@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/resources/utils/shared-persistence-collection.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared-persistence-collection.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,eAAO,MAAM,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAe3F,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CAAC,YAAY,EAAE,YAAY,GAAG,MAAM,CAEzF;AAED,iGAAiG;AACjG,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAClE;AAED,gFAAgF;AAChF,MAAM,WAAW,6CAA6C;IAC5D,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,EAAE,CAAC;IAC9F,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,kDAAkD,CAChE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,EACnF,yBAAyB,EAAE,sBAAsB,GAChD,6CAA6C,EAAE,CAsDjD;AAED,mGAAmG;AACnG,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,oBAAoB,CAAA;KAAE,GAAG,SAAS,CAAC;CACxE;AAyBD,iFAAiF;AACjF,MAAM,WAAW,+CAA+C;IAC9D,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CAAA;KAAE,EAAE,CAAC;IACrG,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,oDAAoD,CAClE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,6CAA6C,CAAC,GACpF,+CAA+C,EAAE,CA0DnD"}
+{"version":3,"file":"shared-persistence-collection.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,eAAO,MAAM,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAe3F,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CAAC,YAAY,EAAE,YAAY,GAAG,MAAM,CAEzF;AAED,iGAAiG;AACjG,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAClE;AAED,gFAAgF;AAChF,MAAM,WAAW,6CAA6C;IAC5D,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,EAAE,CAAC;IAC9F,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,kDAAkD,CAChE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,EACnF,yBAAyB,EAAE,sBAAsB,GAChD,6CAA6C,EAAE,CAsDjD;AAED,mGAAmG;AACnG,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,oBAAoB,CAAA;KAAE,GAAG,SAAS,CAAC;CACxE;AAyBD,iFAAiF;AACjF,MAAM,WAAW,+CAA+C;IAC9D,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CAAA;KAAE,EAAE,CAAC;IACrG,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,oDAAoD,CAClE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,6CAA6C,CAAC,GACpF,+CAA+C,EAAE,CA0DnD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,iCAAiC;IAC3C,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB"}

package/dist/esm/resources/utils/shared-persistence-collection.utils.js

@@ -292,4 +292,34 @@ export function findSharedPersistenceCollectionRetentionIncoherences(resourceCon
     }
     return incoherences;
 }
+/**
+ * The privilege AXES a database credential issued to a named runtime principal (a minion) is built
+ * from — one closed vocabulary shared by every storage adapter that mints such a credential.
+ *
+ * Each axis is a distinct verb set, not a strength on a scale, and they must never be merged:
+ *
+ * - {@link READ} — read rows.
+ * - {@link WRITE} — insert, update and delete. The only axis that can REMOVE a row.
+ * - {@link APPEND} — insert only. A principal can add a row and never amend or remove it, which is
+ *   what makes it the axis for evidence: an audit trail a principal can rewrite is not an audit trail.
+ * - {@link MAINTAIN} — insert and update, never delete, for durable runtime state whose history must
+ *   survive the principal that advances it.
+ *
+ * It lives beside the collection aliases because a grant is issued per COLLECTION: the alias map says
+ * which rows a grant on a resource type reaches, and this says which verbs it carries there. The
+ * derivation that fills each axis, and the engine floor it adds, live in `platform-config-lib`
+ * (`deriveMinionDatabaseGrants`); the MongoDB and PostgreSQL adapters each translate an axis into
+ * their own privilege dialect.
+ *
+ * Scope, stated because it is easy to over-read: this governs NAMED runtime principals only. The
+ * application backend is not issued an axis-scoped credential — it owns its database — so nothing
+ * here constrains what the backend's own credential can do to a row.
+ */
+export var RuntimePrincipalDatabaseGrantAxis;
+(function (RuntimePrincipalDatabaseGrantAxis) {
+    RuntimePrincipalDatabaseGrantAxis["READ"] = "read";
+    RuntimePrincipalDatabaseGrantAxis["WRITE"] = "write";
+    RuntimePrincipalDatabaseGrantAxis["APPEND"] = "append";
+    RuntimePrincipalDatabaseGrantAxis["MAINTAIN"] = "maintain";
+})(RuntimePrincipalDatabaseGrantAxis || (RuntimePrincipalDatabaseGrantAxis = {}));
 //# sourceMappingURL=shared-persistence-collection.utils.js.map

package/dist/esm/resources/utils/shared-persistence-collection.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared-persistence-collection.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAKxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK;IACpD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,aAAa;IACrE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,gBAAgB,CAAC,gBAAgB;IAC3E;;;;;;;;;OASG;IACH,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,UAAU;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,YAA0B;IAC/E,OAAO,8CAA8C,CAAC,YAAsB,CAAC,IAAK,YAAuB,CAAC;AAC5G,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,kDAAkD,CAChE,sBAAmF,EACnF,yBAAiD;IAEjD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,2FAA2F;QAC3F,0EAA0E;QAC1E,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG;YACZ,YAAY;YACZ,OAAO,EAAE,cAAc,EAAE,kBAAkB,IAAI,yBAAyB;SACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAoD,EAAE,CAAC;IAEzE,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,sBAAsB,cAAc,+BAA+B;gBAChG,8FAA8F;gBAC9F,gGAAgG;gBAChG,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,+FAA+F;gBAC/F,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAAC,eAA4D;IAC5F,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAA0C,CAAC;SACvE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,oDAAoD,CAClE,sBAAqF;IAErF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG;YACd,YAAY;YACZ,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI;YAC3C,UAAU,EAAE,wBAAwB,CAAC,cAAc,EAAE,eAAe,CAAC;SACtE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAsD,EAAE,CAAC;IAE3E,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;aACnG,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,uBAAuB,cAAc,2BAA2B;gBAC7F,gGAAgG;gBAChG,+FAA+F;gBAC/F,iGAAiG;gBACjG,+FAA+F;gBAC/F,2FAA2F;gBAC3F,6FAA6F;gBAC7F,gGAAgG;gBAChG,6FAA6F;gBAC7F,8BAA8B;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import { CoreResourceType } from '../resources.shared.core.definitions';\nimport type { ResourceType } from '../resources.shared.schemas';\nimport type { PersistenceAdapterType } from '../resources-config.shared.schemas';\nimport { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Resource types that deliberately project onto ANOTHER resource type's\n * persistence collection — THE authority for \"which configs address the same\n * physical rows?\".\n *\n * ## What this expresses\n *\n * A `USER_SELF*` resource is not a different record set; it is a different DOOR\n * onto the SAME record set, with its own operations, roles and scoping. The\n * `USERS` door is the admin surface (list every user, delete a user); the\n * `USER_SELF` door is the self surface (read/update MY row). They intentionally\n * share `UserSchema` and they intentionally share storage — the persistence\n * layer builds a SEPARATE model per resource config over ONE collection.\n *\n * Anything not listed here stores under its own resource type.\n *\n * ## Why it is a single named authority\n *\n * This mapping had already been copied twice inside the backend (the\n * zod→mongoose model builder, which is what actually creates and reads the\n * collection, and the aggregation collection resolver — whose earlier\n * divergence made every aggregation query a non-existent collection and return\n * zero rows). It now has a third consumer of a completely different kind:\n * {@link findSharedPersistenceCollectionRetentionIncoherences}, a boot-time\n * coherence guard. A per-resource config factory structurally cannot see this\n * relationship — it validates ONE config at a time — so the fact has to live\n * where every layer can read it, and it has to live exactly once.\n *\n * ## The alias belongs to the RESOURCE, not to the storage adapter\n *\n * Every persistence path resolves through this map, and each adapter has\n * exactly ONE composition point that does so: MongoDB's model builder and its\n * aggregation resolver, and — on the SQL side — the single\n * `resolveTableNameForResource` helper that the hybrid planner, the PostgreSQL\n * repository and the boot-time table verifier all call.\n *\n * This was NOT always true, and the way it failed is the reason to keep it\n * true: PostgreSQL used to derive its table name straight from\n * `resourceIdentifier`, so `USER_SELF` planned, wrote and verified a `userself`\n * table while `USERS` used `users`. An adapter choice must never silently\n * change WHICH RECORDS a resource addresses — that is not a storage detail, it\n * is the \"two doors, one record set\" contract itself. On the SQL side the\n * resolved name is additionally normalised into a SQL identifier; casing is an\n * adapter concern, the alias is not.\n *\n * The one thing a shared resolver still cannot see is an alias group whose\n * members are pointed at DIFFERENT adapters — each config is individually\n * valid, and only the pair is wrong. That is what\n * {@link findSharedPersistenceCollectionAdapterIncoherences} fails closed on.\n */\nexport const RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES: Readonly<Record<string, string>> = {\n  [CoreResourceType.USER_SELF]: CoreResourceType.USERS,\n  [CoreResourceType.USER_SELF_PROFILES]: CoreResourceType.USER_PROFILES,\n  [CoreResourceType.USER_SELF_PREFERENCES]: CoreResourceType.USER_PREFERENCES,\n  /*\n   * The application-scoped audit door addresses the organization-scoped resource's rows (#317).\n   *\n   * Unlike the `USER_SELF` group above — where the alias exists so a principal can address its OWN\n   * row through a narrower door — this pair exists because the two doors see DIFFERENT SUBSETS of\n   * one set: the organization door is tenant-filtered and structurally cannot return the rows that\n   * carry no organization (logins, session evictions, application-wide policy changes), which is\n   * 74% of them on a measured dogfood application. Splitting the storage would split the audit\n   * trail itself, so the alias is load-bearing rather than a convenience.\n   */\n  [CoreResourceType.APPLICATION_AUDIT_LOGS]: CoreResourceType.AUDIT_LOGS,\n};\n\n/**\n * The persistence collection a resource type's rows live in — its alias target\n * when it declares one, otherwise the resource type itself.\n *\n * @param resourceType - the resource type whose storage location is wanted.\n * @returns the collection name, as a plain string.\n */\nexport function resolveSharedPersistenceCollectionName(resourceType: ResourceType): string {\n  return RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES[resourceType as string] ?? (resourceType as string);\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionAdapterIncoherences} reads. */\nexport interface SharedPersistenceCollectionAdapterCandidate {\n  readonly resourceIdentifier: ResourceType;\n  /** The config's OWN declaration; `undefined` means \"inherit the application default\". */\n  readonly persistenceAdapter?: PersistenceAdapterType | undefined;\n}\n\n/** One collection whose resource configs are pointed at different databases. */\nexport interface SharedPersistenceCollectionAdapterIncoherence {\n  /** The shared collection the disagreeing configs claim to address. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the adapter it RESOLVED to. */\n  readonly adapters: readonly { resourceType: ResourceType; adapter: PersistenceAdapterType }[];\n  /** Operator-facing explanation naming the consequence and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must resolve to the SAME persistence adapter.\n *\n * ## Why the shared resolver cannot cover this on its own\n *\n * {@link resolveSharedPersistenceCollectionName} makes the alias\n * adapter-independent: whichever database a resource lands in, it addresses the\n * aliased NAME. That is necessary and not sufficient. A name is only an address\n * WITHIN one database, so pointing `USERS` at PostgreSQL while `USER_SELF`\n * inherits MongoDB yields two stores that both believe they own the same rows.\n * Nothing downstream can detect it: each config is individually valid, each\n * repository is correctly built, and every per-resource check passes.\n *\n * ## The failure it prevents\n *\n * The doors silently stop sharing records. The admin door lists users the self\n * door cannot read; a self-service update writes to a row the admin door will\n * never see; and — because retention is enforced against ROWS — an erasure\n * performed through one door leaves the other door's copy completely\n * untouched, which is the same compliance-grade lie that\n * {@link findSharedPersistenceCollectionRetentionIncoherences} exists to\n * prevent, arrived at from a different direction.\n *\n * The table name is not the only thing that follows from the adapter. Id FORMAT\n * does too — the PostgreSQL repository validates ids as UUIDs while Mongo\n * expects ObjectIds, each resolved from its OWN resource's adapter — so a split\n * group would also reject through one door the very ids the other door mints.\n * Anything keyed on \"this resource's adapter\" inherits this invariant.\n *\n * ## Why this is permanent, not a capability gate\n *\n * Unlike adapter gaps that close when the missing support is implemented, this\n * one has no future in which it becomes valid: two databases cannot hold one\n * set of rows. It is deliberately NOT a ban on aliased resources using\n * PostgreSQL — an alias group that agrees on PostgreSQL resolves to one shared\n * table, and whether that table was actually provisioned is a separate,\n * already-enforced question (the boot-time table verifier).\n *\n * Resources inherit the application default when they declare nothing, so the\n * caller supplies the resolved default rather than this function guessing it.\n *\n * Pure and side-effect free: it reports, the caller throws.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @param defaultPersistenceAdapter - the adapter a config with no declaration inherits.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionAdapterIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionAdapterCandidate>,\n  defaultPersistenceAdapter: PersistenceAdapterType,\n): SharedPersistenceCollectionAdapterIncoherence[] {\n  const adaptersByCollection = new Map<\n    string,\n    { resourceType: ResourceType; adapter: PersistenceAdapterType }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Same reasoning as the retention guard: prefer the config's OWN identifier so a mis-keyed\n    // registry entry is diagnosed against the name its author actually wrote.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const entry = {\n      resourceType,\n      adapter: resourceConfig?.persistenceAdapter ?? defaultPersistenceAdapter,\n    };\n\n    const existing = adaptersByCollection.get(collectionName);\n    if (existing) {\n      existing.push(entry);\n    } else {\n      adaptersByCollection.set(collectionName, [entry]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionAdapterIncoherence[] = [];\n\n  for (const [collectionName, adapters] of adaptersByCollection) {\n    if (adapters.length < 2) {\n      continue;\n    }\n    if (new Set(adapters.map((entry) => entry.adapter)).size < 2) {\n      continue;\n    }\n\n    const declared = adapters\n      .map((entry) => `'${String(entry.resourceType)}' → ${entry.adapter}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      adapters,\n      message:\n        `Resource configs [${declared}] all address the '${collectionName}' persistence collection but ` +\n        `resolve to DIFFERENT persistence adapters. These configs are separate doors onto ONE set of ` +\n        `rows, and a collection name only addresses rows within a single database, so this splits them ` +\n        `across two stores that each believe they own the records: the admin door lists rows the self ` +\n        `door cannot read, a self-service write lands where the admin door will never see it, and an ` +\n        `erasure performed through one door leaves the other door's copy fully intact. Give every ` +\n        `config listed above the same persistenceAdapter (a resource sharing a collection cannot pick ` +\n        `its database alone), or stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionRetentionIncoherences} reads. */\nexport interface SharedPersistenceCollectionRetentionCandidate {\n  readonly resourceIdentifier: ResourceType;\n  readonly retentionPolicy?: { mode?: ErasureRetentionMode } | undefined;\n}\n\n/**\n * Canonical comparison key for a resource's retention POSTURE.\n *\n * Compares the WHOLE resolved policy, not just `mode`. `ResourceRetentionPolicy` carries a single\n * axis today, so `mode` alone would be exhaustive — but this guard exists precisely because config\n * checks that look sufficient go quietly wrong later, and a second axis (a disposal clock, a\n * jurisdiction) added to the policy would otherwise escape the comparison with no compile-time\n * signal. Two configs over one collection must agree on ALL of it.\n *\n * Key order is normalised so authoring order cannot masquerade as a disagreement. `undefined` gets\n * its own key rather than being skipped: \"rows of this resource are hard-deleted\" is a positive\n * claim, and the in-vs-out asymmetry is what produces both failure modes documented below.\n */\nfunction buildRetentionPostureKey(retentionPolicy: { mode?: ErasureRetentionMode } | undefined): string {\n  if (retentionPolicy === undefined || retentionPolicy === null) {\n    return 'NOT_GOVERNED';\n  }\n  const entries = Object.entries(retentionPolicy as Record<string, unknown>)\n    .filter(([, value]) => value !== undefined)\n    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n  return entries.length === 0 ? 'NOT_GOVERNED' : JSON.stringify(entries);\n}\n\n/** One collection whose resource configs disagree about retention governance. */\nexport interface SharedPersistenceCollectionRetentionIncoherence {\n  /** The shared collection the disagreeing configs write to. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the posture it declared. */\n  readonly postures: readonly { resourceType: ResourceType; mode: ErasureRetentionMode | undefined }[];\n  /** Operator-facing explanation naming both failure modes and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must declare the SAME retention posture.\n *\n * ## Why a config that passes every per-resource check can still be broken\n *\n * `retentionPolicy` is validated PER RESOURCE CONFIG by the config factory: it\n * checks that resource's operations, its field treatments, its system-access\n * grants. It cannot check what a SIBLING config declares, because a factory\n * invocation never sees one. But retention is enforced against ROWS, and two\n * configs can own the same rows (see\n * {@link RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES}). So a pair that\n * disagrees produces a config where every individual resource is valid and the\n * COLLECTION is not.\n *\n * ## The two concrete failure modes\n *\n * **1. Fail-open erasure.** The retention hide filter (rows marked `RETAINED`\n * are invisible) and the immutability freeze are injected per resource config,\n * in `buildContextualFilter`. A row erased through the governed door stays\n * fully READABLE and UPDATABLE through the ungoverned one. For the\n * `USERS`/`USER_SELF` pair that ungoverned door exposes READ + UPDATE to\n * `APP_USER` — i.e. the erased subject can still read and edit their own\n * \"erased\" record. The row is erased only from the door that was opted in,\n * which is a compliance-grade lie about the record.\n *\n * **2. Unique-index collision — a hard functional abort.** A retention-governed\n * config scopes each unique index to NON-retained rows (a partial filter on the\n * retention marker), precisely so scrubbed rows leave the index and cannot\n * collide on the shared mask value. An ungoverned config over the same\n * collection emits a PLAIN unique index on the same field. The FIRST erasure\n * succeeds; the SECOND writes the same mask value, hits the plain index, and\n * fails E11000 — inside the erasure transaction, so the whole erasure rolls\n * back. The capability is silently single-use.\n *\n * Both modes are invisible until a real erasure runs, which is why this is a\n * BOOT-time guard and not a test: the point is that a config which passes at\n * boot must actually be able to perform an erasure.\n *\n * ## Why \"one opted in, one not\" is a disagreement, not a default\n *\n * An absent `retentionPolicy` is a positive statement — \"rows of this resource\n * are hard-deleted\" — not an unset value the governed sibling can supply. Both\n * failure modes above are produced by exactly that asymmetry, so `undefined`\n * participates in the comparison as its own posture rather than being skipped.\n *\n * Pure and side-effect free: it reports, the caller throws. That keeps the\n * shared-collection fact and its invariant in the layer both persistence and\n * validation can import, while the registry owns the error shape.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionRetentionIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionRetentionCandidate>,\n): SharedPersistenceCollectionRetentionIncoherence[] {\n  const posturesByCollection = new Map<\n    string,\n    { resourceType: ResourceType; mode: ErasureRetentionMode | undefined; postureKey: string }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Prefer the config's OWN identifier over the map key: the registry keys by resource type, but a\n    // host that mis-keyed an entry would otherwise be diagnosed against a name it never authored.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const posture = {\n      resourceType,\n      mode: resourceConfig?.retentionPolicy?.mode,\n      postureKey: buildRetentionPostureKey(resourceConfig?.retentionPolicy),\n    };\n\n    const existing = posturesByCollection.get(collectionName);\n    if (existing) {\n      existing.push(posture);\n    } else {\n      posturesByCollection.set(collectionName, [posture]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionRetentionIncoherence[] = [];\n\n  for (const [collectionName, postures] of posturesByCollection) {\n    if (postures.length < 2) {\n      continue;\n    }\n    const distinctPostures = new Set(postures.map((posture) => posture.postureKey));\n    if (distinctPostures.size < 2) {\n      continue;\n    }\n\n    const declared = postures\n      .map((posture) => `'${String(posture.resourceType)}' → ${posture.mode ?? 'NOT retention-governed'}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      postures,\n      message:\n        `Resource configs [${declared}] all store in the '${collectionName}' collection but declare ` +\n        `DIFFERENT retention postures. They are separate models over ONE set of rows, and retention is ` +\n        `enforced per resource config, so this ships two defects that only appear when a real erasure ` +\n        `runs: (1) FAIL-OPEN ERASURE — the retention hide filter and the immutability freeze are absent ` +\n        `on the ungoverned door, leaving an erased row readable and updatable there; (2) UNIQUE-INDEX ` +\n        `COLLISION — the governed config scopes its unique indexes to non-retained rows while the ` +\n        `ungoverned one emits plain unique indexes on the same collection, so the SECOND erased row ` +\n        `collides (E11000) and the erasure transaction rolls back. Declare the SAME retentionPolicy on ` +\n        `every config listed above (a resource sharing a collection cannot opt in or out alone), or ` +\n        `stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n"]}
+{"version":3,"file":"shared-persistence-collection.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/shared-persistence-collection.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAKxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK;IACpD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,aAAa;IACrE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,gBAAgB,CAAC,gBAAgB;IAC3E;;;;;;;;;OASG;IACH,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,UAAU;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,YAA0B;IAC/E,OAAO,8CAA8C,CAAC,YAAsB,CAAC,IAAK,YAAuB,CAAC;AAC5G,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,kDAAkD,CAChE,sBAAmF,EACnF,yBAAiD;IAEjD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,2FAA2F;QAC3F,0EAA0E;QAC1E,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG;YACZ,YAAY;YACZ,OAAO,EAAE,cAAc,EAAE,kBAAkB,IAAI,yBAAyB;SACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAoD,EAAE,CAAC;IAEzE,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,sBAAsB,cAAc,+BAA+B;gBAChG,8FAA8F;gBAC9F,gGAAgG;gBAChG,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,+FAA+F;gBAC/F,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAAC,eAA4D;IAC5F,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAA0C,CAAC;SACvE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,oDAAoD,CAClE,sBAAqF;IAErF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,KAAK,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,kBAAkB,IAAI,eAAe,CAAiB,CAAC;QAC7F,MAAM,cAAc,GAAG,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG;YACd,YAAY;YACZ,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI;YAC3C,UAAU,EAAE,wBAAwB,CAAC,cAAc,EAAE,eAAe,CAAC;SACtE,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAsD,EAAE,CAAC;IAE3E,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ;aACtB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;aACnG,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,YAAY,CAAC,IAAI,CAAC;YAChB,cAAc;YACd,QAAQ;YACR,OAAO,EACL,qBAAqB,QAAQ,uBAAuB,cAAc,2BAA2B;gBAC7F,gGAAgG;gBAChG,+FAA+F;gBAC/F,iGAAiG;gBACjG,+FAA+F;gBAC/F,2FAA2F;gBAC3F,6FAA6F;gBAC7F,gGAAgG;gBAChG,6FAA6F;gBAC7F,8BAA8B;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,kDAAa,CAAA;IACb,oDAAe,CAAA;IACf,sDAAiB,CAAA;IACjB,0DAAqB,CAAA;AACvB,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C","sourcesContent":["import { CoreResourceType } from '../resources.shared.core.definitions';\nimport type { ResourceType } from '../resources.shared.schemas';\nimport type { PersistenceAdapterType } from '../resources-config.shared.schemas';\nimport { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Resource types that deliberately project onto ANOTHER resource type's\n * persistence collection — THE authority for \"which configs address the same\n * physical rows?\".\n *\n * ## What this expresses\n *\n * A `USER_SELF*` resource is not a different record set; it is a different DOOR\n * onto the SAME record set, with its own operations, roles and scoping. The\n * `USERS` door is the admin surface (list every user, delete a user); the\n * `USER_SELF` door is the self surface (read/update MY row). They intentionally\n * share `UserSchema` and they intentionally share storage — the persistence\n * layer builds a SEPARATE model per resource config over ONE collection.\n *\n * Anything not listed here stores under its own resource type.\n *\n * ## Why it is a single named authority\n *\n * This mapping had already been copied twice inside the backend (the\n * zod→mongoose model builder, which is what actually creates and reads the\n * collection, and the aggregation collection resolver — whose earlier\n * divergence made every aggregation query a non-existent collection and return\n * zero rows). It now has a third consumer of a completely different kind:\n * {@link findSharedPersistenceCollectionRetentionIncoherences}, a boot-time\n * coherence guard. A per-resource config factory structurally cannot see this\n * relationship — it validates ONE config at a time — so the fact has to live\n * where every layer can read it, and it has to live exactly once.\n *\n * ## The alias belongs to the RESOURCE, not to the storage adapter\n *\n * Every persistence path resolves through this map, and each adapter has\n * exactly ONE composition point that does so: MongoDB's model builder and its\n * aggregation resolver, and — on the SQL side — the single\n * `resolveTableNameForResource` helper that the hybrid planner, the PostgreSQL\n * repository and the boot-time table verifier all call.\n *\n * This was NOT always true, and the way it failed is the reason to keep it\n * true: PostgreSQL used to derive its table name straight from\n * `resourceIdentifier`, so `USER_SELF` planned, wrote and verified a `userself`\n * table while `USERS` used `users`. An adapter choice must never silently\n * change WHICH RECORDS a resource addresses — that is not a storage detail, it\n * is the \"two doors, one record set\" contract itself. On the SQL side the\n * resolved name is additionally normalised into a SQL identifier; casing is an\n * adapter concern, the alias is not.\n *\n * The one thing a shared resolver still cannot see is an alias group whose\n * members are pointed at DIFFERENT adapters — each config is individually\n * valid, and only the pair is wrong. That is what\n * {@link findSharedPersistenceCollectionAdapterIncoherences} fails closed on.\n */\nexport const RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES: Readonly<Record<string, string>> = {\n  [CoreResourceType.USER_SELF]: CoreResourceType.USERS,\n  [CoreResourceType.USER_SELF_PROFILES]: CoreResourceType.USER_PROFILES,\n  [CoreResourceType.USER_SELF_PREFERENCES]: CoreResourceType.USER_PREFERENCES,\n  /*\n   * The application-scoped audit door addresses the organization-scoped resource's rows (#317).\n   *\n   * Unlike the `USER_SELF` group above — where the alias exists so a principal can address its OWN\n   * row through a narrower door — this pair exists because the two doors see DIFFERENT SUBSETS of\n   * one set: the organization door is tenant-filtered and structurally cannot return the rows that\n   * carry no organization (logins, session evictions, application-wide policy changes), which is\n   * 74% of them on a measured dogfood application. Splitting the storage would split the audit\n   * trail itself, so the alias is load-bearing rather than a convenience.\n   */\n  [CoreResourceType.APPLICATION_AUDIT_LOGS]: CoreResourceType.AUDIT_LOGS,\n};\n\n/**\n * The persistence collection a resource type's rows live in — its alias target\n * when it declares one, otherwise the resource type itself.\n *\n * @param resourceType - the resource type whose storage location is wanted.\n * @returns the collection name, as a plain string.\n */\nexport function resolveSharedPersistenceCollectionName(resourceType: ResourceType): string {\n  return RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES[resourceType as string] ?? (resourceType as string);\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionAdapterIncoherences} reads. */\nexport interface SharedPersistenceCollectionAdapterCandidate {\n  readonly resourceIdentifier: ResourceType;\n  /** The config's OWN declaration; `undefined` means \"inherit the application default\". */\n  readonly persistenceAdapter?: PersistenceAdapterType | undefined;\n}\n\n/** One collection whose resource configs are pointed at different databases. */\nexport interface SharedPersistenceCollectionAdapterIncoherence {\n  /** The shared collection the disagreeing configs claim to address. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the adapter it RESOLVED to. */\n  readonly adapters: readonly { resourceType: ResourceType; adapter: PersistenceAdapterType }[];\n  /** Operator-facing explanation naming the consequence and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must resolve to the SAME persistence adapter.\n *\n * ## Why the shared resolver cannot cover this on its own\n *\n * {@link resolveSharedPersistenceCollectionName} makes the alias\n * adapter-independent: whichever database a resource lands in, it addresses the\n * aliased NAME. That is necessary and not sufficient. A name is only an address\n * WITHIN one database, so pointing `USERS` at PostgreSQL while `USER_SELF`\n * inherits MongoDB yields two stores that both believe they own the same rows.\n * Nothing downstream can detect it: each config is individually valid, each\n * repository is correctly built, and every per-resource check passes.\n *\n * ## The failure it prevents\n *\n * The doors silently stop sharing records. The admin door lists users the self\n * door cannot read; a self-service update writes to a row the admin door will\n * never see; and — because retention is enforced against ROWS — an erasure\n * performed through one door leaves the other door's copy completely\n * untouched, which is the same compliance-grade lie that\n * {@link findSharedPersistenceCollectionRetentionIncoherences} exists to\n * prevent, arrived at from a different direction.\n *\n * The table name is not the only thing that follows from the adapter. Id FORMAT\n * does too — the PostgreSQL repository validates ids as UUIDs while Mongo\n * expects ObjectIds, each resolved from its OWN resource's adapter — so a split\n * group would also reject through one door the very ids the other door mints.\n * Anything keyed on \"this resource's adapter\" inherits this invariant.\n *\n * ## Why this is permanent, not a capability gate\n *\n * Unlike adapter gaps that close when the missing support is implemented, this\n * one has no future in which it becomes valid: two databases cannot hold one\n * set of rows. It is deliberately NOT a ban on aliased resources using\n * PostgreSQL — an alias group that agrees on PostgreSQL resolves to one shared\n * table, and whether that table was actually provisioned is a separate,\n * already-enforced question (the boot-time table verifier).\n *\n * Resources inherit the application default when they declare nothing, so the\n * caller supplies the resolved default rather than this function guessing it.\n *\n * Pure and side-effect free: it reports, the caller throws.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @param defaultPersistenceAdapter - the adapter a config with no declaration inherits.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionAdapterIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionAdapterCandidate>,\n  defaultPersistenceAdapter: PersistenceAdapterType,\n): SharedPersistenceCollectionAdapterIncoherence[] {\n  const adaptersByCollection = new Map<\n    string,\n    { resourceType: ResourceType; adapter: PersistenceAdapterType }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Same reasoning as the retention guard: prefer the config's OWN identifier so a mis-keyed\n    // registry entry is diagnosed against the name its author actually wrote.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const entry = {\n      resourceType,\n      adapter: resourceConfig?.persistenceAdapter ?? defaultPersistenceAdapter,\n    };\n\n    const existing = adaptersByCollection.get(collectionName);\n    if (existing) {\n      existing.push(entry);\n    } else {\n      adaptersByCollection.set(collectionName, [entry]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionAdapterIncoherence[] = [];\n\n  for (const [collectionName, adapters] of adaptersByCollection) {\n    if (adapters.length < 2) {\n      continue;\n    }\n    if (new Set(adapters.map((entry) => entry.adapter)).size < 2) {\n      continue;\n    }\n\n    const declared = adapters\n      .map((entry) => `'${String(entry.resourceType)}' → ${entry.adapter}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      adapters,\n      message:\n        `Resource configs [${declared}] all address the '${collectionName}' persistence collection but ` +\n        `resolve to DIFFERENT persistence adapters. These configs are separate doors onto ONE set of ` +\n        `rows, and a collection name only addresses rows within a single database, so this splits them ` +\n        `across two stores that each believe they own the records: the admin door lists rows the self ` +\n        `door cannot read, a self-service write lands where the admin door will never see it, and an ` +\n        `erasure performed through one door leaves the other door's copy fully intact. Give every ` +\n        `config listed above the same persistenceAdapter (a resource sharing a collection cannot pick ` +\n        `its database alone), or stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n\n/** The minimal config shape {@link findSharedPersistenceCollectionRetentionIncoherences} reads. */\nexport interface SharedPersistenceCollectionRetentionCandidate {\n  readonly resourceIdentifier: ResourceType;\n  readonly retentionPolicy?: { mode?: ErasureRetentionMode } | undefined;\n}\n\n/**\n * Canonical comparison key for a resource's retention POSTURE.\n *\n * Compares the WHOLE resolved policy, not just `mode`. `ResourceRetentionPolicy` carries a single\n * axis today, so `mode` alone would be exhaustive — but this guard exists precisely because config\n * checks that look sufficient go quietly wrong later, and a second axis (a disposal clock, a\n * jurisdiction) added to the policy would otherwise escape the comparison with no compile-time\n * signal. Two configs over one collection must agree on ALL of it.\n *\n * Key order is normalised so authoring order cannot masquerade as a disagreement. `undefined` gets\n * its own key rather than being skipped: \"rows of this resource are hard-deleted\" is a positive\n * claim, and the in-vs-out asymmetry is what produces both failure modes documented below.\n */\nfunction buildRetentionPostureKey(retentionPolicy: { mode?: ErasureRetentionMode } | undefined): string {\n  if (retentionPolicy === undefined || retentionPolicy === null) {\n    return 'NOT_GOVERNED';\n  }\n  const entries = Object.entries(retentionPolicy as Record<string, unknown>)\n    .filter(([, value]) => value !== undefined)\n    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n  return entries.length === 0 ? 'NOT_GOVERNED' : JSON.stringify(entries);\n}\n\n/** One collection whose resource configs disagree about retention governance. */\nexport interface SharedPersistenceCollectionRetentionIncoherence {\n  /** The shared collection the disagreeing configs write to. */\n  readonly collectionName: string;\n  /** Every resource config addressing that collection, with the posture it declared. */\n  readonly postures: readonly { resourceType: ResourceType; mode: ErasureRetentionMode | undefined }[];\n  /** Operator-facing explanation naming both failure modes and the fix. */\n  readonly message: string;\n}\n\n/**\n * Registry-ASSEMBLY guardrail: every resource config that resolves to the SAME\n * persistence collection must declare the SAME retention posture.\n *\n * ## Why a config that passes every per-resource check can still be broken\n *\n * `retentionPolicy` is validated PER RESOURCE CONFIG by the config factory: it\n * checks that resource's operations, its field treatments, its system-access\n * grants. It cannot check what a SIBLING config declares, because a factory\n * invocation never sees one. But retention is enforced against ROWS, and two\n * configs can own the same rows (see\n * {@link RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES}). So a pair that\n * disagrees produces a config where every individual resource is valid and the\n * COLLECTION is not.\n *\n * ## The two concrete failure modes\n *\n * **1. Fail-open erasure.** The retention hide filter (rows marked `RETAINED`\n * are invisible) and the immutability freeze are injected per resource config,\n * in `buildContextualFilter`. A row erased through the governed door stays\n * fully READABLE and UPDATABLE through the ungoverned one. For the\n * `USERS`/`USER_SELF` pair that ungoverned door exposes READ + UPDATE to\n * `APP_USER` — i.e. the erased subject can still read and edit their own\n * \"erased\" record. The row is erased only from the door that was opted in,\n * which is a compliance-grade lie about the record.\n *\n * **2. Unique-index collision — a hard functional abort.** A retention-governed\n * config scopes each unique index to NON-retained rows (a partial filter on the\n * retention marker), precisely so scrubbed rows leave the index and cannot\n * collide on the shared mask value. An ungoverned config over the same\n * collection emits a PLAIN unique index on the same field. The FIRST erasure\n * succeeds; the SECOND writes the same mask value, hits the plain index, and\n * fails E11000 — inside the erasure transaction, so the whole erasure rolls\n * back. The capability is silently single-use.\n *\n * Both modes are invisible until a real erasure runs, which is why this is a\n * BOOT-time guard and not a test: the point is that a config which passes at\n * boot must actually be able to perform an erasure.\n *\n * ## Why \"one opted in, one not\" is a disagreement, not a default\n *\n * An absent `retentionPolicy` is a positive statement — \"rows of this resource\n * are hard-deleted\" — not an unset value the governed sibling can supply. Both\n * failure modes above are produced by exactly that asymmetry, so `undefined`\n * participates in the comparison as its own posture rather than being skipped.\n *\n * Pure and side-effect free: it reports, the caller throws. That keeps the\n * shared-collection fact and its invariant in the layer both persistence and\n * validation can import, while the registry owns the error shape.\n *\n * @param resourceConfigurations - every assembled resource config, keyed by resource type.\n * @returns one entry per incoherent collection; empty when the registry is coherent.\n */\nexport function findSharedPersistenceCollectionRetentionIncoherences(\n  resourceConfigurations: Record<string, SharedPersistenceCollectionRetentionCandidate>,\n): SharedPersistenceCollectionRetentionIncoherence[] {\n  const posturesByCollection = new Map<\n    string,\n    { resourceType: ResourceType; mode: ErasureRetentionMode | undefined; postureKey: string }[]\n  >();\n\n  for (const [resourceTypeKey, resourceConfig] of Object.entries(resourceConfigurations)) {\n    // Prefer the config's OWN identifier over the map key: the registry keys by resource type, but a\n    // host that mis-keyed an entry would otherwise be diagnosed against a name it never authored.\n    const resourceType = (resourceConfig?.resourceIdentifier ?? resourceTypeKey) as ResourceType;\n    const collectionName = resolveSharedPersistenceCollectionName(resourceType);\n    const posture = {\n      resourceType,\n      mode: resourceConfig?.retentionPolicy?.mode,\n      postureKey: buildRetentionPostureKey(resourceConfig?.retentionPolicy),\n    };\n\n    const existing = posturesByCollection.get(collectionName);\n    if (existing) {\n      existing.push(posture);\n    } else {\n      posturesByCollection.set(collectionName, [posture]);\n    }\n  }\n\n  const incoherences: SharedPersistenceCollectionRetentionIncoherence[] = [];\n\n  for (const [collectionName, postures] of posturesByCollection) {\n    if (postures.length < 2) {\n      continue;\n    }\n    const distinctPostures = new Set(postures.map((posture) => posture.postureKey));\n    if (distinctPostures.size < 2) {\n      continue;\n    }\n\n    const declared = postures\n      .map((posture) => `'${String(posture.resourceType)}' → ${posture.mode ?? 'NOT retention-governed'}`)\n      .join(', ');\n\n    incoherences.push({\n      collectionName,\n      postures,\n      message:\n        `Resource configs [${declared}] all store in the '${collectionName}' collection but declare ` +\n        `DIFFERENT retention postures. They are separate models over ONE set of rows, and retention is ` +\n        `enforced per resource config, so this ships two defects that only appear when a real erasure ` +\n        `runs: (1) FAIL-OPEN ERASURE — the retention hide filter and the immutability freeze are absent ` +\n        `on the ungoverned door, leaving an erased row readable and updatable there; (2) UNIQUE-INDEX ` +\n        `COLLISION — the governed config scopes its unique indexes to non-retained rows while the ` +\n        `ungoverned one emits plain unique indexes on the same collection, so the SECOND erased row ` +\n        `collides (E11000) and the erasure transaction rolls back. Declare the SAME retentionPolicy on ` +\n        `every config listed above (a resource sharing a collection cannot opt in or out alone), or ` +\n        `stop sharing the collection.`,\n    });\n  }\n\n  return incoherences;\n}\n\n/**\n * The privilege AXES a database credential issued to a named runtime principal (a minion) is built\n * from — one closed vocabulary shared by every storage adapter that mints such a credential.\n *\n * Each axis is a distinct verb set, not a strength on a scale, and they must never be merged:\n *\n * - {@link READ} — read rows.\n * - {@link WRITE} — insert, update and delete. The only axis that can REMOVE a row.\n * - {@link APPEND} — insert only. A principal can add a row and never amend or remove it, which is\n *   what makes it the axis for evidence: an audit trail a principal can rewrite is not an audit trail.\n * - {@link MAINTAIN} — insert and update, never delete, for durable runtime state whose history must\n *   survive the principal that advances it.\n *\n * It lives beside the collection aliases because a grant is issued per COLLECTION: the alias map says\n * which rows a grant on a resource type reaches, and this says which verbs it carries there. The\n * derivation that fills each axis, and the engine floor it adds, live in `platform-config-lib`\n * (`deriveMinionDatabaseGrants`); the MongoDB and PostgreSQL adapters each translate an axis into\n * their own privilege dialect.\n *\n * Scope, stated because it is easy to over-read: this governs NAMED runtime principals only. The\n * application backend is not issued an axis-scoped credential — it owns its database — so nothing\n * here constrains what the backend's own credential can do to a row.\n */\nexport enum RuntimePrincipalDatabaseGrantAxis {\n  READ = 'read',\n  WRITE = 'write',\n  APPEND = 'append',\n  MAINTAIN = 'maintain',\n}\n"]}

package/dist/esm/resources/utils/templatable-file-fields.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templatable-file-fields.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/templatable-file-fields.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,iCAAiC;IAChD,mBAAmB,CAAC,EAAE,CACpB,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,KAChC,CAAC,CAAC,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,yCAA0C,SAAQ,KAAK;aAEhD,SAAS,EAAE,MAAM;aACjB,gBAAgB,EAAE,kBAAkB,GAAG,SAAS;aAChD,mBAAmB,EAAE,kBAAkB,GAAG,SAAS;gBAFnD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,EAChD,mBAAmB,EAAE,kBAAkB,GAAG,SAAS;CAOtE;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,CAAC,CAAC,UAAU,EACpB,UAAU,SAAK,EACf,aAAa,UAAQ,EACrB,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,wBAAwB,EAAE,CAmG5B;AAmDD;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,CAAC,CAAC,UAAU,EACpB,OAAO,GAAE,iCAAsC,EAC/C,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,CAAC,CAAC,UAAU,CA4Md"}
+{"version":3,"file":"templatable-file-fields.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/templatable-file-fields.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAkBL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,iCAAiC;IAChD,mBAAmB,CAAC,EAAE,CACpB,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,KAChC,CAAC,CAAC,UAAU,CAAC;CACnB;AAiBD,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,yCAA0C,SAAQ,KAAK;aAEhD,SAAS,EAAE,MAAM;aACjB,gBAAgB,EAAE,kBAAkB,GAAG,SAAS;aAChD,mBAAmB,EAAE,kBAAkB,GAAG,SAAS;gBAFnD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,EAChD,mBAAmB,EAAE,kBAAkB,GAAG,SAAS;CAOtE;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,CAAC,CAAC,UAAU,EACpB,UAAU,SAAK,EACf,aAAa,UAAQ,EACrB,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,wBAAwB,EAAE,CAmG5B;AAmDD;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,CAAC,CAAC,UAAU,EACpB,OAAO,GAAE,iCAAsC,EAC/C,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,CAAC,CAAC,UAAU,CAgOd"}

package/dist/esm/resources/utils/templatable-file-fields.shared.utils.js

@@ -1,5 +1,19 @@
-import { getFileMetadata, getZodDefArrayProperty, getZodDef, getZodDefProperty, getZodDefSchemaProperty, getZodDefStringProperty, getZodObjectShape, getZodType, isTemplatableFileField, isZodArray, isZodDefault, isZodNullable, isZodObject, isZodOptional, unwrapSchema, withArrayElement, } from '@wildo-ai/zod-decorators';
+import { getFileMetadata, getZodDefArrayProperty, getZodDef, getZodDefProperty, getZodDefSchemaProperty, getZodDefStringProperty, getZodObjectShape, getZodType, isTemplatableFileField, isZodArray, isZodDefault, isZodNullable, isZodObject, isZodOptional, SCHEMA_METADATA, unwrapSchema, withArrayElement, } from '@wildo-ai/zod-decorators';
 import { z } from 'zod';
+/**
+ * Carry decorator metadata (`SCHEMA_METADATA`) from a schema onto the instance that replaces it.
+ *
+ * Structured value types (`z_address`, `z_file`, `z_money`, `z_range`, …) record their identity as
+ * metadata on the schema INSTANCE. A rebuild that does not carry it turns the field into a plain
+ * object, and the form then renders its parts as unrelated inputs.
+ */
+function carrySchemaMetadata(source, rebuilt) {
+    const metadata = source[SCHEMA_METADATA];
+    if (metadata !== undefined) {
+        rebuilt[SCHEMA_METADATA] = metadata;
+    }
+    return rebuilt;
+}
 export class IncompatibleTemplatableFileFieldPathError extends Error {
     fieldName;
     existingMetadata;
@@ -136,17 +150,30 @@ export function stripTemplatableFileFieldsRecursively(schema, options = {}, acti
     }
     activeSchemas.add(schema);
     try {
+        /*
+         * Wrappers hand back the ORIGINAL instance when nothing beneath them changed (#989).
+         *
+         * They used to rebuild `inner.optional()` unconditionally. A fresh wrapper is a different
+         * instance, so the enclosing object read it as "changed" and was rebuilt too — and the rebuild
+         * dropped the object's decorator metadata. A `z_address()` nested in any object therefore reached
+         * the create and update request DTOs as a plain object, and the form rendered its parts as
+         * unrelated text inputs. Identity is what tells the object branch nothing was stripped.
+         */
         if (isZodOptional(schema)) {
             const innerSchema = getZodDefSchemaProperty(schema, 'innerType');
-            return innerSchema
-                ? stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas).optional()
-                : schema;
+            if (!innerSchema) {
+                return schema;
+            }
+            const strippedInner = stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas);
+            return strippedInner === innerSchema ? schema : carrySchemaMetadata(schema, strippedInner.optional());
         }
         if (isZodNullable(schema)) {
             const innerSchema = getZodDefSchemaProperty(schema, 'innerType');
-            return innerSchema
-                ? stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas).nullable()
-                : schema;
+            if (!innerSchema) {
+                return schema;
+            }
+            const strippedInner = stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas);
+            return strippedInner === innerSchema ? schema : carrySchemaMetadata(schema, strippedInner.nullable());
         }
         if (isZodDefault(schema)) {
             const innerSchema = getZodDefSchemaProperty(schema, 'innerType');
@@ -154,13 +181,16 @@ export function stripTemplatableFileFieldsRecursively(schema, options = {}, acti
                 return schema;
             }
             const strippedInner = stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas);
+            if (strippedInner === innerSchema) {
+                return schema;
+            }
             // Re-READ the default per parse rather than carrying a value across. In Zod 4
             // `def.defaultValue` is a GETTER, so reading it here EVALUATES the default —
             // and this stripped schema is built once, at configuration time, so a value
             // read here would be frozen into every parse the process performs. (The old
             // `typeof defaultValue === 'function'` branch could never fire for a dynamic
             // default for the same reason: the getter returns the VALUE, not the factory.)
-            return strippedInner.default(() => getZodDefProperty(schema, 'defaultValue'));
+            return carrySchemaMetadata(schema, strippedInner.default(() => getZodDefProperty(schema, 'defaultValue')));
         }
         const schemaType = getZodType(schema);
         if (schemaType === 'pipe') {
@@ -210,9 +240,13 @@ export function stripTemplatableFileFieldsRecursively(schema, options = {}, acti
             if (strippedOptions.length < 2) {
                 return strippedOptions[0] ?? schema;
             }
-            return discriminator
+            if (strippedOptions.every((option, index) => option === unionOptions[index])) {
+                return schema;
+            }
+            const rebuiltUnion = discriminator
                 ? z.discriminatedUnion(discriminator, strippedOptions)
                 : z.union(strippedOptions);
+            return carrySchemaMetadata(schema, rebuiltUnion);
         }
         if (isZodArray(schema)) {
             const elementSchema = getZodDefProperty(schema, 'element');
@@ -311,12 +345,16 @@ function rebuildObjectSchemaPreservingSemantics(schema, strippedShape) {
         const omittedSchema = removedFields.length > 0
             ? schema.omit(Object.fromEntries(removedFields.map((fieldName) => [fieldName, true])))
             : schema;
-        return omittedSchema.extend(strippedShape);
+        const extended = omittedSchema.extend(strippedShape);
+        // Same field set, only a nested field replaced: the object is still what its metadata describes.
+        // A field REMOVED means it may not be, so the metadata stays behind on that path (#989).
+        return removedFields.length === 0 ? carrySchemaMetadata(schema, extended) : extended;
     }
     catch {
         const rebuiltSchema = z.object(strippedShape);
         const catchallSchema = getZodDefProperty(schema, 'catchall');
-        return catchallSchema ? rebuiltSchema.catchall(catchallSchema) : rebuiltSchema;
+        const rebuilt = catchallSchema ? rebuiltSchema.catchall(catchallSchema) : rebuiltSchema;
+        return removedFields.length === 0 ? carrySchemaMetadata(schema, rebuilt) : rebuilt;
     }
 }
 //# sourceMappingURL=templatable-file-fields.shared.utils.js.map

package/dist/esm/resources/utils/templatable-file-fields.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"templatable-file-fields.shared.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/templatable-file-fields.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,sBAAsB,EACtB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,WAAW,EACX,aAAa,EACb,YAAY,EACZ,gBAAgB,GAEjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,MAAM,OAAO,yCAA0C,SAAQ,KAAK;IAEhD;IACA;IACA;IAHlB,YACkB,SAAiB,EACjB,gBAAgD,EAChD,mBAAmD;QAEnE,KAAK,CACH,kFAAkF,SAAS,IAAI,CAChG,CAAC;QANc,cAAS,GAAT,SAAS,CAAQ;QACjB,qBAAgB,GAAhB,gBAAgB,CAAgC;QAChD,wBAAmB,GAAnB,mBAAmB,CAAgC;QAKnE,IAAI,CAAC,IAAI,GAAG,2CAA2C,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAoB,EACpB,UAAU,GAAG,EAAE,EACf,aAAa,GAAG,KAAK,EACrB,gBAAiC,IAAI,OAAO,EAAU;IAEtD,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzD,OAAO,8BAA8B,CAAC;gBACpC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,OAAO,WAAW;gBAChB,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC;gBACzF,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAED,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,gCAAgC,CAAC,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,sBAAsB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,SAAS,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;YACtD,MAAM,UAAU,GAAG,OAAO,UAAU,KAAK,UAAU;gBACjD,CAAC,CAAC,UAAU,EAAE;gBACd,CAAC,CAAC,SAAS,CAAC;YACd,OAAO,UAAU;gBACf,CAAC,CAAC,gCAAgC,CAAC,UAA0B,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC;gBACxG,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAED,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACpE,MAAM,WAAW,GAAG,uBAAuB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACtE,OAAO,8BAA8B,CAAC;gBACpC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,gCAAgC,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7G,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChH,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,sBAAsB,CAAC,eAAe,EAAE,SAAS,CAA+B,CAAC;YACtG,OAAO,8BAA8B,CACnC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACtC,gCAAgC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CACnF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,iBAAiB,CAAC,eAAe,EAAE,SAAS,CAA6B,CAAC;YAChG,OAAO,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,CAAC;QAED,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5E,MAAM,WAAW,GAAG,uBAAuB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YAC1E,OAAO,WAAW;gBAChB,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC;gBAChF,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,sBAAsB,CAAC,eAAe,EAAE,OAAO,CAA+B,CAAC;YAClG,MAAM,UAAU,GAAG,uBAAuB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,8BAA8B,CAAC;gBACpC,GAAG,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,gCAAgC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CACxE,CAAC;gBACF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,gCAAgC,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QACjD,OAAO,8BAA8B,CACnC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE;YACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,OAAO,gCAAgC,CAAC,WAA2B,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAC/G,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAkC;IAElC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoC,CAAC;IAChE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,QAAQ,IAAI,CAAC,oCAAoC,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,yCAAyC,CACjD,KAAK,CAAC,SAAS,EACf,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAChC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ;YACvC,CAAC,CAAC;gBACE,GAAG,QAAQ;gBACX,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;aAC7D;YACH,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3D,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAc;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oCAAoC,CAC3C,UAAwB,EACxB,WAAyB;IAEzB,OAAO,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,MAAoB,EACpB,UAA6C,EAAE,EAC/C,gBAAiC,IAAI,OAAO,EAAU;IAEtD,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,OAAO,WAAW;gBAChB,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE;gBACvF,CAAC,CAAC,MAAM,CAAC;QACb,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,OAAO,WAAW;gBAChB,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE;gBACvF,CAAC,CAAC,MAAM,CAAC;QACb,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YACjG,8EAA8E;YAC9E,6EAA6E;YAC7E,4EAA4E;YAC5E,4EAA4E;YAC5E,6EAA6E;YAC7E,+EAA+E;YAC/E,OAAO,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAY,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,QAAQ;gBACzB,CAAC,CAAC,qCAAqC,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;gBACzE,CAAC,CAAC,QAAQ,CAAC;YACb,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,qCAAqC,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC1E,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,UAAU,KAAK,QAAQ,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBACzD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;gBAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,WAAW,IAAI,UAAU,IAAI,MAAM,CAAC;QAC7C,CAAC;QAED,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC7C,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACjB,qCAAqC,CAAC,UAAU,EAAkB,EAAE,OAAO,EAAE,aAAa,CAAC,CAC5F,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,YAAY,GAAG,UAAU;gBAC7B,CAAC,CAAC,qCAAqC,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC3E,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC5E,CAAC,CAAC,WAAW,CAAC;YAChB,OAAO,YAAY,KAAK,UAAU,IAAI,aAAa,KAAK,WAAW;gBACjE,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAA+B,CAAC;YAC7F,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClD,qCAAqC,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CACtE,CAAC;YACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;YACtC,CAAC;YAED,OAAO,aAAa;gBAClB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAClB,aAAa,EACb,eAA8E,CAC/E;gBACH,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAkE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAA6B,CAAC;YACvF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,eAAe,GAAG,qCAAqC,CAAC,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YAErG,wFAAwF;YACxF,2CAA2C;YAC3C,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;gBACtC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,kDAAkD;YAClD,OAAO,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC5E,CAAC,CAAC,WAAW,CAAC;YAChB,OAAO,WAAW,IAAI,aAAa,KAAK,WAAW;gBACjD,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAQ,EAAE,aAAa,CAAC;gBAC3D,CAAC,CAAC,MAAM,CAAC;QACb,CAAC;QAED,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC5E,CAAC,CAAC,WAAW,CAAC;YAChB,OAAO,SAAS,IAAI,WAAW,IAAI,aAAa,KAAK,WAAW;gBAC9D,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC;QACb,CAAC;QAED,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC5E,CAAC,CAAC,WAAW,CAAC;YAChB,OAAO,WAAW,IAAI,aAAa,KAAK,WAAW;gBACjD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC;QACb,CAAC;QAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAA+B,CAAC;YACzF,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,aAAa,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpD,qCAAqC,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CACpE,CAAC;YACF,MAAM,YAAY,GAAG,UAAU;gBAC7B,CAAC,CAAC,qCAAqC,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC3E,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;mBAC5E,YAAY,KAAK,UAAU,CAAC;YACjC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,aAAoB,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,aAAa,GAAiC,EAAE,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;YAChD,IAAI,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YAED,MAAM,cAAc,GAAG,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YAClG,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;gBACnC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,aAAa,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,OAAO,CAAC,mBAAmB;YAChC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC;YACpD,CAAC,CAAC,sCAAsC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,sCAAsC,CAC7C,MAAwB,EACxB,aAA2C;IAE3C,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC;IAEtG,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAyB,CAAC;YAC9G,CAAC,CAAC,MAAM,CAAC;QAEX,OAAO,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAA6B,CAAC;QACzF,OAAO,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IACjF,CAAC;AACH,CAAC","sourcesContent":["import {\n  getFileMetadata,\n  getZodDefArrayProperty,\n  getZodDef,\n  getZodDefProperty,\n  getZodDefSchemaProperty,\n  getZodDefStringProperty,\n  getZodObjectShape,\n  getZodType,\n  isTemplatableFileField,\n  isZodArray,\n  isZodDefault,\n  isZodNullable,\n  isZodObject,\n  isZodOptional,\n  unwrapSchema,\n  withArrayElement,\n  type FileSchemaMetadata,\n} from '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\n\nexport interface StripTemplatableFileFieldsOptions {\n  rebuildObjectSchema?: (\n    schema: z.ZodObject<any>,\n    shape: Record<string, z.ZodTypeAny>,\n  ) => z.ZodTypeAny;\n}\n\nexport interface TemplatableFileFieldPath {\n  fieldName: string;\n  schema: z.ZodTypeAny;\n  isInsideArray: boolean;\n}\n\nexport class IncompatibleTemplatableFileFieldPathError extends Error {\n  constructor(\n    public readonly fieldName: string,\n    public readonly existingMetadata: FileSchemaMetadata | undefined,\n    public readonly conflictingMetadata: FileSchemaMetadata | undefined,\n  ) {\n    super(\n      `Incompatible generated file metadata detected for templatable file field path \"${fieldName}\".`,\n    );\n    this.name = 'IncompatibleTemplatableFileFieldPathError';\n  }\n}\n\nexport function collectTemplatableFileFieldPaths(\n  schema: z.ZodTypeAny,\n  pathPrefix = '',\n  isInsideArray = false,\n  activeSchemas: WeakSet<object> = new WeakSet<object>(),\n): TemplatableFileFieldPath[] {\n  if (activeSchemas.has(schema)) {\n    return [];\n  }\n\n  activeSchemas.add(schema);\n  try {\n    const rawSchemaType = getZodType(schema);\n    if (rawSchemaType === 'pipe') {\n      const inSchema = getZodDefSchemaProperty(schema, 'in');\n      const outSchema = getZodDefSchemaProperty(schema, 'out');\n      return mergeTemplatableFileFieldPaths([\n        ...(inSchema ? collectTemplatableFileFieldPaths(inSchema, pathPrefix, isInsideArray, activeSchemas) : []),\n        ...(outSchema ? collectTemplatableFileFieldPaths(outSchema, pathPrefix, isInsideArray, activeSchemas) : []),\n      ]);\n    }\n\n    if (isZodOptional(schema) || isZodNullable(schema) || isZodDefault(schema)) {\n      const innerSchema = getZodDefSchemaProperty(schema, 'innerType');\n      return innerSchema\n        ? collectTemplatableFileFieldPaths(innerSchema, pathPrefix, isInsideArray, activeSchemas)\n        : [];\n    }\n\n    const unwrappedSchema = unwrapSchema(schema);\n    if (unwrappedSchema !== schema) {\n      return collectTemplatableFileFieldPaths(unwrappedSchema, pathPrefix, isInsideArray, activeSchemas);\n    }\n\n    if (isTemplatableFileField(unwrappedSchema)) {\n      return pathPrefix ? [{ fieldName: pathPrefix, schema: unwrappedSchema, isInsideArray }] : [];\n    }\n\n    const schemaType = getZodType(unwrappedSchema);\n    if (schemaType === 'lazy') {\n      const lazyGetter = getZodDef(unwrappedSchema)?.getter;\n      const lazySchema = typeof lazyGetter === 'function'\n        ? lazyGetter()\n        : undefined;\n      return lazySchema\n        ? collectTemplatableFileFieldPaths(lazySchema as z.ZodTypeAny, pathPrefix, isInsideArray, activeSchemas)\n        : [];\n    }\n\n    if (schemaType === 'intersection') {\n      const leftSchema = getZodDefSchemaProperty(unwrappedSchema, 'left');\n      const rightSchema = getZodDefSchemaProperty(unwrappedSchema, 'right');\n      return mergeTemplatableFileFieldPaths([\n        ...(leftSchema ? collectTemplatableFileFieldPaths(leftSchema, pathPrefix, isInsideArray, activeSchemas) : []),\n        ...(rightSchema ? collectTemplatableFileFieldPaths(rightSchema, pathPrefix, isInsideArray, activeSchemas) : []),\n      ]);\n    }\n\n    if (schemaType === 'union') {\n      const unionOptions = getZodDefArrayProperty(unwrappedSchema, 'options') as z.ZodTypeAny[] | undefined;\n      return mergeTemplatableFileFieldPaths(\n        (unionOptions ?? []).flatMap((option) =>\n          collectTemplatableFileFieldPaths(option, pathPrefix, isInsideArray, activeSchemas)\n        ),\n      );\n    }\n\n    if (isZodArray(unwrappedSchema)) {\n      const elementSchema = getZodDefProperty(unwrappedSchema, 'element') as z.ZodTypeAny | undefined;\n      return elementSchema ? collectTemplatableFileFieldPaths(elementSchema, pathPrefix, true, activeSchemas) : [];\n    }\n\n    if (schemaType === 'record' || schemaType === 'map' || schemaType === 'set') {\n      const valueSchema = getZodDefSchemaProperty(unwrappedSchema, 'valueType');\n      return valueSchema\n        ? collectTemplatableFileFieldPaths(valueSchema, pathPrefix, true, activeSchemas)\n        : [];\n    }\n\n    if (schemaType === 'tuple') {\n      const tupleItems = getZodDefArrayProperty(unwrappedSchema, 'items') as z.ZodTypeAny[] | undefined;\n      const restSchema = getZodDefSchemaProperty(unwrappedSchema, 'rest');\n      return mergeTemplatableFileFieldPaths([\n        ...((tupleItems ?? []).flatMap((item) =>\n          collectTemplatableFileFieldPaths(item, pathPrefix, true, activeSchemas)\n        )),\n        ...(restSchema ? collectTemplatableFileFieldPaths(restSchema, pathPrefix, true, activeSchemas) : []),\n      ]);\n    }\n\n    if (!isZodObject(unwrappedSchema)) {\n      return [];\n    }\n\n    const shape = getZodObjectShape(unwrappedSchema);\n    return mergeTemplatableFileFieldPaths(\n      Object.entries(shape).flatMap(([fieldName, fieldSchema]) => {\n        const nextPath = pathPrefix ? `${pathPrefix}.${fieldName}` : fieldName;\n        return collectTemplatableFileFieldPaths(fieldSchema as z.ZodTypeAny, nextPath, isInsideArray, activeSchemas);\n      }),\n    );\n  } finally {\n    activeSchemas.delete(schema);\n  }\n}\n\nfunction mergeTemplatableFileFieldPaths(\n  fields: TemplatableFileFieldPath[],\n): TemplatableFileFieldPath[] {\n  const byFieldName = new Map<string, TemplatableFileFieldPath>();\n  for (const field of fields) {\n    const existing = byFieldName.get(field.fieldName);\n    if (existing && !areTemplatableFileMetadataCompatible(existing.schema, field.schema)) {\n      throw new IncompatibleTemplatableFileFieldPathError(\n        field.fieldName,\n        getFileMetadata(existing.schema),\n        getFileMetadata(field.schema),\n      );\n    }\n    byFieldName.set(field.fieldName, existing\n      ? {\n          ...existing,\n          isInsideArray: existing.isInsideArray || field.isInsideArray,\n        }\n      : field);\n  }\n  return Array.from(byFieldName.values()).sort((left, right) =>\n    left.fieldName.localeCompare(right.fieldName)\n  );\n}\n\nfunction normalizeMetadataForComparison(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(normalizeMetadataForComparison);\n  }\n\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, childValue]) => [key, normalizeMetadataForComparison(childValue)]),\n    );\n  }\n\n  return value;\n}\n\nfunction areTemplatableFileMetadataCompatible(\n  leftSchema: z.ZodTypeAny,\n  rightSchema: z.ZodTypeAny,\n): boolean {\n  return JSON.stringify(normalizeMetadataForComparison(getFileMetadata(leftSchema)))\n    === JSON.stringify(normalizeMetadataForComparison(getFileMetadata(rightSchema)));\n}\n\n/**\n * Remove generated PDF file fields from request DTO schemas, including nested\n * structures and union arms. These fields are framework-owned outputs, so they\n * must never appear in frontend/authored write DTOs even when custom DTOs are\n * provided by an application.\n */\nexport function stripTemplatableFileFieldsRecursively(\n  schema: z.ZodTypeAny,\n  options: StripTemplatableFileFieldsOptions = {},\n  activeSchemas: WeakSet<object> = new WeakSet<object>(),\n): z.ZodTypeAny {\n  if (activeSchemas.has(schema)) {\n    return schema;\n  }\n  activeSchemas.add(schema);\n\n  try {\n    if (isZodOptional(schema)) {\n      const innerSchema = getZodDefSchemaProperty(schema, 'innerType');\n      return innerSchema\n        ? stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas).optional()\n        : schema;\n    }\n\n    if (isZodNullable(schema)) {\n      const innerSchema = getZodDefSchemaProperty(schema, 'innerType');\n      return innerSchema\n        ? stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas).nullable()\n        : schema;\n    }\n\n    if (isZodDefault(schema)) {\n      const innerSchema = getZodDefSchemaProperty(schema, 'innerType');\n      if (!innerSchema) {\n        return schema;\n      }\n      const strippedInner = stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas);\n      // Re-READ the default per parse rather than carrying a value across. In Zod 4\n      // `def.defaultValue` is a GETTER, so reading it here EVALUATES the default —\n      // and this stripped schema is built once, at configuration time, so a value\n      // read here would be frozen into every parse the process performs. (The old\n      // `typeof defaultValue === 'function'` branch could never fire for a dynamic\n      // default for the same reason: the getter returns the VALUE, not the factory.)\n      return strippedInner.default(() => getZodDefProperty(schema, 'defaultValue') as unknown);\n    }\n\n    const schemaType = getZodType(schema);\n    if (schemaType === 'pipe') {\n      const inSchema = getZodDefSchemaProperty(schema, 'in');\n      const outSchema = getZodDefSchemaProperty(schema, 'out');\n      const strippedIn = inSchema\n        ? stripTemplatableFileFieldsRecursively(inSchema, options, activeSchemas)\n        : inSchema;\n      const strippedOut = outSchema\n        ? stripTemplatableFileFieldsRecursively(outSchema, options, activeSchemas)\n        : outSchema;\n      if (strippedIn === inSchema && strippedOut === outSchema) {\n        return schema;\n      }\n      if (strippedIn && strippedOut) {\n        return z.pipe(strippedIn, strippedOut);\n      }\n      return strippedOut ?? strippedIn ?? schema;\n    }\n\n    if (schemaType === 'lazy') {\n      const lazyGetter = getZodDef(schema)?.getter;\n      if (typeof lazyGetter !== 'function') {\n        return schema;\n      }\n      return z.lazy(() =>\n        stripTemplatableFileFieldsRecursively(lazyGetter() as z.ZodTypeAny, options, activeSchemas)\n      );\n    }\n\n    if (schemaType === 'intersection') {\n      const leftSchema = getZodDefSchemaProperty(schema, 'left');\n      const rightSchema = getZodDefSchemaProperty(schema, 'right');\n      const strippedLeft = leftSchema\n        ? stripTemplatableFileFieldsRecursively(leftSchema, options, activeSchemas)\n        : leftSchema;\n      const strippedRight = rightSchema\n        ? stripTemplatableFileFieldsRecursively(rightSchema, options, activeSchemas)\n        : rightSchema;\n      return strippedLeft === leftSchema && strippedRight === rightSchema\n        ? schema\n        : z.intersection(strippedLeft ?? z.object({}), strippedRight ?? z.object({}));\n    }\n\n    if (schemaType === 'union') {\n      const discriminator = getZodDefStringProperty(schema, 'discriminator');\n      const unionOptions = getZodDefArrayProperty(schema, 'options') as z.ZodTypeAny[] | undefined;\n      if (!unionOptions?.length) {\n        return schema;\n      }\n\n      const strippedOptions = unionOptions.map((option) =>\n        stripTemplatableFileFieldsRecursively(option, options, activeSchemas)\n      );\n      if (strippedOptions.length < 2) {\n        return strippedOptions[0] ?? schema;\n      }\n\n      return discriminator\n        ? z.discriminatedUnion(\n            discriminator,\n            strippedOptions as [z.ZodObject<any>, z.ZodObject<any>, ...z.ZodObject<any>[]],\n          )\n        : z.union(strippedOptions as [z.ZodTypeAny, z.ZodTypeAny, ...z.ZodTypeAny[]]);\n    }\n\n    if (isZodArray(schema)) {\n      const elementSchema = getZodDefProperty(schema, 'element') as z.ZodTypeAny | undefined;\n      if (!elementSchema) {\n        return schema;\n      }\n\n      const strippedElement = stripTemplatableFileFieldsRecursively(elementSchema, options, activeSchemas);\n\n      // Nothing to strip inside the element — hand back the ORIGINAL schema, the same way the\n      // intersection / record / map branches do.\n      if (strippedElement === elementSchema) {\n        return schema;\n      }\n\n      // The element WAS rewritten. `withArrayElement` keeps the array's own `.min()` / `.max()` /\n      // `.length()` checks across the swap; a plain `z.array(strippedElement)` — what this branch\n      // used to do unconditionally — drops them, so an authored constraint never reached the DTO\n      // the controller and repository validate against.\n      return withArrayElement(schema, strippedElement);\n    }\n\n    if (schemaType === 'record') {\n      const keySchema = getZodDefSchemaProperty(schema, 'keyType');\n      const valueSchema = getZodDefSchemaProperty(schema, 'valueType');\n      const strippedValue = valueSchema\n        ? stripTemplatableFileFieldsRecursively(valueSchema, options, activeSchemas)\n        : valueSchema;\n      return valueSchema && strippedValue !== valueSchema\n        ? z.record((keySchema ?? z.string()) as any, strippedValue)\n        : schema;\n    }\n\n    if (schemaType === 'map') {\n      const keySchema = getZodDefSchemaProperty(schema, 'keyType');\n      const valueSchema = getZodDefSchemaProperty(schema, 'valueType');\n      const strippedValue = valueSchema\n        ? stripTemplatableFileFieldsRecursively(valueSchema, options, activeSchemas)\n        : valueSchema;\n      return keySchema && valueSchema && strippedValue !== valueSchema\n        ? z.map(keySchema, strippedValue)\n        : schema;\n    }\n\n    if (schemaType === 'set') {\n      const valueSchema = getZodDefSchemaProperty(schema, 'valueType');\n      const strippedValue = valueSchema\n        ? stripTemplatableFileFieldsRecursively(valueSchema, options, activeSchemas)\n        : valueSchema;\n      return valueSchema && strippedValue !== valueSchema\n        ? z.set(strippedValue)\n        : schema;\n    }\n\n    if (schemaType === 'tuple') {\n      const tupleItems = getZodDefArrayProperty(schema, 'items') as z.ZodTypeAny[] | undefined;\n      const restSchema = getZodDefSchemaProperty(schema, 'rest');\n      const strippedItems = (tupleItems ?? []).map((item) =>\n        stripTemplatableFileFieldsRecursively(item, options, activeSchemas)\n      );\n      const strippedRest = restSchema\n        ? stripTemplatableFileFieldsRecursively(restSchema, options, activeSchemas)\n        : restSchema;\n      const changed = strippedItems.some((item, index) => item !== tupleItems?.[index])\n        || strippedRest !== restSchema;\n      if (!changed) {\n        return schema;\n      }\n      const rebuiltTuple = z.tuple(strippedItems as any);\n      return strippedRest ? rebuiltTuple.rest(strippedRest) : rebuiltTuple;\n    }\n\n    if (!isZodObject(schema)) {\n      return schema;\n    }\n\n    const shape = getZodObjectShape(schema);\n    const strippedShape: Record<string, z.ZodTypeAny> = {};\n    let changed = false;\n\n    for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n      const typedSchema = fieldSchema as z.ZodTypeAny;\n      if (isTemplatableFileField(typedSchema)) {\n        changed = true;\n        continue;\n      }\n\n      const strippedSchema = stripTemplatableFileFieldsRecursively(typedSchema, options, activeSchemas);\n      if (strippedSchema !== typedSchema) {\n        changed = true;\n      }\n      strippedShape[fieldName] = strippedSchema;\n    }\n\n    if (!changed) {\n      return schema;\n    }\n\n    return options.rebuildObjectSchema\n      ? options.rebuildObjectSchema(schema, strippedShape)\n      : rebuildObjectSchemaPreservingSemantics(schema, strippedShape);\n  } finally {\n    activeSchemas.delete(schema);\n  }\n}\n\nfunction rebuildObjectSchemaPreservingSemantics(\n  schema: z.ZodObject<any>,\n  strippedShape: Record<string, z.ZodTypeAny>,\n): z.ZodTypeAny {\n  const originalShape = getZodObjectShape(schema);\n  const removedFields = Object.keys(originalShape).filter((fieldName) => !(fieldName in strippedShape));\n\n  try {\n    const omittedSchema = removedFields.length > 0\n      ? schema.omit(Object.fromEntries(removedFields.map((fieldName) => [fieldName, true])) as Record<string, true>)\n      : schema;\n\n    return omittedSchema.extend(strippedShape);\n  } catch {\n    const rebuiltSchema = z.object(strippedShape);\n    const catchallSchema = getZodDefProperty(schema, 'catchall') as z.ZodTypeAny | undefined;\n    return catchallSchema ? rebuiltSchema.catchall(catchallSchema) : rebuiltSchema;\n  }\n}\n"]}
+{"version":3,"file":"templatable-file-fields.shared.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/templatable-file-fields.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,sBAAsB,EACtB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,YAAY,EACZ,gBAAgB,GAEjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB;;;;;;GAMG;AACH,SAAS,mBAAmB,CAA+B,MAAoB,EAAE,OAAgB;IAC/F,MAAM,QAAQ,GAAI,MAAc,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAe,CAAC,eAAe,CAAC,GAAG,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,MAAM,OAAO,yCAA0C,SAAQ,KAAK;IAEhD;IACA;IACA;IAHlB,YACkB,SAAiB,EACjB,gBAAgD,EAChD,mBAAmD;QAEnE,KAAK,CACH,kFAAkF,SAAS,IAAI,CAChG,CAAC;QANc,cAAS,GAAT,SAAS,CAAQ;QACjB,qBAAgB,GAAhB,gBAAgB,CAAgC;QAChD,wBAAmB,GAAnB,mBAAmB,CAAgC;QAKnE,IAAI,CAAC,IAAI,GAAG,2CAA2C,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAoB,EACpB,UAAU,GAAG,EAAE,EACf,aAAa,GAAG,KAAK,EACrB,gBAAiC,IAAI,OAAO,EAAU;IAEtD,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzD,OAAO,8BAA8B,CAAC;gBACpC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,OAAO,WAAW;gBAChB,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC;gBACzF,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAED,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,gCAAgC,CAAC,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,sBAAsB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,SAAS,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;YACtD,MAAM,UAAU,GAAG,OAAO,UAAU,KAAK,UAAU;gBACjD,CAAC,CAAC,UAAU,EAAE;gBACd,CAAC,CAAC,SAAS,CAAC;YACd,OAAO,UAAU;gBACf,CAAC,CAAC,gCAAgC,CAAC,UAA0B,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC;gBACxG,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAED,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACpE,MAAM,WAAW,GAAG,uBAAuB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACtE,OAAO,8BAA8B,CAAC;gBACpC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,gCAAgC,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7G,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChH,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,sBAAsB,CAAC,eAAe,EAAE,SAAS,CAA+B,CAAC;YACtG,OAAO,8BAA8B,CACnC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACtC,gCAAgC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CACnF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,iBAAiB,CAAC,eAAe,EAAE,SAAS,CAA6B,CAAC;YAChG,OAAO,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,CAAC;QAED,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5E,MAAM,WAAW,GAAG,uBAAuB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YAC1E,OAAO,WAAW;gBAChB,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC;gBAChF,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,sBAAsB,CAAC,eAAe,EAAE,OAAO,CAA+B,CAAC;YAClG,MAAM,UAAU,GAAG,uBAAuB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,8BAA8B,CAAC;gBACpC,GAAG,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,gCAAgC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CACxE,CAAC;gBACF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,gCAAgC,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QACjD,OAAO,8BAA8B,CACnC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE;YACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,OAAO,gCAAgC,CAAC,WAA2B,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAC/G,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAkC;IAElC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoC,CAAC;IAChE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,QAAQ,IAAI,CAAC,oCAAoC,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,yCAAyC,CACjD,KAAK,CAAC,SAAS,EACf,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAChC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ;YACvC,CAAC,CAAC;gBACE,GAAG,QAAQ;gBACX,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;aAC7D;YACH,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3D,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAc;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oCAAoC,CAC3C,UAAwB,EACxB,WAAyB;IAEzB,OAAO,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,MAAoB,EACpB,UAA6C,EAAE,EAC/C,gBAAiC,IAAI,OAAO,EAAU;IAEtD,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH;;;;;;;;WAQG;QACH,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YACjG,OAAO,aAAa,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YACjG,OAAO,aAAa,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YACjG,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,8EAA8E;YAC9E,6EAA6E;YAC7E,4EAA4E;YAC5E,4EAA4E;YAC5E,6EAA6E;YAC7E,+EAA+E;YAC/E,OAAO,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAY,CAAC,CAAC,CAAC;QACxH,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,QAAQ;gBACzB,CAAC,CAAC,qCAAqC,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;gBACzE,CAAC,CAAC,QAAQ,CAAC;YACb,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,qCAAqC,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC1E,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,UAAU,KAAK,QAAQ,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBACzD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;gBAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,WAAW,IAAI,UAAU,IAAI,MAAM,CAAC;QAC7C,CAAC;QAED,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC7C,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACjB,qCAAqC,CAAC,UAAU,EAAkB,EAAE,OAAO,EAAE,aAAa,CAAC,CAC5F,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,YAAY,GAAG,UAAU;gBAC7B,CAAC,CAAC,qCAAqC,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC3E,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC5E,CAAC,CAAC,WAAW,CAAC;YAChB,OAAO,YAAY,KAAK,UAAU,IAAI,aAAa,KAAK,WAAW;gBACjE,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAA+B,CAAC;YAC7F,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClD,qCAAqC,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CACtE,CAAC;YACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;YACtC,CAAC;YACD,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC7E,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,YAAY,GAAiB,aAAa;gBAC9C,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAClB,aAAa,EACb,eAA8E,CAC/E;gBACH,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAkE,CAAC,CAAC;YAChF,OAAO,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAA6B,CAAC;YACvF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,eAAe,GAAG,qCAAqC,CAAC,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YAErG,wFAAwF;YACxF,2CAA2C;YAC3C,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;gBACtC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,kDAAkD;YAClD,OAAO,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC5E,CAAC,CAAC,WAAW,CAAC;YAChB,OAAO,WAAW,IAAI,aAAa,KAAK,WAAW;gBACjD,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAQ,EAAE,aAAa,CAAC;gBAC3D,CAAC,CAAC,MAAM,CAAC;QACb,CAAC;QAED,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC5E,CAAC,CAAC,WAAW,CAAC;YAChB,OAAO,SAAS,IAAI,WAAW,IAAI,aAAa,KAAK,WAAW;gBAC9D,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC;QACb,CAAC;QAED,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC5E,CAAC,CAAC,WAAW,CAAC;YAChB,OAAO,WAAW,IAAI,aAAa,KAAK,WAAW;gBACjD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC;QACb,CAAC;QAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAA+B,CAAC;YACzF,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,aAAa,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpD,qCAAqC,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CACpE,CAAC;YACF,MAAM,YAAY,GAAG,UAAU;gBAC7B,CAAC,CAAC,qCAAqC,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC3E,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;mBAC5E,YAAY,KAAK,UAAU,CAAC;YACjC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,aAAoB,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,aAAa,GAAiC,EAAE,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;YAChD,IAAI,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YAED,MAAM,cAAc,GAAG,qCAAqC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YAClG,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;gBACnC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,aAAa,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,OAAO,CAAC,mBAAmB;YAChC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC;YACpD,CAAC,CAAC,sCAAsC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,sCAAsC,CAC7C,MAAwB,EACxB,aAA2C;IAE3C,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC;IAEtG,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAyB,CAAC;YAC9G,CAAC,CAAC,MAAM,CAAC;QAEX,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACrD,iGAAiG;QACjG,yFAAyF;QACzF,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAA6B,CAAC;QACzF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACxF,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACrF,CAAC;AACH,CAAC","sourcesContent":["import {\n  getFileMetadata,\n  getZodDefArrayProperty,\n  getZodDef,\n  getZodDefProperty,\n  getZodDefSchemaProperty,\n  getZodDefStringProperty,\n  getZodObjectShape,\n  getZodType,\n  isTemplatableFileField,\n  isZodArray,\n  isZodDefault,\n  isZodNullable,\n  isZodObject,\n  isZodOptional,\n  SCHEMA_METADATA,\n  unwrapSchema,\n  withArrayElement,\n  type FileSchemaMetadata,\n} from '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\n\nexport interface StripTemplatableFileFieldsOptions {\n  rebuildObjectSchema?: (\n    schema: z.ZodObject<any>,\n    shape: Record<string, z.ZodTypeAny>,\n  ) => z.ZodTypeAny;\n}\n\n/**\n * Carry decorator metadata (`SCHEMA_METADATA`) from a schema onto the instance that replaces it.\n *\n * Structured value types (`z_address`, `z_file`, `z_money`, `z_range`, …) record their identity as\n * metadata on the schema INSTANCE. A rebuild that does not carry it turns the field into a plain\n * object, and the form then renders its parts as unrelated inputs.\n */\nfunction carrySchemaMetadata<TSchema extends z.ZodTypeAny>(source: z.ZodTypeAny, rebuilt: TSchema): TSchema {\n  const metadata = (source as any)[SCHEMA_METADATA];\n  if (metadata !== undefined) {\n    (rebuilt as any)[SCHEMA_METADATA] = metadata;\n  }\n  return rebuilt;\n}\n\nexport interface TemplatableFileFieldPath {\n  fieldName: string;\n  schema: z.ZodTypeAny;\n  isInsideArray: boolean;\n}\n\nexport class IncompatibleTemplatableFileFieldPathError extends Error {\n  constructor(\n    public readonly fieldName: string,\n    public readonly existingMetadata: FileSchemaMetadata | undefined,\n    public readonly conflictingMetadata: FileSchemaMetadata | undefined,\n  ) {\n    super(\n      `Incompatible generated file metadata detected for templatable file field path \"${fieldName}\".`,\n    );\n    this.name = 'IncompatibleTemplatableFileFieldPathError';\n  }\n}\n\nexport function collectTemplatableFileFieldPaths(\n  schema: z.ZodTypeAny,\n  pathPrefix = '',\n  isInsideArray = false,\n  activeSchemas: WeakSet<object> = new WeakSet<object>(),\n): TemplatableFileFieldPath[] {\n  if (activeSchemas.has(schema)) {\n    return [];\n  }\n\n  activeSchemas.add(schema);\n  try {\n    const rawSchemaType = getZodType(schema);\n    if (rawSchemaType === 'pipe') {\n      const inSchema = getZodDefSchemaProperty(schema, 'in');\n      const outSchema = getZodDefSchemaProperty(schema, 'out');\n      return mergeTemplatableFileFieldPaths([\n        ...(inSchema ? collectTemplatableFileFieldPaths(inSchema, pathPrefix, isInsideArray, activeSchemas) : []),\n        ...(outSchema ? collectTemplatableFileFieldPaths(outSchema, pathPrefix, isInsideArray, activeSchemas) : []),\n      ]);\n    }\n\n    if (isZodOptional(schema) || isZodNullable(schema) || isZodDefault(schema)) {\n      const innerSchema = getZodDefSchemaProperty(schema, 'innerType');\n      return innerSchema\n        ? collectTemplatableFileFieldPaths(innerSchema, pathPrefix, isInsideArray, activeSchemas)\n        : [];\n    }\n\n    const unwrappedSchema = unwrapSchema(schema);\n    if (unwrappedSchema !== schema) {\n      return collectTemplatableFileFieldPaths(unwrappedSchema, pathPrefix, isInsideArray, activeSchemas);\n    }\n\n    if (isTemplatableFileField(unwrappedSchema)) {\n      return pathPrefix ? [{ fieldName: pathPrefix, schema: unwrappedSchema, isInsideArray }] : [];\n    }\n\n    const schemaType = getZodType(unwrappedSchema);\n    if (schemaType === 'lazy') {\n      const lazyGetter = getZodDef(unwrappedSchema)?.getter;\n      const lazySchema = typeof lazyGetter === 'function'\n        ? lazyGetter()\n        : undefined;\n      return lazySchema\n        ? collectTemplatableFileFieldPaths(lazySchema as z.ZodTypeAny, pathPrefix, isInsideArray, activeSchemas)\n        : [];\n    }\n\n    if (schemaType === 'intersection') {\n      const leftSchema = getZodDefSchemaProperty(unwrappedSchema, 'left');\n      const rightSchema = getZodDefSchemaProperty(unwrappedSchema, 'right');\n      return mergeTemplatableFileFieldPaths([\n        ...(leftSchema ? collectTemplatableFileFieldPaths(leftSchema, pathPrefix, isInsideArray, activeSchemas) : []),\n        ...(rightSchema ? collectTemplatableFileFieldPaths(rightSchema, pathPrefix, isInsideArray, activeSchemas) : []),\n      ]);\n    }\n\n    if (schemaType === 'union') {\n      const unionOptions = getZodDefArrayProperty(unwrappedSchema, 'options') as z.ZodTypeAny[] | undefined;\n      return mergeTemplatableFileFieldPaths(\n        (unionOptions ?? []).flatMap((option) =>\n          collectTemplatableFileFieldPaths(option, pathPrefix, isInsideArray, activeSchemas)\n        ),\n      );\n    }\n\n    if (isZodArray(unwrappedSchema)) {\n      const elementSchema = getZodDefProperty(unwrappedSchema, 'element') as z.ZodTypeAny | undefined;\n      return elementSchema ? collectTemplatableFileFieldPaths(elementSchema, pathPrefix, true, activeSchemas) : [];\n    }\n\n    if (schemaType === 'record' || schemaType === 'map' || schemaType === 'set') {\n      const valueSchema = getZodDefSchemaProperty(unwrappedSchema, 'valueType');\n      return valueSchema\n        ? collectTemplatableFileFieldPaths(valueSchema, pathPrefix, true, activeSchemas)\n        : [];\n    }\n\n    if (schemaType === 'tuple') {\n      const tupleItems = getZodDefArrayProperty(unwrappedSchema, 'items') as z.ZodTypeAny[] | undefined;\n      const restSchema = getZodDefSchemaProperty(unwrappedSchema, 'rest');\n      return mergeTemplatableFileFieldPaths([\n        ...((tupleItems ?? []).flatMap((item) =>\n          collectTemplatableFileFieldPaths(item, pathPrefix, true, activeSchemas)\n        )),\n        ...(restSchema ? collectTemplatableFileFieldPaths(restSchema, pathPrefix, true, activeSchemas) : []),\n      ]);\n    }\n\n    if (!isZodObject(unwrappedSchema)) {\n      return [];\n    }\n\n    const shape = getZodObjectShape(unwrappedSchema);\n    return mergeTemplatableFileFieldPaths(\n      Object.entries(shape).flatMap(([fieldName, fieldSchema]) => {\n        const nextPath = pathPrefix ? `${pathPrefix}.${fieldName}` : fieldName;\n        return collectTemplatableFileFieldPaths(fieldSchema as z.ZodTypeAny, nextPath, isInsideArray, activeSchemas);\n      }),\n    );\n  } finally {\n    activeSchemas.delete(schema);\n  }\n}\n\nfunction mergeTemplatableFileFieldPaths(\n  fields: TemplatableFileFieldPath[],\n): TemplatableFileFieldPath[] {\n  const byFieldName = new Map<string, TemplatableFileFieldPath>();\n  for (const field of fields) {\n    const existing = byFieldName.get(field.fieldName);\n    if (existing && !areTemplatableFileMetadataCompatible(existing.schema, field.schema)) {\n      throw new IncompatibleTemplatableFileFieldPathError(\n        field.fieldName,\n        getFileMetadata(existing.schema),\n        getFileMetadata(field.schema),\n      );\n    }\n    byFieldName.set(field.fieldName, existing\n      ? {\n          ...existing,\n          isInsideArray: existing.isInsideArray || field.isInsideArray,\n        }\n      : field);\n  }\n  return Array.from(byFieldName.values()).sort((left, right) =>\n    left.fieldName.localeCompare(right.fieldName)\n  );\n}\n\nfunction normalizeMetadataForComparison(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(normalizeMetadataForComparison);\n  }\n\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, childValue]) => [key, normalizeMetadataForComparison(childValue)]),\n    );\n  }\n\n  return value;\n}\n\nfunction areTemplatableFileMetadataCompatible(\n  leftSchema: z.ZodTypeAny,\n  rightSchema: z.ZodTypeAny,\n): boolean {\n  return JSON.stringify(normalizeMetadataForComparison(getFileMetadata(leftSchema)))\n    === JSON.stringify(normalizeMetadataForComparison(getFileMetadata(rightSchema)));\n}\n\n/**\n * Remove generated PDF file fields from request DTO schemas, including nested\n * structures and union arms. These fields are framework-owned outputs, so they\n * must never appear in frontend/authored write DTOs even when custom DTOs are\n * provided by an application.\n */\nexport function stripTemplatableFileFieldsRecursively(\n  schema: z.ZodTypeAny,\n  options: StripTemplatableFileFieldsOptions = {},\n  activeSchemas: WeakSet<object> = new WeakSet<object>(),\n): z.ZodTypeAny {\n  if (activeSchemas.has(schema)) {\n    return schema;\n  }\n  activeSchemas.add(schema);\n\n  try {\n    /*\n     * Wrappers hand back the ORIGINAL instance when nothing beneath them changed (#989).\n     *\n     * They used to rebuild `inner.optional()` unconditionally. A fresh wrapper is a different\n     * instance, so the enclosing object read it as \"changed\" and was rebuilt too — and the rebuild\n     * dropped the object's decorator metadata. A `z_address()` nested in any object therefore reached\n     * the create and update request DTOs as a plain object, and the form rendered its parts as\n     * unrelated text inputs. Identity is what tells the object branch nothing was stripped.\n     */\n    if (isZodOptional(schema)) {\n      const innerSchema = getZodDefSchemaProperty(schema, 'innerType');\n      if (!innerSchema) {\n        return schema;\n      }\n      const strippedInner = stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas);\n      return strippedInner === innerSchema ? schema : carrySchemaMetadata(schema, strippedInner.optional());\n    }\n\n    if (isZodNullable(schema)) {\n      const innerSchema = getZodDefSchemaProperty(schema, 'innerType');\n      if (!innerSchema) {\n        return schema;\n      }\n      const strippedInner = stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas);\n      return strippedInner === innerSchema ? schema : carrySchemaMetadata(schema, strippedInner.nullable());\n    }\n\n    if (isZodDefault(schema)) {\n      const innerSchema = getZodDefSchemaProperty(schema, 'innerType');\n      if (!innerSchema) {\n        return schema;\n      }\n      const strippedInner = stripTemplatableFileFieldsRecursively(innerSchema, options, activeSchemas);\n      if (strippedInner === innerSchema) {\n        return schema;\n      }\n      // Re-READ the default per parse rather than carrying a value across. In Zod 4\n      // `def.defaultValue` is a GETTER, so reading it here EVALUATES the default —\n      // and this stripped schema is built once, at configuration time, so a value\n      // read here would be frozen into every parse the process performs. (The old\n      // `typeof defaultValue === 'function'` branch could never fire for a dynamic\n      // default for the same reason: the getter returns the VALUE, not the factory.)\n      return carrySchemaMetadata(schema, strippedInner.default(() => getZodDefProperty(schema, 'defaultValue') as unknown));\n    }\n\n    const schemaType = getZodType(schema);\n    if (schemaType === 'pipe') {\n      const inSchema = getZodDefSchemaProperty(schema, 'in');\n      const outSchema = getZodDefSchemaProperty(schema, 'out');\n      const strippedIn = inSchema\n        ? stripTemplatableFileFieldsRecursively(inSchema, options, activeSchemas)\n        : inSchema;\n      const strippedOut = outSchema\n        ? stripTemplatableFileFieldsRecursively(outSchema, options, activeSchemas)\n        : outSchema;\n      if (strippedIn === inSchema && strippedOut === outSchema) {\n        return schema;\n      }\n      if (strippedIn && strippedOut) {\n        return z.pipe(strippedIn, strippedOut);\n      }\n      return strippedOut ?? strippedIn ?? schema;\n    }\n\n    if (schemaType === 'lazy') {\n      const lazyGetter = getZodDef(schema)?.getter;\n      if (typeof lazyGetter !== 'function') {\n        return schema;\n      }\n      return z.lazy(() =>\n        stripTemplatableFileFieldsRecursively(lazyGetter() as z.ZodTypeAny, options, activeSchemas)\n      );\n    }\n\n    if (schemaType === 'intersection') {\n      const leftSchema = getZodDefSchemaProperty(schema, 'left');\n      const rightSchema = getZodDefSchemaProperty(schema, 'right');\n      const strippedLeft = leftSchema\n        ? stripTemplatableFileFieldsRecursively(leftSchema, options, activeSchemas)\n        : leftSchema;\n      const strippedRight = rightSchema\n        ? stripTemplatableFileFieldsRecursively(rightSchema, options, activeSchemas)\n        : rightSchema;\n      return strippedLeft === leftSchema && strippedRight === rightSchema\n        ? schema\n        : z.intersection(strippedLeft ?? z.object({}), strippedRight ?? z.object({}));\n    }\n\n    if (schemaType === 'union') {\n      const discriminator = getZodDefStringProperty(schema, 'discriminator');\n      const unionOptions = getZodDefArrayProperty(schema, 'options') as z.ZodTypeAny[] | undefined;\n      if (!unionOptions?.length) {\n        return schema;\n      }\n\n      const strippedOptions = unionOptions.map((option) =>\n        stripTemplatableFileFieldsRecursively(option, options, activeSchemas)\n      );\n      if (strippedOptions.length < 2) {\n        return strippedOptions[0] ?? schema;\n      }\n      if (strippedOptions.every((option, index) => option === unionOptions[index])) {\n        return schema;\n      }\n\n      const rebuiltUnion: z.ZodTypeAny = discriminator\n        ? z.discriminatedUnion(\n            discriminator,\n            strippedOptions as [z.ZodObject<any>, z.ZodObject<any>, ...z.ZodObject<any>[]],\n          )\n        : z.union(strippedOptions as [z.ZodTypeAny, z.ZodTypeAny, ...z.ZodTypeAny[]]);\n      return carrySchemaMetadata(schema, rebuiltUnion);\n    }\n\n    if (isZodArray(schema)) {\n      const elementSchema = getZodDefProperty(schema, 'element') as z.ZodTypeAny | undefined;\n      if (!elementSchema) {\n        return schema;\n      }\n\n      const strippedElement = stripTemplatableFileFieldsRecursively(elementSchema, options, activeSchemas);\n\n      // Nothing to strip inside the element — hand back the ORIGINAL schema, the same way the\n      // intersection / record / map branches do.\n      if (strippedElement === elementSchema) {\n        return schema;\n      }\n\n      // The element WAS rewritten. `withArrayElement` keeps the array's own `.min()` / `.max()` /\n      // `.length()` checks across the swap; a plain `z.array(strippedElement)` — what this branch\n      // used to do unconditionally — drops them, so an authored constraint never reached the DTO\n      // the controller and repository validate against.\n      return withArrayElement(schema, strippedElement);\n    }\n\n    if (schemaType === 'record') {\n      const keySchema = getZodDefSchemaProperty(schema, 'keyType');\n      const valueSchema = getZodDefSchemaProperty(schema, 'valueType');\n      const strippedValue = valueSchema\n        ? stripTemplatableFileFieldsRecursively(valueSchema, options, activeSchemas)\n        : valueSchema;\n      return valueSchema && strippedValue !== valueSchema\n        ? z.record((keySchema ?? z.string()) as any, strippedValue)\n        : schema;\n    }\n\n    if (schemaType === 'map') {\n      const keySchema = getZodDefSchemaProperty(schema, 'keyType');\n      const valueSchema = getZodDefSchemaProperty(schema, 'valueType');\n      const strippedValue = valueSchema\n        ? stripTemplatableFileFieldsRecursively(valueSchema, options, activeSchemas)\n        : valueSchema;\n      return keySchema && valueSchema && strippedValue !== valueSchema\n        ? z.map(keySchema, strippedValue)\n        : schema;\n    }\n\n    if (schemaType === 'set') {\n      const valueSchema = getZodDefSchemaProperty(schema, 'valueType');\n      const strippedValue = valueSchema\n        ? stripTemplatableFileFieldsRecursively(valueSchema, options, activeSchemas)\n        : valueSchema;\n      return valueSchema && strippedValue !== valueSchema\n        ? z.set(strippedValue)\n        : schema;\n    }\n\n    if (schemaType === 'tuple') {\n      const tupleItems = getZodDefArrayProperty(schema, 'items') as z.ZodTypeAny[] | undefined;\n      const restSchema = getZodDefSchemaProperty(schema, 'rest');\n      const strippedItems = (tupleItems ?? []).map((item) =>\n        stripTemplatableFileFieldsRecursively(item, options, activeSchemas)\n      );\n      const strippedRest = restSchema\n        ? stripTemplatableFileFieldsRecursively(restSchema, options, activeSchemas)\n        : restSchema;\n      const changed = strippedItems.some((item, index) => item !== tupleItems?.[index])\n        || strippedRest !== restSchema;\n      if (!changed) {\n        return schema;\n      }\n      const rebuiltTuple = z.tuple(strippedItems as any);\n      return strippedRest ? rebuiltTuple.rest(strippedRest) : rebuiltTuple;\n    }\n\n    if (!isZodObject(schema)) {\n      return schema;\n    }\n\n    const shape = getZodObjectShape(schema);\n    const strippedShape: Record<string, z.ZodTypeAny> = {};\n    let changed = false;\n\n    for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n      const typedSchema = fieldSchema as z.ZodTypeAny;\n      if (isTemplatableFileField(typedSchema)) {\n        changed = true;\n        continue;\n      }\n\n      const strippedSchema = stripTemplatableFileFieldsRecursively(typedSchema, options, activeSchemas);\n      if (strippedSchema !== typedSchema) {\n        changed = true;\n      }\n      strippedShape[fieldName] = strippedSchema;\n    }\n\n    if (!changed) {\n      return schema;\n    }\n\n    return options.rebuildObjectSchema\n      ? options.rebuildObjectSchema(schema, strippedShape)\n      : rebuildObjectSchemaPreservingSemantics(schema, strippedShape);\n  } finally {\n    activeSchemas.delete(schema);\n  }\n}\n\nfunction rebuildObjectSchemaPreservingSemantics(\n  schema: z.ZodObject<any>,\n  strippedShape: Record<string, z.ZodTypeAny>,\n): z.ZodTypeAny {\n  const originalShape = getZodObjectShape(schema);\n  const removedFields = Object.keys(originalShape).filter((fieldName) => !(fieldName in strippedShape));\n\n  try {\n    const omittedSchema = removedFields.length > 0\n      ? schema.omit(Object.fromEntries(removedFields.map((fieldName) => [fieldName, true])) as Record<string, true>)\n      : schema;\n\n    const extended = omittedSchema.extend(strippedShape);\n    // Same field set, only a nested field replaced: the object is still what its metadata describes.\n    // A field REMOVED means it may not be, so the metadata stays behind on that path (#989).\n    return removedFields.length === 0 ? carrySchemaMetadata(schema, extended) : extended;\n  } catch {\n    const rebuiltSchema = z.object(strippedShape);\n    const catchallSchema = getZodDefProperty(schema, 'catchall') as z.ZodTypeAny | undefined;\n    const rebuilt = catchallSchema ? rebuiltSchema.catchall(catchallSchema) : rebuiltSchema;\n    return removedFields.length === 0 ? carrySchemaMetadata(schema, rebuilt) : rebuilt;\n  }\n}\n"]}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAyTlH,CAAC"}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoF,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlK,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBA4TlH,CAAC"}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js

@@ -7,7 +7,7 @@
 import { z } from 'zod';
 import { ApiKeyApplicationSchema, ApiKeyStatus } from './api-keys.shared.schemas.js';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel } from '../../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../../resources/resources.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
@@ -134,6 +134,9 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's
                     // invalidation at the requested boundary (default: now) and returns the replacement in
                     // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,kDAAkD;AAElD,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAEhH,kDAAkD;AAClD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAE1E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,8EAA8E;QAC9E,gFAAgF;QAChF,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,iEAAiE;QACjE,8EAA8E;QAC9E,yEAAyE;QACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application API Keys Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within applications.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyApplicationSchema,\n  ApiKeyStatus\n} from './api-keys.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application API keys\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_API_KEYS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  hasExpiration: z.boolean(),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_API_KEYS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application API keys\nexport enum AppApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype AppApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication API Keys Resource Configuration Factory\n*/\nexport const appApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppApiKeys_Operations,\n  AppApiKeysCoreOperations,\n  typeof ApiKeyApplicationSchema\n>({\n  mainSchema: ApiKeyApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so key rows are physically removed when their owning\n    // application is deleted. Without it the cascade throws ErrorType.CONFIGURATION\n    // on any application that still has API-key rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so API-key rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has key rows. Super-admin/HIGH: the app API-key admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [AppApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller.\n     *\n     * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n     * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n     * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n     * hazard DEACTIVATE documents at length — with no route there is no request contract to\n     * auto-derive and no `PUT .../expire` that could carry `status: active`.\n     *\n     * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n     * direct write would be a second authority over the field and would skip the ACTIVE-only\n     * precondition, which lives in the paired prefix implementation\n     * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n     * `enabledCondition` cannot be.\n     */\n    [AppApiKeys_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n      // No notification: expiry is the scheduled consequence of a date the administrator set, not\n      // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n      // feature and is not this one.\n    },\n\n    [AppApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        }\n      ]\n    }\n  },\n});\n"]}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,kDAAkD;AAElD,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAEhH,kDAAkD;AAClD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAE1E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,8EAA8E;QAC9E,gFAAgF;QAChF,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,iEAAiE;QACjE,8EAA8E;QAC9E,yEAAyE;QACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,+GAA+G;oBAC/G,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application API Keys Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within applications.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyApplicationSchema,\n  ApiKeyStatus\n} from './api-keys.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application API keys\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_API_KEYS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  hasExpiration: z.boolean(),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_API_KEYS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application API keys\nexport enum AppApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype AppApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication API Keys Resource Configuration Factory\n*/\nexport const appApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppApiKeys_Operations,\n  AppApiKeysCoreOperations,\n  typeof ApiKeyApplicationSchema\n>({\n  mainSchema: ApiKeyApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so key rows are physically removed when their owning\n    // application is deleted. Without it the cascade throws ErrorType.CONFIGURATION\n    // on any application that still has API-key rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so API-key rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has key rows. Super-admin/HIGH: the app API-key admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [AppApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller.\n     *\n     * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n     * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n     * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n     * hazard DEACTIVATE documents at length — with no route there is no request contract to\n     * auto-derive and no `PUT .../expire` that could carry `status: active`.\n     *\n     * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n     * direct write would be a second authority over the field and would skip the ACTIVE-only\n     * precondition, which lives in the paired prefix implementation\n     * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n     * `enabledCondition` cannot be.\n     */\n    [AppApiKeys_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n      // No notification: expiry is the scheduled consequence of a date the administrator set, not\n      // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n      // feature and is not this one.\n    },\n\n    [AppApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        }\n      ]\n    }\n  },\n});\n"]}

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAohBlH,CAAC"}
+{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoF,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlK,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAuhBlH,CAAC"}