@wildo-ai/saas-models 1.1.3 → 1.1.4

package/dist/esm/billing/product-behavior-policy.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"product-behavior-policy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/product-behavior-policy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAExC,sEAAsE;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,2DAA2D;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,0CAA0C;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC;CACzD,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,mFAAmF;IACnF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,0CAA0C;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC;;;;;;;;;;WAUG;QACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACjD,CAAC,CAAC,QAAQ,EAAE;IAEb,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,4EAA4E;QAC5E,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACjF,oDAAoD;QACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;KAC/D,CAAC,CAAC,QAAQ,EAAE;IAEb,yEAAyE;IACzE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACpE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KACnE,CAAC,CAAC,QAAQ,EAAE;IAEb,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,2DAA2D;QAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1C,oDAAoD;QACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAC5E,CAAC,CAAC,QAAQ,EAAE;IAEb;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB;;;;;;;;WAQG;QACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD;;;;;;;;;WASG;QACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,SAAS,CAAC;QACjG;;;;;;WAMG;QACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C;;;;;;WAMG;QACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC","sourcesContent":["/**\n * Product Behavior Policy & Limit Grant Schemas (Shared)\n *\n * Declarative configuration for how the billing provider and the engine\n * should handle product lifecycle (trial, proration, cancellation, metering).\n *\n * Also defines the LimitGrant schema that controls how product limits compose.\n *\n * @see billing-and-features-system.md §6.1 (LimitGrant), §6.1 (ProductBehaviorPolicy)\n */\n\nimport { z } from 'zod';\nimport {\n  LimitGrantMode,\n  ProrationBehavior,\n  BillingTiming,\n  MeteringAggregationWindow,\n} from './billing-enums.shared.schemas';\n\n// ── Limit Grant ────────────────────────────────────────────────────\n\n/**\n * A limit grant from a product.\n *\n * - SET mode: absolute value (replaces, used for PLAN base limits).\n *   Example: \"Professional plan gives you 50 projects.\"\n * - ADD mode: additive (stacks on top, used for ADDON bonus limits).\n *   Example: \"+10 extra projects.\"\n *\n * Aggregation algorithm in BillingFeatureSyncBackendService:\n *   1. Start with active PLAN's SET limits (only one active plan per billing account)\n *   2. For each active ADDON with ADD mode: sum onto current limit\n *   3. For each active ADDON with SET mode: take max(current, addon value)\n *   4. FEATURES_UNLIMITED always wins in any comparison\n */\nexport const LimitGrantSchema = z.object({\n  /** The limit value (count or -1 for FEATURES_UNLIMITED) */\n  value: z.number(),\n  /** How this grant composes with others */\n  mode: z.enum(LimitGrantMode).default(LimitGrantMode.SET),\n});\nexport type LimitGrant = z.infer<typeof LimitGrantSchema>;\n\n// ── Product Behavior Policy ────────────────────────────────────────\n\n/**\n * Declarative configuration for how the billing provider and the engine\n * should handle this product's lifecycle.\n *\n * This is the \"billing policy\" layer — NOT reimplementing provider logic,\n * but CONFIGURING the parameters that get passed to the provider's API.\n */\nexport const ProductBehaviorPolicySchema = z.object({\n  /** Trial configuration (overrides global BillingConfiguration.defaultTrialDays) */\n  trial: z.object({\n    /** Number of trial days (0 = no trial) */\n    days: z.number().min(0).default(0),\n    /**\n     * Require a payment method before the trial starts. READ since 2026-09-08 (#408).\n     *\n     * It reached no provider call before that, so a trial declared as requiring a card behaved\n     * identically to one that did not — Wonder Todos' enterprise plan (`true`) and professional\n     * plan (`false`) were indistinguishable at the provider.\n     *\n     * Only meaningful WITH a trial: a product declaring it alongside `days: 0` demands nothing,\n     * because asking for a card up front on a purchase with no trial is a different decision and\n     * nobody authored it.\n     */\n    requirePaymentMethod: z.boolean().default(false),\n  }).optional(),\n\n  /** Upgrade behavior (when switching TO this plan from a lower tier) */\n  upgrade: z.object({\n    /** Proration passed to provider: create_prorations, none, always_invoice */\n    proration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n    /** Apply immediately or at end of current period */\n    timing: z.enum(BillingTiming).default(BillingTiming.IMMEDIATE),\n  }).optional(),\n\n  /** Downgrade behavior (when switching FROM this plan to a lower tier) */\n  downgrade: z.object({\n    proration: z.enum(ProrationBehavior).default(ProrationBehavior.NONE),\n    timing: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).optional(),\n\n  /** Cancellation behavior for subscriptions on this product */\n  cancellation: z.object({\n    /** Allow immediate cancellation (vs only at period end) */\n    allowImmediate: z.boolean().default(false),\n    /** Default cancellation timing when user cancels */\n    defaultBehavior: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).optional(),\n\n  /**\n   * Authored metering policy (for METERED products only), READ by\n   * `UsageMeteringBackendService` since 2026-09-08 (#415).\n   *\n   * Every field here was declared, defaulted, documented and read by NOTHING until then: the flush\n   * merged every pending row by billing account and product whatever the product said, so\n   * `preFlushAggregation: false` was unrepresentable and `aggregationWindow`'s two members selected\n   * between behaviours that were the same behaviour. The note that stood here said exactly that and\n   * asked that the gap stay visible rather than become \"a false runtime guarantee\"; this replaces it\n   * because the guarantee is now real, and says which reader makes each field true.\n   */\n  metering: z.object({\n    /**\n     * How often to flush aggregated usage to the billing provider (minutes).\n     *\n     * Read by the engine's usage-flush batch, which picks the SHORTEST interval any metered product\n     * authors — a schedule is one thing and the products sharing it are many, so the fastest promise\n     * is the one that has to be kept. A product asking for less frequent reporting than its neighbour\n     * still gets reported at the neighbour's cadence, which costs nothing: reporting sooner than\n     * authored is never wrong, reporting later than authored is.\n     */\n    flushIntervalMinutes: z.number().min(1).default(60),\n    /**\n     * Whether one meter event may span a billing-period boundary.\n     *\n     * This is not a preference, it is a correctness choice about MONEY. A merged group carries ONE\n     * timestamp and the provider assigns the event to the period that timestamp falls in, so\n     * `PER_FLUSH` merging across a boundary bills the earlier period's usage into the later one.\n     * `PER_BILLING_PERIOD` splits at the boundary, derived from the subscription's own\n     * `currentPeriodStart` / `currentPeriodEnd`. Leave it `PER_FLUSH` when the product's periods do\n     * not change what it costs.\n     */\n    aggregationWindow: z.enum(MeteringAggregationWindow).default(MeteringAggregationWindow.PER_FLUSH),\n    /**\n     * Aggregate locally before sending (sum same-key records into one meter event).\n     *\n     * `false` sends one event per recorded row, each with its own instant. Choose it when the provider\n     * must see every event — because its aggregation is not a sum, or because the individual instants\n     * matter. Local merging destroys both irreversibly, before the provider ever sees them.\n     */\n    preFlushAggregation: z.boolean().default(true),\n    /**\n     * Retry policy when a provider report fails.\n     *\n     * Safe only because every meter event carries a derived idempotency identifier: a retry after a\n     * response lost in transit re-sends the same identifier and the provider discards it. Retrying\n     * without that is how a timeout becomes a double charge, which is why the two shipped together.\n     */\n    retryPolicy: z.object({\n      maxRetries: z.number().default(3),\n      backoffMultiplier: z.number().default(2),\n    }).default({ maxRetries: 3, backoffMultiplier: 2 }),\n  }).optional(),\n});\nexport type ProductBehaviorPolicy = z.infer<typeof ProductBehaviorPolicySchema>;\n"]}
+{"version":3,"file":"product-behavior-policy.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/product-behavior-policy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAExC,sEAAsE;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,2DAA2D;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,0CAA0C;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC;CACzD,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,mFAAmF;IACnF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,0CAA0C;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC;;;;;;;;;;WAUG;QACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACjD,CAAC,CAAC,QAAQ,EAAE;IAEb,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,4EAA4E;QAC5E,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACjF,oDAAoD;QACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC;KAC/D,CAAC,CAAC,QAAQ,EAAE;IAEb,yEAAyE;IACzE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACpE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KACnE,CAAC,CAAC,QAAQ,EAAE;IAEb,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,2DAA2D;QAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1C,oDAAoD;QACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAC5E,CAAC,CAAC,QAAQ,EAAE;IAEb;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB;;;;;;;;WAQG;QACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD;;;;;;;;;WASG;QACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,SAAS,CAAC;QACjG;;;;;;WAMG;QACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C;;;;;;WAMG;QACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC","sourcesContent":["/**\n * Product Behavior Policy & Limit Grant Schemas (Shared)\n *\n * Declarative configuration for how the billing provider and the engine\n * should handle product lifecycle (trial, proration, cancellation, metering).\n *\n * Also defines the LimitGrant schema that controls how product limits compose.\n *\n * @see billing-and-features-system.md §6.1 (LimitGrant), §6.1 (ProductBehaviorPolicy)\n */\n\nimport { z } from 'zod';\nimport {\n  LimitGrantMode,\n  ProrationBehavior,\n  BillingTiming,\n  MeteringAggregationWindow,\n} from './billing-enums.shared.schemas';\n\n// ── Limit Grant ────────────────────────────────────────────────────\n\n/**\n * A limit grant from a product.\n *\n * - SET mode: absolute value (replaces, used for PLAN base limits).\n *   Example: \"Professional plan gives you 50 projects.\"\n * - ADD mode: additive (stacks on top, used for ADDON bonus limits).\n *   Example: \"+10 extra projects.\"\n *\n * Aggregation algorithm in BillingFeatureSyncBackendService:\n *   1. Start with active PLAN's SET limits (only one active plan per billing account)\n *   2. For each active ADDON with ADD mode: sum onto current limit\n *   3. For each active ADDON with SET mode: take max(current, addon value)\n *   4. FEATURES_UNLIMITED always wins in any comparison\n */\nexport const LimitGrantSchema = z.object({\n  /** The limit value (count or -1 for FEATURES_UNLIMITED) */\n  value: z.number(),\n  /** How this grant composes with others */\n  mode: z.enum(LimitGrantMode).default(LimitGrantMode.SET),\n});\nexport type LimitGrant = z.infer<typeof LimitGrantSchema>;\n\n// ── Product Behavior Policy ────────────────────────────────────────\n\n/**\n * Declarative configuration for how the billing provider and the engine\n * should handle this product's lifecycle.\n *\n * This is the \"billing policy\" layer — NOT reimplementing provider logic,\n * but CONFIGURING the parameters that get passed to the provider's API.\n */\nexport const ProductBehaviorPolicySchema = z.object({\n  /** Trial configuration (overrides global BillingConfiguration.defaultTrialDays) */\n  trial: z.object({\n    /** Number of trial days (0 = no trial) */\n    days: z.number().min(0).default(0),\n    /**\n     * Require a payment method before the trial starts. READ since 2026-09-08 (#408).\n     *\n     * It reached no provider call before that, so a trial declared as requiring a card behaved\n     * identically to one that did not — Wonder Todos' enterprise plan (`true`) and professional\n     * plan (`false`) were indistinguishable at the provider.\n     *\n     * Only meaningful WITH a trial: a product declaring it alongside `days: 0` demands nothing,\n     * because asking for a card up front on a purchase with no trial is a different decision and\n     * nobody authored it.\n     */\n    requirePaymentMethod: z.boolean().default(false),\n  }).optional(),\n\n  /** Upgrade behavior (when switching TO this plan from a lower tier) */\n  upgrade: z.object({\n    /** Proration passed to provider: create_prorations, none, always_invoice */\n    proration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n    /** Apply immediately or at end of current period */\n    timing: z.enum(BillingTiming).default(BillingTiming.IMMEDIATE),\n  }).optional(),\n\n  /** Downgrade behavior (when switching FROM this plan to a lower tier) */\n  downgrade: z.object({\n    proration: z.enum(ProrationBehavior).default(ProrationBehavior.NONE),\n    timing: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).optional(),\n\n  /** Cancellation behavior for subscriptions on this product */\n  cancellation: z.object({\n    /** Allow immediate cancellation (vs only at period end) */\n    allowImmediate: z.boolean().default(false),\n    /** Default cancellation timing when user cancels */\n    defaultBehavior: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).optional(),\n\n  /**\n   * Authored metering policy (for METERED products only), READ by\n   * `UsageMeteringBackendService` since 2026-09-08 (#415).\n   *\n   * Every field here was declared, defaulted, documented and read by NOTHING until then: the flush\n   * merged every pending row by billing account and product whatever the product said, so\n   * `preFlushAggregation: false` was unrepresentable and `aggregationWindow`'s two members selected\n   * between behaviours that were the same behaviour. The note that stood here said exactly that and\n   * asked that the gap stay visible rather than become \"a false runtime guarantee\"; this replaces it\n   * because the guarantee is now real, and says which reader makes each field true.\n   */\n  metering: z.object({\n    /**\n     * How often to flush aggregated usage to the billing provider (minutes).\n     *\n     * Read by the engine's usage-flush batch, which picks the SHORTEST interval any metered product\n     * authors — a schedule is one thing and the products sharing it are many, so the fastest promise\n     * is the one that has to be kept. A product asking for less frequent reporting than its neighbour\n     * still gets reported at the neighbour's cadence, which costs nothing: reporting sooner than\n     * authored is never wrong, reporting later than authored is.\n     */\n    flushIntervalMinutes: z.number().min(1).default(60),\n    /**\n     * Whether one meter event may span a billing-period boundary.\n     *\n     * This is not a preference, it is a correctness choice about MONEY. A merged group carries ONE\n     * timestamp and the provider assigns the event to the period that timestamp falls in, so\n     * `PER_FLUSH` merging across a boundary bills the earlier period's usage into the later one.\n     * `PER_BILLING_PERIOD` splits at the boundary, derived from the subscription's own\n     * `currentPeriodStart` / `currentPeriodEnd`. Leave it `PER_FLUSH` when the product's periods do\n     * not change what it costs.\n     */\n    aggregationWindow: z.enum(MeteringAggregationWindow).default(MeteringAggregationWindow.PER_FLUSH),\n    /**\n     * Aggregate locally before sending (sum same-key records into one meter event).\n     *\n     * `false` sends one event per recorded row, each with its own instant. Choose it when the provider\n     * must see every event — because its aggregation is not a sum, or because the individual instants\n     * matter. Local merging destroys both irreversibly, before the provider ever sees them.\n     */\n    preFlushAggregation: z.boolean().default(true),\n    /**\n     * Retry policy when a provider report fails.\n     *\n     * Safe only because every meter event carries a derived idempotency identifier: a retry after a\n     * response lost in transit re-sends the same identifier and the provider discards it. Retrying\n     * without that is how a timeout becomes a double charge, which is why the two shipped together.\n     */\n    retryPolicy: z.object({\n      maxRetries: z.number().default(3),\n      backoffMultiplier: z.number().default(2),\n    }).default({ maxRetries: 3, backoffMultiplier: 2 }),\n  }).optional(),\n});\nexport type ProductBehaviorPolicy = z.infer<typeof ProductBehaviorPolicySchema>;\n"]}

package/dist/esm/billing/product-definition.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"product-definition.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/product-definition.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,cAAc,EACf,MAAM,gCAAgC,CAAC;AAMxC;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;iBAuBhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2ElC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"product-definition.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/product-definition.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,cAAc,EACf,MAAM,gCAAgC,CAAC;AAMxC;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;iBAuBhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2ElC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/esm/billing/product.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"product.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/product.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAI/C,KAAK,eAAe,GAChB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,mDAAmD,GAC9D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAkE9C,CAAC"}
+{"version":3,"file":"product.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/product.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAI/C,KAAK,eAAe,GAChB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,mDAAmD,GAC9D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAkE9C,CAAC"}

package/dist/esm/billing/product.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"product.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/product.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,cAAc,EACf,MAAM,gCAAgC,CAAC;AAIxC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8ExB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"product.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/product.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,cAAc,EACf,MAAM,gCAAgC,CAAC;AAIxC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8ExB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/esm/billing/product.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"product.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/product.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,cAAc,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAEvF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAEpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;IAClG,yEAAyE;IACzE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAErF,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAEhE;;;;;;;;;;OAUG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAEjF,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAChD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,8FAA8F;IAC9F,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,iFAAiF;QACjF,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpD,sDAAsD;QACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC5C,yFAAyF;QACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC,QAAQ,EAAE;IAEb,gEAAgE;IAChE,cAAc,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAEtD,uFAAuF;IACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAExD,2CAA2C;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,mDAAmD;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACpD,qDAAqD;IACrD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC","sourcesContent":["/**\n * Product Schema (Shared)\n *\n * Products define what you sell. They live in the DB as APPLICATION-scoped records,\n * populated lazily from the code-defined ProductDefinition catalog.\n *\n * Config-driven, lazy-populated:\n * 1. Config is the source of truth: Product definitions live in code (shared lib)\n * 2. Populate on demand: DB records created on first checkout/admin view\n * 3. Provider sync on demand: providerProductId filled when first used in provider ops\n * 4. Bulk sync available: Admin action to pre-populate all products\n * 5. Startup is lightweight: No blocking provider calls at boot\n *\n * The admin UI shows products as read-only resources (view + \"Sync to Provider\" action),\n * NOT as CRUD-editable. Changes require code deployment.\n *\n * @see billing-and-features-system.md §6.2 (Product & Price Catalog)\n */\n\nimport { z } from 'zod';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  ProductType,\n  TaxDisplayMode,\n} from './billing-enums.shared.schemas';\nimport { LimitGrantSchema } from './product-behavior-policy.shared.schemas';\nimport { ProductBehaviorPolicySchema } from './product-behavior-policy.shared.schemas';\n\nexport const ProductSchema = z.object({\n\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  type: z.enum(ProductType).isDBIndexed().isSummaryField().isNotEditable().systemEnum('ProductType'),\n  /** Unique product key (maps to ProductDefinition.key in code catalog) */\n  key: z.string().min(1).isUnique({ scope: 'global' }).isSummaryField().isNotEditable(),\n\n  /** Which scopes can subscribe to this product (code-driven, not user-editable) */\n  targetScopes: z.array(z.enum(ResourcePrimaryScope)).min(1),\n\n  /** Features this product grants (boolean: present = enabled) */\n  grantedFeatures: z.array(z.string()).default([]).isNotEditable(),\n\n  /**\n   * Limits this product grants, with aggregation mode.\n   * - SET: absolute value (for PLAN products: \"Professional gives you 50 projects\")\n   * - ADD: additive to current limits (for ADDON products: \"+10 extra projects\")\n   *\n   * Aggregation algorithm in BillingFeatureSyncBackendService:\n   *   1. Start with active PLAN's SET limits (only one active plan per billing account)\n   *   2. For each active ADDON with ADD mode: sum onto current limit\n   *   3. For each active ADDON with SET mode: take max(current, addon value)\n   *   4. FEATURES_UNLIMITED always wins in any comparison\n   */\n  grantedLimits: z.record(z.string(), LimitGrantSchema).default({}).isNotEditable(),\n\n  /** For PLAN type: mutually exclusive tier ordering (higher number = higher tier) */\n  planTier: z.string().optional().isSummaryField(),\n  /** For PLAN type: tier sort order (used for upgrade/downgrade direction detection) */\n  planTierOrder: z.number().optional(),\n\n  /** For ADDON type: required plan tiers to subscribe to this addon (empty = no restriction) */\n  requiredPlanTiers: z.array(z.string()).optional(),\n\n  /**\n   * Tax display intent for this product, recorded on the product row.\n   * - 'exclusive': price amounts are HT (tax added at checkout)\n   * - 'inclusive': price amounts are TTC (tax embedded)\n   *\n   * It is DECLARATIVE ONLY and does not reach the billing provider. The catalog sync stores it on\n   * the product and then sends each price's own `taxBehavior` unchanged, so a price that declares\n   * none is created without `tax_behavior` regardless of what this field says. To make the\n   * intention effective, set `taxBehavior` on the prices as well.\n   *\n   * Common pattern: org products exclusive, user products inclusive.\n   */\n  taxDisplayMode: z.enum(TaxDisplayMode).optional(),\n\n  /**\n   * Purchase configuration for non-subscription products (ONE_TIME, CREDIT_PACK, ITEM).\n   * Ignored for subscription products (PLAN, ADDON, METERED).\n   */\n  purchaseConfig: z.object({\n    /** Maximum quantity per purchase (for CREDIT_PACK/ITEM). undefined = no limit */\n    maxQuantityPerPurchase: z.number().min(1).optional(),\n    /** For CREDIT_PACK: how many credits per pack unit */\n    creditsPerUnit: z.number().min(1).optional(),\n    /** For CREDIT_PACK: which \"credit pool\" this feeds (e.g., 'ai_tokens', 'sms_credits') */\n    creditPoolKey: z.string().optional(),\n  }).optional(),\n\n  /** Behavior policy: trial, proration, cancellation, metering */\n  behaviorPolicy: ProductBehaviorPolicySchema.optional(),\n\n  /** Provider sync (lazy: populated on first checkout or sync action, NOT at startup) */\n  providerProductId: z.string().optional().isBackendOnly(),\n\n  /** Display sort order in pricing tables */\n  sortOrder: z.number().default(0),\n  /** Whether this product is visible to end users */\n  isPublic: z.boolean().default(true).isSummaryField(),\n  /** Whether this product is available for purchase */\n  isActive: z.boolean().default(true).isDBIndexed().isSummaryField(),\n  metadata: z.record(z.string(), z.string()).optional(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type Product = z.infer<typeof ProductSchema>;\n"]}
+{"version":3,"file":"product.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/product.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,cAAc,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAEvF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAEpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;IAClG,yEAAyE;IACzE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAErF,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAEhE;;;;;;;;;;OAUG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAEjF,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAChD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,8FAA8F;IAC9F,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,iFAAiF;QACjF,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpD,sDAAsD;QACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC5C,yFAAyF;QACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC,QAAQ,EAAE;IAEb,gEAAgE;IAChE,cAAc,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAEtD,uFAAuF;IACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAExD,2CAA2C;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,mDAAmD;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACpD,qDAAqD;IACrD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC","sourcesContent":["/**\n * Product Schema (Shared)\n *\n * Products define what you sell. They live in the DB as APPLICATION-scoped records,\n * populated lazily from the code-defined ProductDefinition catalog.\n *\n * Config-driven, lazy-populated:\n * 1. Config is the source of truth: Product definitions live in code (shared lib)\n * 2. Populate on demand: DB records created on first checkout/admin view\n * 3. Provider sync on demand: providerProductId filled when first used in provider ops\n * 4. Bulk sync available: Admin action to pre-populate all products\n * 5. Startup is lightweight: No blocking provider calls at boot\n *\n * The admin UI shows products as read-only resources (view + \"Sync to Provider\" action),\n * NOT as CRUD-editable. Changes require code deployment.\n *\n * @see billing-and-features-system.md §6.2 (Product & Price Catalog)\n */\n\nimport { z } from 'zod';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  ProductType,\n  TaxDisplayMode,\n} from './billing-enums.shared.schemas';\nimport { LimitGrantSchema } from './product-behavior-policy.shared.schemas';\nimport { ProductBehaviorPolicySchema } from './product-behavior-policy.shared.schemas';\n\nexport const ProductSchema = z.object({\n\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  type: z.enum(ProductType).isDBIndexed().isSummaryField().isNotEditable().systemEnum('ProductType'),\n  /** Unique product key (maps to ProductDefinition.key in code catalog) */\n  key: z.string().min(1).isUnique({ scope: 'global' }).isSummaryField().isNotEditable(),\n\n  /** Which scopes can subscribe to this product (code-driven, not user-editable) */\n  targetScopes: z.array(z.enum(ResourcePrimaryScope)).min(1),\n\n  /** Features this product grants (boolean: present = enabled) */\n  grantedFeatures: z.array(z.string()).default([]).isNotEditable(),\n\n  /**\n   * Limits this product grants, with aggregation mode.\n   * - SET: absolute value (for PLAN products: \"Professional gives you 50 projects\")\n   * - ADD: additive to current limits (for ADDON products: \"+10 extra projects\")\n   *\n   * Aggregation algorithm in BillingFeatureSyncBackendService:\n   *   1. Start with active PLAN's SET limits (only one active plan per billing account)\n   *   2. For each active ADDON with ADD mode: sum onto current limit\n   *   3. For each active ADDON with SET mode: take max(current, addon value)\n   *   4. FEATURES_UNLIMITED always wins in any comparison\n   */\n  grantedLimits: z.record(z.string(), LimitGrantSchema).default({}).isNotEditable(),\n\n  /** For PLAN type: mutually exclusive tier ordering (higher number = higher tier) */\n  planTier: z.string().optional().isSummaryField(),\n  /** For PLAN type: tier sort order (used for upgrade/downgrade direction detection) */\n  planTierOrder: z.number().optional(),\n\n  /** For ADDON type: required plan tiers to subscribe to this addon (empty = no restriction) */\n  requiredPlanTiers: z.array(z.string()).optional(),\n\n  /**\n   * Tax display intent for this product, recorded on the product row.\n   * - 'exclusive': price amounts are HT (tax added at checkout)\n   * - 'inclusive': price amounts are TTC (tax embedded)\n   *\n   * It is DECLARATIVE ONLY and does not reach the billing provider. The catalog sync stores it on\n   * the product and then sends each price's own `taxBehavior` unchanged, so a price that declares\n   * none is created without `tax_behavior` regardless of what this field says. To make the\n   * intention effective, set `taxBehavior` on the prices as well.\n   *\n   * Common pattern: org products exclusive, user products inclusive.\n   */\n  taxDisplayMode: z.enum(TaxDisplayMode).optional(),\n\n  /**\n   * Purchase configuration for non-subscription products (ONE_TIME, CREDIT_PACK, ITEM).\n   * Ignored for subscription products (PLAN, ADDON, METERED).\n   */\n  purchaseConfig: z.object({\n    /** Maximum quantity per purchase (for CREDIT_PACK/ITEM). undefined = no limit */\n    maxQuantityPerPurchase: z.number().min(1).optional(),\n    /** For CREDIT_PACK: how many credits per pack unit */\n    creditsPerUnit: z.number().min(1).optional(),\n    /** For CREDIT_PACK: which \"credit pool\" this feeds (e.g., 'ai_tokens', 'sms_credits') */\n    creditPoolKey: z.string().optional(),\n  }).optional(),\n\n  /** Behavior policy: trial, proration, cancellation, metering */\n  behaviorPolicy: ProductBehaviorPolicySchema.optional(),\n\n  /** Provider sync (lazy: populated on first checkout or sync action, NOT at startup) */\n  providerProductId: z.string().optional().isBackendOnly(),\n\n  /** Display sort order in pricing tables */\n  sortOrder: z.number().default(0),\n  /** Whether this product is visible to end users */\n  isPublic: z.boolean().default(true).isSummaryField(),\n  /** Whether this product is available for purchase */\n  isActive: z.boolean().default(true).isDBIndexed().isSummaryField(),\n  metadata: z.record(z.string(), z.string()).optional(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type Product = z.infer<typeof ProductSchema>;\n"]}

package/dist/esm/billing/promotions.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promotions.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/promotions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAM/C,oBAAY,oBAAoB;IAC9B,2DAA2D;IAC3D,KAAK,UAAU;IACf,sDAAsD;IACtD,UAAU,eAAe;CAC1B;AAED,KAAK,iBAAiB,GAClB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,qDAAqD,GAChE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;kBAqH9C,CAAC"}
+{"version":3,"file":"promotions.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/promotions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAM/C,oBAAY,oBAAoB;IAC9B,2DAA2D;IAC3D,KAAK,UAAU;IACf,sDAAsD;IACtD,UAAU,eAAe;CAC1B;AAED,KAAK,iBAAiB,GAClB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,qDAAqD,GAChE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;kBAqH9C,CAAC"}

package/dist/esm/billing/promotions.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promotions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/promotions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;iBAkE1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"promotions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/promotions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;iBAkE1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/esm/billing/referral.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"referral.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/referral.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAI/C,KAAK,gBAAgB,GACjB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,oDAAoD,GAC/D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAmD9C,CAAC"}
+{"version":3,"file":"referral.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/referral.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAI/C,KAAK,gBAAgB,GACjB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,oDAAoD,GAC/D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAmD9C,CAAC"}

package/dist/esm/billing/referral.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"referral.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/referral.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AAKxC,eAAO,MAAM,oBAAoB;;;;;;;iBAY/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,oBAAoB;;;;;;;iBAQ/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"referral.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/referral.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AAKxC,eAAO,MAAM,oBAAoB;;;;;;;iBAY/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,oBAAoB;;;;;;;iBAQ/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/esm/billing/subscription.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAczG,oBAAY,8BAA8B;IACxC,6DAA6D;IAC7D,MAAM,WAAW;IACjB,wDAAwD;IACxD,MAAM,WAAW;IACjB,qDAAqD;IACrD,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,SAAS,cAAc;IACvB,oDAAoD;IACpD,YAAY,iBAAiB;CAC9B;AAID,wFAAwF;AACxF,eAAO,MAAM,oCAAoC;;;iBAiB/C,CAAC;AAEH,6FAA6F;AAC7F,eAAO,MAAM,wCAAwC;;;iBAGnD,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,sCAAsC;;;iBAGjD,CAAC;AAEH,8FAA8F;AAC9F,eAAO,MAAM,yCAAyC;;iBAEpD,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC,iRA4LpD,CAAC"}
+{"version":3,"file":"subscription.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAczG,oBAAY,8BAA8B;IACxC,6DAA6D;IAC7D,MAAM,WAAW;IACjB,wDAAwD;IACxD,MAAM,WAAW;IACjB,qDAAqD;IACrD,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,SAAS,cAAc;IACvB,oDAAoD;IACpD,YAAY,iBAAiB;CAC9B;AAID,wFAAwF;AACxF,eAAO,MAAM,oCAAoC;;;iBAiB/C,CAAC;AAEH,6FAA6F;AAC7F,eAAO,MAAM,wCAAwC;;;iBAGnD,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,sCAAsC;;;iBAGjD,CAAC;AAEH,8FAA8F;AAC9F,eAAO,MAAM,yCAAyC;;iBAEpD,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC,iRA4LpD,CAAC"}

package/dist/esm/billing/subscription.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,0CAA0C,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,8BAWX;AAXD,WAAY,8BAA8B;IACxC,6DAA6D;IAC7D,mDAAiB,CAAA;IACjB,wDAAwD;IACxD,mDAAiB,CAAA;IACjB,qDAAqD;IACrD,6DAA2B,CAAA;IAC3B,+CAA+C;IAC/C,yDAAuB,CAAA;IACvB,oDAAoD;IACpD,+DAA6B,CAAA;AAC/B,CAAC,EAXW,8BAA8B,KAA9B,8BAA8B,QAWzC;AAED,wEAAwE;AAExE,wFAAwF;AACxF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,uCAAuC,CAC7F,0CAA0C,EAC1C;IACE,gBAAgB,EAAE,IAAI;IACtB,gGAAgG;IAChG,4FAA4F;IAC5F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,+FAA+F;IAC/F,wDAAwD;IACxD,kBAAkB,EAAE;QAClB,kSAAkS;QAClS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,eAAe,EAAE,8BAA8B;IAC/C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,iFAAiF;oBACjF,mFAAmF;oBACnF,6EAA6E;oBAC7E,wFAAwF;oBACxF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,oCAAoC;iBACjD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,mFAAmF;oBACnF,iFAAiF;oBACjF,oFAAoF;oBACpF,+EAA+E;oBAC/E,+EAA+E;oBAC/E,gFAAgF;oBAChF,kCAAkC;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAAE;YAC5C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,wCAAwC;iBACrD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,sCAAsC;iBACnD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,YAAY,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Subscription Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...billingSubscriptionsPolymorphicFactories\n *\n * @see polymorphic-scope-approach-A-expansion.md — Phase 3\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { billingSubscriptionsPolymorphicDeclaration } from './subscription.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingSubscription_Operations {\n  /** Cancel the subscription (at period end or immediately) */\n  CANCEL = 'cancel',\n  /** Resume a cancelled subscription before period end */\n  RESUME = 'resume',\n  /** Change to a different plan (upgrade/downgrade) */\n  CHANGE_PLAN = 'change_plan',\n  /** Add an addon product to the subscription */\n  ADD_ADDON = 'add_addon',\n  /** Remove an addon product from the subscription */\n  REMOVE_ADDON = 'remove_addon',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/** Request DTO for CANCEL operation — shared between resource config and custom impl */\nexport const BillingSubscription_CancelRequestDto = z.object({\n  /**\n   * OPTIONAL, with no default — and the absence of a default is the point (#408, 2026-09-08).\n   *\n   * It carried `.default(false)` until then, which materialized `false` at parse and made \"the\n   * caller expressed no preference\" a state the handler could never observe. That erased the only\n   * input `ProductBehaviorPolicy.cancellation.defaultBehavior` exists to answer, so an authored\n   * product default was unimplementable rather than merely unimplemented — a field one layer up\n   * had already decided for it.\n   *\n   * The resolution order is now: the caller's explicit choice, then the plan product's\n   * `defaultBehavior`, then period-end as the framework floor. Omitting it still ends in period-end\n   * for a product that authors no policy, so nothing changes for an existing caller — what changes\n   * is that a product declaring IMMEDIATE now gets it.\n   */\n  cancelImmediately: z.boolean().optional(),\n  reason: z.string().max(500).optional(),\n});\n\n/** Request DTO for CHANGE_PLAN operation — shared between resource config and custom impl */\nexport const BillingSubscription_ChangePlanRequestDto = z.object({\n  newProductKey: z.string().min(1),\n  newPriceId: z.string().min(1),\n});\n\n/** Request DTO for ADD_ADDON operation — shared between resource config and custom impl */\nexport const BillingSubscription_AddAddonRequestDto = z.object({\n  addonProductKey: z.string().min(1),\n  priceId: z.string().min(1),\n});\n\n/** Request DTO for REMOVE_ADDON operation — shared between resource config and custom impl */\nexport const BillingSubscription_RemoveAddonRequestDto = z.object({\n  addonProductKey: z.string().min(1),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/**\n * Polymorphic factory map for subscriptions.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...billingSubscriptionsPolymorphicFactories\n *\n * Produces entries for:\n *   - organizationSubscriptions\n *   - userSubscriptions\n */\nexport const billingSubscriptionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  billingSubscriptionsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // System-context LIST opt-in (fail-closed default is FORBIDDEN). Subject erasure enumerates the\n    // erased person's live subscriptions so it can cancel them at the provider immediately — an\n    // erased subject must stop being billed. There is no request context on that path (the subject\n    // is being erased), so it reads through `SystemAccessBackendService.listAsSystem`, which refuses\n    // any resource that has not opted in here. LIST's default variant is API_CALL and therefore\n    // resolves through `getServiceOperationPathDefault`; a REPOSITORY_ONLY-only LIST would satisfy\n    // this grant and still fail to resolve at erasure time.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own subscriptions. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * subscription terms — plan and price references, status and period boundaries — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n *\n * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    customOperation: BillingSubscription_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: subscriptions are a user-facing collection (Settings Hub → Billing →\n          // Subscriptions, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n          // strip the op from the frontend registry and register no HTTP route. Writes\n          // (checkout + webhook sync) are INTERNAL_CALL (service-pipeline) / custom API_CALL ops.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [BillingSubscription_Operations.CANCEL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_CancelRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.RESUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // RESUME clears a pending cancellation at the provider and mirrors the result — it\n          // takes no caller input. Its implementation already ignores the payload, but the\n          // dispatcher MERGES a prefix's return onto the caller payload rather than replacing\n          // it, so an unnarrowed contract is still writable. Omitting `requestDto` would\n          // auto-derive the FULL subscription update DTO (`status`, `items`, `discount`,\n          // `currentPeriodEnd`, `cancelledAt`, …), letting a subscriber rewrite their own\n          // billing state through \"resume\".\n          requestDto: z.object({}),\n        }],\n      },\n      [BillingSubscription_Operations.CHANGE_PLAN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_ChangePlanRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.ADD_ADDON]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_AddAddonRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.REMOVE_ADDON]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_RemoveAddonRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"subscription.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,0CAA0C,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,8BAWX;AAXD,WAAY,8BAA8B;IACxC,6DAA6D;IAC7D,mDAAiB,CAAA;IACjB,wDAAwD;IACxD,mDAAiB,CAAA;IACjB,qDAAqD;IACrD,6DAA2B,CAAA;IAC3B,+CAA+C;IAC/C,yDAAuB,CAAA;IACvB,oDAAoD;IACpD,+DAA6B,CAAA;AAC/B,CAAC,EAXW,8BAA8B,KAA9B,8BAA8B,QAWzC;AAED,wEAAwE;AAExE,wFAAwF;AACxF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,uCAAuC,CAC7F,0CAA0C,EAC1C;IACE,gBAAgB,EAAE,IAAI;IACtB,gGAAgG;IAChG,4FAA4F;IAC5F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,+FAA+F;IAC/F,wDAAwD;IACxD,kBAAkB,EAAE;QAClB,kSAAkS;QAClS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,eAAe,EAAE,8BAA8B;IAC/C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,iFAAiF;oBACjF,mFAAmF;oBACnF,6EAA6E;oBAC7E,wFAAwF;oBACxF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,oCAAoC;iBACjD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,mFAAmF;oBACnF,iFAAiF;oBACjF,oFAAoF;oBACpF,+EAA+E;oBAC/E,+EAA+E;oBAC/E,gFAAgF;oBAChF,kCAAkC;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAAE;YAC5C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,wCAAwC;iBACrD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,sCAAsC;iBACnD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,YAAY,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Subscription Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...billingSubscriptionsPolymorphicFactories\n *\n * @see polymorphic-scope-approach-A-expansion.md — Phase 3\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { billingSubscriptionsPolymorphicDeclaration } from './subscription.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingSubscription_Operations {\n  /** Cancel the subscription (at period end or immediately) */\n  CANCEL = 'cancel',\n  /** Resume a cancelled subscription before period end */\n  RESUME = 'resume',\n  /** Change to a different plan (upgrade/downgrade) */\n  CHANGE_PLAN = 'change_plan',\n  /** Add an addon product to the subscription */\n  ADD_ADDON = 'add_addon',\n  /** Remove an addon product from the subscription */\n  REMOVE_ADDON = 'remove_addon',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/** Request DTO for CANCEL operation — shared between resource config and custom impl */\nexport const BillingSubscription_CancelRequestDto = z.object({\n  /**\n   * OPTIONAL, with no default — and the absence of a default is the point (#408, 2026-09-08).\n   *\n   * It carried `.default(false)` until then, which materialized `false` at parse and made \"the\n   * caller expressed no preference\" a state the handler could never observe. That erased the only\n   * input `ProductBehaviorPolicy.cancellation.defaultBehavior` exists to answer, so an authored\n   * product default was unimplementable rather than merely unimplemented — a field one layer up\n   * had already decided for it.\n   *\n   * The resolution order is now: the caller's explicit choice, then the plan product's\n   * `defaultBehavior`, then period-end as the framework floor. Omitting it still ends in period-end\n   * for a product that authors no policy, so nothing changes for an existing caller — what changes\n   * is that a product declaring IMMEDIATE now gets it.\n   */\n  cancelImmediately: z.boolean().optional(),\n  reason: z.string().max(500).optional(),\n});\n\n/** Request DTO for CHANGE_PLAN operation — shared between resource config and custom impl */\nexport const BillingSubscription_ChangePlanRequestDto = z.object({\n  newProductKey: z.string().min(1),\n  newPriceId: z.string().min(1),\n});\n\n/** Request DTO for ADD_ADDON operation — shared between resource config and custom impl */\nexport const BillingSubscription_AddAddonRequestDto = z.object({\n  addonProductKey: z.string().min(1),\n  priceId: z.string().min(1),\n});\n\n/** Request DTO for REMOVE_ADDON operation — shared between resource config and custom impl */\nexport const BillingSubscription_RemoveAddonRequestDto = z.object({\n  addonProductKey: z.string().min(1),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/**\n * Polymorphic factory map for subscriptions.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...billingSubscriptionsPolymorphicFactories\n *\n * Produces entries for:\n *   - organizationSubscriptions\n *   - userSubscriptions\n */\nexport const billingSubscriptionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  billingSubscriptionsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // System-context LIST opt-in (fail-closed default is FORBIDDEN). Subject erasure enumerates the\n    // erased person's live subscriptions so it can cancel them at the provider immediately — an\n    // erased subject must stop being billed. There is no request context on that path (the subject\n    // is being erased), so it reads through `SystemAccessBackendService.listAsSystem`, which refuses\n    // any resource that has not opted in here. LIST's default variant is API_CALL and therefore\n    // resolves through `getServiceOperationPathDefault`; a REPOSITORY_ONLY-only LIST would satisfy\n    // this grant and still fail to resolve at erasure time.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own subscriptions. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * subscription terms — plan and price references, status and period boundaries — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n *\n * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    customOperation: BillingSubscription_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: subscriptions are a user-facing collection (Settings Hub → Billing →\n          // Subscriptions, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n          // strip the op from the frontend registry and register no HTTP route. Writes\n          // (checkout + webhook sync) are INTERNAL_CALL (service-pipeline) / custom API_CALL ops.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [BillingSubscription_Operations.CANCEL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_CancelRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.RESUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // RESUME clears a pending cancellation at the provider and mirrors the result — it\n          // takes no caller input. Its implementation already ignores the payload, but the\n          // dispatcher MERGES a prefix's return onto the caller payload rather than replacing\n          // it, so an unnarrowed contract is still writable. Omitting `requestDto` would\n          // auto-derive the FULL subscription update DTO (`status`, `items`, `discount`,\n          // `currentPeriodEnd`, `cancelledAt`, …), letting a subscriber rewrite their own\n          // billing state through \"resume\".\n          requestDto: z.object({}),\n        }],\n      },\n      [BillingSubscription_Operations.CHANGE_PLAN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_ChangePlanRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.ADD_ADDON]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_AddAddonRequestDto,\n        }],\n      },\n      [BillingSubscription_Operations.REMOVE_ADDON]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingSubscription_RemoveAddonRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/subscription.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIpE;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAUjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0ExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;;;GASG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQrD,CAAC"}
+{"version":3,"file":"subscription.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIpE;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAUjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0ExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;;;GASG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQrD,CAAC"}

package/dist/esm/billing/usage-record.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage-record.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAYzG,eAAO,MAAM,gCAAgC,qPA0G5C,CAAC"}
+{"version":3,"file":"usage-record.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/usage-record.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAYzG,eAAO,MAAM,gCAAgC,qPA0G5C,CAAC"}

package/dist/esm/billing/usage-record.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage-record.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEvH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;iBAsE5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;kBAQ7C,CAAC"}
+{"version":3,"file":"usage-record.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEvH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;iBAsE5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;kBAQ7C,CAAC"}

package/dist/esm/billing/usage-record.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"usage-record.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEvH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnI,sEAAsE;IACtE,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,qBAAqB;IACrB,+FAA+F;IAC/F,gGAAgG;IAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC5C,8BAA8B;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAElE,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAClJ,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAC/C;;;;;;OAMG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAChI,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAEnD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,kCAAkC,GAAG,yBAAyB,CAAC;IAC1E,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,eAAe;IACpC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,iBAAiB;IAC7B,2EAA2E;IAC3E,iDAAiD;IACjD,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Usage Record Schema (Shared) — Polymorphic\n *\n * Tracks metered usage for METERED products. The current metering service groups\n * unreported rows by billing account and product when its scheduled flush runs.\n * `ProductBehaviorPolicy.metering` is an authored policy surface, but the current\n * flush scheduler does not consume its interval, window or retry members; do not\n * present those values as an effective reporting schedule until that runtime join exists.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, usage records are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationUsageRecords  (with organizationId + organizationBillingAccountId)\n *   - userUsageRecords          (with userId + userBillingAccountId)\n *\n *\n * @see billing-and-features-system.md §6.6 (Usage Records)\n */\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { UsageRecordFlushState, UsageRecordUnreportableReason, UsageSourceType } from './billing-enums.shared.schemas';\n\nexport const UsageRecordSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n  /** Product key for grouping/lookup (matches ProductDefinition.key) */\n  // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n  // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n  // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n  // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n  // resource config (#138).\n  productKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable(),\n\n  /** Usage quantity */\n  // USAGE, not FINANCIAL. A metered quantity is what the person DID in the product; the money it\n  // becomes lives on the invoice. Two different sentences in a notice, and they read differently.\n  quantity: z.number().min(0).isSummaryField(),\n  /** When the usage occurred */\n  timestamp: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n  /** What generated this usage */\n  source: z.object({\n    type: z.enum(UsageSourceType),\n    resourceType: z.string().optional(),\n    operationIdentifier: z.string().optional(),\n    description: z.string().optional(),\n  }).optional().isNotEditable(),\n\n  /**\n   * Where this row stands with respect to the provider flush.\n   *\n   * The flush selects exactly `PENDING`, so this ONE indexed field decides whether a row is still\n   * work. It replaced a `reportedToProvider` boolean on 2026-09-09 (#512): a boolean has no way to\n   * say \"this can never be reported\", so rows whose billing account had been deleted were\n   * re-selected by every run forever. See {@link UsageRecordFlushState} for why all three states are\n   * semantically distinct and why the shortcut of marking them reported was refused.\n   */\n  flushState: z.enum(UsageRecordFlushState).default(UsageRecordFlushState.PENDING).isDBIndexed().isNotEditable().systemEnum('UsageRecordFlushState'),\n  /** When the PROVIDER acknowledged the quantity. Set only alongside `flushState: reported`. */\n  reportedAt: z.date().optional().isNotEditable(),\n  /**\n   * Why this row can never be reported. Set only alongside `flushState: unreportable`.\n   *\n   * Separate from `reportedAt` on purpose: that timestamp records an acknowledgement by the\n   * provider, this pair records a determination made locally, and merging them would put two\n   * different events under one name.\n   */\n  unreportableReason: z.enum(UsageRecordUnreportableReason).optional().isNotEditable().systemEnum('UsageRecordUnreportableReason'),\n  /** When the flush determined this row unreportable. Set only alongside `unreportableReason`. */\n  unreportableAt: z.date().optional().isNotEditable(),\n\n  /**\n   * Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n   *\n   * ⚠️ **AUTHORING RULE — never store personal data here.** This row is RETAINED when its subject is\n   * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n   * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n   * personal data of its own — the person is a foreign key. An open bag is the one place that\n   * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n   * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n   * keys it does not know.\n   *\n   * Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n   * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n   * breach that the retained label makes look intentional.\n   *\n   * Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n   * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n   * Revisit only if an app is found using the bag this way.\n   */\n  metadata: z.record(z.string(), z.string()).optional(),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type UsageRecord = z.infer<typeof UsageRecordSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const usageRecordsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'usageRecords',\n  baseFieldIdentifier: 'usageRecordId',\n  baseEnumKey: 'USAGE_RECORDS',\n  baseSchema: UsageRecordSchema,\n  // Many metered usage rows per scope — opt out of the polymorphism engine's\n  // singleton-per-scope business-key auto-default.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"usage-record.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEvH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnI,sEAAsE;IACtE,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,qBAAqB;IACrB,+FAA+F;IAC/F,gGAAgG;IAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC5C,8BAA8B;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAElE,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAClJ,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAC/C;;;;;;OAMG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAChI,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAEnD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,kCAAkC,GAAG,yBAAyB,CAAC;IAC1E,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,eAAe;IACpC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,iBAAiB;IAC7B,2EAA2E;IAC3E,iDAAiD;IACjD,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Usage Record Schema (Shared) — Polymorphic\n *\n * Tracks metered usage for METERED products. The current metering service groups\n * unreported rows by billing account and product when its scheduled flush runs.\n * `ProductBehaviorPolicy.metering` is an authored policy surface, but the current\n * flush scheduler does not consume its interval, window or retry members; do not\n * present those values as an effective reporting schedule until that runtime join exists.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, usage records are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationUsageRecords  (with organizationId + organizationBillingAccountId)\n *   - userUsageRecords          (with userId + userBillingAccountId)\n *\n *\n * @see billing-and-features-system.md §6.6 (Usage Records)\n */\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { UsageRecordFlushState, UsageRecordUnreportableReason, UsageSourceType } from './billing-enums.shared.schemas';\n\nexport const UsageRecordSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n  /** Product key for grouping/lookup (matches ProductDefinition.key) */\n  // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n  // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n  // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n  // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n  // resource config (#138).\n  productKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable(),\n\n  /** Usage quantity */\n  // USAGE, not FINANCIAL. A metered quantity is what the person DID in the product; the money it\n  // becomes lives on the invoice. Two different sentences in a notice, and they read differently.\n  quantity: z.number().min(0).isSummaryField(),\n  /** When the usage occurred */\n  timestamp: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n  /** What generated this usage */\n  source: z.object({\n    type: z.enum(UsageSourceType),\n    resourceType: z.string().optional(),\n    operationIdentifier: z.string().optional(),\n    description: z.string().optional(),\n  }).optional().isNotEditable(),\n\n  /**\n   * Where this row stands with respect to the provider flush.\n   *\n   * The flush selects exactly `PENDING`, so this ONE indexed field decides whether a row is still\n   * work. It replaced a `reportedToProvider` boolean on 2026-09-09 (#512): a boolean has no way to\n   * say \"this can never be reported\", so rows whose billing account had been deleted were\n   * re-selected by every run forever. See {@link UsageRecordFlushState} for why all three states are\n   * semantically distinct and why the shortcut of marking them reported was refused.\n   */\n  flushState: z.enum(UsageRecordFlushState).default(UsageRecordFlushState.PENDING).isDBIndexed().isNotEditable().systemEnum('UsageRecordFlushState'),\n  /** When the PROVIDER acknowledged the quantity. Set only alongside `flushState: reported`. */\n  reportedAt: z.date().optional().isNotEditable(),\n  /**\n   * Why this row can never be reported. Set only alongside `flushState: unreportable`.\n   *\n   * Separate from `reportedAt` on purpose: that timestamp records an acknowledgement by the\n   * provider, this pair records a determination made locally, and merging them would put two\n   * different events under one name.\n   */\n  unreportableReason: z.enum(UsageRecordUnreportableReason).optional().isNotEditable().systemEnum('UsageRecordUnreportableReason'),\n  /** When the flush determined this row unreportable. Set only alongside `unreportableReason`. */\n  unreportableAt: z.date().optional().isNotEditable(),\n\n  /**\n   * Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n   *\n   * ⚠️ **AUTHORING RULE — never store personal data here.** This row is RETAINED when its subject is\n   * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n   * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n   * personal data of its own — the person is a foreign key. An open bag is the one place that\n   * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n   * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n   * keys it does not know.\n   *\n   * Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n   * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n   * breach that the retained label makes look intentional.\n   *\n   * Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n   * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n   * Revisit only if an app is found using the bag this way.\n   */\n  metadata: z.record(z.string(), z.string()).optional(),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type UsageRecord = z.infer<typeof UsageRecordSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const usageRecordsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'usageRecords',\n  baseFieldIdentifier: 'usageRecordId',\n  baseEnumKey: 'USAGE_RECORDS',\n  baseSchema: UsageRecordSchema,\n  // Many metered usage rows per scope — opt out of the polymorphism engine's\n  // singleton-per-scope business-key auto-default.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/charts/aggregation-query.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aggregation-query.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/charts/aggregation-query.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;oEAMoE;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EAChB,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,aAAa;;;;;;;;;iBAqBxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAIpD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;iBAwC1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD,eAAO,MAAM,qBAAqB;;;;;iBAkBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,eAAO,MAAM,oBAAoB;;;;;;;;iBAY/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE,eAAO,MAAM,kBAAkB;;;;;;iBAW7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,kBAAkB;;;;iBAO7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,mBAAmB;;;;;iBAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AA0ChE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAaE,CAAC;AACtC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE,eAAO,MAAM,iCAAiC,wCAAoC,CAAC;AACnF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,0BAA0B;;;;;iBASrC,CAAC;AAKH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;;;;iBAKzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"aggregation-query.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/charts/aggregation-query.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;oEAMoE;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EAChB,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,aAAa;;;;;;;;;iBAqBxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAIpD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;iBAwC1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD,eAAO,MAAM,qBAAqB;;;;;iBAkBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,eAAO,MAAM,oBAAoB;;;;;;;;iBAY/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE,eAAO,MAAM,kBAAkB;;;;;;iBAW7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,kBAAkB;;;;iBAO7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,mBAAmB;;;;;iBAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AA0ChE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAaE,CAAC;AACtC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE,eAAO,MAAM,iCAAiC,wCAAoC,CAAC;AACnF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,0BAA0B;;;;;iBASrC,CAAC;AAKH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;;;;iBAKzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/esm/charts/chart-definition-builder.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chart-definition-builder.shared.d.ts","sourceRoot":"","sources":["../../../../src/charts/chart-definition-builder.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;oEAiBoE;AAEpE,OAAO,EACL,SAAS,EAET,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EAEb,QAAQ,EACR,kBAAkB,EACnB,MAAM,kCAAkC,CAAC;AAc1C,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,aAAa,CAAC;QAC1B,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,qBAAa,sBAAsB;IAwB/B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAxBpC,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,WAAW,CAAmB;IACtC,OAAO,CAAC,SAAS,CAAiB;IAClC,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,QAAQ,CAAC,CAA0B;IAC3C,OAAO,CAAC,cAAc,CAAC,CAAqB;IAC5C,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,CAAmD;IACpE,OAAO,CAAC,iBAAiB,CAAC,CAAS;IACnC,OAAO,CAAC,YAAY,CAAC,CAAmB;IACxC,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,gBAAgB,CAAwB;IAChD,OAAO,CAAC,WAAW,CAAC,CAAkB;IACtC,OAAO,CAAC,gBAAgB,CAAC,CAAkB;IAC3C,OAAO,CAAC,KAAK,CAAC,CAA0B;IACxC,OAAO,CAAC,OAAO,CAAC,CAAyB;gBAGtB,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,MAAM;IAK5C,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAOhC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAiB1D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI;IAsBhG,KAAK,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAOrC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAIlD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAIlD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAIlD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAIlD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAcpF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI;IAgBpF,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAQ9D,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAO/C,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAUlI,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAO9C;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAY3F;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI;IAa/G;;OAEG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAIvG;;OAEG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAIxG;;;;OAIG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAOzH;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAIzG;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAMrG,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI;IAavF;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAO7E;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAoB/G,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAK1B,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAKjC,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAK7B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,aAAiC,GAAG,IAAI;IAQxE,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI;IAKzC,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI;IAK9C;;;;;OAKG;IACH,KAAK,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI;IAS7C;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI;IAOxD,KAAK,IAAI,eAAe;IAyExB,OAAO,CAAC,mBAAmB;CAO5B;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,sBAAsB,CAE1F"}
+{"version":3,"file":"chart-definition-builder.shared.d.ts","sourceRoot":"","sources":["../../../src/charts/chart-definition-builder.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;oEAiBoE;AAEpE,OAAO,EACL,SAAS,EAET,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EAEb,QAAQ,EACR,kBAAkB,EACnB,MAAM,kCAAkC,CAAC;AAc1C,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,aAAa,CAAC;QAC1B,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,qBAAa,sBAAsB;IAwB/B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAxBpC,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,WAAW,CAAmB;IACtC,OAAO,CAAC,SAAS,CAAiB;IAClC,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,QAAQ,CAAC,CAA0B;IAC3C,OAAO,CAAC,cAAc,CAAC,CAAqB;IAC5C,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,CAAmD;IACpE,OAAO,CAAC,iBAAiB,CAAC,CAAS;IACnC,OAAO,CAAC,YAAY,CAAC,CAAmB;IACxC,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,gBAAgB,CAAwB;IAChD,OAAO,CAAC,WAAW,CAAC,CAAkB;IACtC,OAAO,CAAC,gBAAgB,CAAC,CAAkB;IAC3C,OAAO,CAAC,KAAK,CAAC,CAA0B;IACxC,OAAO,CAAC,OAAO,CAAC,CAAyB;gBAGtB,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,MAAM;IAK5C,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAOhC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAiB1D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI;IAsBhG,KAAK,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAOrC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAIlD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAIlD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAIlD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAIlD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAcpF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI;IAgBpF,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAQ9D,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAO/C,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAUlI,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAO9C;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAY3F;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI;IAa/G;;OAEG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAIvG;;OAEG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAIxG;;;;OAIG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAOzH;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAIzG;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,IAAI;IAMrG,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI;IAavF;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAO7E;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAoB/G,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAK1B,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAKjC,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAK7B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,aAAiC,GAAG,IAAI;IAQxE,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI;IAKzC,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI;IAK9C;;;;;OAKG;IACH,KAAK,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI;IAS7C;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI;IAOxD,KAAK,IAAI,eAAe;IAyExB,OAAO,CAAC,mBAAmB;CAO5B;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,sBAAsB,CAE1F"}

package/dist/esm/companion/provider-discovery.shared.schemas.d.ts

@@ -184,6 +184,8 @@ export declare const ProviderCompanionContributionSchema: z.ZodObject<{
         components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("..").ProviderFrontendSelectionDelivery>>;
         }, z.core.$strict>>>;
+        publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        fileStorage: z.ZodOptional<z.ZodEnum<typeof import("@wildo-ai/zod-decorators").FileStorageAccepted>>;
     }, z.core.$loose>>;
     /**
      * Optional app module owner when the provider implementation belongs to one

package/dist/esm/companion/provider-discovery.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-discovery.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/companion/provider-discovery.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAI5F;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0CAA0C;;;kBAGrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;4BAgB/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;;;kBAKjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC;;;;;mBA+B5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;IAE9C;;;;;;OAMG;;;;;;;;;;;;;;IAEH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;IAOH;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAEH;;;OAGG;;iBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,MAAM,WAAW,4BAA4B;IAC3C,qBAAqB,CAAC,EAAE,6BAA6B,EAAE,CAAC;CACzD"}
+{"version":3,"file":"provider-discovery.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/companion/provider-discovery.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAI5F;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0CAA0C;;;kBAGrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;4BAgB/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;;;kBAKjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC;;;;;mBA+B5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;IAE9C;;;;;;OAMG;;;;;;;;;;;;;;IAEH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;IAOH;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAEH;;;OAGG;;iBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,MAAM,WAAW,4BAA4B;IAC3C,qBAAqB,CAAC,EAAE,6BAA6B,EAAE,CAAC;CACzD"}

package/dist/esm/companion/provider-discovery.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-discovery.shared.schemas.js","sourceRoot":"","sources":["../../../../src/companion/provider-discovery.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAEhG;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/E,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KAC3B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;KAC7B,CAAC;IACF,0CAA0C;IAC1C,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChI,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACrB,OAAO,EAAE,4CAA4C,KAAK,CAAC,IAAI,IAAI;aACpE,CAAC,CAAC;QACL,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC3B,OAAO,EAAE,kDAAkD,KAAK,CAAC,UAAU,IAAI;aAChF,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEtC,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACrB,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC3C;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,oBAAoB,EAAE,iCAAiC;IACvD;;;;;OAKG;IACH,aAAa,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { AppFrontendType } from '../config/app-frontend-type.shared.schemas';\nimport { EngineCapability } from '../external-providers/engine-capabilities.shared.schemas';\nimport { FrontendProviderEntrySchema } from '../external-providers/frontend-bootstrap.shared.schemas';\nimport { ProviderIdentitySchema } from '../external-providers/provider-metadata.shared.schemas';\n\n/**\n * Companion-safe provider implementation declaration.\n *\n * App/runtime-owner packages expose these entries through their `./companion`\n * default export so tooling can discover which provider refs are actually\n * reachable from which runtime owners before materializing generated artifacts.\n */\n\n/**\n * Discriminator branch for `frontendService` runtime targets.\n *\n * Targets a frontend service by its `AppFrontendType` (the closed kind set\n * — SAAS_APP, STATIC_WEBSITE, TECH_DOC) rather than by an app-defined\n * `serviceKey` string. Engine-shipped packages (`external-connectors-public`,\n * etc.) have no way to know app-defined service keys, so the discovery\n * contract is keyed on the type. Apps with multiple frontend services of\n * the same type currently broadcast the contribution to all of them; if\n * per-service-key targeting becomes a need, add a second variant.\n */\nexport const ProviderFrontendServiceRuntimeTargetSchema = z.strictObject({\n  kind: z.literal('frontendService'),\n  serviceType: z.enum(AppFrontendType),\n});\nexport type ProviderFrontendServiceRuntimeTarget = z.infer<typeof ProviderFrontendServiceRuntimeTargetSchema>;\n\nexport const ProviderCompanionRuntimeTargetSchema = z.discriminatedUnion('kind', [\n  z.strictObject({\n    kind: z.literal('backend'),\n  }),\n  z.strictObject({\n    kind: z.literal('companion'),\n  }),\n  ProviderFrontendServiceRuntimeTargetSchema,\n  z.strictObject({\n    kind: z.literal('minion'),\n    minionKey: z.string().min(1),\n  }),\n  z.strictObject({\n    kind: z.literal('worker'),\n    workerKey: z.string().min(1),\n  }),\n]);\nexport type ProviderCompanionRuntimeTarget = z.infer<typeof ProviderCompanionRuntimeTargetSchema>;\n\n/**\n * Values-free projection of one backend provider secret requirement.\n *\n * The stable provider-owned `slug` is preserved separately from the concrete\n * environment-variable name so a rename on either axis changes the lockfile\n * integrity digest. Secret values never cross this companion-safe boundary.\n */\nexport const ProviderSecretContractShapeEntrySchema = z.strictObject({\n  slug: z.string().min(1),\n  envVarName: z.string().min(1),\n  required: z.boolean(),\n  description: z.string().min(1),\n});\nexport type ProviderSecretContractShapeEntry = z.infer<typeof ProviderSecretContractShapeEntrySchema>;\n\n/**\n * Deterministic, values-free secret-contract shape used by provider discovery\n * and lockfile integrity checks.\n *\n * Every contribution must declare this field. `[]` means the provider is\n * authoritatively known to require no secrets; omission is rejected rather\n * than being silently interpreted as an empty contract. Entries must be\n * sorted by `slug`, and both slugs and environment-variable names are unique,\n * so independently contributed facets cannot produce order-dependent digests.\n */\nexport const ProviderSecretContractShapeSchema = z.array(ProviderSecretContractShapeEntrySchema).superRefine((entries, context) => {\n  const seenSlugs = new Set<string>();\n  const seenEnvVarNames = new Set<string>();\n\n  for (const [index, entry] of entries.entries()) {\n    if (seenSlugs.has(entry.slug)) {\n      context.addIssue({\n        code: 'custom',\n        path: [index, 'slug'],\n        message: `Duplicate provider secret-contract slug \"${entry.slug}\".`,\n      });\n    }\n    seenSlugs.add(entry.slug);\n\n    if (seenEnvVarNames.has(entry.envVarName)) {\n      context.addIssue({\n        code: 'custom',\n        path: [index, 'envVarName'],\n        message: `Duplicate provider secret-contract envVarName \"${entry.envVarName}\".`,\n      });\n    }\n    seenEnvVarNames.add(entry.envVarName);\n\n    if (index > 0 && entries[index - 1].slug.localeCompare(entry.slug) >= 0) {\n      context.addIssue({\n        code: 'custom',\n        path: [index, 'slug'],\n        message: 'Provider secret-contract entries must be sorted by slug.',\n      });\n    }\n  }\n});\nexport type ProviderSecretContractShape = z.infer<typeof ProviderSecretContractShapeSchema>;\n\n/**\n * A contribution is a wire record produced by one package version and read by\n * another (the CLI, the companion, a generated artifact), so it is a LOOSE\n * object: an additive field from a newer producer rides through an older\n * consumer instead of hard-failing the parse (#328 — it used to be strict,\n * which made every additive field a five-surface change and every old/new\n * mix a boot failure). Required fields stay required; only UNKNOWN keys are\n * tolerated, and they are kept rather than stripped so a re-emitting\n * consumer does not silently drop what it did not understand.\n */\nexport const ProviderCompanionContributionSchema = z.looseObject({\n  ref: z.string().min(1),\n  /**\n   * The provider's identity (package, tier, vendor, origin) as declared on\n   * its module metadata, so tooling can display tiers and group vendors\n   * without loading the runtime module. Optional on the wire for one\n   * reason only: contributions emitted before #328 carry none, and a\n   * discovery walk must still read them.\n   */\n  identity: ProviderIdentitySchema.optional(),\n  /**\n   * Stable package import path that makes the provider implementation reachable\n   * from the contributing package at runtime. This validates owner-package\n   * reachability without coupling discovery to source-file paths.\n   */\n  runtimeImportPath: z.string().min(1),\n  runtimeTargets: z.array(ProviderCompanionRuntimeTargetSchema).min(1),\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n  providerCapabilities: z.array(z.string().min(1)).default([]),\n  protocols: z.array(z.string().min(1)).default([]),\n  secretsContractShape: ProviderSecretContractShapeSchema,\n  /**\n   * Optional frontend-safe provider payload for `frontendService` runtime\n   * targets. Tooling materializes this into generated runtime artifacts so the\n   * backend bootstrap endpoint can serve app-owned public providers without\n   * importing frontend packages at runtime.\n   */\n  frontendEntry: FrontendProviderEntrySchema.optional(),\n  /**\n   * Optional app module owner when the provider implementation belongs to one\n   * concrete module instead of the whole package/runtime.\n   */\n  sourceModuleId: z.string().min(1).optional(),\n});\nexport type ProviderCompanionContribution = z.infer<typeof ProviderCompanionContributionSchema>;\n\nexport interface RuntimeOwnerCompanionExports {\n  providerContributions?: ProviderCompanionContribution[];\n}\n"]}
+{"version":3,"file":"provider-discovery.shared.schemas.js","sourceRoot":"","sources":["../../../src/companion/provider-discovery.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAEhG;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/E,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KAC3B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;KAC7B,CAAC;IACF,0CAA0C;IAC1C,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChI,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACrB,OAAO,EAAE,4CAA4C,KAAK,CAAC,IAAI,IAAI;aACpE,CAAC,CAAC;QACL,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC3B,OAAO,EAAE,kDAAkD,KAAK,CAAC,UAAU,IAAI;aAChF,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEtC,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACrB,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC3C;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,oBAAoB,EAAE,iCAAiC;IACvD;;;;;OAKG;IACH,aAAa,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { AppFrontendType } from '../config/app-frontend-type.shared.schemas';\nimport { EngineCapability } from '../external-providers/engine-capabilities.shared.schemas';\nimport { FrontendProviderEntrySchema } from '../external-providers/frontend-bootstrap.shared.schemas';\nimport { ProviderIdentitySchema } from '../external-providers/provider-metadata.shared.schemas';\n\n/**\n * Companion-safe provider implementation declaration.\n *\n * App/runtime-owner packages expose these entries through their `./companion`\n * default export so tooling can discover which provider refs are actually\n * reachable from which runtime owners before materializing generated artifacts.\n */\n\n/**\n * Discriminator branch for `frontendService` runtime targets.\n *\n * Targets a frontend service by its `AppFrontendType` (the closed kind set\n * — SAAS_APP, STATIC_WEBSITE, TECH_DOC) rather than by an app-defined\n * `serviceKey` string. Engine-shipped packages (`external-connectors-public`,\n * etc.) have no way to know app-defined service keys, so the discovery\n * contract is keyed on the type. Apps with multiple frontend services of\n * the same type currently broadcast the contribution to all of them; if\n * per-service-key targeting becomes a need, add a second variant.\n */\nexport const ProviderFrontendServiceRuntimeTargetSchema = z.strictObject({\n  kind: z.literal('frontendService'),\n  serviceType: z.enum(AppFrontendType),\n});\nexport type ProviderFrontendServiceRuntimeTarget = z.infer<typeof ProviderFrontendServiceRuntimeTargetSchema>;\n\nexport const ProviderCompanionRuntimeTargetSchema = z.discriminatedUnion('kind', [\n  z.strictObject({\n    kind: z.literal('backend'),\n  }),\n  z.strictObject({\n    kind: z.literal('companion'),\n  }),\n  ProviderFrontendServiceRuntimeTargetSchema,\n  z.strictObject({\n    kind: z.literal('minion'),\n    minionKey: z.string().min(1),\n  }),\n  z.strictObject({\n    kind: z.literal('worker'),\n    workerKey: z.string().min(1),\n  }),\n]);\nexport type ProviderCompanionRuntimeTarget = z.infer<typeof ProviderCompanionRuntimeTargetSchema>;\n\n/**\n * Values-free projection of one backend provider secret requirement.\n *\n * The stable provider-owned `slug` is preserved separately from the concrete\n * environment-variable name so a rename on either axis changes the lockfile\n * integrity digest. Secret values never cross this companion-safe boundary.\n */\nexport const ProviderSecretContractShapeEntrySchema = z.strictObject({\n  slug: z.string().min(1),\n  envVarName: z.string().min(1),\n  required: z.boolean(),\n  description: z.string().min(1),\n});\nexport type ProviderSecretContractShapeEntry = z.infer<typeof ProviderSecretContractShapeEntrySchema>;\n\n/**\n * Deterministic, values-free secret-contract shape used by provider discovery\n * and lockfile integrity checks.\n *\n * Every contribution must declare this field. `[]` means the provider is\n * authoritatively known to require no secrets; omission is rejected rather\n * than being silently interpreted as an empty contract. Entries must be\n * sorted by `slug`, and both slugs and environment-variable names are unique,\n * so independently contributed facets cannot produce order-dependent digests.\n */\nexport const ProviderSecretContractShapeSchema = z.array(ProviderSecretContractShapeEntrySchema).superRefine((entries, context) => {\n  const seenSlugs = new Set<string>();\n  const seenEnvVarNames = new Set<string>();\n\n  for (const [index, entry] of entries.entries()) {\n    if (seenSlugs.has(entry.slug)) {\n      context.addIssue({\n        code: 'custom',\n        path: [index, 'slug'],\n        message: `Duplicate provider secret-contract slug \"${entry.slug}\".`,\n      });\n    }\n    seenSlugs.add(entry.slug);\n\n    if (seenEnvVarNames.has(entry.envVarName)) {\n      context.addIssue({\n        code: 'custom',\n        path: [index, 'envVarName'],\n        message: `Duplicate provider secret-contract envVarName \"${entry.envVarName}\".`,\n      });\n    }\n    seenEnvVarNames.add(entry.envVarName);\n\n    if (index > 0 && entries[index - 1].slug.localeCompare(entry.slug) >= 0) {\n      context.addIssue({\n        code: 'custom',\n        path: [index, 'slug'],\n        message: 'Provider secret-contract entries must be sorted by slug.',\n      });\n    }\n  }\n});\nexport type ProviderSecretContractShape = z.infer<typeof ProviderSecretContractShapeSchema>;\n\n/**\n * A contribution is a wire record produced by one package version and read by\n * another (the CLI, the companion, a generated artifact), so it is a LOOSE\n * object: an additive field from a newer producer rides through an older\n * consumer instead of hard-failing the parse (#328 — it used to be strict,\n * which made every additive field a five-surface change and every old/new\n * mix a boot failure). Required fields stay required; only UNKNOWN keys are\n * tolerated, and they are kept rather than stripped so a re-emitting\n * consumer does not silently drop what it did not understand.\n */\nexport const ProviderCompanionContributionSchema = z.looseObject({\n  ref: z.string().min(1),\n  /**\n   * The provider's identity (package, tier, vendor, origin) as declared on\n   * its module metadata, so tooling can display tiers and group vendors\n   * without loading the runtime module. Optional on the wire for one\n   * reason only: contributions emitted before #328 carry none, and a\n   * discovery walk must still read them.\n   */\n  identity: ProviderIdentitySchema.optional(),\n  /**\n   * Stable package import path that makes the provider implementation reachable\n   * from the contributing package at runtime. This validates owner-package\n   * reachability without coupling discovery to source-file paths.\n   */\n  runtimeImportPath: z.string().min(1),\n  runtimeTargets: z.array(ProviderCompanionRuntimeTargetSchema).min(1),\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n  providerCapabilities: z.array(z.string().min(1)).default([]),\n  protocols: z.array(z.string().min(1)).default([]),\n  secretsContractShape: ProviderSecretContractShapeSchema,\n  /**\n   * Optional frontend-safe provider payload for `frontendService` runtime\n   * targets. Tooling materializes this into generated runtime artifacts so the\n   * backend bootstrap endpoint can serve app-owned public providers without\n   * importing frontend packages at runtime.\n   */\n  frontendEntry: FrontendProviderEntrySchema.optional(),\n  /**\n   * Optional app module owner when the provider implementation belongs to one\n   * concrete module instead of the whole package/runtime.\n   */\n  sourceModuleId: z.string().min(1).optional(),\n});\nexport type ProviderCompanionContribution = z.infer<typeof ProviderCompanionContributionSchema>;\n\nexport interface RuntimeOwnerCompanionExports {\n  providerContributions?: ProviderCompanionContribution[];\n}\n"]}

package/dist/esm/companion/shared-library-companion.shared.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared-library-companion.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../src/companion/shared-library-companion.shared.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAExF,MAAM,WAAW,6BAA6B,CAC5C,aAAa,SAAS,gBAAgB,GAAG,gBAAgB,CACzD,SAAQ,4BAA4B;IACpC,iBAAiB,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CACnD"}
+{"version":3,"file":"shared-library-companion.shared.definitions.d.ts","sourceRoot":"","sources":["../../../src/companion/shared-library-companion.shared.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAExF,MAAM,WAAW,6BAA6B,CAC5C,aAAa,SAAS,gBAAgB,GAAG,gBAAgB,CACzD,SAAQ,4BAA4B;IACpC,iBAAiB,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CACnD"}

package/dist/esm/companion-exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"companion-exports.d.ts","sourceRoot":"","sources":["../../../src/companion-exports.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,yDAAyD,CAAC"}
+{"version":3,"file":"companion-exports.d.ts","sourceRoot":"","sources":["../../src/companion-exports.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,yDAAyD,CAAC"}

package/dist/esm/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAgC,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAI1I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,eAAO,MAAM,+DAA+D,GAC1E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBA8F9C,CAAC"}
+{"version":3,"file":"application-audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAgC,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAI1I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,eAAO,MAAM,+DAA+D,GAC1E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBA8F9C,CAAC"}

package/dist/esm/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-audit-logs.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrH,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAC7E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,8KAA8K;IAC9K,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,4GAA4G;oBAC5G,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C;;;;;;uBAMG;oBACH,uCAAuC,EAAE,IAAI;iBAC9C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB;;;;;2BAKG;wBACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,qLAAqL;oBACrL,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAU;oBACtE,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAU;oBAC3D,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { AuditEventCategory, AuditEventSeverity, AuditableEvent_BaseSchema } from './auditable-events.shared.schema';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\n\n/**\n * The APPLICATION-scoped door onto the audit trail.\n *\n * ## Why this exists at all\n *\n * `AUDIT_LOGS` is organization-scoped and its only route is\n * `/organizations/{organizationId}/audit-logs`, so it returns exactly the rows carrying that\n * tenant. A large share of security events carry NO organization by design — `logUserLogin` takes\n * `organizationId` as optional because no organization is selected at login, and the same is true\n * of session eviction, token refresh and application-wide authentication-policy changes. Measured\n * on a dogfood application (#317): **94 of 127 rows had no organization**, and were reachable\n * through no API. An operator could see 26% of the trail and could not attest the rest, while a\n * reader querying the only available surface saw `user_login: 0` for a control that had emitted 21.\n *\n * ## Why a SEPARATE resource type rather than a second route\n *\n * `generateParentCombinations` composes every URL as\n * `[...primaryScope, ...mandatoryContext, ...optionalCombo]`, so a routed application edge on\n * `AUDIT_LOGS` would appear in EVERY combination and rewrite the organization route to\n * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` — breaking all eight of\n * its documented paths and their consumers. Making the organization edge optional does not help:\n * the empty combination is skipped whenever any parent exists, so no bare route is emitted either.\n * A sibling type carrying ONE application parent takes the route it needs and leaves the existing\n * door byte-identical. The pattern is the engine's own: notification badges are dual-scope with a\n * type per scope, `APPLICATION_API_KEYS` shows the application routing shape, and `USER_SELF`\n * shows a distinct type addressing another's rows.\n *\n * ## Two doors, ONE record set — the security contract\n *\n * Both types resolve to the `auditLogs` collection through\n * `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES`. That makes the isolation properties a\n * per-DOOR obligation rather than a property of the rows:\n *\n * - the organization door keeps its tenant filter and its organization roles, unchanged;\n * - this door is `APP_ADMIN_SUPER_ADMIN`-ONLY on every operation. An organization role must never\n *   reach it — the rows behind it span every tenant;\n * - a read here that touches a tenant-attributed row is a CROSS-TENANT read and OWES an audit\n *   emission. **It is wired**, by the two halves below acting together, and neither is optional:\n *   each read variant declares `admitsCrossTenantPlatformAdministration`, and\n *   `ServicesRegistryHandler.recordCrossTenantReadAccess` observes every enrolled read and emits\n *   `CROSS_TENANT_ADMINISTRATIVE_ACCESS` once per TENANT the returned rows belong to. The\n *   declaration is what enrols the read: `authorizeOrganizations` — where that event is otherwise\n *   emitted — runs only for ORGANIZATIONS-scoped resources and decides on ONE fetched row, so it\n *   never sees this door at all. Grouping per tenant is what makes the crossing visible to the\n *   REACHED tenant, in its own organization-scoped viewer, rather than only to the operator.\n *   `.claude/rules/administrative-continuity-floors.md` requires every crossing to be named in the\n *   trail, and the trail is the worst possible surface on which to make an operator read invisible.\n *   See `security/authorizations/cross-tenant-read-observation.backend.ts` for why an UNDECLARED\n *   door is deliberately not observed instead of being observed with a false `admissionDeclared`.\n *\n * ## Deliberately mirrored from the organization resource\n *\n * `isSystemResource`, `systemAccessPolicy.exportSubject: FORBIDDEN` and the ABSENCE of a\n * `retentionPolicy` are copied ON PURPOSE. They are properties of the ROWS, and the rows are the\n * same ones — a second door that disagreed about whether the audit trail is subject-exportable, or\n * about how long it is kept, would be a policy fork over one record set. See the organization\n * config for the reasoning behind each; do not change one without the other.\n *\n * ## Deliberately NOT mirrored\n *\n * There is no CREATE. The organization resource carries a `REPOSITORY_ONLY` CREATE because that is\n * how audit rows are written; writing is not a scope question and must keep exactly one door.\n */\nexport const applicationAuditLogsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<\n  undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH,\n  typeof AuditableEvent_BaseSchema\n>({\n  mainSchema: AuditableEvent_BaseSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_AUDIT_LOGS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_AUDIT_LOGS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  /** Mirrored from the organization door — the same rows, so the same answer. Disclosing the monitoring trail to its own subject is self-defeating and out of Art. 20 scope. */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        /** APP_ADMIN_SUPER_ADMIN ONLY — never an organization role. The rows behind this door span every tenant. */\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        /**\n         * Reading ONE tenant's audit row through the application door IS a crossing, so the cheapest\n         * reach — fetch by id — is declared and audited exactly like the collection verbs. Declaring\n         * it is also what stops `assignInitiatorOrganizationConfinementToFilter` silently narrowing\n         * this door to an operator who happens to carry an ambient organization, which would make a\n         * surface documented as spanning every tenant return one tenant and report success.\n         */\n        admitsCrossTenantPlatformAdministration: true,\n      }],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        /** The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. */\n        admitsCrossTenantPlatformAdministration: true,\n        filterFields: {\n          eventType: z.string(),\n          eventCategory: z.enum(AuditEventCategory),\n          severity: z.enum(AuditEventSeverity),\n          userId: z.string(),\n          /**\n           * Filterable so an operator can narrow to one tenant THROUGH this door, which is the\n           * cross-tenant investigation this surface exists for. It is a FILTER, never the isolation\n           * boundary: isolation on this door is the role gate above, and narrowing to a tenant does\n           * not make the read any less cross-tenant for audit purposes.\n           */\n          organizationId: z.string(),\n          correlationId: z.string(),\n          clientInstanceId: z.string(),\n          createdAt: z.date(),\n        },\n        /** `eventId` last, as the keyset tie-breaker — `createdAt` is not unique under boot/seed bursts. Mirrors the organization door; removing it reintroduces a paging data-loss path. */\n        sortFields: ['createdAt', 'severity', 'eventType', 'eventId'] as const,\n        maxPaginatedResultPerPageLimit: 100,\n      }],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        /** The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. */\n        admitsCrossTenantPlatformAdministration: true,\n        isSearchable: false,\n        searchableFields: [],\n        filterFields: {\n          eventType: z.string(),\n          eventCategory: z.enum(AuditEventCategory),\n          severity: z.enum(AuditEventSeverity),\n          userId: z.string(),\n          organizationId: z.string(),\n          correlationId: z.string(),\n          clientInstanceId: z.string(),\n          createdAt: z.date(),\n        },\n        sortFields: ['createdAt', 'severity', 'eventType'] as const,\n        maxPaginatedResultPerPageLimit: 100,\n      }],\n    },\n  },\n});\n"]}
+{"version":3,"file":"application-audit-logs.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrH,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAC7E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,8KAA8K;IAC9K,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,4GAA4G;oBAC5G,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C;;;;;;uBAMG;oBACH,uCAAuC,EAAE,IAAI;iBAC9C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB;;;;;2BAKG;wBACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,qLAAqL;oBACrL,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAU;oBACtE,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAU;oBAC3D,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { AuditEventCategory, AuditEventSeverity, AuditableEvent_BaseSchema } from './auditable-events.shared.schema';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\n\n/**\n * The APPLICATION-scoped door onto the audit trail.\n *\n * ## Why this exists at all\n *\n * `AUDIT_LOGS` is organization-scoped and its only route is\n * `/organizations/{organizationId}/audit-logs`, so it returns exactly the rows carrying that\n * tenant. A large share of security events carry NO organization by design — `logUserLogin` takes\n * `organizationId` as optional because no organization is selected at login, and the same is true\n * of session eviction, token refresh and application-wide authentication-policy changes. Measured\n * on a dogfood application (#317): **94 of 127 rows had no organization**, and were reachable\n * through no API. An operator could see 26% of the trail and could not attest the rest, while a\n * reader querying the only available surface saw `user_login: 0` for a control that had emitted 21.\n *\n * ## Why a SEPARATE resource type rather than a second route\n *\n * `generateParentCombinations` composes every URL as\n * `[...primaryScope, ...mandatoryContext, ...optionalCombo]`, so a routed application edge on\n * `AUDIT_LOGS` would appear in EVERY combination and rewrite the organization route to\n * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` — breaking all eight of\n * its documented paths and their consumers. Making the organization edge optional does not help:\n * the empty combination is skipped whenever any parent exists, so no bare route is emitted either.\n * A sibling type carrying ONE application parent takes the route it needs and leaves the existing\n * door byte-identical. The pattern is the engine's own: notification badges are dual-scope with a\n * type per scope, `APPLICATION_API_KEYS` shows the application routing shape, and `USER_SELF`\n * shows a distinct type addressing another's rows.\n *\n * ## Two doors, ONE record set — the security contract\n *\n * Both types resolve to the `auditLogs` collection through\n * `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES`. That makes the isolation properties a\n * per-DOOR obligation rather than a property of the rows:\n *\n * - the organization door keeps its tenant filter and its organization roles, unchanged;\n * - this door is `APP_ADMIN_SUPER_ADMIN`-ONLY on every operation. An organization role must never\n *   reach it — the rows behind it span every tenant;\n * - a read here that touches a tenant-attributed row is a CROSS-TENANT read and OWES an audit\n *   emission. **It is wired**, by the two halves below acting together, and neither is optional:\n *   each read variant declares `admitsCrossTenantPlatformAdministration`, and\n *   `ServicesRegistryHandler.recordCrossTenantReadAccess` observes every enrolled read and emits\n *   `CROSS_TENANT_ADMINISTRATIVE_ACCESS` once per TENANT the returned rows belong to. The\n *   declaration is what enrols the read: `authorizeOrganizations` — where that event is otherwise\n *   emitted — runs only for ORGANIZATIONS-scoped resources and decides on ONE fetched row, so it\n *   never sees this door at all. Grouping per tenant is what makes the crossing visible to the\n *   REACHED tenant, in its own organization-scoped viewer, rather than only to the operator.\n *   `.claude/rules/administrative-continuity-floors.md` requires every crossing to be named in the\n *   trail, and the trail is the worst possible surface on which to make an operator read invisible.\n *   See `security/authorizations/cross-tenant-read-observation.backend.ts` for why an UNDECLARED\n *   door is deliberately not observed instead of being observed with a false `admissionDeclared`.\n *\n * ## Deliberately mirrored from the organization resource\n *\n * `isSystemResource`, `systemAccessPolicy.exportSubject: FORBIDDEN` and the ABSENCE of a\n * `retentionPolicy` are copied ON PURPOSE. They are properties of the ROWS, and the rows are the\n * same ones — a second door that disagreed about whether the audit trail is subject-exportable, or\n * about how long it is kept, would be a policy fork over one record set. See the organization\n * config for the reasoning behind each; do not change one without the other.\n *\n * ## Deliberately NOT mirrored\n *\n * There is no CREATE. The organization resource carries a `REPOSITORY_ONLY` CREATE because that is\n * how audit rows are written; writing is not a scope question and must keep exactly one door.\n */\nexport const applicationAuditLogsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<\n  undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH,\n  typeof AuditableEvent_BaseSchema\n>({\n  mainSchema: AuditableEvent_BaseSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_AUDIT_LOGS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_AUDIT_LOGS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  /** Mirrored from the organization door — the same rows, so the same answer. Disclosing the monitoring trail to its own subject is self-defeating and out of Art. 20 scope. */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        /** APP_ADMIN_SUPER_ADMIN ONLY — never an organization role. The rows behind this door span every tenant. */\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        /**\n         * Reading ONE tenant's audit row through the application door IS a crossing, so the cheapest\n         * reach — fetch by id — is declared and audited exactly like the collection verbs. Declaring\n         * it is also what stops `assignInitiatorOrganizationConfinementToFilter` silently narrowing\n         * this door to an operator who happens to carry an ambient organization, which would make a\n         * surface documented as spanning every tenant return one tenant and report success.\n         */\n        admitsCrossTenantPlatformAdministration: true,\n      }],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        /** The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. */\n        admitsCrossTenantPlatformAdministration: true,\n        filterFields: {\n          eventType: z.string(),\n          eventCategory: z.enum(AuditEventCategory),\n          severity: z.enum(AuditEventSeverity),\n          userId: z.string(),\n          /**\n           * Filterable so an operator can narrow to one tenant THROUGH this door, which is the\n           * cross-tenant investigation this surface exists for. It is a FILTER, never the isolation\n           * boundary: isolation on this door is the role gate above, and narrowing to a tenant does\n           * not make the read any less cross-tenant for audit purposes.\n           */\n          organizationId: z.string(),\n          correlationId: z.string(),\n          clientInstanceId: z.string(),\n          createdAt: z.date(),\n        },\n        /** `eventId` last, as the keyset tie-breaker — `createdAt` is not unique under boot/seed bursts. Mirrors the organization door; removing it reintroduces a paging data-loss path. */\n        sortFields: ['createdAt', 'severity', 'eventType', 'eventId'] as const,\n        maxPaginatedResultPerPageLimit: 100,\n      }],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        /** The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. */\n        admitsCrossTenantPlatformAdministration: true,\n        isSearchable: false,\n        searchableFields: [],\n        filterFields: {\n          eventType: z.string(),\n          eventCategory: z.enum(AuditEventCategory),\n          severity: z.enum(AuditEventSeverity),\n          userId: z.string(),\n          organizationId: z.string(),\n          correlationId: z.string(),\n          clientInstanceId: z.string(),\n          createdAt: z.date(),\n        },\n        sortFields: ['createdAt', 'severity', 'eventType'] as const,\n        maxPaginatedResultPerPageLimit: 100,\n      }],\n    },\n  },\n});\n"]}

package/dist/esm/compliance/audit-trails/audit-log-sink.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log-sink.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-log-sink.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,oBAAY,0BAA0B;IACpC,2EAA2E;IAC3E,QAAQ,aAAa;IACrB,0GAA0G;IAC1G,MAAM,WAAW;IACjB,oGAAoG;IACpG,QAAQ,aAAa;IACrB,yGAAyG;IACzG,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,OAAO,CAAC;IAClB,4FAA4F;IAC5F,MAAM,EAAE,0BAA0B,CAAC;IACnC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,6BAA6B;IAC5C,qHAAqH;IACrH,2BAA2B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,qFAAqF;IACrF,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D"}
+{"version":3,"file":"audit-log-sink.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/audit-log-sink.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,oBAAY,0BAA0B;IACpC,2EAA2E;IAC3E,QAAQ,aAAa;IACrB,0GAA0G;IAC1G,MAAM,WAAW;IACjB,oGAAoG;IACpG,QAAQ,aAAa;IACrB,yGAAyG;IACzG,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,OAAO,CAAC;IAClB,4FAA4F;IAC5F,MAAM,EAAE,0BAA0B,CAAC;IACnC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,6BAA6B;IAC5C,qHAAqH;IACrH,2BAA2B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,qFAAqF;IACrF,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D"}

package/dist/esm/compliance/audit-trails/audit-logs.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAE1B,oBAAoB,EAErB,MAAM,0CAA0C,CAAC;AAOlD,oBAAY,oBAAoB;IAC9B,iBAAiB,oBAAoB;CACtC;AAID,eAAO,MAAM,0BAA0B;;;;;;;;;;kBAa5B,CAAC;AAEZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;kBAI7B,CAAC;AAEZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAO1F;;;;;GAKG;AACH,eAAO,MAAM,oDAAoD,GAC/D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBA8K9C,CAAC"}
+{"version":3,"file":"audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAE1B,oBAAoB,EAErB,MAAM,0CAA0C,CAAC;AAOlD,oBAAY,oBAAoB;IAC9B,iBAAiB,oBAAoB;CACtC;AAID,eAAO,MAAM,0BAA0B;;;;;;;;;;kBAa5B,CAAC;AAEZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;kBAI7B,CAAC;AAEZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAO1F;;;;;GAKG;AACH,eAAO,MAAM,oDAAoD,GAC/D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBA8K9C,CAAC"}

package/dist/esm/compliance/audit-trails/audit-trail-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-trail-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-trail-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,eAAO,MAAM,sBAAsB;;;iBAsDjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,4DAA4D"}
+{"version":3,"file":"audit-trail-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/audit-trail-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,eAAO,MAAM,sBAAsB;;;iBAsDjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,4DAA4D"}

package/dist/esm/compliance/audit-trails/audit-trail-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-trail-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-trail-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,iCAAiC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,4DAA4D","sourcesContent":["import { z } from 'zod';\n\n/**\n * @wildo_source:part:start saas.models.audit.trail-config facet:layer:shared facet:audience:app-developer\n *\n * `AuditTrailConfig` — application-level operator-tunable configuration for the\n * compliance audit-trail subsystem.\n *\n * ⚠️ **`archiveAfterDays` IS the opt-in, and it never deletes anything.** While it is unset the\n * archival job still runs and does nothing, and every audit record stays in the primary store\n * indefinitely — so an application that has never set it is accumulating, not rotating.\n *\n * Setting it does not shrink the primary store either. `AUDIT_LOGS` is immutable by invariant: it\n * has no UPDATE and no DELETE, so records older than the horizon are COPIED to durable archival\n * artifacts in file storage while the originals remain. The field is named `archiveAfterDays` rather\n * than `retentionDays` for exactly that reason — nothing is retained-then-deleted, and an operator\n * expecting the primary store to shrink has misread it.\n *\n * The decision is taken at each tick from live configuration, so changing the value takes effect\n * without a restart, and a misconfigured value cannot orphan the schedule. An application that turns\n * this on after it already has aged data seeds the archive with a one-off wider look-back run.\n *\n * Phase 5 / F1 (audit-logging plan). Mirrors {@link DataSeedingConfigSchema} /\n * {@link LifecycleConfigSchema} in shape and intent: a small, OPTIONAL block on\n * the shared application configuration ({@link AppConfiguration_Shared_Schema})\n * that tunes an engine-owned background batch — here the\n * `compliance:audit-logs-archive` cron batch — without forking the factory's\n * built-in defaults.\n *\n * It also carries the subsystem's one EGRESS posture\n * ({@link allowPrivateNetworkSiemCollectors}), which belongs to the operator rather\n * than to the tenant who authors a SIEM destination — see that field's own JSDoc\n * for why the distinction is the whole control.\n *\n * --------------------------------------------------------------------------\n * Archival, NOT deletion — audit logs are immutable\n * --------------------------------------------------------------------------\n * The `AUDIT_LOGS` resource is IMMUTABLE by invariant (G5): its\n * `coreOperations` are `READ | LIST | SEARCH | CREATE` — there is NO `UPDATE`\n * and NO `DELETE`. The retention mechanism therefore NEVER removes audit\n * records from the primary store. Instead, records older than\n * {@link archiveAfterDays} are EXPORTED (copied) to durable off-DB archival\n * artifacts in file storage by the archival batch, while the original rows\n * remain in the always-on `AUDIT_LOGS` store (and, when configured, in the\n * append-only immudb tamper-proof ledger). This is why the field is named\n * `archiveAfterDays` and not `retentionDays`: nothing is retained-then-deleted;\n * the value is purely the ARCHIVAL HORIZON. (The distinction mirrors the\n * `archiveAfterDays` vs `retentionDays` split in the general\n * `DataRetentionPolicySchema`.)\n *\n * --------------------------------------------------------------------------\n * Why the config lives in `saas-models` (not next to the batch)\n * --------------------------------------------------------------------------\n * The runtime wiring (`StartApplicationBackendService.initialize`) and the\n * batch body read operator-tunable configuration EXCLUSIVELY from\n * `appConfigService.config?.*` — i.e. the {@link AppConfiguration_Shared_Schema}\n * aggregate. Placing the schema here (rather than in `saas-backend-lib` next to\n * the batch) keeps every operator-tunable engine batch symmetric with\n * `dataSeeding` / `lifecycle` and gives one source of truth the batch factory\n * and the startup validator can both import (`saas-models` cannot depend on\n * `saas-backend-lib` — the dependency arrow points the other way).\n *\n * --------------------------------------------------------------------------\n * Bounds + production floor\n * --------------------------------------------------------------------------\n * {@link archiveAfterDays} bounds mirror the SSO `auditConfig.retentionDays`\n * precedent (min 1 day, max 2555 ≈ 7 years). A stricter PRODUCTION FLOOR (365\n * days) is enforced at boot by\n * `ApplicationStartupConfigValidatorService.validate()` — NOT by a schema-level\n * `.min()` and NOT by a Zod `.superRefine()`, because the environment\n * (development vs staging/production) is a RUNTIME signal\n * (`process.env.APPLICATION_ENV`) that a pure, environment-agnostic shared\n * schema must not read. The schema `.min(1)` is the absolute floor; the runtime\n * validator raises it to 365 outside development.\n */\nexport const AuditTrailConfigSchema = z.object({\n  /**\n   * Age (in days) beyond which audit records are EXPORTED to durable archival\n   * file-storage artifacts by the `compliance:audit-logs-archive` cron batch.\n   *\n   * Records are NEVER deleted from the primary `AUDIT_LOGS` store — this is the\n   * archival horizon only (see the block-level JSDoc on why the field is\n   * `archiveAfterDays`, not `retentionDays`).\n   *\n   * OPTIONAL — when omitted (`undefined`), NO archival runs and audit records\n   * are retained in the primary store indefinitely. This is the compliance-safe\n   * default: an operator must explicitly opt in before any archival happens.\n   *\n   * Bounds: min 1 / max 2555 (≈ 7 years), mirroring the SSO\n   * `auditConfig.retentionDays` precedent. A production floor of 365 days is\n   * enforced at boot (see block-level JSDoc) — setting a value below 365 in a\n   * staging/production environment fails startup with a CONFIGURATION error.\n   */\n  archiveAfterDays: z.number().int().min(1).max(2555).optional(),\n\n  /**\n   * May a SIEM export deliver to a collector on an address the public internet cannot reach?\n   *\n   * ── What it is for ─────────────────────────────────────────────────────────\n   * A SIEM webhook URL is TENANT-authored (`siemExportConfig.webhookUrl`, written by an organization\n   * administrator) and the delivery worker POSTs to it with the deployment's own network position.\n   * That is a server-side request forgery primitive by construction, and the classic targets are the\n   * ones every guard in `security/ssrf` names: `169.254.169.254`, loopback admin ports, RFC 1918.\n   *\n   * But one legitimate deployment shape genuinely lives there: a self-hosted collector (Splunk,\n   * QRadar, a syslog bridge) on the same private network as the application. Refusing that\n   * unconditionally would not be \"safe\" — it would break a supported topology and push operators to\n   * a worse workaround.\n   *\n   * ── Why it is an OPERATOR field and not a tenant field ─────────────────────\n   * It lives HERE, on the application configuration the deployment operator authors, and NOT on\n   * `SiemExportConfigBaseSchema`, which the tenant authors. A tenant-settable \"allow private\n   * addresses\" flag would hand the party supplying the attacker-controlled URL the switch that\n   * disarms the guard aimed at them — an SSRF bypass with a checkbox. The operator declares the\n   * network posture; the tenant chooses a destination within it.\n   *\n   * ── Why OPTIONAL rather than `.default(false)` ─────────────────────────────\n   * The reader tests for `=== true`, so absent is refuse, and the fail-closed posture is the one you\n   * get by doing nothing — the same contract `archiveAfterDays` states one field above. It is left\n   * without a Zod default so `AuditTrailConfigSchema.parse({})` still round-trips as `{}`; an\n   * always-materialised `false` would make the block non-empty for every application that never\n   * authored it, which is what the pin below this schema's tests exists to prevent.\n   *\n   * ── What it does NOT relax ─────────────────────────────────────────────────\n   * Not the scheme policy, not the credentials-in-URL refusal, and not the PINNING: the delivery\n   * still connects only to an address classified at the moment of connection. It widens WHICH\n   * addresses are admitted, never whether the admitted address is the one connected to.\n   */\n  allowPrivateNetworkSiemCollectors: z.boolean().optional(),\n});\n\nexport type AuditTrailConfig = z.infer<typeof AuditTrailConfigSchema>;\n/** @wildo_source:part:end saas.models.audit.trail-config */\n"]}
+{"version":3,"file":"audit-trail-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/audit-trail-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,iCAAiC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,4DAA4D","sourcesContent":["import { z } from 'zod';\n\n/**\n * @wildo_source:part:start saas.models.audit.trail-config facet:layer:shared facet:audience:app-developer\n *\n * `AuditTrailConfig` — application-level operator-tunable configuration for the\n * compliance audit-trail subsystem.\n *\n * ⚠️ **`archiveAfterDays` IS the opt-in, and it never deletes anything.** While it is unset the\n * archival job still runs and does nothing, and every audit record stays in the primary store\n * indefinitely — so an application that has never set it is accumulating, not rotating.\n *\n * Setting it does not shrink the primary store either. `AUDIT_LOGS` is immutable by invariant: it\n * has no UPDATE and no DELETE, so records older than the horizon are COPIED to durable archival\n * artifacts in file storage while the originals remain. The field is named `archiveAfterDays` rather\n * than `retentionDays` for exactly that reason — nothing is retained-then-deleted, and an operator\n * expecting the primary store to shrink has misread it.\n *\n * The decision is taken at each tick from live configuration, so changing the value takes effect\n * without a restart, and a misconfigured value cannot orphan the schedule. An application that turns\n * this on after it already has aged data seeds the archive with a one-off wider look-back run.\n *\n * Phase 5 / F1 (audit-logging plan). Mirrors {@link DataSeedingConfigSchema} /\n * {@link LifecycleConfigSchema} in shape and intent: a small, OPTIONAL block on\n * the shared application configuration ({@link AppConfiguration_Shared_Schema})\n * that tunes an engine-owned background batch — here the\n * `compliance:audit-logs-archive` cron batch — without forking the factory's\n * built-in defaults.\n *\n * It also carries the subsystem's one EGRESS posture\n * ({@link allowPrivateNetworkSiemCollectors}), which belongs to the operator rather\n * than to the tenant who authors a SIEM destination — see that field's own JSDoc\n * for why the distinction is the whole control.\n *\n * --------------------------------------------------------------------------\n * Archival, NOT deletion — audit logs are immutable\n * --------------------------------------------------------------------------\n * The `AUDIT_LOGS` resource is IMMUTABLE by invariant (G5): its\n * `coreOperations` are `READ | LIST | SEARCH | CREATE` — there is NO `UPDATE`\n * and NO `DELETE`. The retention mechanism therefore NEVER removes audit\n * records from the primary store. Instead, records older than\n * {@link archiveAfterDays} are EXPORTED (copied) to durable off-DB archival\n * artifacts in file storage by the archival batch, while the original rows\n * remain in the always-on `AUDIT_LOGS` store (and, when configured, in the\n * append-only immudb tamper-proof ledger). This is why the field is named\n * `archiveAfterDays` and not `retentionDays`: nothing is retained-then-deleted;\n * the value is purely the ARCHIVAL HORIZON. (The distinction mirrors the\n * `archiveAfterDays` vs `retentionDays` split in the general\n * `DataRetentionPolicySchema`.)\n *\n * --------------------------------------------------------------------------\n * Why the config lives in `saas-models` (not next to the batch)\n * --------------------------------------------------------------------------\n * The runtime wiring (`StartApplicationBackendService.initialize`) and the\n * batch body read operator-tunable configuration EXCLUSIVELY from\n * `appConfigService.config?.*` — i.e. the {@link AppConfiguration_Shared_Schema}\n * aggregate. Placing the schema here (rather than in `saas-backend-lib` next to\n * the batch) keeps every operator-tunable engine batch symmetric with\n * `dataSeeding` / `lifecycle` and gives one source of truth the batch factory\n * and the startup validator can both import (`saas-models` cannot depend on\n * `saas-backend-lib` — the dependency arrow points the other way).\n *\n * --------------------------------------------------------------------------\n * Bounds + production floor\n * --------------------------------------------------------------------------\n * {@link archiveAfterDays} bounds mirror the SSO `auditConfig.retentionDays`\n * precedent (min 1 day, max 2555 ≈ 7 years). A stricter PRODUCTION FLOOR (365\n * days) is enforced at boot by\n * `ApplicationStartupConfigValidatorService.validate()` — NOT by a schema-level\n * `.min()` and NOT by a Zod `.superRefine()`, because the environment\n * (development vs staging/production) is a RUNTIME signal\n * (`process.env.APPLICATION_ENV`) that a pure, environment-agnostic shared\n * schema must not read. The schema `.min(1)` is the absolute floor; the runtime\n * validator raises it to 365 outside development.\n */\nexport const AuditTrailConfigSchema = z.object({\n  /**\n   * Age (in days) beyond which audit records are EXPORTED to durable archival\n   * file-storage artifacts by the `compliance:audit-logs-archive` cron batch.\n   *\n   * Records are NEVER deleted from the primary `AUDIT_LOGS` store — this is the\n   * archival horizon only (see the block-level JSDoc on why the field is\n   * `archiveAfterDays`, not `retentionDays`).\n   *\n   * OPTIONAL — when omitted (`undefined`), NO archival runs and audit records\n   * are retained in the primary store indefinitely. This is the compliance-safe\n   * default: an operator must explicitly opt in before any archival happens.\n   *\n   * Bounds: min 1 / max 2555 (≈ 7 years), mirroring the SSO\n   * `auditConfig.retentionDays` precedent. A production floor of 365 days is\n   * enforced at boot (see block-level JSDoc) — setting a value below 365 in a\n   * staging/production environment fails startup with a CONFIGURATION error.\n   */\n  archiveAfterDays: z.number().int().min(1).max(2555).optional(),\n\n  /**\n   * May a SIEM export deliver to a collector on an address the public internet cannot reach?\n   *\n   * ── What it is for ─────────────────────────────────────────────────────────\n   * A SIEM webhook URL is TENANT-authored (`siemExportConfig.webhookUrl`, written by an organization\n   * administrator) and the delivery worker POSTs to it with the deployment's own network position.\n   * That is a server-side request forgery primitive by construction, and the classic targets are the\n   * ones every guard in `security/ssrf` names: `169.254.169.254`, loopback admin ports, RFC 1918.\n   *\n   * But one legitimate deployment shape genuinely lives there: a self-hosted collector (Splunk,\n   * QRadar, a syslog bridge) on the same private network as the application. Refusing that\n   * unconditionally would not be \"safe\" — it would break a supported topology and push operators to\n   * a worse workaround.\n   *\n   * ── Why it is an OPERATOR field and not a tenant field ─────────────────────\n   * It lives HERE, on the application configuration the deployment operator authors, and NOT on\n   * `SiemExportConfigBaseSchema`, which the tenant authors. A tenant-settable \"allow private\n   * addresses\" flag would hand the party supplying the attacker-controlled URL the switch that\n   * disarms the guard aimed at them — an SSRF bypass with a checkbox. The operator declares the\n   * network posture; the tenant chooses a destination within it.\n   *\n   * ── Why OPTIONAL rather than `.default(false)` ─────────────────────────────\n   * The reader tests for `=== true`, so absent is refuse, and the fail-closed posture is the one you\n   * get by doing nothing — the same contract `archiveAfterDays` states one field above. It is left\n   * without a Zod default so `AuditTrailConfigSchema.parse({})` still round-trips as `{}`; an\n   * always-materialised `false` would make the block non-empty for every application that never\n   * authored it, which is what the pin below this schema's tests exists to prevent.\n   *\n   * ── What it does NOT relax ─────────────────────────────────────────────────\n   * Not the scheme policy, not the credentials-in-URL refusal, and not the PINNING: the delivery\n   * still connects only to an address classified at the moment of connection. It widens WHICH\n   * addresses are admitted, never whether the admitted address is the one connected to.\n   */\n  allowPrivateNetworkSiemCollectors: z.boolean().optional(),\n});\n\nexport type AuditTrailConfig = z.infer<typeof AuditTrailConfigSchema>;\n/** @wildo_source:part:end saas.models.audit.trail-config */\n"]}