@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.schemas.js

@@ -0,0 +1,204 @@
+/**
+ * `systemOfRecordPartitionAssignments` — which ORGANIZATION UNIT a remote partition belongs to.
+ *
+ * ## The gap this closes
+ *
+ * A system of record holds several partitions inside one corporate: Odoo companies (`company_id`),
+ * SAP company codes, Dynamics business units, NetSuite subsidiaries. Every row read out of one is
+ * stamped with the application's OWNER organization (#1055 §6) — so before this resource existed,
+ * every member of that organization saw every partition, and the Spanish subsidiary's accountant
+ * read the German company's invoices.
+ *
+ * The mechanism that confines WITHIN one organization already exists and is pinned: organization
+ * unit narrowing. What it lacked was the edge from a remote partition key to a Wildo unit. This
+ * resource IS that edge, and it is deliberately the only thing that carries it:
+ *
+ * ```
+ *   Odoo company_id = 10  ──(this row)──▶  unit "Acme Deutschland"  ──(unit narrowing)──▶  members
+ * ```
+ *
+ * ## Why the edge points THIS way
+ *
+ * The remote has never heard of Wildo. Pushing a Wildo unit id into Odoo was rejected in the slice's
+ * own alternatives table for that reason — there is nothing on the far side to receive it. So the
+ * mapping lives here, and the read path walks it in REVERSE: a caller's effective unit set becomes a
+ * set of remote keys, which is what a remote predicate can actually be written in.
+ *
+ * ## APPLICATION-scoped, not ORGANIZATIONS-scoped (slice E10)
+ *
+ * Every row here names a unit of the owner organization, so the tenant-scoped shape is the intuitive
+ * one and it is wrong. Assigning a remote partition is an OPERATOR act (D11) — the deployment's own
+ * administrator deciding which part of the operator's ERP a unit of their customer-facing org chart
+ * corresponds to. An operator door on an ORGANIZATIONS-scoped resource would need
+ * `admitsCrossTenantPlatformAdministration` on every verb plus a platform access grant per crossing
+ * (`.claude/rules/administrative-continuity-floors.md`), which is the ceremony for reaching into a
+ * CUSTOMER's data — not for editing the deployment's own configuration.
+ *
+ * The precedent is `applicationAccessGrants` beside `platformAccessGrants`: a sibling resource type
+ * at the scope the act actually has, rather than a nullable tenant field weakening the resource whose
+ * tenant field IS its control.
+ *
+ * ## What identifies an assignment, and what an edit may change
+ *
+ * `[system, remoteKey]` is the business key: one remote partition maps to at most one unit, and that
+ * uniqueness is persisted rather than conventional. All three of `system`, `remoteKey` and
+ * `organizationUnitId` are `.excludeFromUpdate()`, which leaves an ordinary UPDATE with nothing to
+ * write — deliberately. A reassignment is a MOVE-shaped custom operation carrying a compare-and-swap
+ * on the CURRENT unit (slice E11), because "move partition 10 from Deutschland to Österreich" is a
+ * decision about two units and a plain field write can neither name the unit it expected to replace
+ * nor refuse when another operator got there first.
+ *
+ * ⚠️ An excluded-field write SUCCEEDS and persists nothing — the repository's strict re-parse drops
+ * it. So the reassign door must write through a path that re-attaches the field
+ * (`preserveServerInjectedFields` / an authoritative write), never a plain UPDATE that looks like it
+ * worked. `.claude/rules/invariant-call-site-enumeration.md` #8 is this exact shape.
+ *
+ * ## `remoteKey` is a STRING, and the codec is what makes that safe
+ *
+ * Odoo's `company_id` is an integer; Dataverse's is a GUID; NetSuite's subsidiary is an integer. One
+ * stored shape across every vendor would either lose type information or need a column per vendor, so
+ * the row carries the key's CANONICAL TEXT and the facet's partition declaration carries the codec
+ * that decodes it before a predicate is compiled. Storing `10` as `'10'` and comparing it against
+ * Odoo's integer `10` without decoding is the defect that codec exists to prevent.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a remote partition reaches only the unit an
+ * operator assigned it to, and a member reaches only the partitions their unit grants.
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every assignment change is justified and
+ * recorded with its before/after unit.
+ */
+import { z } from 'zod';
+import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
+import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
+import { addImpersonalizeWith } from '@wildo-ai/zod-decorators';
+import { SYSTEM_OF_RECORD_NAME_MAX_LENGTH, SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas.js';
+/** Fixed replacement for assignment free-text that cannot be cleared (a `.min(1)` field). */
+const ERASED_ASSIGNMENT_TEXT = '[erased]';
+/**
+ * The longest canonical text a remote partition key may have.
+ *
+ * 128 is a GUID (36) with room for a vendor that composes one — NetSuite's internal ids, an SAP
+ * company code, a Dataverse business-unit id. Bounded rather than open because the value is compiled
+ * into a remote predicate: an OData `or`-chain of keys is a URL, and a URL has a length the vendor
+ * enforces long before we would.
+ */
+export const SYSTEM_OF_RECORD_REMOTE_KEY_MAX_LENGTH = 128;
+/** One transition in the life of a partition assignment. */
+export var SystemOfRecordPartitionAssignmentTransition;
+(function (SystemOfRecordPartitionAssignmentTransition) {
+    /** A remote partition gained a unit it did not have. */
+    SystemOfRecordPartitionAssignmentTransition["ASSIGNED"] = "assigned";
+    /** An assigned partition MOVED to a different unit — carries both units. */
+    SystemOfRecordPartitionAssignmentTransition["REASSIGNED"] = "reassigned";
+    /** The edge was removed. The partition becomes unreachable to every caller. */
+    SystemOfRecordPartitionAssignmentTransition["UNASSIGNED"] = "unassigned";
+})(SystemOfRecordPartitionAssignmentTransition || (SystemOfRecordPartitionAssignmentTransition = {}));
+/** The custom doors this resource opens beyond the core verbs. */
+export const SystemOfRecordPartitionAssignments_Operations = {
+    /**
+     * Move an assigned partition to a different unit, under a compare-and-swap on the current one.
+     *
+     * Not an UPDATE: `organizationUnitId` is `.excludeFromUpdate()` precisely so this is the only door,
+     * and the CAS is what makes concurrent operators safe — two administrators reassigning the same
+     * partition in opposite directions must not silently produce whichever write landed second.
+     */
+    REASSIGN: 'reassign',
+};
+export const SystemOfRecordPartitionAssignmentSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /**
+     * The primary-scope parent — the deployment this assignment configures.
+     *
+     * OPTIONAL, copying `applicationAccessGrants` and `applicationAuditLogs` rather than loosening
+     * anything: declared MANDATORY the resource does not load at all on a Mongo-persisted deployment
+     * (the ZodToMongoose convertor refuses it and INIT dies on
+     * `zod_converter_schema_conversion_failed`). Addressing is carried by `isPrimaryScope` +
+     * `REQUIRES_CONTEXT` on the relationship, which is what the URL builder reads, so the route is
+     * identical either way.
+     */
+    applicationId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),
+    /**
+     * WHICH declared instance this partition lives in — a `systemsOfRecord.<name>` key.
+     *
+     * Instance-scoped rather than vendor-scoped, and that is load-bearing: two Odoo deployments
+     * (`odoo-fr`, `odoo-de`) share one vendor facet and have entirely unrelated company ids. A key
+     * scoped to the vendor would let one deployment's company 10 resolve through the other's map.
+     *
+     * ⚠️ Built from the exported PATTERN and MAX_LENGTH rather than from `SystemOfRecordNameSchema`,
+     * and that is not a style choice. A zod decorator MUTATES the schema object it is called on —
+     * measured 2026-09-18: `shared.isDBIndexed() === shared` is `true`, and the metadata lands on the
+     * shared object. Chaining off the exported instance-name schema would therefore stamp
+     * `isDBIndexed`/`isSummaryField`/`excludeFromUpdate`/`isAuditEvidence` onto the schema that
+     * validates `systemsOfRecord.<name>` keys in `wildo.saas.config.ts`, which is a configuration key
+     * and not a resource field. The two constants ARE the single source — they are exported precisely
+     * because the environment-variable derivation depends on them — so nothing is duplicated here
+     * except the act of building a fresh schema out of them.
+     */
+    system: z.string()
+        .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')
+        .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH)
+        .isDBIndexed().isSummaryField().excludeFromUpdate().isAuditEvidence(),
+    /**
+     * The partition's key AS THE REMOTE SPELLS IT, in canonical text.
+     *
+     * Decoded through the facet's partition codec before it reaches a compiler — see the class doc on
+     * why one stored shape plus a codec beats a column per vendor.
+     */
+    remoteKey: z.string().min(1).max(SYSTEM_OF_RECORD_REMOTE_KEY_MAX_LENGTH)
+        .isDBIndexed().isSummaryField().excludeFromUpdate().isAuditEvidence(),
+    /**
+     * The unit of the OWNER organization this partition belongs to.
+     *
+     * `.excludeFromUpdate()` so the only writer is the `reassign` door and its compare-and-swap.
+     *
+     * The foreign key buys EXISTENCE and nothing more. An APPLICATION-scoped row written by a
+     * super-administrator resolves `writeTenantId === ''` in the write-integrity check, so the FK
+     * cannot also assert that the unit belongs to the owner organization or that it is ACTIVE — both
+     * are checked in the custom implementation through the system door, and pinned there (slice R10).
+     */
+    organizationUnitId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),
+    /**
+     * Why this partition belongs to this unit. REQUIRED, on the `applicationAccessGrants` precedent.
+     *
+     * It carries real weight here rather than being ceremony: an assignment is an access decision with
+     * no expiry — unlike a grant, it stands until someone changes it — and the next operator looking at
+     * "company 10 → Deutschland" has no other way to learn whether that reflects the corporate
+     * structure or somebody's guess during an incident.
+     */
+    // USER_CONTENT — free prose an OPERATOR typed. MASK rather than REMOVE on erasure: `.min(1)` makes
+    // it non-clearable, so a null would be rejected by the strict update-DTO parse the impersonalize
+    // writer runs, and a fixed non-empty string is accepted.
+    justification: addImpersonalizeWith(z.string().min(1).max(1000).isSummaryField()
+        .dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.MASK, { maskValue: ERASED_ASSIGNMENT_TEXT }),
+    /** The operator who last assigned or moved this partition. Server-authored from the session. */
+    assignedByUserId: z.string().min(1).optional().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+    updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+}).businessKeySet([
+    'system',
+    'remoteKey',
+]);
+/**
+ * The inverse map a read uses: unit ids → the remote keys confined to them.
+ *
+ * Built per request from the rows this caller's units reach. Deliberately NOT cached — measured
+ * 2026-09-18, the indexed lookup is 0.078–0.177 ms at 20× the realistic row count, against a 1.02 ms
+ * p50 floor for the remote read it precedes (a loopback socket with a handler that does nothing but
+ * serialize). A real system of record is 50–500 ms, so the cache would save ~0.1 ms on a path about
+ * to spend three orders of magnitude more.
+ *
+ * The correctness half is what settles it: the cached value is a SECURITY CONFINEMENT, so a stale
+ * entry means a member still reads a partition they were unassigned from — the defect this resource
+ * exists to close, re-entering through the cache. `ApplicationOwnerOrganizationResolverBackendService`
+ * caches for the process lifetime and is right to, because its invalidating event is an owner
+ * PROMOTION — once per application lifetime. Reassigning a partition is ordinary administration.
+ */
+export function buildRemoteKeysForUnits(assignments, organizationUnitIds) {
+    const wanted = new Set(organizationUnitIds);
+    const keys = new Set();
+    for (const assignment of assignments) {
+        if (wanted.has(assignment.organizationUnitId))
+            keys.add(assignment.remoteKey);
+    }
+    return [...keys];
+}
+//# sourceMappingURL=system-of-record-partition-assignments.shared.schemas.js.map

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-partition-assignments.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-partition-assignments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAEhI,6FAA6F;AAC7F,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,4DAA4D;AAC5D,MAAM,CAAN,IAAY,2CAOX;AAPD,WAAY,2CAA2C;IACrD,wDAAwD;IACxD,oEAAqB,CAAA;IACrB,4EAA4E;IAC5E,wEAAyB,CAAA;IACzB,+EAA+E;IAC/E,wEAAyB,CAAA;AAC3B,CAAC,EAPW,2CAA2C,KAA3C,2CAA2C,QAOtD;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D;;;;;;OAMG;IACH,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SACf,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;SAC5G,GAAG,CAAC,gCAAgC,CAAC;SACrC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEvE;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;SACrE,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEvE;;;;;;;;;OASG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzH;;;;;;;OAOG;IACH,mGAAmG;IACnG,iGAAiG;IACjG,yDAAyD;IACzD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;SAC3C,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,sBAAsB,EAAE,CACtC;IAED,gGAAgG;IAChG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAExI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAIH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmG,EACnG,mBAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC","sourcesContent":["/**\n * `systemOfRecordPartitionAssignments` — which ORGANIZATION UNIT a remote partition belongs to.\n *\n * ## The gap this closes\n *\n * A system of record holds several partitions inside one corporate: Odoo companies (`company_id`),\n * SAP company codes, Dynamics business units, NetSuite subsidiaries. Every row read out of one is\n * stamped with the application's OWNER organization (#1055 §6) — so before this resource existed,\n * every member of that organization saw every partition, and the Spanish subsidiary's accountant\n * read the German company's invoices.\n *\n * The mechanism that confines WITHIN one organization already exists and is pinned: organization\n * unit narrowing. What it lacked was the edge from a remote partition key to a Wildo unit. This\n * resource IS that edge, and it is deliberately the only thing that carries it:\n *\n * ```\n *   Odoo company_id = 10  ──(this row)──▶  unit \"Acme Deutschland\"  ──(unit narrowing)──▶  members\n * ```\n *\n * ## Why the edge points THIS way\n *\n * The remote has never heard of Wildo. Pushing a Wildo unit id into Odoo was rejected in the slice's\n * own alternatives table for that reason — there is nothing on the far side to receive it. So the\n * mapping lives here, and the read path walks it in REVERSE: a caller's effective unit set becomes a\n * set of remote keys, which is what a remote predicate can actually be written in.\n *\n * ## APPLICATION-scoped, not ORGANIZATIONS-scoped (slice E10)\n *\n * Every row here names a unit of the owner organization, so the tenant-scoped shape is the intuitive\n * one and it is wrong. Assigning a remote partition is an OPERATOR act (D11) — the deployment's own\n * administrator deciding which part of the operator's ERP a unit of their customer-facing org chart\n * corresponds to. An operator door on an ORGANIZATIONS-scoped resource would need\n * `admitsCrossTenantPlatformAdministration` on every verb plus a platform access grant per crossing\n * (`.claude/rules/administrative-continuity-floors.md`), which is the ceremony for reaching into a\n * CUSTOMER's data — not for editing the deployment's own configuration.\n *\n * The precedent is `applicationAccessGrants` beside `platformAccessGrants`: a sibling resource type\n * at the scope the act actually has, rather than a nullable tenant field weakening the resource whose\n * tenant field IS its control.\n *\n * ## What identifies an assignment, and what an edit may change\n *\n * `[system, remoteKey]` is the business key: one remote partition maps to at most one unit, and that\n * uniqueness is persisted rather than conventional. All three of `system`, `remoteKey` and\n * `organizationUnitId` are `.excludeFromUpdate()`, which leaves an ordinary UPDATE with nothing to\n * write — deliberately. A reassignment is a MOVE-shaped custom operation carrying a compare-and-swap\n * on the CURRENT unit (slice E11), because \"move partition 10 from Deutschland to Österreich\" is a\n * decision about two units and a plain field write can neither name the unit it expected to replace\n * nor refuse when another operator got there first.\n *\n * ⚠️ An excluded-field write SUCCEEDS and persists nothing — the repository's strict re-parse drops\n * it. So the reassign door must write through a path that re-attaches the field\n * (`preserveServerInjectedFields` / an authoritative write), never a plain UPDATE that looks like it\n * worked. `.claude/rules/invariant-call-site-enumeration.md` #8 is this exact shape.\n *\n * ## `remoteKey` is a STRING, and the codec is what makes that safe\n *\n * Odoo's `company_id` is an integer; Dataverse's is a GUID; NetSuite's subsidiary is an integer. One\n * stored shape across every vendor would either lose type information or need a column per vendor, so\n * the row carries the key's CANONICAL TEXT and the facet's partition declaration carries the codec\n * that decodes it before a predicate is compiled. Storing `10` as `'10'` and comparing it against\n * Odoo's integer `10` without decoding is the defect that codec exists to prevent.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a remote partition reaches only the unit an\n * operator assigned it to, and a member reaches only the partitions their unit grants.\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every assignment change is justified and\n * recorded with its before/after unit.\n */\n\nimport { z } from 'zod';\n\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { SYSTEM_OF_RECORD_NAME_MAX_LENGTH, SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Fixed replacement for assignment free-text that cannot be cleared (a `.min(1)` field). */\nconst ERASED_ASSIGNMENT_TEXT = '[erased]';\n\n/**\n * The longest canonical text a remote partition key may have.\n *\n * 128 is a GUID (36) with room for a vendor that composes one — NetSuite's internal ids, an SAP\n * company code, a Dataverse business-unit id. Bounded rather than open because the value is compiled\n * into a remote predicate: an OData `or`-chain of keys is a URL, and a URL has a length the vendor\n * enforces long before we would.\n */\nexport const SYSTEM_OF_RECORD_REMOTE_KEY_MAX_LENGTH = 128;\n\n/** One transition in the life of a partition assignment. */\nexport enum SystemOfRecordPartitionAssignmentTransition {\n  /** A remote partition gained a unit it did not have. */\n  ASSIGNED = 'assigned',\n  /** An assigned partition MOVED to a different unit — carries both units. */\n  REASSIGNED = 'reassigned',\n  /** The edge was removed. The partition becomes unreachable to every caller. */\n  UNASSIGNED = 'unassigned',\n}\n\n/** The custom doors this resource opens beyond the core verbs. */\nexport const SystemOfRecordPartitionAssignments_Operations = {\n  /**\n   * Move an assigned partition to a different unit, under a compare-and-swap on the current one.\n   *\n   * Not an UPDATE: `organizationUnitId` is `.excludeFromUpdate()` precisely so this is the only door,\n   * and the CAS is what makes concurrent operators safe — two administrators reassigning the same\n   * partition in opposite directions must not silently produce whichever write landed second.\n   */\n  REASSIGN: 'reassign',\n} as const;\n\nexport const SystemOfRecordPartitionAssignmentSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The primary-scope parent — the deployment this assignment configures.\n   *\n   * OPTIONAL, copying `applicationAccessGrants` and `applicationAuditLogs` rather than loosening\n   * anything: declared MANDATORY the resource does not load at all on a Mongo-persisted deployment\n   * (the ZodToMongoose convertor refuses it and INIT dies on\n   * `zod_converter_schema_conversion_failed`). Addressing is carried by `isPrimaryScope` +\n   * `REQUIRES_CONTEXT` on the relationship, which is what the URL builder reads, so the route is\n   * identical either way.\n   */\n  applicationId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * WHICH declared instance this partition lives in — a `systemsOfRecord.<name>` key.\n   *\n   * Instance-scoped rather than vendor-scoped, and that is load-bearing: two Odoo deployments\n   * (`odoo-fr`, `odoo-de`) share one vendor facet and have entirely unrelated company ids. A key\n   * scoped to the vendor would let one deployment's company 10 resolve through the other's map.\n   *\n   * ⚠️ Built from the exported PATTERN and MAX_LENGTH rather than from `SystemOfRecordNameSchema`,\n   * and that is not a style choice. A zod decorator MUTATES the schema object it is called on —\n   * measured 2026-09-18: `shared.isDBIndexed() === shared` is `true`, and the metadata lands on the\n   * shared object. Chaining off the exported instance-name schema would therefore stamp\n   * `isDBIndexed`/`isSummaryField`/`excludeFromUpdate`/`isAuditEvidence` onto the schema that\n   * validates `systemsOfRecord.<name>` keys in `wildo.saas.config.ts`, which is a configuration key\n   * and not a resource field. The two constants ARE the single source — they are exported precisely\n   * because the environment-variable derivation depends on them — so nothing is duplicated here\n   * except the act of building a fresh schema out of them.\n   */\n  system: z.string()\n    .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n    .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH)\n    .isDBIndexed().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The partition's key AS THE REMOTE SPELLS IT, in canonical text.\n   *\n   * Decoded through the facet's partition codec before it reaches a compiler — see the class doc on\n   * why one stored shape plus a codec beats a column per vendor.\n   */\n  remoteKey: z.string().min(1).max(SYSTEM_OF_RECORD_REMOTE_KEY_MAX_LENGTH)\n    .isDBIndexed().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The unit of the OWNER organization this partition belongs to.\n   *\n   * `.excludeFromUpdate()` so the only writer is the `reassign` door and its compare-and-swap.\n   *\n   * The foreign key buys EXISTENCE and nothing more. An APPLICATION-scoped row written by a\n   * super-administrator resolves `writeTenantId === ''` in the write-integrity check, so the FK\n   * cannot also assert that the unit belongs to the owner organization or that it is ACTIVE — both\n   * are checked in the custom implementation through the system door, and pinned there (slice R10).\n   */\n  organizationUnitId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * Why this partition belongs to this unit. REQUIRED, on the `applicationAccessGrants` precedent.\n   *\n   * It carries real weight here rather than being ceremony: an assignment is an access decision with\n   * no expiry — unlike a grant, it stands until someone changes it — and the next operator looking at\n   * \"company 10 → Deutschland\" has no other way to learn whether that reflects the corporate\n   * structure or somebody's guess during an incident.\n   */\n  // USER_CONTENT — free prose an OPERATOR typed. MASK rather than REMOVE on erasure: `.min(1)` makes\n  // it non-clearable, so a null would be rejected by the strict update-DTO parse the impersonalize\n  // writer runs, and a fixed non-empty string is accepted.\n  justification: addImpersonalizeWith(\n    z.string().min(1).max(1000).isSummaryField()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.MASK,\n    { maskValue: ERASED_ASSIGNMENT_TEXT },\n  ),\n\n  /** The operator who last assigned or moved this partition. Server-authored from the session. */\n  assignedByUserId: z.string().min(1).optional().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'system',\n  'remoteKey',\n]);\n\nexport type SystemOfRecordPartitionAssignment = z.infer<typeof SystemOfRecordPartitionAssignmentSchema>;\n\n/**\n * The inverse map a read uses: unit ids → the remote keys confined to them.\n *\n * Built per request from the rows this caller's units reach. Deliberately NOT cached — measured\n * 2026-09-18, the indexed lookup is 0.078–0.177 ms at 20× the realistic row count, against a 1.02 ms\n * p50 floor for the remote read it precedes (a loopback socket with a handler that does nothing but\n * serialize). A real system of record is 50–500 ms, so the cache would save ~0.1 ms on a path about\n * to spend three orders of magnitude more.\n *\n * The correctness half is what settles it: the cached value is a SECURITY CONFINEMENT, so a stale\n * entry means a member still reads a partition they were unassigned from — the defect this resource\n * exists to close, re-entering through the cache. `ApplicationOwnerOrganizationResolverBackendService`\n * caches for the process lifetime and is right to, because its invalidating event is an owner\n * PROMOTION — once per application lifetime. Reassigning a partition is ordinary administration.\n */\nexport function buildRemoteKeysForUnits(\n  assignments: readonly Pick<SystemOfRecordPartitionAssignment, 'organizationUnitId' | 'remoteKey'>[],\n  organizationUnitIds: readonly string[],\n): string[] {\n  const wanted = new Set(organizationUnitIds);\n  const keys = new Set<string>();\n  for (const assignment of assignments) {\n    if (wanted.has(assignment.organizationUnitId)) keys.add(assignment.remoteKey);\n  }\n  return [...keys];\n}\n"]}

package/dist/esm/testing/resource-config-builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-config-builders.d.ts","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2CAA2C,EAC5C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAKL,oBAAoB,EAKrB,MAAM,uCAAuC,CAAC;AAG/C,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAuC5F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,mBAAmB,GAAE,qBAAkD,GACtE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAsChD;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,UAAU,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAC3D,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CA0BtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,2CAA2C,CAuI7C;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,oBAAoB,EAAE,CAQxB"}
+{"version":3,"file":"resource-config-builders.d.ts","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2CAA2C,EAC5C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAKL,oBAAoB,EAKrB,MAAM,uCAAuC,CAAC;AAG/C,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CA6C5F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,mBAAmB,GAAE,qBAAkD,GACtE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAsChD;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,UAAU,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAC3D,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CA0BtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,2CAA2C,CAuI7C;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,oBAAoB,EAAE,CAQxB"}

package/dist/esm/testing/resource-config-builders.js

@@ -20,11 +20,17 @@ export function makeUserTypeAuth(overrides) {
             emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,
             blockForSSODomains: false,
         },
+        /*
+         * Mirrors the production default (#1249). It did not: this builder said `requireNumbers: false`
+         * while all five production declarations said `true`, so every test written against it validated a
+         * policy no application had. That is worth more than the fix — a test double that drifts from the
+         * thing it doubles reports on a product that does not exist.
+         */
         passwordPolicy: {
-            minLength: 8,
+            minLength: 15,
             maxLength: 128,
-            requireUppercase: true,
-            requireLowercase: true,
+            requireUppercase: false,
+            requireLowercase: false,
             requireNumbers: false,
             requireSpecialChars: false,
             expiryDays: 0,
@@ -39,7 +45,7 @@ export function makeUserTypeAuth(overrides) {
         autoLinkByEmail: true,
         methodManagement: {
             allowUserMethodRemoval: true,
-            requireReauthForMethodChanges: false,
+            requireReauthForMethodChanges: true,
         },
         ...overrides,
     };

package/dist/esm/testing/resource-config-builders.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-config-builders.js","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EACL,qBAAqB,GAGtB,MAAM,gDAAgD,CAAC;AAMxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,UAAU,gBAAgB,CAAC,SAAuC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;QAClF,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,oBAAoB,EAAE,SAAS;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrC,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD,cAAc,EAAE;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,EAAE;QAC1B,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,KAAK;SACrC;QACD,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAwB,EACxB,sBAA6C,qBAAqB,CAAC,IAAI;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,gBAAgB,EAAE,KAAK;QACvB,mBAAmB;QACnB,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,QAAe;QACnC,2BAA2B,EAAE,EAAE;QAC/B,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,qBAAqB,EAAE,SAAS;QAChC,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,0BAA0B,CAAC,GAAG;QACzC,KAAK,EAAE,EAAE;QACT,gCAAgC,EAAE,EAAE;QACpC,oBAAoB,EAAE,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,sBAAsB,EAAE,KAAK;QAC7B,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,SAAS;KAC4B,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAwB,EACxB,UAA4D;IAE5D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,SAAS;QAC1B,UAAU;QACV,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,2BAA2B,EAAE,SAAS;QACtC,gBAAgB,EAAE,KAAK;QACvB,iGAAiG;QACjG,cAAc,EAAE,KAAK;QACrB,4FAA4F;QAC5F,mBAAmB,EAAE,2BAA2B,CAAC,GAAG;QACpD,UAAU;KACoC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,kBAA0B,EAC1B,qBAA6C;IAE7C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;IAEF,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACxB,CAAC;IAEF,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAE7F,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE7E,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,kBAA0B,EAC1B,qBAA6C;IAE7C,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,EAAE,kBAAkB;QACrC,GAAG,CAAC,aAAa,CAAC,MAAM;QACxB,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CAAC,CACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared helpers for saas-models tests: minimal resource configs, auth fixtures,\n * and relationship processing that mirrors `createResourceConfiguration_Initialization`.\n *\n * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.\n */\nimport type { z } from 'zod';\nimport {\n  EmailVerificationMode,\n  RegistrationMode,\n  type UserTypeAuthPolicy,\n} from '../config/entity-identity-config.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport {\n  CoreResourceOperation,\n  ResourceFieldIdentifier,\n  ResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport type {\n  ResourceConfiguration,\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_ResourceRelationships,\n} from '../resources/resources-config.shared.schemas';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceTranspositionPolicy,\n} from '../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../resources/resources.shared.utils';\n\nexport function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy {\n  return {\n    authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.MAGIC_LINK]: true },\n    mfaPolicy: {\n      requireMFA: false,\n      requireStrongMFA: false,\n      acceptableMFAMethods: undefined,\n      enrollmentGracePeriodDays: 14,\n      passkeyExemptFromMFA: true,\n    },\n    registration: {\n      mode: RegistrationMode.OPEN,\n      allowedMethods: [AuthMethod.PASSWORD],\n      emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n      blockForSSODomains: false,\n    },\n    passwordPolicy: {\n      minLength: 8,\n      maxLength: 128,\n      requireUppercase: true,\n      requireLowercase: true,\n      requireNumbers: false,\n      requireSpecialChars: false,\n      expiryDays: 0,\n    },\n    sessionDurationMinutes: 30,\n    lockoutPolicy: {\n      maxLoginAttempts: 5,\n      lockoutDurationMinutes: 30,\n      progressiveLockout: false,\n      maxProgressiveLockoutHours: 24,\n    },\n    autoLinkByEmail: true,\n    methodManagement: {\n      allowUserMethodRemoval: true,\n      requireReauthForMethodChanges: false,\n    },\n    ...overrides,\n  } as UserTypeAuthPolicy;\n}\n\n/**\n * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.\n *\n * **Not** the same symbol as `createTestOperation` in `@wildo-ai/saas-backend-lib/testing`\n * (`feature-test-utils.ts`), which builds operation stubs for **feature-gate** tests.\n */\nexport function createTestOperation(\n  mainSchema: z.ZodTypeAny,\n  operationIdentifier: CoreResourceOperation = CoreResourceOperation.READ\n): ResourceConfiguration_Operation<any, any, any> {\n  return {\n    isDisabled: false,\n    mainSchema,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    isSystemResource: false,\n    operationIdentifier,\n    isOperationDefault: true,\n    serviceRuntimeMode: 'INLINE' as any,\n    notificationBadgeOperations: [],\n    userNotifications: [],\n    m2mNotifications: [],\n    variantType: ResourceOperationVariantType.API_CALL,\n    resourceOperationLike: undefined,\n    requiredFeatures: undefined,\n    riskLevel: ResourceOperationRiskLevel.LOW,\n    roles: [],\n    customServiceImplementationModes: [],\n    basicPrefixOperation: undefined,\n    httpVerb: HttpMethod.GET,\n    isApiKeyAccessDisabled: false,\n    isBulkOperation: false,\n    consumableToken: undefined,\n    enabledCondition: undefined,\n    isDefault: true,\n    variantKey: undefined,\n  } as ResourceConfiguration_Operation<any, any, any>;\n}\n\nexport function createTestResourceConfig(\n  mainSchema: z.ZodTypeAny,\n  operations: ResourceConfiguration_Operation<any, any, any>[]\n): ResourceConfiguration<any, any, any> {\n  return {\n    isDisabled: false,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    coreOperations: [],\n    customOperation: undefined,\n    mainSchema,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    inheritenceSchemaDefinition: undefined,\n    isSystemResource: false,\n    /** W7.3a: test fixtures default to non-anonymizable unless overrides replace the full config. */\n    isAnonymizable: false,\n    /** Required by type; only applied when `isAnonymizable` is true (engine default is ADD). */\n    transpositionPolicy: ResourceTranspositionPolicy.ADD,\n    operations,\n  } satisfies ResourceConfiguration<any, any, any>;\n}\n\n/**\n * Process relationships for a resource — mirrors the logic in createResourceConfiguration_Initialization.\n * M:N relationships are transformed into 1:N relationships for the junction table.\n *\n * The helper expects compiled runtime relationships, matching the production\n * factory output from `createResourcesRelationship()` / registry initialization.\n */\nexport function processResourceRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceConfiguration_ResourceRelationships {\n  const compileSyntheticRelationship = (\n    relationshipDeclaration: ResourceRelationshipDeclaration\n  ): ResourceRelationship =>\n    Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n  const activeRelationships = resourceRelationships.filter((rel) => !rel.isDisabled);\n\n  const isManyToMany = (rel: ResourceRelationship) =>\n    rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n    rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n    rel.jointResourceType;\n\n  const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n    parentRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType2 === resourceIdentifier &&\n        rel.resourceType1 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    childRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    selfRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 === resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n  };\n\n  const manyToManyRelationships = activeRelationships.filter(\n    (rel) =>\n      rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n      rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n      rel.jointResourceType\n  );\n\n  manyToManyRelationships.forEach((m2mRel) => {\n    Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n    const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType } = m2mRel;\n\n    if (resourceIdentifier === jointResourceType) {\n      const relationFromEntity1 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity1Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity1);\n\n      const relationFromEntity2 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity2Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity2);\n    } else if (resourceIdentifier === entity1Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    } else if (resourceIdentifier === entity2Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    }\n  });\n\n  return processedResourceRelationships;\n}\n\n/**\n * Conditional relationships — active only for specific discriminator variants.\n */\nexport function getConditionalRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceRelationship[] {\n  return resourceRelationships.filter(\n    (rel) =>\n      rel.discriminator?.discriminatorField &&\n      rel.discriminator.values &&\n      rel.discriminator.values.length > 0 &&\n      (rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier)\n  );\n}\n"]}
+{"version":3,"file":"resource-config-builders.js","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EACL,qBAAqB,GAGtB,MAAM,gDAAgD,CAAC;AAMxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,UAAU,gBAAgB,CAAC,SAAuC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;QAClF,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,oBAAoB,EAAE,SAAS;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrC,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD;;;;;WAKG;QACH,cAAc,EAAE;YACd,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,KAAK;YACvB,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,EAAE;QAC1B,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,IAAI;SACpC;QACD,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAwB,EACxB,sBAA6C,qBAAqB,CAAC,IAAI;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,gBAAgB,EAAE,KAAK;QACvB,mBAAmB;QACnB,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,QAAe;QACnC,2BAA2B,EAAE,EAAE;QAC/B,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,qBAAqB,EAAE,SAAS;QAChC,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,0BAA0B,CAAC,GAAG;QACzC,KAAK,EAAE,EAAE;QACT,gCAAgC,EAAE,EAAE;QACpC,oBAAoB,EAAE,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,sBAAsB,EAAE,KAAK;QAC7B,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,SAAS;KAC4B,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAwB,EACxB,UAA4D;IAE5D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,SAAS;QAC1B,UAAU;QACV,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,2BAA2B,EAAE,SAAS;QACtC,gBAAgB,EAAE,KAAK;QACvB,iGAAiG;QACjG,cAAc,EAAE,KAAK;QACrB,4FAA4F;QAC5F,mBAAmB,EAAE,2BAA2B,CAAC,GAAG;QACpD,UAAU;KACoC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,kBAA0B,EAC1B,qBAA6C;IAE7C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;IAEF,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACxB,CAAC;IAEF,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAE7F,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE7E,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,kBAA0B,EAC1B,qBAA6C;IAE7C,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,EAAE,kBAAkB;QACrC,GAAG,CAAC,aAAa,CAAC,MAAM;QACxB,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CAAC,CACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared helpers for saas-models tests: minimal resource configs, auth fixtures,\n * and relationship processing that mirrors `createResourceConfiguration_Initialization`.\n *\n * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.\n */\nimport type { z } from 'zod';\nimport {\n  EmailVerificationMode,\n  RegistrationMode,\n  type UserTypeAuthPolicy,\n} from '../config/entity-identity-config.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport {\n  CoreResourceOperation,\n  ResourceFieldIdentifier,\n  ResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport type {\n  ResourceConfiguration,\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_ResourceRelationships,\n} from '../resources/resources-config.shared.schemas';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceTranspositionPolicy,\n} from '../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../resources/resources.shared.utils';\n\nexport function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy {\n  return {\n    authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.MAGIC_LINK]: true },\n    mfaPolicy: {\n      requireMFA: false,\n      requireStrongMFA: false,\n      acceptableMFAMethods: undefined,\n      enrollmentGracePeriodDays: 14,\n      passkeyExemptFromMFA: true,\n    },\n    registration: {\n      mode: RegistrationMode.OPEN,\n      allowedMethods: [AuthMethod.PASSWORD],\n      emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n      blockForSSODomains: false,\n    },\n    /*\n     * Mirrors the production default (#1249). It did not: this builder said `requireNumbers: false`\n     * while all five production declarations said `true`, so every test written against it validated a\n     * policy no application had. That is worth more than the fix — a test double that drifts from the\n     * thing it doubles reports on a product that does not exist.\n     */\n    passwordPolicy: {\n      minLength: 15,\n      maxLength: 128,\n      requireUppercase: false,\n      requireLowercase: false,\n      requireNumbers: false,\n      requireSpecialChars: false,\n      expiryDays: 0,\n    },\n    sessionDurationMinutes: 30,\n    lockoutPolicy: {\n      maxLoginAttempts: 5,\n      lockoutDurationMinutes: 30,\n      progressiveLockout: false,\n      maxProgressiveLockoutHours: 24,\n    },\n    autoLinkByEmail: true,\n    methodManagement: {\n      allowUserMethodRemoval: true,\n      requireReauthForMethodChanges: true,\n    },\n    ...overrides,\n  } as UserTypeAuthPolicy;\n}\n\n/**\n * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.\n *\n * **Not** the same symbol as `createTestOperation` in `@wildo-ai/saas-backend-lib/testing`\n * (`feature-test-utils.ts`), which builds operation stubs for **feature-gate** tests.\n */\nexport function createTestOperation(\n  mainSchema: z.ZodTypeAny,\n  operationIdentifier: CoreResourceOperation = CoreResourceOperation.READ\n): ResourceConfiguration_Operation<any, any, any> {\n  return {\n    isDisabled: false,\n    mainSchema,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    isSystemResource: false,\n    operationIdentifier,\n    isOperationDefault: true,\n    serviceRuntimeMode: 'INLINE' as any,\n    notificationBadgeOperations: [],\n    userNotifications: [],\n    m2mNotifications: [],\n    variantType: ResourceOperationVariantType.API_CALL,\n    resourceOperationLike: undefined,\n    requiredFeatures: undefined,\n    riskLevel: ResourceOperationRiskLevel.LOW,\n    roles: [],\n    customServiceImplementationModes: [],\n    basicPrefixOperation: undefined,\n    httpVerb: HttpMethod.GET,\n    isApiKeyAccessDisabled: false,\n    isBulkOperation: false,\n    consumableToken: undefined,\n    enabledCondition: undefined,\n    isDefault: true,\n    variantKey: undefined,\n  } as ResourceConfiguration_Operation<any, any, any>;\n}\n\nexport function createTestResourceConfig(\n  mainSchema: z.ZodTypeAny,\n  operations: ResourceConfiguration_Operation<any, any, any>[]\n): ResourceConfiguration<any, any, any> {\n  return {\n    isDisabled: false,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    coreOperations: [],\n    customOperation: undefined,\n    mainSchema,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    inheritenceSchemaDefinition: undefined,\n    isSystemResource: false,\n    /** W7.3a: test fixtures default to non-anonymizable unless overrides replace the full config. */\n    isAnonymizable: false,\n    /** Required by type; only applied when `isAnonymizable` is true (engine default is ADD). */\n    transpositionPolicy: ResourceTranspositionPolicy.ADD,\n    operations,\n  } satisfies ResourceConfiguration<any, any, any>;\n}\n\n/**\n * Process relationships for a resource — mirrors the logic in createResourceConfiguration_Initialization.\n * M:N relationships are transformed into 1:N relationships for the junction table.\n *\n * The helper expects compiled runtime relationships, matching the production\n * factory output from `createResourcesRelationship()` / registry initialization.\n */\nexport function processResourceRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceConfiguration_ResourceRelationships {\n  const compileSyntheticRelationship = (\n    relationshipDeclaration: ResourceRelationshipDeclaration\n  ): ResourceRelationship =>\n    Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n  const activeRelationships = resourceRelationships.filter((rel) => !rel.isDisabled);\n\n  const isManyToMany = (rel: ResourceRelationship) =>\n    rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n    rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n    rel.jointResourceType;\n\n  const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n    parentRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType2 === resourceIdentifier &&\n        rel.resourceType1 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    childRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    selfRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 === resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n  };\n\n  const manyToManyRelationships = activeRelationships.filter(\n    (rel) =>\n      rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n      rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n      rel.jointResourceType\n  );\n\n  manyToManyRelationships.forEach((m2mRel) => {\n    Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n    const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType } = m2mRel;\n\n    if (resourceIdentifier === jointResourceType) {\n      const relationFromEntity1 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity1Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity1);\n\n      const relationFromEntity2 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity2Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity2);\n    } else if (resourceIdentifier === entity1Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    } else if (resourceIdentifier === entity2Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    }\n  });\n\n  return processedResourceRelationships;\n}\n\n/**\n * Conditional relationships — active only for specific discriminator variants.\n */\nexport function getConditionalRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceRelationship[] {\n  return resourceRelationships.filter(\n    (rel) =>\n      rel.discriminator?.discriminatorField &&\n      rel.discriminator.values &&\n      rel.discriminator.values.length > 0 &&\n      (rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier)\n  );\n}\n"]}

package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.d.ts

@@ -39,7 +39,8 @@
  *
  * NOT modeled here (already on parent `AnonymousUserSchema`):
  * - `userAgent`         — `AnonymousUser.userAgent` (line 14).
- * - `consentGrantedAt`  — `AnonymousUserPrivacy.consentTimestamp`.
+ * - consent            — `AnonymousUserPrivacy.consentedPurposes` (what was granted) and
+ *                        `consentDecidedAt` (when the visitor decided — a decision, not necessarily a grant).
  * - `ipHash`            — `AnonymousUser.ipHash` (line 15).
  *
  * Length caps mirror the existing `AnonymousUser.userAgent` truncation

package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;iBAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oCAAoC;;;;;;;;;;;iBAK/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}
+{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;iBAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oCAAoC;;;;;;;;;;;iBAK/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.js

@@ -39,7 +39,8 @@
  *
  * NOT modeled here (already on parent `AnonymousUserSchema`):
  * - `userAgent`         — `AnonymousUser.userAgent` (line 14).
- * - `consentGrantedAt`  — `AnonymousUserPrivacy.consentTimestamp`.
+ * - consent            — `AnonymousUserPrivacy.consentedPurposes` (what was granted) and
+ *                        `consentDecidedAt` (when the visitor decided — a decision, not necessarily a grant).
  * - `ipHash`            — `AnonymousUser.ipHash` (line 15).
  *
  * Length caps mirror the existing `AnonymousUser.userAgent` truncation

package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAO,0CAA0C;AAClF,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,OAAO,EAAI,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAc,mBAAmB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAC/D,WAAW,EAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACnE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser First-Touch Marketing Attribution (Phase 0.5, Q-D=β)\n *\n * Captured ONCE at session-init time on `AnonymousUser.marketingMetadata`\n * and never overwritten on subsequent requests (first-touch semantics).\n * Attribution lives on the session, not the conversion row — so a single\n * `AnonymousUser` is the canonical source whether the visitor:\n *   - converts via an `InboundContact` form submission,\n *   - signs up directly,\n *   - or never converts at all (cleaned up by the anonymous-session-cleanup\n *     batch at session TTL).\n *\n * Marketing analytics joins `InboundContact → AnonymousUser →\n * marketingMetadata` via the `anonymousUserId` FK declared in\n * `inbound-contacts.shared.schemas.ts`.\n *\n * Field-by-field rationale:\n *\n * - `utm.*`            — Standard UTM parameters extracted from `req.query`\n *                        on the marketing site landing request. All optional\n *                        because organic / direct traffic has none.\n * - `referrer`         — `Referer` HTTP header (note the historical\n *                        misspelling — kept as `referrer` here to match\n *                        the analytics-industry convention rather than\n *                        the HTTP-header spec spelling).\n * - `landingPath`      — Path of the FIRST page the visitor landed on\n *                        (e.g. `/pricing`, `/blog/post-slug`). Sourced\n *                        from a marketing-site-only `x-landing-path` HTTP\n *                        header (registered in `WildoHeaderKeys`) that\n *                        the marketing-site bootstrap injects on the\n *                        very first request to the anonymous-session-init\n *                        endpoint. We do NOT use `req.path` because the\n *                        anonymous-session-init endpoint URL is itself\n *                        not a marketing landing page.\n * - `acceptLanguage`   — Raw `Accept-Language` header (full string, not\n *                        parsed). Useful for analytics segmentation and\n *                        for inferring locale preference when the visitor\n *                        eventually creates an account.\n *\n * NOT modeled here (already on parent `AnonymousUserSchema`):\n * - `userAgent`         — `AnonymousUser.userAgent` (line 14).\n * - `consentGrantedAt`  — `AnonymousUserPrivacy.consentTimestamp`.\n * - `ipHash`            — `AnonymousUser.ipHash` (line 15).\n *\n * Length caps mirror the existing `AnonymousUser.userAgent` truncation\n * pattern (`.substring(0, 256)` in `createAnonymousUser`) — applied at\n * the schema level here so the boundary is explicit and re-used at every\n * write site.\n */\n\nimport { z } from 'zod';\n\nconst MAX_UTM_FIELD_LENGTH = 256;\nconst MAX_REFERRER_LENGTH = 2048;       // URLs can be long (oauth callbacks etc.)\nconst MAX_LANDING_PATH_LENGTH = 2048;\nconst MAX_ACCEPT_LANGUAGE_LENGTH = 256;\n\n/**\n * Standard UTM parameter subobject. Every field optional because\n * organic / direct traffic carries no UTM params at all.\n */\nexport const UtmParametersSchema = z.object({\n  source   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  medium   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  campaign : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  term     : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  content  : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n});\n\nexport type UtmParameters = z.infer<typeof UtmParametersSchema>;\n\nexport const AnonymousUserMarketingMetadataSchema = z.object({\n  utm            : UtmParametersSchema.optional(),\n  referrer       : z.string().max(MAX_REFERRER_LENGTH).optional(),\n  landingPath    : z.string().max(MAX_LANDING_PATH_LENGTH).optional(),\n  acceptLanguage : z.string().max(MAX_ACCEPT_LANGUAGE_LENGTH).optional(),\n});\n\nexport type AnonymousUserMarketingMetadata = z.infer<typeof AnonymousUserMarketingMetadataSchema>;\n"]}
+{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAO,0CAA0C;AAClF,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,OAAO,EAAI,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAc,mBAAmB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAC/D,WAAW,EAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACnE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser First-Touch Marketing Attribution (Phase 0.5, Q-D=β)\n *\n * Captured ONCE at session-init time on `AnonymousUser.marketingMetadata`\n * and never overwritten on subsequent requests (first-touch semantics).\n * Attribution lives on the session, not the conversion row — so a single\n * `AnonymousUser` is the canonical source whether the visitor:\n *   - converts via an `InboundContact` form submission,\n *   - signs up directly,\n *   - or never converts at all (cleaned up by the anonymous-session-cleanup\n *     batch at session TTL).\n *\n * Marketing analytics joins `InboundContact → AnonymousUser →\n * marketingMetadata` via the `anonymousUserId` FK declared in\n * `inbound-contacts.shared.schemas.ts`.\n *\n * Field-by-field rationale:\n *\n * - `utm.*`            — Standard UTM parameters extracted from `req.query`\n *                        on the marketing site landing request. All optional\n *                        because organic / direct traffic has none.\n * - `referrer`         — `Referer` HTTP header (note the historical\n *                        misspelling — kept as `referrer` here to match\n *                        the analytics-industry convention rather than\n *                        the HTTP-header spec spelling).\n * - `landingPath`      — Path of the FIRST page the visitor landed on\n *                        (e.g. `/pricing`, `/blog/post-slug`). Sourced\n *                        from a marketing-site-only `x-landing-path` HTTP\n *                        header (registered in `WildoHeaderKeys`) that\n *                        the marketing-site bootstrap injects on the\n *                        very first request to the anonymous-session-init\n *                        endpoint. We do NOT use `req.path` because the\n *                        anonymous-session-init endpoint URL is itself\n *                        not a marketing landing page.\n * - `acceptLanguage`   — Raw `Accept-Language` header (full string, not\n *                        parsed). Useful for analytics segmentation and\n *                        for inferring locale preference when the visitor\n *                        eventually creates an account.\n *\n * NOT modeled here (already on parent `AnonymousUserSchema`):\n * - `userAgent`         — `AnonymousUser.userAgent` (line 14).\n * - consent            — `AnonymousUserPrivacy.consentedPurposes` (what was granted) and\n *                        `consentDecidedAt` (when the visitor decided — a decision, not necessarily a grant).\n * - `ipHash`            — `AnonymousUser.ipHash` (line 15).\n *\n * Length caps mirror the existing `AnonymousUser.userAgent` truncation\n * pattern (`.substring(0, 256)` in `createAnonymousUser`) — applied at\n * the schema level here so the boundary is explicit and re-used at every\n * write site.\n */\n\nimport { z } from 'zod';\n\nconst MAX_UTM_FIELD_LENGTH = 256;\nconst MAX_REFERRER_LENGTH = 2048;       // URLs can be long (oauth callbacks etc.)\nconst MAX_LANDING_PATH_LENGTH = 2048;\nconst MAX_ACCEPT_LANGUAGE_LENGTH = 256;\n\n/**\n * Standard UTM parameter subobject. Every field optional because\n * organic / direct traffic carries no UTM params at all.\n */\nexport const UtmParametersSchema = z.object({\n  source   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  medium   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  campaign : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  term     : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  content  : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n});\n\nexport type UtmParameters = z.infer<typeof UtmParametersSchema>;\n\nexport const AnonymousUserMarketingMetadataSchema = z.object({\n  utm            : UtmParametersSchema.optional(),\n  referrer       : z.string().max(MAX_REFERRER_LENGTH).optional(),\n  landingPath    : z.string().max(MAX_LANDING_PATH_LENGTH).optional(),\n  acceptLanguage : z.string().max(MAX_ACCEPT_LANGUAGE_LENGTH).optional(),\n});\n\nexport type AnonymousUserMarketingMetadata = z.infer<typeof AnonymousUserMarketingMetadataSchema>;\n"]}

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.d.ts

@@ -9,30 +9,145 @@
  * it never reads its own AnonymousUser row. See the READ variant note for why anon
  * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).
  */
+import { z } from 'zod';
+import { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
 import { ResourceRelationship } from '../resources/resources.shared.schemas';
-export declare const anonymousUsersResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, import("zod").ZodObject<{
-    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
-    uuidRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>;
-    privacy: import("zod").ZodObject<{
-        dataProcessingConsent: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("..").DataProcessingConsent>>;
-    }, import("zod/v4/core").$strip>;
-    userAgent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
-    ipHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
-    marketingMetadata: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodObject<{
-        utm: import("zod").ZodOptional<import("zod").ZodObject<{
-            source: import("zod").ZodOptional<import("zod").ZodString>;
-            medium: import("zod").ZodOptional<import("zod").ZodString>;
-            campaign: import("zod").ZodOptional<import("zod").ZodString>;
-            term: import("zod").ZodOptional<import("zod").ZodString>;
-            content: import("zod").ZodOptional<import("zod").ZodString>;
-        }, import("zod/v4/core").$strip>>;
-        referrer: import("zod").ZodOptional<import("zod").ZodString>;
-        landingPath: import("zod").ZodOptional<import("zod").ZodString>;
-        acceptLanguage: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>>>>;
-    convertedToUserId: import("zod").ZodOptional<import("zod").ZodString>;
-    transpositionStatus: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodEnum<typeof import("./anonymous-users.shared.schema").AnonymousUserTranspositionStatus>>>;
-    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>;
-}, import("zod/v4/core").$strip>>;
+/**
+ * Custom operations on the anonymous identity anchor.
+ *
+ * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent
+ * decision was declared on this resource's UPDATE — *"a visitor's or a lead's consent decision is as
+ * recordable as a member's"* — while every operation here is `INTERNAL_CALL` or super-admin, so no
+ * visitor could reach it. The recording contract was written for a door nobody built (#1258).
+ */
+export declare enum AnonymousUsers_Operations {
+    RECORD_CONSENT = "record_consent",
+    /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */
+    RECORD_NOTICE_DELIVERED = "record_notice_delivered"
+}
+/**
+ * What a visitor's consent surface sends when they decide.
+ *
+ * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise
+ *
+ * A decision is `(granted subset-of offered, at an instant)` — see
+ * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the
+ * person saw, and the server does not know it: the marketing website is statically built and derives
+ * its panel from its OWN live providers, which this backend never sees. So the client is the only
+ * party that can state it.
+ *
+ * The blast radius is confined by construction, which is what makes that acceptable:
+ *
+ * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the
+ *   request, so no visitor can describe another visitor's decision;
+ * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes
+ *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an
+ *   account that has already decided;
+ * - it grants no privilege a visitor does not already have — they may tick the same boxes on the
+ *   application's own consent surface a minute later.
+ *
+ * The residual is a shared browser whose first visitor lies: the next person to register from it
+ * starts with grants they did not make. That is the pre-existing shared-browser exposure of any
+ * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.
+ *
+ * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same
+ * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the
+ * fact that a decision happened.
+ */
+export declare const AnonymousUsersRecordConsentRequestDtoSchema: z.ZodObject<{
+    grantedPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+    offeredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+}, z.core.$strip>;
+export type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;
+/**
+ * What the visitor gets back: their OWN decision, and nothing else.
+ *
+ * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`
+ * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the
+ * controller's response validation — measured live as `controller_resource_validation_failed` after
+ * the write had already succeeded (#1267).
+ *
+ * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and
+ * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`
+ * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a
+ * consent click would disclose more than the click.
+ *
+ * The decision itself IS safe to return to the session that just made it, and useful: a client can
+ * reconcile what the server stored — including the instant, which the server owns — without a read
+ * door on a resource whose READ is deliberately admin-only.
+ */
+export declare const AnonymousUsersRecordConsentResponseDtoSchema: z.ZodObject<{
+    consentedPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+    offeredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+    consentDecidedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodISODateTime]>>;
+}, z.core.$strip>;
+export type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;
+/**
+ * What a visitor's public-document page sends when a governed document renders for them (#1258 Step
+ * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,
+ * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers
+ * have different security characteristics and each already has a proven pattern to reuse.
+ *
+ * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from
+ * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to
+ * have met a release that was never in force, or the wrong version of one that was.
+ */
+export declare const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema: z.ZodObject<{
+    documentRef: z.ZodString;
+}, z.core.$strip>;
+export type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;
+/**
+ * Declared rather than inherited, for the same reason as its consent sibling: a custom operation
+ * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at
+ * all, so there is no row to fail validation against — an explicit, minimal response avoids
+ * reintroducing that trap by construction.
+ *
+ * `recorded: false` is not an error — it means the resolved release does not permit
+ * `NOTICE_DELIVERED`, or nothing is in force for that document right now. The caller does not act on
+ * this value; it exists for the rare case a session wants to know whether the call did anything.
+ */
+export declare const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema: z.ZodObject<{
+    recorded: z.ZodBoolean;
+}, z.core.$strip>;
+export type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;
+/**
+ * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed
+ * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,
+ * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the
+ * resource or operation identifier changes, on a public door nobody monitors.
+ *
+ * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that
+ * carve (it cannot import the resources layer), and this door is reached only from the signed-out
+ * pages of the APPLICATION itself, which already imports this package freely.
+ */
+export declare const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH: string;
+/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */
+export declare const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = "PUT";
+export declare const anonymousUsersResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<typeof AnonymousUsers_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    uuidRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+        consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+        offeredPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+        consentDecidedAt: z.ZodOptional<z.ZodDate>;
+    }, z.core.$strip>>>;
+    userAgent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    ipHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    marketingMetadata: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodObject<{
+        utm: z.ZodOptional<z.ZodObject<{
+            source: z.ZodOptional<z.ZodString>;
+            medium: z.ZodOptional<z.ZodString>;
+            campaign: z.ZodOptional<z.ZodString>;
+            term: z.ZodOptional<z.ZodString>;
+            content: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        referrer: z.ZodOptional<z.ZodString>;
+        landingPath: z.ZodOptional<z.ZodString>;
+        acceptLanguage: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>;
+    convertedToUserId: z.ZodOptional<z.ZodString>;
+    transpositionStatus: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof import("./anonymous-users.shared.schema").AnonymousUserTranspositionStatus>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>;
+}, z.core.$strip>>;
 //# sourceMappingURL=anonymous-users.shared.resources-config.schemas.d.ts.map