes.\n *\n * ## The failure it prevents\n *\n * The doors silently stop sharing records. The admin door lists users the self\n * door cannot read; a self-service update writes to a row the admin door will\n * never see; and — because retention is enforced against ROWS — an erasure\n * performed through one door leaves the other door's copy completely\n * untouched, which is the same compliance-grade lie that\n * {@link findSharedPersistenceCollectionRetentionIncoherences} exists to\n * prevent, arrived at from a different direction.\n *\n * The table name is not the only thing that follows from the adapter. Id FORMAT\n * does too — the PostgreSQL repository validates ids as UUIDs while Mongo\n * expects ObjectIds, each resolved from its OWN resource's adapter — so a split\n * group would also reject through one door the very ids the other door mints.\n * Anything keyed on \"this resource's adapter\" inherits this invariant.\n *\n * ## Why this is permanent, not a capability gate\n *\n * Unlike adapter gaps that close when the missing support is implemented, this\n * one has no future in which it becomes valid: two databases cannot hold one\n * set of rows. It is deliberately NOT a ban on aliased resources using\n * PostgreSQL — an alias group that agrees on PostgreSQL resolves to one shared\n * table, and whether that table was actually provisioned is a separate,\n * already-enforced question (the boot-time table verifier).\n *\n * Resources inherit the application default when they declare nothing, so the\n * caller supplies the resolved default rather than this function guessing it.\n *\n * Pure and side-effect free: it reports, the caller throws.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @param defaultPersistenceAdapter - the adapter a config with no declaration inherits.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionAdapterIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionAdapterCandidate>,\n  defaultPersistenceAdapter: PersistenceAdapterType,\n): SharedPersistenceCollectionAdapterIncoherence[] {\n  const adaptersByCollection = new Map<\n    string,\n    { resourceType: ResourceType; adapter: PersistenceAdapterType }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Same reasoning as the retention guard: prefer the config's OWN identifier so a mis-keyed\n    // registry entry is diagnosed against the name its author actually wrote.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const entry = {\n      resourceType,\n      adapter: resourceConfig?.persistenceAdapter ?? defaultPersistenceAdapter,\n    };\n\n    const existing = adaptersByCollection.get(collectionName);\n    if (existing) {\n      existing.push(entry);\n    } else {\n      adaptersByCollection.set(collectionName, [entry]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionAdapterIncoherence[] = [];\n\n  for (const [collectionName, adapters] of adaptersByCollection) {\n    if (adapters.length < 2) {\n      continue;\n    }\n    if (new Set(adapters.map((entry) => entry.adapter)).size < 2) {\n      continue;\n    }\n\n    const declared = adapters\n      .map((entry) => `'${String(entry.resourceType)}' → ${entry.adapter}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      adapters,\n      message:\n        `Resource configs [${declared}] all address the '${collectionName}' persistence collection but ` +\n        `resolve to DIFFERENT persistence adapters. These configs are separate doors onto ONE set of ` +\n        `rows, and a collection name only addresses rows within a single database, so this splits them ` +\n        `across two stores that each believe they own the records: the admin door lists rows the self ` +\n        `door cannot read, a self-service write lands where the admin door will never see it, and an ` +\n        `erasure performed through one door leaves the other door's copy fully intact. Give every ` +\n        `config listed above the same persistenceAdapter (a resource sharing a collection cannot pick ` +\n        `its database alone), or stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionRetentionIncoherences} reads. */\nexport interface SharedPersistenceCollectionRetentionCandidate {\n  readonly resourceIdentifier: ResourceType;\n  readonly retentionPolicy?: { mode?: ErasureRetentionMode } | undefined;\n}\n\n/**\n * Canonical comparison key for a resource's retention POSTURE.\n *\n * Compares the WHOLE resolved policy, not just `mode`. `ResourceRetentionPolicy` carries a single\n * axis today, so `mode` alone would be exhaustive — but this guard exists precisely because config\n * checks that look sufficient go quietly wrong later, and a second axis (a disposal clock, a\n * jurisdiction) added to the policy would otherwise escape the comparison with no compile-time\n * signal. Two configs over one collection must agree on ALL of it.\n *\n * Key order is normalised so authoring order cannot masquerade as a disagreement. `undefined` gets\n * its own key rather than being skipped: \"rows of this resource are hard-deleted\" is a positive\n * claim, and the in-vs-out asymmetry is what produces both failure modes documented below.\n */\nfunction buildRetentionPostureKey(retentionPolicy: { mode?: ErasureRetentionMode } | undefined): string {\n  if (retentionPolicy === undefined || retentionPolicy === null) {\n    return 'NOT_GOVERNED';\n  }\n  const entries = Object.entries(retentionPolicy as Record<string, unknown>)\n    .filter(([, value]) => value !== undefined)\n    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n  return entries.length === 0 ? 'NOT_GOVERNED' : JSON.stringify(entries);\n}\n\n/** One collection whose resource configs disagree about retention governance. */\nexport interface SharedPersistenceCollectionRetentionIncoherence {\n  /** The shared collection the disagreeing configs write to. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the posture it declared. */\n  readonly postures: readonly { resourceType: ResourceType; mode: ErasureRetentionMode | undefined }[];\n  /** Operator-facing explanation naming both failure modes and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must declare the SAME retention posture.\n *\n * ## Why a config that passes every per-resource check can still be broken\n *\n * `retentionPolicy` is validated PER RESOURCE CONFIG by the config factory: it\n * checks that resource's operations, its field treatments, its system-access\n * grants. It cannot check what a SIBLING config declares, because a factory\n * invocation never sees one. But retention is enforced against ROWS, and two\n * configs can own the same rows (see\n * {@link RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES}). So a pair that\n * disagrees produces a config where every individual resource is valid and the\n * COLLECTION is not.\n *\n * ## The two concrete failure modes\n *\n * **1. Fail-open erasure.** The retention hide filter (rows marked `RETAINED`\n * are invisible) and the immutability freeze are injected per resource config,\n * in `buildContextualFilter`. A row erased through the governed door stays\n * fully READABLE and UPDATABLE through the ungoverned one. For the\n * `USERS`/`USER_SELF` pair that ungoverned door exposes READ + UPDATE to\n * `APP_USER` — i.e. the erased subject can still read and edit their own\n * \"erased\" record. The row is erased only from the door that was opted in,\n * which is a compliance-grade lie about the record.\n *\n * **2. Unique-index collision — a hard functional abort.** A retention-governed\n * config scopes each unique index to NON-retained rows (a partial filter on the\n * retention marker), precisely so scrubbed rows leave the index and cannot\n * collide on the shared mask value. An ungoverned config over the same\n * collection emits a PLAIN unique index on the same field. The FIRST erasure\n * succeeds; the SECOND writes the same mask value, hits the plain index, and\n * fails E11000 — inside the erasure transaction, so the whole erasure rolls\n * back. The capability is silently single-use.\n *\n * Both modes are invisible until a real erasure runs, which is why this is a\n * BOOT-time guard and not a test: the point is that a config which passes at\n * boot must actually be able to perform an erasure.\n *\n * ## Why \"one opted in, one not\" is a disagreement, not a default\n *\n * An absent `retentionPolicy` is a positive statement — \"rows of this resource\n * are hard-deleted\" — not an unset value the governed sibling can supply. Both\n * failure modes above are produced by exactly that asymmetry, so `undefined`\n * participates in the comparison as its own posture rather than being skipped.\n *\n * Pure and side-effect free: it reports, the caller throws. That keeps the\n * shared-collection fact and its invariant in the layer both persistence and\n * validation can import, while the registry owns the error shape.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionRetentionIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionRetentionCandidate>,\n): SharedPersistenceCollectionRetentionIncoherence[] {\n  const posturesByCollection = new Map<\n    string,\n    { resourceType: ResourceType; mode: ErasureRetentionMode | undefined; postureKey: string }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Prefer the config's OWN identifier over the map key: the registry keys by resource type, but a\n    // host that mis-keyed an entry would otherwise be diagnosed against a name it never authored.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const posture = {\n      resourceType,\n      mode: resourceConfig?.retentionPolicy?.mode,\n      postureKey: buildRetentionPostureKey(resourceConfig?.retentionPolicy),\n    };\n\n    const existing = posturesByCollection.get(collectionName);\n    if (existing) {\n      existing.push(posture);\n    } else {\n      posturesByCollection.set(collectionName, [posture]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionRetentionIncoherence[] = [];\n\n  for (const [collectionName, postures] of posturesByCollection) {\n    if (postures.length < 2) {\n      continue;\n    }\n    const distinctPostures = new Set(postures.map((posture) => posture.postureKey));\n    if (distinctPostures.size < 2) {\n      continue;\n    }\n\n    const declared = postures\n      .map((posture) => `'${String(posture.resourceType)}' → ${posture.mode ?? 'NOT retention-governed'}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      postures,\n      message:\n        `Resource configs [${declared}] all store in the '${collectionName}' collection but declare ` +\n        `DIFFERENT retention postures. They are separate models over ONE set of rows, and retention is ` +\n        `enforced per resource config, so this ships two defects that only appear when a real erasure ` +\n        `runs: (1) FAIL-OPEN ERASURE — the retention hide filter and the immutability freeze are absent ` +\n        `on the ungoverned door, leaving an erased row readable and updatable there; (2) UNIQUE-INDEX ` +\n        `COLLISION — the governed config scopes its unique indexes to non-retained rows while the ` +\n        `ungoverned one emits plain unique indexes on the same collection, so the SECOND erased row ` +\n        `collides (E11000) and the erasure transaction rolls back. Declare the SAME retentionPolicy on ` +\n        `every config listed above (a resource sharing a collection cannot opt in or out alone), or ` +\n        `stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n"]}

package/dist/esm/resources/utils/templatable-file-fields.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templatable-file-fields.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/templatable-file-fields.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,iCAAiC;IAChD,mBAAmB,CAAC,EAAE,CACpB,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,KAChC,CAAC,CAAC,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,yCAA0C,SAAQ,KAAK;aAEhD,SAAS,EAAE,MAAM;aACjB,gBAAgB,EAAE,kBAAkB,GAAG,SAAS;aAChD,mBAAmB,EAAE,kBAAkB,GAAG,SAAS;gBAFnD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,EAChD,mBAAmB,EAAE,kBAAkB,GAAG,SAAS;CAOtE;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,CAAC,CAAC,UAAU,EACpB,UAAU,SAAK,EACf,aAAa,UAAQ,EACrB,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,wBAAwB,EAAE,CAmG5B;AAmDD;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,CAAC,CAAC,UAAU,EACpB,OAAO,GAAE,iCAAsC,EAC/C,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,CAAC,CAAC,UAAU,CA4Md"}
+{"version":3,"file":"templatable-file-fields.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/resources/utils/templatable-file-fields.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,iCAAiC;IAChD,mBAAmB,CAAC,EAAE,CACpB,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,KAChC,CAAC,CAAC,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,yCAA0C,SAAQ,KAAK;aAEhD,SAAS,EAAE,MAAM;aACjB,gBAAgB,EAAE,kBAAkB,GAAG,SAAS;aAChD,mBAAmB,EAAE,kBAAkB,GAAG,SAAS;gBAFnD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,EAChD,mBAAmB,EAAE,kBAAkB,GAAG,SAAS;CAOtE;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,CAAC,CAAC,UAAU,EACpB,UAAU,SAAK,EACf,aAAa,UAAQ,EACrB,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,wBAAwB,EAAE,CAmG5B;AAmDD;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,CAAC,CAAC,UAAU,EACpB,OAAO,GAAE,iCAAsC,EAC/C,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,CAAC,CAAC,UAAU,CA4Md"}

package/dist/esm/runtime/domain-module.shared.definitions.d.ts

@@ -36,6 +36,18 @@ export interface SharedSaaSModule extends SharedDomainModule {
         defaultProfile?: string;
         unavailabilityPolicy?: Partial<FeatureConfiguration['unavailabilityPolicy']>;
     };
+    /**
+     * Progression milestones this module owns.
+     *
+     * ⚠️ **Milestones need the ANALYTICS capability enabled to appear at all.** The frontend fetches
+     * milestone definitions only when analytics is on and returns an empty list otherwise, so with it
+     * off the definitions never arrive and the progression tracker renders nothing — declared
+     * correctly, and invisible.
+     *
+     * Enabling analytics with an EMPTY provider list is what lights up the internal progression plane
+     * without any telemetry leaving the application. That is the configuration to reach for when an
+     * application wants progression and not tracking.
+     */
     customMilestoneDefinitions?: MilestoneDefinition[];
     productDefinitions?: ProductDefinition[];
     /**
@@ -44,6 +56,19 @@ export interface SharedSaaSModule extends SharedDomainModule {
      * an "incomplete todos" count). Aggregated across modules by
      * `buildSharedSaaSModulesRegistry` and threaded into the app init config, so a
      * module owns its badge concern end-to-end with no app-level wiring.
+     *
+     * The framework ships NO badges of its own — every badge in an application is one that application
+     * declared.
+     *
+     * Two limits worth knowing before designing around one. A badge is scoped to a USER or to an
+     * ORGANIZATION and to nothing else; there is no application-wide scope. And a DERIVED badge is
+     * recomputed off the resource operation's own dispatch, so a change written by some other route
+     * does not move it — a client sees the corrected count on its next connection rather than
+     * immediately.
+     *
+     * A badge reference that does not resolve renders nothing, deliberately. The configuration
+     * verifier is what makes that loud: an unresolvable badge reference on a launcher item is reported
+     * when the application's navigation content is checked.
      */
     notificationBadgeDefinitions?: NotificationBadgeDefinition[];
 }

package/dist/esm/runtime/domain-module.shared.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain-module.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../src/runtime/domain-module.shared.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAiC,MAAM,+CAA+C,CAAC;AAKzH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EACV,2CAA2C,EAC3C,8CAA8C,EAC/C,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAE1F;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAChD;AAED,wBAAgB,wBAAwB,CACtC,GAAG,OAAO,EAAE,kBAAkB,EAAE,GAC/B,kBAAkB,CAYpB;AACD,8DAA8D;AAE9D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,wBAAwB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IAC/D,0BAA0B,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;KAC9E,CAAC;IACF,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACnD,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC;;;;;;OAMG;IACH,4BAA4B,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAC9D;AACD,4DAA4D;AAE5D,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sBAAsB,EAAE,8CAA8C,CAAC;IACvE,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;IAC9C,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,wBAAwB,EAAE,iCAAiC,EAAE,CAAC;IAC9D,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;IAC5E,0BAA0B,EAAE,mBAAmB,EAAE,CAAC;IAClD,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,4BAA4B,EAAE,2BAA2B,EAAE,CAAC;CAC7D;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,OAAO,EAAE,gBAAgB,EAAE,GAC7B,yBAAyB,CAgD3B;AAED,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,yBAAyB,GAClC,+BAA+B,GAAG,SAAS,CAuC7C"}
+{"version":3,"file":"domain-module.shared.definitions.d.ts","sourceRoot":"","sources":["../../../src/runtime/domain-module.shared.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAiC,MAAM,+CAA+C,CAAC;AAKzH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EACV,2CAA2C,EAC3C,8CAA8C,EAC/C,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAE1F;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAChD;AAED,wBAAgB,wBAAwB,CACtC,GAAG,OAAO,EAAE,kBAAkB,EAAE,GAC/B,kBAAkB,CAYpB;AACD,8DAA8D;AAE9D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,wBAAwB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IAC/D,0BAA0B,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;KAC9E,CAAC;IACF;;;;;;;;;;;OAWG;IACH,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACnD,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,4BAA4B,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAC9D;AACD,4DAA4D;AAE5D,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sBAAsB,EAAE,8CAA8C,CAAC;IACvE,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;IAC9C,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,wBAAwB,EAAE,iCAAiC,EAAE,CAAC;IAC9D,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;IAC5E,0BAA0B,EAAE,mBAAmB,EAAE,CAAC;IAClD,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,4BAA4B,EAAE,2BAA2B,EAAE,CAAC;CAC7D;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,OAAO,EAAE,gBAAgB,EAAE,GAC7B,yBAAyB,CAgD3B;AAED,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,yBAAyB,GAClC,+BAA+B,GAAG,SAAS,CAuC7C"}

package/dist/esm/runtime/domain-module.shared.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-module.shared.definitions.js","sourceRoot":"","sources":["../../../../src/runtime/domain-module.shared.definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,IAAI,iCAAiC,EAClE,2BAA2B,GAC5B,MAAM,+CAA+C,CAAC;AAwBvD,MAAM,UAAU,wBAAwB,CACtC,GAAG,OAA6B;IAEhC,OAAO;QACL,sBAAsB,EAAE,MAAM,CAAC,MAAM,CACnC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACgB;QAC/E,wBAAwB,EAAE,MAAM,CAAC,MAAM,CACrC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACtC;QAC3B,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AA8CD,MAAM,UAAU,8BAA8B,CAC5C,GAAG,OAA2B;IAE9B,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,GAAG,OAAO,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CACzC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAC7C,CAAC;IACnC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAC9C,EAAE,EACF,GAAG,OAAO;SACP,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;SACxE,MAAM,CAAC,OAAO,CAAC,CACsC,CAAC;IAC3D,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEnF,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC;SAChC,OAAO,EAAE;SACT,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,cAAc,CAAC;QACpE,EAAE,0BAA0B,EAAE,cAAc,CAAC;IAE/C,MAAM,0BAA0B,GAAG,kBAAkB,IAAI,cAAc,IAAI,uBAAuB;QAChG,CAAC,CAAC;YACE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;YAChE,cAAc;YACd,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS;SACvF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAC/B,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAC/B,CAAC;IAExB,OAAO;QACL,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;aAC5C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnC,sBAAsB,EAAE,CAAC,kBAAkB,CAAC,sBAAsB,IAAI,EAAE,CAAmD;QAC3H,wBAAwB,EAAE,kBAAkB,CAAC,wBAAwB,IAAI,EAAE;QAC3E,qBAAqB,EAAE,kBAAkB,CAAC,qBAAqB,IAAI,EAAE;QACrE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC1E,wBAAwB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;QAC5F,0BAA0B;QAC1B,0BAA0B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAChG,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAChF,4BAA4B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,4BAA4B,IAAI,EAAE,CAAC;KACrG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,QAAmC;IAEnC,MAAM,cAAc,GAAG,QAAQ,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC;WACrE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;WAC/E,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAE7F,MAAM,4BAA4B,GAA6D,SAAS;QACtG,CAAC,CAAC;YACE,eAAe,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,eAAe;mBACtF,iCAAiC,CAAC,cAAc;YACrD,mBAAmB,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,mBAAmB;mBAC9F,iCAAiC,CAAC,IAAI;YAC3C,YAAY,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,YAAY,IAAI,EAAE;YAC3F,cAAc,EAAE;gBACd,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAC/C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;uBACzH,iCAAiC,CAAC,cAAc;gBACrD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAC1C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,cAAc,CAAC;uBACpH,iCAAiC,CAAC,oBAAoB;gBAC3D,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAC1C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,cAAc,CAAC;uBACpH,iCAAiC,CAAC,IAAI;aAC5C;SACF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS;QAC3E,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;QACjF,cAAc,EAAE,QAAQ,CAAC,0BAA0B,EAAE,cAAc;QACnE,oBAAoB,EAAE,4BAA4B;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import type { ProductDefinition } from '../billing/product-definition.shared.schemas';\nimport type { FeatureConfiguration, FeatureUnavailabilityBehavior } from '../features/feature-definition.shared.schemas';\nimport {\n  FeatureUnavailabilityBehavior as FeatureUnavailabilityBehaviorEnum,\n  FeatureUnavailabilityReason,\n} from '../features/feature-definition.shared.schemas';\nimport type { FeatureDefinitionWithAutoRegister } from '../features/feature-builders.shared';\nimport type { CustomFeatureConfigurationInput } from '../features/feature-registry.shared';\nimport type { ScopeFeatures } from '../features/scope-features.shared.schemas';\nimport type { MilestoneDefinition } from '../guidance/milestone-definition.shared.schemas';\nimport type { NotificationBadgeDefinition } from '../notifications/notification-badges.schemas';\nimport type {\n  ResourceConfiguration_InitializationFactory,\n  ResourceConfiguration_InitializationFactoryMap,\n} from '../resources/resources-config.shared.schemas';\nimport type { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport type { RolesConfiguration } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.shared-domain-module facet:layer:shared facet:family:module\n *\n * Cross-runtime module slice: resource factories, field identifiers, and relationship declarations merged across packages.\n */\nexport interface SharedDomainModule {\n  resourceConfigurations?: Record<string, ResourceConfiguration_InitializationFactory<any, any, any>>;\n  resourceFieldIdentifiers?: Record<string, string>;\n  resourceRelationships?: ResourceRelationship[];\n}\n\nexport function mergeSharedDomainModules(\n  ...modules: SharedDomainModule[]\n): SharedDomainModule {\n  return {\n    resourceConfigurations: Object.assign(\n      {},\n      ...modules.map(m => m.resourceConfigurations).filter(Boolean),\n    ) as Record<string, ResourceConfiguration_InitializationFactory<any, any, any>>,\n    resourceFieldIdentifiers: Object.assign(\n      {},\n      ...modules.map(m => m.resourceFieldIdentifiers).filter(Boolean),\n    ) as Record<string, string>,\n    resourceRelationships: modules.flatMap(m => m.resourceRelationships ?? []),\n  };\n}\n/** @wildo_source:part:end saas.models.shared-domain-module */\n\nexport type ApplicationModuleKind = 'domain' | 'engine';\n\n/**\n * @wildo_source:part:start saas.models.shared-saas-module facet:layer:shared facet:family:module\n *\n * App module contract: id, kind, roles, feature/milestone/product/notification-badge definition hooks layered on shared resources.\n */\nexport interface SharedSaaSModule extends SharedDomainModule {\n  moduleId: string;\n  kind?: ApplicationModuleKind;\n  customRoles?: RolesConfiguration;\n  customFeatureDefinitions?: FeatureDefinitionWithAutoRegister[];\n  customFeatureConfiguration?: {\n    profiles?: Record<string, ScopeFeatures>;\n    defaultProfile?: string;\n    unavailabilityPolicy?: Partial<FeatureConfiguration['unavailabilityPolicy']>;\n  };\n  customMilestoneDefinitions?: MilestoneDefinition[];\n  productDefinitions?: ProductDefinition[];\n  /**\n   * Notification badge definitions owned by this module (a module declares the\n   * badges derived from / driven by its own resources — e.g. a tasks module owns\n   * an \"incomplete todos\" count). Aggregated across modules by\n   * `buildSharedSaaSModulesRegistry` and threaded into the app init config, so a\n   * module owns its badge concern end-to-end with no app-level wiring.\n   */\n  notificationBadgeDefinitions?: NotificationBadgeDefinition[];\n}\n/** @wildo_source:part:end saas.models.shared-saas-module */\n\nexport interface SharedSaaSModulesRegistry {\n  moduleIds: string[];\n  resourceConfigurations: ResourceConfiguration_InitializationFactoryMap;\n  resourceFieldIdentifiers: Record<string, string>;\n  resourceRelationships: ResourceRelationship[];\n  customRoles?: RolesConfiguration;\n  customFeatureDefinitions: FeatureDefinitionWithAutoRegister[];\n  customFeatureConfiguration?: SharedSaaSModule['customFeatureConfiguration'];\n  customMilestoneDefinitions: MilestoneDefinition[];\n  productDefinitions: ProductDefinition[];\n  notificationBadgeDefinitions: NotificationBadgeDefinition[];\n}\n\nexport function buildSharedSaaSModulesRegistry(\n  ...modules: SharedSaaSModule[]\n): SharedSaaSModulesRegistry {\n  const mergedSharedModule = mergeSharedDomainModules(...modules);\n  const mergedFeatureProfiles = Object.assign(\n    {},\n    ...modules.map((module) => module.customFeatureConfiguration?.profiles ?? {}),\n  ) as Record<string, ScopeFeatures>;\n  const hasFeatureProfiles = Object.keys(mergedFeatureProfiles).length > 0;\n\n  const mergedUnavailabilityPolicy = Object.assign(\n    {},\n    ...modules\n      .map((module) => module.customFeatureConfiguration?.unavailabilityPolicy)\n      .filter(Boolean),\n  ) as Partial<FeatureConfiguration['unavailabilityPolicy']>;\n  const hasUnavailabilityPolicy = Object.keys(mergedUnavailabilityPolicy).length > 0;\n\n  const defaultProfile = [...modules]\n    .reverse()\n    .find((module) => module.customFeatureConfiguration?.defaultProfile)\n    ?.customFeatureConfiguration?.defaultProfile;\n\n  const customFeatureConfiguration = hasFeatureProfiles || defaultProfile || hasUnavailabilityPolicy\n    ? {\n        profiles: hasFeatureProfiles ? mergedFeatureProfiles : undefined,\n        defaultProfile,\n        unavailabilityPolicy: hasUnavailabilityPolicy ? mergedUnavailabilityPolicy : undefined,\n      }\n    : undefined;\n\n  const mergedRoles = Object.assign(\n    {},\n    ...modules.map((module) => module.customRoles ?? {}),\n  ) as RolesConfiguration;\n\n  return {\n    moduleIds: modules\n      .filter((module) => module.kind !== 'engine')\n      .map((module) => module.moduleId),\n    resourceConfigurations: (mergedSharedModule.resourceConfigurations ?? {}) as ResourceConfiguration_InitializationFactoryMap,\n    resourceFieldIdentifiers: mergedSharedModule.resourceFieldIdentifiers ?? {},\n    resourceRelationships: mergedSharedModule.resourceRelationships ?? [],\n    customRoles: Object.keys(mergedRoles).length > 0 ? mergedRoles : undefined,\n    customFeatureDefinitions: modules.flatMap((module) => module.customFeatureDefinitions ?? []),\n    customFeatureConfiguration,\n    customMilestoneDefinitions: modules.flatMap((module) => module.customMilestoneDefinitions ?? []),\n    productDefinitions: modules.flatMap((module) => module.productDefinitions ?? []),\n    notificationBadgeDefinitions: modules.flatMap((module) => module.notificationBadgeDefinitions ?? []),\n  };\n}\n\nexport function buildFrontendFeatureConfigurationInput(\n  registry: SharedSaaSModulesRegistry,\n): CustomFeatureConfigurationInput | undefined {\n  const hasDefinitions = registry.customFeatureDefinitions.length > 0;\n  const hasProfiles = Boolean(registry.customFeatureConfiguration?.profiles)\n    && Object.keys(registry.customFeatureConfiguration?.profiles ?? {}).length > 0;\n  const hasDefaultProfile = Boolean(registry.customFeatureConfiguration?.defaultProfile);\n  const hasPolicy = Boolean(registry.customFeatureConfiguration?.unavailabilityPolicy)\n    && Object.keys(registry.customFeatureConfiguration?.unavailabilityPolicy ?? {}).length > 0;\n\n  const resolvedUnavailabilityPolicy: FeatureConfiguration['unavailabilityPolicy'] | undefined = hasPolicy\n    ? {\n        defaultBehavior: registry.customFeatureConfiguration?.unavailabilityPolicy?.defaultBehavior\n          ?? FeatureUnavailabilityBehaviorEnum.UPGRADE_PROMPT,\n        whenBillingDisabled: registry.customFeatureConfiguration?.unavailabilityPolicy?.whenBillingDisabled\n          ?? FeatureUnavailabilityBehaviorEnum.HIDE,\n        roleDefaults: registry.customFeatureConfiguration?.unavailabilityPolicy?.roleDefaults ?? {},\n        reasonDefaults: {\n          [FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]\n            ?? FeatureUnavailabilityBehaviorEnum.UPGRADE_PROMPT,\n          [FeatureUnavailabilityReason.LIMIT_EXCEEDED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.LIMIT_EXCEEDED]\n            ?? FeatureUnavailabilityBehaviorEnum.LIMIT_UPGRADE_PROMPT,\n          [FeatureUnavailabilityReason.NOT_CONFIGURED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.NOT_CONFIGURED]\n            ?? FeatureUnavailabilityBehaviorEnum.HIDE,\n        },\n      }\n    : undefined;\n\n  if (!hasDefinitions && !hasProfiles && !hasDefaultProfile && !hasPolicy) {\n    return undefined;\n  }\n\n  return {\n    definitions: hasDefinitions ? registry.customFeatureDefinitions : undefined,\n    profiles: hasProfiles ? registry.customFeatureConfiguration?.profiles : undefined,\n    defaultProfile: registry.customFeatureConfiguration?.defaultProfile,\n    unavailabilityPolicy: resolvedUnavailabilityPolicy,\n  };\n}\n"]}
+{"version":3,"file":"domain-module.shared.definitions.js","sourceRoot":"","sources":["../../../src/runtime/domain-module.shared.definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,IAAI,iCAAiC,EAClE,2BAA2B,GAC5B,MAAM,+CAA+C,CAAC;AAwBvD,MAAM,UAAU,wBAAwB,CACtC,GAAG,OAA6B;IAEhC,OAAO;QACL,sBAAsB,EAAE,MAAM,CAAC,MAAM,CACnC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACgB;QAC/E,wBAAwB,EAAE,MAAM,CAAC,MAAM,CACrC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACtC;QAC3B,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAuED,MAAM,UAAU,8BAA8B,CAC5C,GAAG,OAA2B;IAE9B,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,GAAG,OAAO,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CACzC,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAC7C,CAAC;IACnC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAC9C,EAAE,EACF,GAAG,OAAO;SACP,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;SACxE,MAAM,CAAC,OAAO,CAAC,CACsC,CAAC;IAC3D,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEnF,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC;SAChC,OAAO,EAAE;SACT,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,cAAc,CAAC;QACpE,EAAE,0BAA0B,EAAE,cAAc,CAAC;IAE/C,MAAM,0BAA0B,GAAG,kBAAkB,IAAI,cAAc,IAAI,uBAAuB;QAChG,CAAC,CAAC;YACE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;YAChE,cAAc;YACd,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS;SACvF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAC/B,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAC/B,CAAC;IAExB,OAAO;QACL,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;aAC5C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnC,sBAAsB,EAAE,CAAC,kBAAkB,CAAC,sBAAsB,IAAI,EAAE,CAAmD;QAC3H,wBAAwB,EAAE,kBAAkB,CAAC,wBAAwB,IAAI,EAAE;QAC3E,qBAAqB,EAAE,kBAAkB,CAAC,qBAAqB,IAAI,EAAE;QACrE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC1E,wBAAwB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;QAC5F,0BAA0B;QAC1B,0BAA0B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAChG,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAChF,4BAA4B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,4BAA4B,IAAI,EAAE,CAAC;KACrG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,QAAmC;IAEnC,MAAM,cAAc,GAAG,QAAQ,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC;WACrE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;WAC/E,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAE7F,MAAM,4BAA4B,GAA6D,SAAS;QACtG,CAAC,CAAC;YACE,eAAe,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,eAAe;mBACtF,iCAAiC,CAAC,cAAc;YACrD,mBAAmB,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,mBAAmB;mBAC9F,iCAAiC,CAAC,IAAI;YAC3C,YAAY,EAAE,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,YAAY,IAAI,EAAE;YAC3F,cAAc,EAAE;gBACd,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAC/C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;uBACzH,iCAAiC,CAAC,cAAc;gBACrD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAC1C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,cAAc,CAAC;uBACpH,iCAAiC,CAAC,oBAAoB;gBAC3D,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAC1C,QAAQ,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,cAAc,CAAC;uBACpH,iCAAiC,CAAC,IAAI;aAC5C;SACF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS;QAC3E,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;QACjF,cAAc,EAAE,QAAQ,CAAC,0BAA0B,EAAE,cAAc;QACnE,oBAAoB,EAAE,4BAA4B;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import type { ProductDefinition } from '../billing/product-definition.shared.schemas';\nimport type { FeatureConfiguration, FeatureUnavailabilityBehavior } from '../features/feature-definition.shared.schemas';\nimport {\n  FeatureUnavailabilityBehavior as FeatureUnavailabilityBehaviorEnum,\n  FeatureUnavailabilityReason,\n} from '../features/feature-definition.shared.schemas';\nimport type { FeatureDefinitionWithAutoRegister } from '../features/feature-builders.shared';\nimport type { CustomFeatureConfigurationInput } from '../features/feature-registry.shared';\nimport type { ScopeFeatures } from '../features/scope-features.shared.schemas';\nimport type { MilestoneDefinition } from '../guidance/milestone-definition.shared.schemas';\nimport type { NotificationBadgeDefinition } from '../notifications/notification-badges.schemas';\nimport type {\n  ResourceConfiguration_InitializationFactory,\n  ResourceConfiguration_InitializationFactoryMap,\n} from '../resources/resources-config.shared.schemas';\nimport type { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport type { RolesConfiguration } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.shared-domain-module facet:layer:shared facet:family:module\n *\n * Cross-runtime module slice: resource factories, field identifiers, and relationship declarations merged across packages.\n */\nexport interface SharedDomainModule {\n  resourceConfigurations?: Record<string, ResourceConfiguration_InitializationFactory<any, any, any>>;\n  resourceFieldIdentifiers?: Record<string, string>;\n  resourceRelationships?: ResourceRelationship[];\n}\n\nexport function mergeSharedDomainModules(\n  ...modules: SharedDomainModule[]\n): SharedDomainModule {\n  return {\n    resourceConfigurations: Object.assign(\n      {},\n      ...modules.map(m => m.resourceConfigurations).filter(Boolean),\n    ) as Record<string, ResourceConfiguration_InitializationFactory<any, any, any>>,\n    resourceFieldIdentifiers: Object.assign(\n      {},\n      ...modules.map(m => m.resourceFieldIdentifiers).filter(Boolean),\n    ) as Record<string, string>,\n    resourceRelationships: modules.flatMap(m => m.resourceRelationships ?? []),\n  };\n}\n/** @wildo_source:part:end saas.models.shared-domain-module */\n\nexport type ApplicationModuleKind = 'domain' | 'engine';\n\n/**\n * @wildo_source:part:start saas.models.shared-saas-module facet:layer:shared facet:family:module\n *\n * App module contract: id, kind, roles, feature/milestone/product/notification-badge definition hooks layered on shared resources.\n */\nexport interface SharedSaaSModule extends SharedDomainModule {\n  moduleId: string;\n  kind?: ApplicationModuleKind;\n  customRoles?: RolesConfiguration;\n  customFeatureDefinitions?: FeatureDefinitionWithAutoRegister[];\n  customFeatureConfiguration?: {\n    profiles?: Record<string, ScopeFeatures>;\n    defaultProfile?: string;\n    unavailabilityPolicy?: Partial<FeatureConfiguration['unavailabilityPolicy']>;\n  };\n  /**\n   * Progression milestones this module owns.\n   *\n   * ⚠️ **Milestones need the ANALYTICS capability enabled to appear at all.** The frontend fetches\n   * milestone definitions only when analytics is on and returns an empty list otherwise, so with it\n   * off the definitions never arrive and the progression tracker renders nothing — declared\n   * correctly, and invisible.\n   *\n   * Enabling analytics with an EMPTY provider list is what lights up the internal progression plane\n   * without any telemetry leaving the application. That is the configuration to reach for when an\n   * application wants progression and not tracking.\n   */\n  customMilestoneDefinitions?: MilestoneDefinition[];\n  productDefinitions?: ProductDefinition[];\n  /**\n   * Notification badge definitions owned by this module (a module declares the\n   * badges derived from / driven by its own resources — e.g. a tasks module owns\n   * an \"incomplete todos\" count). Aggregated across modules by\n   * `buildSharedSaaSModulesRegistry` and threaded into the app init config, so a\n   * module owns its badge concern end-to-end with no app-level wiring.\n   *\n   * The framework ships NO badges of its own — every badge in an application is one that application\n   * declared.\n   *\n   * Two limits worth knowing before designing around one. A badge is scoped to a USER or to an\n   * ORGANIZATION and to nothing else; there is no application-wide scope. And a DERIVED badge is\n   * recomputed off the resource operation's own dispatch, so a change written by some other route\n   * does not move it — a client sees the corrected count on its next connection rather than\n   * immediately.\n   *\n   * A badge reference that does not resolve renders nothing, deliberately. The configuration\n   * verifier is what makes that loud: an unresolvable badge reference on a launcher item is reported\n   * when the application's navigation content is checked.\n   */\n  notificationBadgeDefinitions?: NotificationBadgeDefinition[];\n}\n/** @wildo_source:part:end saas.models.shared-saas-module */\n\nexport interface SharedSaaSModulesRegistry {\n  moduleIds: string[];\n  resourceConfigurations: ResourceConfiguration_InitializationFactoryMap;\n  resourceFieldIdentifiers: Record<string, string>;\n  resourceRelationships: ResourceRelationship[];\n  customRoles?: RolesConfiguration;\n  customFeatureDefinitions: FeatureDefinitionWithAutoRegister[];\n  customFeatureConfiguration?: SharedSaaSModule['customFeatureConfiguration'];\n  customMilestoneDefinitions: MilestoneDefinition[];\n  productDefinitions: ProductDefinition[];\n  notificationBadgeDefinitions: NotificationBadgeDefinition[];\n}\n\nexport function buildSharedSaaSModulesRegistry(\n  ...modules: SharedSaaSModule[]\n): SharedSaaSModulesRegistry {\n  const mergedSharedModule = mergeSharedDomainModules(...modules);\n  const mergedFeatureProfiles = Object.assign(\n    {},\n    ...modules.map((module) => module.customFeatureConfiguration?.profiles ?? {}),\n  ) as Record<string, ScopeFeatures>;\n  const hasFeatureProfiles = Object.keys(mergedFeatureProfiles).length > 0;\n\n  const mergedUnavailabilityPolicy = Object.assign(\n    {},\n    ...modules\n      .map((module) => module.customFeatureConfiguration?.unavailabilityPolicy)\n      .filter(Boolean),\n  ) as Partial<FeatureConfiguration['unavailabilityPolicy']>;\n  const hasUnavailabilityPolicy = Object.keys(mergedUnavailabilityPolicy).length > 0;\n\n  const defaultProfile = [...modules]\n    .reverse()\n    .find((module) => module.customFeatureConfiguration?.defaultProfile)\n    ?.customFeatureConfiguration?.defaultProfile;\n\n  const customFeatureConfiguration = hasFeatureProfiles || defaultProfile || hasUnavailabilityPolicy\n    ? {\n        profiles: hasFeatureProfiles ? mergedFeatureProfiles : undefined,\n        defaultProfile,\n        unavailabilityPolicy: hasUnavailabilityPolicy ? mergedUnavailabilityPolicy : undefined,\n      }\n    : undefined;\n\n  const mergedRoles = Object.assign(\n    {},\n    ...modules.map((module) => module.customRoles ?? {}),\n  ) as RolesConfiguration;\n\n  return {\n    moduleIds: modules\n      .filter((module) => module.kind !== 'engine')\n      .map((module) => module.moduleId),\n    resourceConfigurations: (mergedSharedModule.resourceConfigurations ?? {}) as ResourceConfiguration_InitializationFactoryMap,\n    resourceFieldIdentifiers: mergedSharedModule.resourceFieldIdentifiers ?? {},\n    resourceRelationships: mergedSharedModule.resourceRelationships ?? [],\n    customRoles: Object.keys(mergedRoles).length > 0 ? mergedRoles : undefined,\n    customFeatureDefinitions: modules.flatMap((module) => module.customFeatureDefinitions ?? []),\n    customFeatureConfiguration,\n    customMilestoneDefinitions: modules.flatMap((module) => module.customMilestoneDefinitions ?? []),\n    productDefinitions: modules.flatMap((module) => module.productDefinitions ?? []),\n    notificationBadgeDefinitions: modules.flatMap((module) => module.notificationBadgeDefinitions ?? []),\n  };\n}\n\nexport function buildFrontendFeatureConfigurationInput(\n  registry: SharedSaaSModulesRegistry,\n): CustomFeatureConfigurationInput | undefined {\n  const hasDefinitions = registry.customFeatureDefinitions.length > 0;\n  const hasProfiles = Boolean(registry.customFeatureConfiguration?.profiles)\n    && Object.keys(registry.customFeatureConfiguration?.profiles ?? {}).length > 0;\n  const hasDefaultProfile = Boolean(registry.customFeatureConfiguration?.defaultProfile);\n  const hasPolicy = Boolean(registry.customFeatureConfiguration?.unavailabilityPolicy)\n    && Object.keys(registry.customFeatureConfiguration?.unavailabilityPolicy ?? {}).length > 0;\n\n  const resolvedUnavailabilityPolicy: FeatureConfiguration['unavailabilityPolicy'] | undefined = hasPolicy\n    ? {\n        defaultBehavior: registry.customFeatureConfiguration?.unavailabilityPolicy?.defaultBehavior\n          ?? FeatureUnavailabilityBehaviorEnum.UPGRADE_PROMPT,\n        whenBillingDisabled: registry.customFeatureConfiguration?.unavailabilityPolicy?.whenBillingDisabled\n          ?? FeatureUnavailabilityBehaviorEnum.HIDE,\n        roleDefaults: registry.customFeatureConfiguration?.unavailabilityPolicy?.roleDefaults ?? {},\n        reasonDefaults: {\n          [FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]\n            ?? FeatureUnavailabilityBehaviorEnum.UPGRADE_PROMPT,\n          [FeatureUnavailabilityReason.LIMIT_EXCEEDED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.LIMIT_EXCEEDED]\n            ?? FeatureUnavailabilityBehaviorEnum.LIMIT_UPGRADE_PROMPT,\n          [FeatureUnavailabilityReason.NOT_CONFIGURED]:\n            registry.customFeatureConfiguration?.unavailabilityPolicy?.reasonDefaults?.[FeatureUnavailabilityReason.NOT_CONFIGURED]\n            ?? FeatureUnavailabilityBehaviorEnum.HIDE,\n        },\n      }\n    : undefined;\n\n  if (!hasDefinitions && !hasProfiles && !hasDefaultProfile && !hasPolicy) {\n    return undefined;\n  }\n\n  return {\n    definitions: hasDefinitions ? registry.customFeatureDefinitions : undefined,\n    profiles: hasProfiles ? registry.customFeatureConfiguration?.profiles : undefined,\n    defaultProfile: registry.customFeatureConfiguration?.defaultProfile,\n    unavailabilityPolicy: resolvedUnavailabilityPolicy,\n  };\n}\n"]}

package/dist/esm/runtime/execution-context.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/runtime/execution-context.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E;;;;;;;;;GASG;AACH,oBAAY,8BAA8B;IACtC;;;;;;;OAOG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAC3C,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,4BAA4B,iCAAiC;IAC7D,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CAC1C;AAED;;;;;GAKG;AACH,oBAAY,iBAAiB;IACzB,oFAAoF;IACpF,OAAO,YAAY;IACnB;;;;OAIG;IACH,YAAY,iBAAiB;CAChC;AAED,oBAAY,uCAAuC;IAC/C,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CAC1C;AAED;;GAEG;AACH,oBAAY,WAAW;IACrB,UAAU,eAAe;IACzB,OAAO,YAAY;CACpB;AAEC;;GAEG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC;;;iBAKnD,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,mCAAmC;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAIlG;;GAEG;AAGH,eAAO,MAAM,+BAA+B;;;;;iBAoBxC,CAAC;AAEL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAEvF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAEtH;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,GAC/D;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,CAInD;AAGD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0CAA0C;;;;;iBAkBrD,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}
+{"version":3,"file":"execution-context.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/runtime/execution-context.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E;;;;;;;;;GASG;AACH,oBAAY,8BAA8B;IACtC;;;;;;;OAOG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAC3C,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,4BAA4B,iCAAiC;IAC7D,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CAC1C;AAED;;;;;GAKG;AACH,oBAAY,iBAAiB;IACzB,oFAAoF;IACpF,OAAO,YAAY;IACnB;;;;OAIG;IACH,YAAY,iBAAiB;CAChC;AAED,oBAAY,uCAAuC;IAC/C,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CAC1C;AAED;;GAEG;AACH,oBAAY,WAAW;IACrB,UAAU,eAAe;IACzB,OAAO,YAAY;CACpB;AAEC;;GAEG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC;;;iBAKnD,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,mCAAmC;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAIlG;;GAEG;AAGH,eAAO,MAAM,+BAA+B;;;;;iBAoBxC,CAAC;AAEL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAEvF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAEtH;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,GAC/D;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,CAInD;AAGD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0CAA0C;;;;;iBAkBrD,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts

@@ -15,6 +15,7 @@ export declare enum AppApiKeys_Operations {
     DEACTIVATE = "deactivate",// Deactivate key
     REACTIVATE = "reactivate",// Reactivate key
     EXTEND_EXPIRY = "extend_expiry",// Extend expiration date
+    EXPIRE = "expire",// ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)
     USAGE_STATS = "usage_stats"
 }
 type AppApiKeysCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE;

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAmRlH,CAAC"}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAyTlH,CAAC"}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js

@@ -31,6 +31,7 @@ export var AppApiKeys_Operations;
     AppApiKeys_Operations["DEACTIVATE"] = "deactivate";
     AppApiKeys_Operations["REACTIVATE"] = "reactivate";
     AppApiKeys_Operations["EXTEND_EXPIRY"] = "extend_expiry";
+    AppApiKeys_Operations["EXPIRE"] = "expire";
     AppApiKeys_Operations["USAGE_STATS"] = "usage_stats";
 })(AppApiKeys_Operations || (AppApiKeys_Operations = {}));
 /*
@@ -254,6 +255,43 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 }
             ]
         },
+        /**
+         * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed
+         * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:
+         * the sweep is the only caller.
+         *
+         * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and
+         * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare
+         * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the
+         * hazard DEACTIVATE documents at length — with no route there is no request contract to
+         * auto-derive and no `PUT .../expire` that could carry `status: active`.
+         *
+         * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a
+         * direct write would be a second authority over the field and would skip the ACTIVE-only
+         * precondition, which lives in the paired prefix implementation
+         * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an
+         * `enabledCondition` cannot be.
+         */
+        [AppApiKeys_Operations.EXPIRE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
+                    // and the paired prefix implementation forces the status transition itself, so there is no field
+                    // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without
+                    // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL
+                    // that accepts nothing advertise every field — `status` included, the one field this verb owns.
+                    requestDto: z.object({}),
+                }
+            ],
+            // No notification: expiry is the scheduled consequence of a date the administrator set, not
+            // an event. The signal that would be worth sending — a key ABOUT to expire — is a different
+            // feature and is not this one.
+        },
         [AppApiKeys_Operations.EXTEND_EXPIRY]: {
             variants: [
                 {

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,kDAAkD;AAElD,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAEhH,kDAAkD;AAClD,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,oDAA2B,CAAA;AAC7B,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAE1E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,8EAA8E;QAC9E,gFAAgF;QAChF,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,iEAAiE;QACjE,8EAA8E;QAC9E,yEAAyE;QACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application API Keys Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within applications.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyApplicationSchema,\n  ApiKeyStatus\n} from './api-keys.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application API keys\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_API_KEYS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  hasExpiration: z.boolean(),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_API_KEYS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application API keys\nexport enum AppApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype AppApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication API Keys Resource Configuration Factory\n*/\nexport const appApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppApiKeys_Operations,\n  AppApiKeysCoreOperations,\n  typeof ApiKeyApplicationSchema\n>({\n  mainSchema: ApiKeyApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so key rows are physically removed when their owning\n    // application is deleted. Without it the cascade throws ErrorType.CONFIGURATION\n    // on any application that still has API-key rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so API-key rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has key rows. Super-admin/HIGH: the app API-key admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [AppApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        }\n      ]\n    }\n  },\n});\n"]}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,kDAAkD;AAElD,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAEhH,kDAAkD;AAClD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAE1E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,8EAA8E;QAC9E,gFAAgF;QAChF,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,iEAAiE;QACjE,8EAA8E;QAC9E,yEAAyE;QACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application API Keys Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within applications.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyApplicationSchema,\n  ApiKeyStatus\n} from './api-keys.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application API keys\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_API_KEYS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  hasExpiration: z.boolean(),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_API_KEYS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application API keys\nexport enum AppApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype AppApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication API Keys Resource Configuration Factory\n*/\nexport const appApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppApiKeys_Operations,\n  AppApiKeysCoreOperations,\n  typeof ApiKeyApplicationSchema\n>({\n  mainSchema: ApiKeyApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so key rows are physically removed when their owning\n    // application is deleted. Without it the cascade throws ErrorType.CONFIGURATION\n    // on any application that still has API-key rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so API-key rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has key rows. Super-admin/HIGH: the app API-key admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [AppApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller.\n     *\n     * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n     * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n     * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n     * hazard DEACTIVATE documents at length — with no route there is no request contract to\n     * auto-derive and no `PUT .../expire` that could carry `status: active`.\n     *\n     * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n     * direct write would be a second authority over the field and would skip the ACTIVE-only\n     * precondition, which lives in the paired prefix implementation\n     * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n     * `enabledCondition` cannot be.\n     */\n    [AppApiKeys_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n      // No notification: expiry is the scheduled consequence of a date the administrator set, not\n      // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n      // feature and is not this one.\n    },\n\n    [AppApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        }\n      ]\n    }\n  },\n});\n"]}

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.d.ts

@@ -15,6 +15,7 @@ export declare enum OrgApiKeys_Operations {
     DEACTIVATE = "deactivate",// Deactivate key
     REACTIVATE = "reactivate",// Reactivate key
     EXTEND_EXPIRY = "extend_expiry",// Extend expiration date
+    EXPIRE = "expire",// ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)
     USAGE_STATS = "usage_stats"
 }
 type OrgApiKeysCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE | CoreResourceOperation.COUNT;

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBA8elH,CAAC"}
+{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAohBlH,CAAC"}

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js

@@ -40,6 +40,7 @@ export var OrgApiKeys_Operations;
     OrgApiKeys_Operations["DEACTIVATE"] = "deactivate";
     OrgApiKeys_Operations["REACTIVATE"] = "reactivate";
     OrgApiKeys_Operations["EXTEND_EXPIRY"] = "extend_expiry";
+    OrgApiKeys_Operations["EXPIRE"] = "expire";
     OrgApiKeys_Operations["USAGE_STATS"] = "usage_stats";
 })(OrgApiKeys_Operations || (OrgApiKeys_Operations = {}));
 /*
@@ -406,6 +407,43 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 }
             ]
         },
+        /**
+         * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed
+         * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:
+         * the sweep is the only caller.
+         *
+         * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and
+         * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare
+         * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the
+         * hazard DEACTIVATE documents at length — with no route there is no request contract to
+         * auto-derive and no `PUT .../expire` that could carry `status: active`.
+         *
+         * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a
+         * direct write would be a second authority over the field and would skip the ACTIVE-only
+         * precondition, which lives in the paired prefix implementation
+         * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an
+         * `enabledCondition` cannot be.
+         */
+        [OrgApiKeys_Operations.EXPIRE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
+                    // and the paired prefix implementation forces the status transition itself, so there is no field
+                    // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without
+                    // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL
+                    // that accepts nothing advertise every field — `status` included, the one field this verb owns.
+                    requestDto: z.object({}),
+                }
+            ],
+            // No notification: expiry is the scheduled consequence of a date the administrator set, not
+            // an event. The signal that would be worth sending — a key ABOUT to expire — is a different
+            // feature and is not this one.
+        },
         [OrgApiKeys_Operations.EXTEND_EXPIRY]: {
             variants: [
                 {