@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/applications/applications.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"applications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAE7I,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,2CAA2C;AAC3C,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,mFAAmF;AACnF,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,mFAAmF;AACnF,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sEAAsE;AACtE,wFAAwF;AACxF,uFAAuF;AACvF,2FAA2F;AAC3F,gGAAgG;AAChG,6DAA6D;AAC7D,qFAAqF;AACrF,yFAAyF;AACzF,6FAA6F;AAC7F,qBAAqB;AACrB,0FAA0F;AAC1F,+EAA+E;AAC/E,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iGAAiG;AACjG,8DAA8D;AAC9D,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,yEAAyE;AACzE,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AACzF,kEAAkE;AAElE,MAAM,uBAAuB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE9D,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAUF;;EAEE;AACF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIlK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,yEAAyE;oBACzE,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,oCAAoC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4GAA4G;oBAChJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;oBACjD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,wEAAwE;oBACxE,sFAAsF;oBACtF,qFAAqF;oBACrF,oFAAoF;oBACpF,qFAAqF;oBACrF,sFAAsF;oBACtF,oEAAoE;oBACpE,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0EAA0E;oBAC1E,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CAEF,CAAC,CAAC","sourcesContent":["/**\n * Application Shared Resource Configuration\n *\n * Resource configuration for application management.\n * Supports both organization self-management and platform admin oversight.\n */\n\nimport { z } from 'zod';\nimport { ApplicationSchema } from './applications.shared.schemas';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for applications.\n//\n// CROSS-ORGANIZATION APPLICATION TRANSFER IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY.\n// `TRANSFER` was declared here in two variants (`ORG_ADMIN` default at `riskLevel: CRITICAL`, and\n// an `APP_ADMIN_SUPER_ADMIN` `admin` variant adding `bypassOwnerApproval`), taking\n// `{ targetOrganizationId, transferReason }`. Both were ROUTED but never implemented, so each\n// request fell through to the generic core UPDATE, which persists only fields the resource schema\n// declares. Neither `targetOrganizationId` nor `transferReason` is one, so every call answered\n// **HTTP 200 having changed nothing** — an operator was told a CRITICAL cross-tenant move had\n// succeeded while the application stayed exactly where it was. Removed 2026-08-01.\n//\n// It was REMOVED rather than implemented on five independent grounds:\n//\n//  1. NO FIELD TO WRITE. `ApplicationSchema` carries no owning-organization field.\n//  2. NO RELATIONSHIP TO RE-POINT. The resources registry declares no\n//     `ORGANIZATIONS → APPLICATION` edge; applications are not organization-owned here.\n//  3. THE OWNERSHIP DIRECTION IS INVERTED. `APPLICATION` is a top-level, self-anchored\n//     `ResourcePrimaryScope`. The application IS the tenant container; organizations are a\n//     sibling scope living inside its tenancy. \"Transferring\" the application to one of its own\n//     organizations is incoherent, not merely unimplemented.\n//  4. WHERE ORGANIZATION OWNERSHIP DOES EXIST, IT IS ALREADY IMMUTABLE. The platform\n//     app-factory's own application record binds `organizationId` at create and marks it\n//     `excludeFromUpdate()` — a different resource, on a different service, already refusing\n//     this mutation.\n//  5. FRAMEWORK PRECEDENT. Cross-organization MEMBER transfer is refused for exactly this\n//     reason — a tenant-boundary crossing the framework does not sanction (see\n//     `organization-members.shared.resources-config.schemas.ts`). An application is the tenant\n//     container itself, so the argument applies with more force, not less.\n//\n// `bypassOwnerApproval` additionally named an approval flow that does not exist, and neither\n// variant emitted an audit event despite being cross-tenant and CRITICAL. Re-declaring an\n// application re-parenting verb would require, at minimum: a persisted ownership edge, an\n// approval flow for the flag to bypass, a custom implementation that writes the edge, and\n// audit/SIEM emission on both request and completion.\n//\n// APPLICATION STATUS LIFECYCLE IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY EITHER.\n// `ACTIVATE` and `SUSPEND` were declared here as `APP_ADMIN_SUPER_ADMIN` verbs (`MEDIUM` and\n// `CRITICAL` respectively, both with a generated bulk variant) taking `{ reason }` and\n// `{ suspensionReason, notifyOwners }`. Like TRANSFER they were ROUTED but never implemented, so\n// each fell through to the generic core UPDATE and answered **HTTP 200 having changed nothing** —\n// an operator was told a CRITICAL application suspension had taken effect while the application\n// kept serving. Removed 2026-08-01, on grounds that compound with TRANSFER's:\n//\n//  1. NO FIELD TO WRITE — and no plausible one. `ApplicationSchema` is\n//     `{_id, appSlug, appDisplayName, lastVersion, platformAppId}`: an identity row, carrying no\n//     lifecycle state at all. There is nothing to transition.\n//  2. THE LIFECYCLE IS OWNED ONE TIER UP. An application's real operational state lives at the\n//     platform tier (`PLATFORM_APPLICATIONS` / `Wildo_Application_Config`), provisioned and\n//     managed by the platform apps-manager. This row is the in-app registry entry an application\n//     reads to know its own identity — halting an application is a platform-tier action, not a\n//     self-service field flip on the application's own copy of its name.\n//  3. SAME INVERTED OWNERSHIP AS TRANSFER (ground 3 above). `APPLICATION` is a top-level\n//     `ResourcePrimaryScope`; suspending the tenant container from inside its own tenancy is\n//     incoherent, and the suspending super-admin's own session lives in that container.\n//\n// The resource specification's framing — \"Created per org, managed by admins, and may be\n// transferred or suspended under governance\", with 409s for destination-org slug collisions —\n// describes a per-organization application marketplace. The framework does not implement one, and\n// inventing an `ApplicationStatus` to satisfy two unimplemented buttons would have built that\n// model backwards from its UI. Re-declaring these verbs requires the ownership model first.\n//\n// Applications consequently declare NO custom operations (hence the `undefined` custom-operation\n// type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and\n// `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n\nconst APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];\n\nconst APPLICATION_FILTER_FIELDS = {\n  appSlug: z.string(),\n  appDisplayName: z.string(),\n};\n\ntype ApplicationCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplications Resource Configuration Factory\n*/\nexport const applicationResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  ApplicationCoreOperations,\n  typeof ApplicationSchema\n>({\n  mainSchema: ApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Applications are core system resources\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can create applications\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // Use database definition so platformAppId and lastVersion are preserved\n          // requestDto auto-derived from decorators\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can create applications for any org\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can view any application\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    /**\n     * ⚠️ NOTHING CONFINES THIS QUERY — and that is safe for a reason worth stating, because the\n     * comment on the default variant used to imply a mechanism that does not exist.\n     *\n     * `applications` is its own scope ROOT, so both repositories blacklist the APPLICATIONS axis and\n     * this LIST compiles to the EMPTY filter (measured 2026-08-12,\n     * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep). The\n     * old wording — \"Org members can list *their* applications\" — is exactly the shape of the claim\n     * that was FALSE on `organizations` and cost a full tenant-isolation investigation, one role tier\n     * higher.\n     *\n     * What makes it safe here is ARCHITECTURE, not a predicate: **one database per application.**\n     * \"An application's organizations live in that application's own database\"\n     * (`organizations.shared.schemas.ts`, on `slug` uniqueness), so this collection holds that\n     * application's own row and a caller can only ever see the application they are already using.\n     * Measured: an ordinary `ORG_MEMBER` receives 1 of 1 rows, projected to four summary fields.\n     *\n     * So the two variants below differ in ROLE, not in reach — `admin` exists for the fields and\n     * operations it unlocks elsewhere, not because it sees more rows here.\n     *\n     * ⚠️ This rests on the one-database-per-application invariant. `CREATE` is super-admin gated, so\n     * a second application row COULD be written into this database; if that ever becomes a real\n     * deployment shape, this resource inherits the `organizations` defect at the `ORG_MEMBER` tier\n     * and must be confined on `initiatorIds.applicationId`. Tracked as SEC-SCOPEROOT-3.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Unconfined by construction; safe because the collection holds this application only — see the block above\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can list all applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description', 'slug'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update their applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can update any application\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can delete their applications\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // An APPLICATION is a top-level scope in this framework, not an org-owned artifact, so\n          // deleting one destroys everything scoped beneath it. Same reasoning as\n          // `ORGANIZATIONS | DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`\n          // policy is opt-in, off by default, and freshness-satisfied — neither challenges the\n          // caller here. Re-authentication itself accepts PASSWORD, an enrolled second factor\n          // (TOTP or a backup code) and PASSKEY, so a directory-managed user whose local first\n          // factor the framework destroys can still clear the gate through their second factor;\n          // see the note on `ORGANIZATIONS | DELETE` for how that came about.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n          requiresStepUpAuthentication: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can delete any application\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-VARIANT flag — nothing is inherited from the default variant above.\n          requiresStepUpAuthentication: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    }\n  },\n\n});\n"]}
+{"version":3,"file":"applications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAE7I,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,2CAA2C;AAC3C,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,mFAAmF;AACnF,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,mFAAmF;AACnF,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sEAAsE;AACtE,wFAAwF;AACxF,uFAAuF;AACvF,2FAA2F;AAC3F,gGAAgG;AAChG,6DAA6D;AAC7D,qFAAqF;AACrF,yFAAyF;AACzF,6FAA6F;AAC7F,qBAAqB;AACrB,0FAA0F;AAC1F,+EAA+E;AAC/E,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iGAAiG;AACjG,8DAA8D;AAC9D,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,yEAAyE;AACzE,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AACzF,mEAAmE;AAEnE,MAAM,uBAAuB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE9D,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAUF;;EAEE;AACF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIlK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,yEAAyE;oBACzE,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,oCAAoC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4GAA4G;oBAChJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;oBACjD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,wEAAwE;oBACxE,sFAAsF;oBACtF,qFAAqF;oBACrF,oFAAoF;oBACpF,qFAAqF;oBACrF,sFAAsF;oBACtF,oEAAoE;oBACpE,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0EAA0E;oBAC1E,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CAEF,CAAC,CAAC","sourcesContent":["/**\n * Application Shared Resource Configuration\n *\n * Resource configuration for application management.\n * Supports both organization self-management and platform admin oversight.\n */\n\nimport { z } from 'zod';\nimport { ApplicationSchema } from './applications.shared.schemas';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for applications.\n//\n// CROSS-ORGANIZATION APPLICATION TRANSFER IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY.\n// `TRANSFER` was declared here in two variants (`ORG_ADMIN` default at `riskLevel: CRITICAL`, and\n// an `APP_ADMIN_SUPER_ADMIN` `admin` variant adding `bypassOwnerApproval`), taking\n// `{ targetOrganizationId, transferReason }`. Both were ROUTED but never implemented, so each\n// request fell through to the generic core UPDATE, which persists only fields the resource schema\n// declares. Neither `targetOrganizationId` nor `transferReason` is one, so every call answered\n// **HTTP 200 having changed nothing** — an operator was told a CRITICAL cross-tenant move had\n// succeeded while the application stayed exactly where it was. Removed 2026-08-01.\n//\n// It was REMOVED rather than implemented on five independent grounds:\n//\n//  1. NO FIELD TO WRITE. `ApplicationSchema` carries no owning-organization field.\n//  2. NO RELATIONSHIP TO RE-POINT. The resources registry declares no\n//     `ORGANIZATIONS → APPLICATION` edge; applications are not organization-owned here.\n//  3. THE OWNERSHIP DIRECTION IS INVERTED. `APPLICATION` is a top-level, self-anchored\n//     `ResourcePrimaryScope`. The application IS the tenant container; organizations are a\n//     sibling scope living inside its tenancy. \"Transferring\" the application to one of its own\n//     organizations is incoherent, not merely unimplemented.\n//  4. WHERE ORGANIZATION OWNERSHIP DOES EXIST, IT IS ALREADY IMMUTABLE. The platform\n//     app-factory's own application record binds `organizationId` at create and marks it\n//     `excludeFromUpdate()` — a different resource, on a different service, already refusing\n//     this mutation.\n//  5. FRAMEWORK PRECEDENT. Cross-organization MEMBER transfer is refused for exactly this\n//     reason — a tenant-boundary crossing the framework does not sanction (see\n//     `organization-members.shared.resources-config.schemas.ts`). An application is the tenant\n//     container itself, so the argument applies with more force, not less.\n//\n// `bypassOwnerApproval` additionally named an approval flow that does not exist, and neither\n// variant emitted an audit event despite being cross-tenant and CRITICAL. Re-declaring an\n// application re-parenting verb would require, at minimum: a persisted ownership edge, an\n// approval flow for the flag to bypass, a custom implementation that writes the edge, and\n// audit/SIEM emission on both request and completion.\n//\n// APPLICATION STATUS LIFECYCLE IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY EITHER.\n// `ACTIVATE` and `SUSPEND` were declared here as `APP_ADMIN_SUPER_ADMIN` verbs (`MEDIUM` and\n// `CRITICAL` respectively, both with a generated bulk variant) taking `{ reason }` and\n// `{ suspensionReason, notifyOwners }`. Like TRANSFER they were ROUTED but never implemented, so\n// each fell through to the generic core UPDATE and answered **HTTP 200 having changed nothing** —\n// an operator was told a CRITICAL application suspension had taken effect while the application\n// kept serving. Removed 2026-08-01, on grounds that compound with TRANSFER's:\n//\n//  1. NO FIELD TO WRITE — and no plausible one. `ApplicationSchema` is\n//     `{_id, appSlug, appDisplayName, lastVersion, platformAppId}`: an identity row, carrying no\n//     lifecycle state at all. There is nothing to transition.\n//  2. THE LIFECYCLE IS OWNED ONE TIER UP. An application's real operational state lives at the\n//     platform tier (`PLATFORM_APPLICATIONS` / `Wildo_Application_Config`), provisioned and\n//     managed by the platform apps-manager. This row is the in-app registry entry an application\n//     reads to know its own identity — halting an application is a platform-tier action, not a\n//     self-service field flip on the application's own copy of its name.\n//  3. SAME INVERTED OWNERSHIP AS TRANSFER (ground 3 above). `APPLICATION` is a top-level\n//     `ResourcePrimaryScope`; suspending the tenant container from inside its own tenancy is\n//     incoherent, and the suspending super-admin's own session lives in that container.\n//\n// The resource specification's framing — \"Created per org, managed by admins, and may be\n// transferred or suspended under governance\", with 409s for destination-org slug collisions —\n// describes a per-organization application marketplace. The framework does not implement one, and\n// inventing an `ApplicationStatus` to satisfy two unimplemented buttons would have built that\n// model backwards from its UI. Re-declaring these verbs requires the ownership model first.\n//\n// Applications consequently declare NO custom operations (hence the `undefined` custom-operation\n// type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and\n// the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n\nconst APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];\n\nconst APPLICATION_FILTER_FIELDS = {\n  appSlug: z.string(),\n  appDisplayName: z.string(),\n};\n\ntype ApplicationCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplications Resource Configuration Factory\n*/\nexport const applicationResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  ApplicationCoreOperations,\n  typeof ApplicationSchema\n>({\n  mainSchema: ApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Applications are core system resources\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can create applications\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // Use database definition so platformAppId and lastVersion are preserved\n          // requestDto auto-derived from decorators\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can create applications for any org\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can view any application\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    /**\n     * ⚠️ NOTHING CONFINES THIS QUERY — and that is safe for a reason worth stating, because the\n     * comment on the default variant used to imply a mechanism that does not exist.\n     *\n     * `applications` is its own scope ROOT, so both repositories blacklist the APPLICATIONS axis and\n     * this LIST compiles to the EMPTY filter (measured 2026-08-12,\n     * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep). The\n     * old wording — \"Org members can list *their* applications\" — is exactly the shape of the claim\n     * that was FALSE on `organizations` and cost a full tenant-isolation investigation, one role tier\n     * higher.\n     *\n     * What makes it safe here is ARCHITECTURE, not a predicate: **one database per application.**\n     * \"An application's organizations live in that application's own database\"\n     * (`organizations.shared.schemas.ts`, on `slug` uniqueness), so this collection holds that\n     * application's own row and a caller can only ever see the application they are already using.\n     * Measured: an ordinary `ORG_MEMBER` receives 1 of 1 rows, projected to four summary fields.\n     *\n     * So the two variants below differ in ROLE, not in reach — `admin` exists for the fields and\n     * operations it unlocks elsewhere, not because it sees more rows here.\n     *\n     * ⚠️ This rests on the one-database-per-application invariant. `CREATE` is super-admin gated, so\n     * a second application row COULD be written into this database; if that ever becomes a real\n     * deployment shape, this resource inherits the `organizations` defect at the `ORG_MEMBER` tier\n     * and must be confined on `initiatorIds.applicationId`. Tracked as SEC-SCOPEROOT-3.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Unconfined by construction; safe because the collection holds this application only — see the block above\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can list all applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description', 'slug'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APPLICATION_FILTER_FIELDS,\n          sortFields: APPLICATION_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update their applications\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can update any application\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can delete their applications\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // An APPLICATION is a top-level scope in this framework, not an org-owned artifact, so\n          // deleting one destroys everything scoped beneath it. Same reasoning as\n          // `ORGANIZATIONS | DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`\n          // policy is opt-in, off by default, and freshness-satisfied — neither challenges the\n          // caller here. Re-authentication itself accepts PASSWORD, an enrolled second factor\n          // (TOTP or a backup code) and PASSKEY, so a directory-managed user whose local first\n          // factor the framework destroys can still clear the gate through their second factor;\n          // see the note on `ORGANIZATIONS | DELETE` for how that came about.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n          requiresStepUpAuthentication: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can delete any application\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-VARIANT flag — nothing is inherited from the default variant above.\n          requiresStepUpAuthentication: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    }\n  },\n\n});\n"]}

package/dist/esm/applications/applications.shared.schemas.d.ts

@@ -80,11 +80,12 @@ export declare const ApplicationSchema: z.ZodObject<{
     appDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     lastVersion: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     platformAppId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    ownerOrganizationSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
 }, z.core.$strip>;
 export type Application = z.infer<typeof ApplicationSchema>;
 export declare const ApplicationVersionSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    appId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     version: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     releaseDate: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
     releaseNotes: z.ZodString;
@@ -92,7 +93,7 @@ export declare const ApplicationVersionSchema: z.ZodObject<{
 export type ApplicationVersion = z.infer<typeof ApplicationVersionSchema>;
 export declare const ApplicationMetadataSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    appId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
     description: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodString>>>;
 }, z.core.$strip>;
 export type ApplicationMetadata = z.infer<typeof ApplicationMetadataSchema>;

package/dist/esm/applications/applications.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"applications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;IACnB,uBAAuB,4BAA4B;CACpD;AAED,oBAAY,cAAc;IACxB,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,4GAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,4KAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,yBAAyB;;;;iBAwBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"applications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;IACnB,uBAAuB,4BAA4B;CACpD;AAED,oBAAY,cAAc;IACxB,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,4GAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,4KAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;iBAuC5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,yBAAyB;;;;iBA2BpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/applications/applications.shared.schemas.js

@@ -89,10 +89,42 @@ export const ApplicationSchema = z.object({
     lastVersion: z.string().optional().excludeFromCreate().excludeFromUpdate(),
     // Backend-only field - stored in DB but never sent to frontend
     platformAppId: z.string().isDBIndexed().isBackendOnly(),
+    /**
+     * Serializes every decision about WHICH organization owns the application (#1054).
+     *
+     * ## The race it closes
+     *
+     * `organizations.promoteToOwnerOrganization` measures ("does an owner organization exist?") and
+     * then writes (`type`). Under snapshot isolation that is textbook WRITE SKEW: two operators
+     * promote two DIFFERENT organizations, each observes no owner, and both commit — producing the two
+     * owner organizations the whole design refuses, which neither was individually permitted to
+     * create. No amount of additional checking closes it: each transaction's view is internally
+     * consistent, and a re-measure after the write cannot see the other's uncommitted row.
+     *
+     * The remedy is to give the two transactions something to collide ON. The promotion bumps this
+     * token inside its transaction before measuring, so two of them touch the same document and the
+     * storage engine aborts the loser. Same mechanism, same reasoning, as
+     * `Organization.ownerFloorSerializationToken` — which is also where the trap is recorded: the
+     * write MUST carry `preserveServerInjectedFields` for this field, or the repository's strict
+     * re-parse silently strips it and the serialization protects nothing.
+     *
+     * ## Why the APPLICATION row and not an organization's
+     *
+     * The two racing promotions target DIFFERENT organizations, so neither organization's row is
+     * shared and colliding on one would serialize nothing. The APPLICATION row is the only row both
+     * transactions can be made to touch, and it is also the right subject semantically: the fact being
+     * protected is a property of the application ("it has one owner organization"), not of any tenant.
+     *
+     * The VALUE is irrelevant and nothing reads it, so a lost update here costs nothing; what matters
+     * is that the document is written at all. `.nullish()` because every existing application predates
+     * the field, and one that has never had a promotion legitimately has no token — absent and zero
+     * mean the same thing.
+     */
+    ownerOrganizationSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),
 });
 export const ApplicationVersionSchema = z.object({
     _id: z.string().isPrimaryKey().isSummaryField(),
-    appId: z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    applicationId: z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
     version: z.string().isDBIndexed().isSummaryField(),
     releaseDate: z.date().isDBIndexed().isSummaryField(),
     releaseNotes: z.string(),
@@ -113,11 +145,14 @@ export const ApplicationMetadataSchema = z.object({
      * a pure marker with no index, so two concurrent creates could otherwise leave
      * an application with two metadata rows, which no read path expects.
      *
-     * NB the field is named `appId`, not the canonical `applicationId` that every
-     * other APPLICATION-scoped resource uses. The relationship declares it, so the
-     * framework follows the declaration.
+     * The name is `applicationId`, matching the APPLICATION scope's registered field
+     * identifier and every other APPLICATION-scoped resource. It was `appId` until
+     * 2026-09-18, which silently excluded this resource — and its two siblings — from
+     * every mechanism keyed on that identifier, up to and including the settings panes
+     * that render it. See the APPLICATION_FEATURES edge in
+     * `resources-registry.shared.core.definitions.ts` for the measured consequences.
      */
-    appId: z.string().isDBIndexed().isForeignKey().isBusinessKey().isUnique().isSummaryField().excludeFromUpdate(),
+    applicationId: z.string().isDBIndexed().isForeignKey().isBusinessKey().isUnique().isSummaryField().excludeFromUpdate(),
     // `.default('')` so the row is eager-seedable via onParentCreate (placeholder;
     // the app sets a real description later) — root-cause fix for the blocking field.
     description: z.string().default('').isDBIndexed().isSummaryField(),

package/dist/esm/applications/applications.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"applications.shared.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,yEAAmD,CAAA;AACrD,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,uDAAqC,CAAA;IACrC,uDAAqC,CAAA;IACrC,uDAAqC,CAAA;IACrC,6DAA2C,CAAA;IAC3C,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;AACnB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1B,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,+BAA+B;IAC/B,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,OAAO,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,WAAW,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC3E,+DAA+D;IAC/D,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,KAAK,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACpF,OAAO,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnD,WAAW,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrD,YAAY,EAAG,CAAC,CAAC,MAAM,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC/G,+EAA+E;IAC/E,kFAAkF;IAClF,WAAW,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;CACtE,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nexport enum StaticFrontEndType {\n  WEBSITE = 'website',\n  TECHNICAL_DOCUMENTATION = 'technical_documentation',\n}\n\nexport enum BackendApiType {\n  MAIN_BACKEND_API = 'main_backend_api',\n  HEALTH_CHECK_API = 'health_check_api',\n  MAIN_WEBHOOK_API = 'main_webhook_api',\n  OAUTH2_PROVIDER_API = 'oauth2_provider_api',\n  MCP_API = 'mcp_api',\n}\n\n/**\n * Background app-owned runtimes — kinds that an application owns but that\n * do NOT serve user-facing requests directly (no public HTTP surface for\n * end-users, no rendered frontend).\n *\n * Introduced by the minions-and-workers plan\n * (`.claude/plans/minions-and-workers-implementation.md`, KD-9):\n *\n * - `MINION` — TS/Node single-instance process sharing the application\n *   scope (Mongo / Redis / RabbitMQ); hosts the actor system; consumes\n *   queue / cron ticks. Always-up or cron-triggered.\n * - `WORKER` — language-pluggable stateless HTTP subprocess (Rust / Node /\n *   Java / …) called by the backend-api with a Wildo JWT. No backing\n *   services; ClusterIP-only, no ingress.\n *\n * Deploy-time identity uses the `{kind, name}` vocabulary (`name` = the\n * `wildo.saas.config.ts` bucket key), surfaced in two forms — the\n * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` **env** pair and the\n * matching `wildo.ai/owned-service-{kind,name}` pod **labels**. WHICH forms a\n * kind carries, and how it consumes them, differs because their runtimes differ:\n *\n * - `WORKER` — language-pluggable, so a non-Node runtime (the reference Rust\n *   worker) READS the `APP_OWNED_SERVICE_NAME` **env** var at boot and forwards\n *   it as the apps-manager `worker-bootstrap` path segment\n *   (`appConfig.workers[name]`). A Node worker instead hardcodes `workerName` in\n *   `defineWorkerInit`; the env pair is still stamped on every worker deploy path\n *   (k8s, docker-compose, CLI `.env`) for the language-agnostic case +\n *   observability, alongside the matching pod labels.\n * - `MINION` — always Node, and sources its `minionName` from its compiled-in\n *   `defineMinionInit({ minionName })` config (the minion package is\n *   domain-specific by construction), cross-validated at boot against the\n *   fetched `appConfig.minions[minionName]`. Because identity is a compile-time\n *   fact, minions carry it ONLY as the `wildo.ai/owned-service-{kind,name}` pod\n *   **labels** (operators, selectors, observability); the `APP_OWNED_SERVICE_*`\n *   **env** pair is deliberately omitted on EVERY minion deploy path (k8s, CLI\n *   `.env`, docker-compose), since an env identity would be a second,\n *   drift-prone authority (see `env-configuration-generator.service.ts`).\n */\nexport enum BackgroundRuntimeType {\n  MINION = 'minion',\n  WORKER = 'worker',\n}\n\n/**\n * Schema for all shared (non-platform-private) application types.\n *\n * Interactive frontend surfaces are config-defined strings keyed by frontend\n * service identity via `frontendServices` in AppConfiguration, not an enum.\n * `z.string()` accepts those config-defined values alongside the known\n * static-frontend and backend-API enums.\n */\nexport const AllSharedApplicationTypesSchema = z.union([\n  z.enum(StaticFrontEndType),\n  z.enum(BackendApiType),\n  z.string(),\n]);\nexport type AllSharedApplicationTypes = z.infer<typeof AllSharedApplicationTypesSchema>;\n\n/**\n * Full app-owned runtime identity surface: every primary application type\n * (`AllSharedApplicationTypesSchema` — backend kinds, static frontends,\n * dynamic-frontend keys) plus the background runtimes\n * (`BackgroundRuntimeType` — minions, workers).\n *\n * Use this where a process needs to declare what kind of app-owned\n * runtime it is without forcing every caller to switch on a coarse\n * vocabulary that overlaps the existing fine-grained enums.\n */\nexport const AllAppOwnedRuntimeTypesSchema = z.union([\n  AllSharedApplicationTypesSchema,\n  z.enum(BackgroundRuntimeType),\n]);\nexport type AllAppOwnedRuntimeTypes = z.infer<typeof AllAppOwnedRuntimeTypesSchema>;\n\nexport const ApplicationSchema = z.object({\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    appSlug : z.string().isDBIndexed().isSummaryField().excludeFromUpdate(),\n    appDisplayName : z.string().isDBIndexed().isSummaryField(),\n    lastVersion : z.string().optional().excludeFromCreate().excludeFromUpdate(),\n    // Backend-only field - stored in DB but never sent to frontend\n    platformAppId : z.string().isDBIndexed().isBackendOnly(),\n});\nexport type Application = z.infer<typeof ApplicationSchema>;\n\nexport const ApplicationVersionSchema = z.object({\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    appId : z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n    version : z.string().isDBIndexed().isSummaryField(),\n    releaseDate : z.date().isDBIndexed().isSummaryField(),\n    releaseNotes : z.string(),\n});\nexport type ApplicationVersion = z.infer<typeof ApplicationVersionSchema>;\n\nexport const ApplicationMetadataSchema = z.object({\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    /**\n     * The owning application — and this row's BUSINESS IDENTITY.\n     *\n     * `APPLICATION → APPLICATION_METADATA` is 1:1, so \"the metadata of application X\"\n     * identifies the row completely. Declaring that lets the framework's business-key\n     * repository helpers address it: the app-init seed\n     * (`engine-applications:application-metadata`) upserts through\n     * `upsertByBusinessKey`, which refuses a schema that declares no identity —\n     * \"Schema declares no business-key identity\" — rather than guessing one.\n     *\n     * `.isUnique()` carries the 1:1 down to the database. `.isBusinessKey()` alone is\n     * a pure marker with no index, so two concurrent creates could otherwise leave\n     * an application with two metadata rows, which no read path expects.\n     *\n     * NB the field is named `appId`, not the canonical `applicationId` that every\n     * other APPLICATION-scoped resource uses. The relationship declares it, so the\n     * framework follows the declaration.\n     */\n    appId : z.string().isDBIndexed().isForeignKey().isBusinessKey().isUnique().isSummaryField().excludeFromUpdate(),\n    // `.default('')` so the row is eager-seedable via onParentCreate (placeholder;\n    // the app sets a real description later) — root-cause fix for the blocking field.\n    description : z.string().default('').isDBIndexed().isSummaryField(),\n});\nexport type ApplicationMetadata = z.infer<typeof ApplicationMetadataSchema>;\n"]}
+{"version":3,"file":"applications.shared.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,yEAAmD,CAAA;AACrD,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,uDAAqC,CAAA;IACrC,uDAAqC,CAAA;IACrC,uDAAqC,CAAA;IACrC,6DAA2C,CAAA;IAC3C,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;AACnB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1B,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,+BAA+B;IAC/B,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,OAAO,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,WAAW,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC3E,+DAA+D;IAC/D,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;IACxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,mCAAmC,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;CACtI,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5F,OAAO,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnD,WAAW,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrD,YAAY,EAAG,CAAC,CAAC,MAAM,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvH,+EAA+E;IAC/E,kFAAkF;IAClF,WAAW,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;CACtE,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nexport enum StaticFrontEndType {\n  WEBSITE = 'website',\n  TECHNICAL_DOCUMENTATION = 'technical_documentation',\n}\n\nexport enum BackendApiType {\n  MAIN_BACKEND_API = 'main_backend_api',\n  HEALTH_CHECK_API = 'health_check_api',\n  MAIN_WEBHOOK_API = 'main_webhook_api',\n  OAUTH2_PROVIDER_API = 'oauth2_provider_api',\n  MCP_API = 'mcp_api',\n}\n\n/**\n * Background app-owned runtimes — kinds that an application owns but that\n * do NOT serve user-facing requests directly (no public HTTP surface for\n * end-users, no rendered frontend).\n *\n * Introduced by the minions-and-workers plan\n * (`.claude/plans/minions-and-workers-implementation.md`, KD-9):\n *\n * - `MINION` — TS/Node single-instance process sharing the application\n *   scope (Mongo / Redis / RabbitMQ); hosts the actor system; consumes\n *   queue / cron ticks. Always-up or cron-triggered.\n * - `WORKER` — language-pluggable stateless HTTP subprocess (Rust / Node /\n *   Java / …) called by the backend-api with a Wildo JWT. No backing\n *   services; ClusterIP-only, no ingress.\n *\n * Deploy-time identity uses the `{kind, name}` vocabulary (`name` = the\n * `wildo.saas.config.ts` bucket key), surfaced in two forms — the\n * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` **env** pair and the\n * matching `wildo.ai/owned-service-{kind,name}` pod **labels**. WHICH forms a\n * kind carries, and how it consumes them, differs because their runtimes differ:\n *\n * - `WORKER` — language-pluggable, so a non-Node runtime (the reference Rust\n *   worker) READS the `APP_OWNED_SERVICE_NAME` **env** var at boot and forwards\n *   it as the apps-manager `worker-bootstrap` path segment\n *   (`appConfig.workers[name]`). A Node worker instead hardcodes `workerName` in\n *   `defineWorkerInit`; the env pair is still stamped on every worker deploy path\n *   (k8s, docker-compose, CLI `.env`) for the language-agnostic case +\n *   observability, alongside the matching pod labels.\n * - `MINION` — always Node, and sources its `minionName` from its compiled-in\n *   `defineMinionInit({ minionName })` config (the minion package is\n *   domain-specific by construction), cross-validated at boot against the\n *   fetched `appConfig.minions[minionName]`. Because identity is a compile-time\n *   fact, minions carry it ONLY as the `wildo.ai/owned-service-{kind,name}` pod\n *   **labels** (operators, selectors, observability); the `APP_OWNED_SERVICE_*`\n *   **env** pair is deliberately omitted on EVERY minion deploy path (k8s, CLI\n *   `.env`, docker-compose), since an env identity would be a second,\n *   drift-prone authority (see `env-configuration-generator.service.ts`).\n */\nexport enum BackgroundRuntimeType {\n  MINION = 'minion',\n  WORKER = 'worker',\n}\n\n/**\n * Schema for all shared (non-platform-private) application types.\n *\n * Interactive frontend surfaces are config-defined strings keyed by frontend\n * service identity via `frontendServices` in AppConfiguration, not an enum.\n * `z.string()` accepts those config-defined values alongside the known\n * static-frontend and backend-API enums.\n */\nexport const AllSharedApplicationTypesSchema = z.union([\n  z.enum(StaticFrontEndType),\n  z.enum(BackendApiType),\n  z.string(),\n]);\nexport type AllSharedApplicationTypes = z.infer<typeof AllSharedApplicationTypesSchema>;\n\n/**\n * Full app-owned runtime identity surface: every primary application type\n * (`AllSharedApplicationTypesSchema` — backend kinds, static frontends,\n * dynamic-frontend keys) plus the background runtimes\n * (`BackgroundRuntimeType` — minions, workers).\n *\n * Use this where a process needs to declare what kind of app-owned\n * runtime it is without forcing every caller to switch on a coarse\n * vocabulary that overlaps the existing fine-grained enums.\n */\nexport const AllAppOwnedRuntimeTypesSchema = z.union([\n  AllSharedApplicationTypesSchema,\n  z.enum(BackgroundRuntimeType),\n]);\nexport type AllAppOwnedRuntimeTypes = z.infer<typeof AllAppOwnedRuntimeTypesSchema>;\n\nexport const ApplicationSchema = z.object({\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    appSlug : z.string().isDBIndexed().isSummaryField().excludeFromUpdate(),\n    appDisplayName : z.string().isDBIndexed().isSummaryField(),\n    lastVersion : z.string().optional().excludeFromCreate().excludeFromUpdate(),\n    // Backend-only field - stored in DB but never sent to frontend\n    platformAppId : z.string().isDBIndexed().isBackendOnly(),\n    /**\n     * Serializes every decision about WHICH organization owns the application (#1054).\n     *\n     * ## The race it closes\n     *\n     * `organizations.promoteToOwnerOrganization` measures (\"does an owner organization exist?\") and\n     * then writes (`type`). Under snapshot isolation that is textbook WRITE SKEW: two operators\n     * promote two DIFFERENT organizations, each observes no owner, and both commit — producing the two\n     * owner organizations the whole design refuses, which neither was individually permitted to\n     * create. No amount of additional checking closes it: each transaction's view is internally\n     * consistent, and a re-measure after the write cannot see the other's uncommitted row.\n     *\n     * The remedy is to give the two transactions something to collide ON. The promotion bumps this\n     * token inside its transaction before measuring, so two of them touch the same document and the\n     * storage engine aborts the loser. Same mechanism, same reasoning, as\n     * `Organization.ownerFloorSerializationToken` — which is also where the trap is recorded: the\n     * write MUST carry `preserveServerInjectedFields` for this field, or the repository's strict\n     * re-parse silently strips it and the serialization protects nothing.\n     *\n     * ## Why the APPLICATION row and not an organization's\n     *\n     * The two racing promotions target DIFFERENT organizations, so neither organization's row is\n     * shared and colliding on one would serialize nothing. The APPLICATION row is the only row both\n     * transactions can be made to touch, and it is also the right subject semantically: the fact being\n     * protected is a property of the application (\"it has one owner organization\"), not of any tenant.\n     *\n     * The VALUE is irrelevant and nothing reads it, so a lost update here costs nothing; what matters\n     * is that the document is written at all. `.nullish()` because every existing application predates\n     * the field, and one that has never had a promotion legitimately has no token — absent and zero\n     * mean the same thing.\n     */\n    ownerOrganizationSerializationToken : z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n});\nexport type Application = z.infer<typeof ApplicationSchema>;\n\nexport const ApplicationVersionSchema = z.object({\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    applicationId : z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n    version : z.string().isDBIndexed().isSummaryField(),\n    releaseDate : z.date().isDBIndexed().isSummaryField(),\n    releaseNotes : z.string(),\n});\nexport type ApplicationVersion = z.infer<typeof ApplicationVersionSchema>;\n\nexport const ApplicationMetadataSchema = z.object({\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    /**\n     * The owning application — and this row's BUSINESS IDENTITY.\n     *\n     * `APPLICATION → APPLICATION_METADATA` is 1:1, so \"the metadata of application X\"\n     * identifies the row completely. Declaring that lets the framework's business-key\n     * repository helpers address it: the app-init seed\n     * (`engine-applications:application-metadata`) upserts through\n     * `upsertByBusinessKey`, which refuses a schema that declares no identity —\n     * \"Schema declares no business-key identity\" — rather than guessing one.\n     *\n     * `.isUnique()` carries the 1:1 down to the database. `.isBusinessKey()` alone is\n     * a pure marker with no index, so two concurrent creates could otherwise leave\n     * an application with two metadata rows, which no read path expects.\n     *\n     * The name is `applicationId`, matching the APPLICATION scope's registered field\n     * identifier and every other APPLICATION-scoped resource. It was `appId` until\n     * 2026-09-18, which silently excluded this resource — and its two siblings — from\n     * every mechanism keyed on that identifier, up to and including the settings panes\n     * that render it. See the APPLICATION_FEATURES edge in\n     * `resources-registry.shared.core.definitions.ts` for the measured consequences.\n     */\n    applicationId : z.string().isDBIndexed().isForeignKey().isBusinessKey().isUnique().isSummaryField().excludeFromUpdate(),\n    // `.default('')` so the row is eager-seedable via onParentCreate (placeholder;\n    // the app sets a real description later) — root-cause fix for the blocking field.\n    description : z.string().default('').isDBIndexed().isSummaryField(),\n});\nexport type ApplicationMetadata = z.infer<typeof ApplicationMetadataSchema>;\n"]}

package/dist/esm/billing/billing-account.shared.resources-config.schemas.d.ts

@@ -17,14 +17,13 @@ export declare enum BillingAccount_Operations {
     /** Fetch aggregated billing state (account, subscription, products, prices, credit pools) */
     GET_STATE = "get_state"
 }
-/** Request DTO for OPEN_CHECKOUT operation */
+/** Request DTO for OPEN_CHECKOUT. Trial duration is server-owned product/application policy, never a payer option. */
 export declare const BillingAccount_OpenCheckoutRequestDto: z.ZodObject<{
     productKey: z.ZodString;
     priceId: z.ZodString;
     successUrl: z.ZodURL;
     cancelUrl: z.ZodURL;
     quantity: z.ZodDefault<z.ZodNumber>;
-    trialDays: z.ZodOptional<z.ZodNumber>;
     promotionCode: z.ZodOptional<z.ZodString>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;

package/dist/esm/billing/billing-account.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-account.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAgBzG,oBAAY,yBAAyB;IACnC,wEAAwE;IACxE,aAAa,kBAAkB;IAC/B,kEAAkE;IAClE,WAAW,gBAAgB;IAC3B,6FAA6F;IAC7F,SAAS,cAAc;CACxB;AAID,8CAA8C;AAC9C,eAAO,MAAM,qCAAqC;;;;;;;;;iBAqChD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,2SAiM/C,CAAC"}
+{"version":3,"file":"billing-account.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAgBzG,oBAAY,yBAAyB;IACnC,wEAAwE;IACxE,aAAa,kBAAkB;IAC/B,kEAAkE;IAClE,WAAW,gBAAgB;IAC3B,6FAA6F;IAC7F,SAAS,cAAc;CACxB;AAID,sHAAsH;AACtH,eAAO,MAAM,qCAAqC;;;;;;;;iBAoChD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,2SAiM/C,CAAC"}

package/dist/esm/billing/billing-account.shared.resources-config.schemas.js

@@ -29,7 +29,7 @@ export var BillingAccount_Operations;
     BillingAccount_Operations["GET_STATE"] = "get_state";
 })(BillingAccount_Operations || (BillingAccount_Operations = {}));
 // ── Request DTOs ─────────────────────────────────────────────────────
-/** Request DTO for OPEN_CHECKOUT operation */
+/** Request DTO for OPEN_CHECKOUT. Trial duration is server-owned product/application policy, never a payer option. */
 export const BillingAccount_OpenCheckoutRequestDto = z.object({
     productKey: z.string().min(1),
     priceId: z.string().min(1),
@@ -41,7 +41,6 @@ export const BillingAccount_OpenCheckoutRequestDto = z.object({
      * that never arrive.
      */
     quantity: z.number().int().min(1).max(BILLING_CHECKOUT_MAX_QUANTITY).default(1),
-    trialDays: z.number().min(0).optional(),
     promotionCode: z.string().optional(),
     /**
      * Caller-supplied tags mirrored to the provider for the application's own analytics or

package/dist/esm/billing/billing-account.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-account.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACrH,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,yBAOX;AAPD,WAAY,yBAAyB;IACnC,wEAAwE;IACxE,4DAA+B,CAAA;IAC/B,kEAAkE;IAClE,wDAA2B,CAAA;IAC3B,6FAA6F;IAC7F,oDAAuB,CAAA;AACzB,CAAC,EAPW,yBAAyB,KAAzB,yBAAyB,QAOpC;AAED,wEAAwE;AAExE,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;IAClB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,oCAAoC,CAAC,EAC9D,gCAAgC,oCAAoC,sEAAsE,CAC3I,EACD,CAAC,CAAC,MAAM,EAAE,CACX;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;CACnB,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,oFAAoF;IACpF,kBAAkB,EAAE;QAClB,oSAAoS;QACpS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,yFAAyF;QACzF,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,uCAAuC;QACvC,EAAE;QACF,0FAA0F;QAC1F,yEAAyE;QACzE,2FAA2F;QAC3F,yFAAyF;QACzF,mCAAmC;QACnC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,eAAe,EAAE,yBAAyB;IAC1C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,kFAAkF;oBAClF,mFAAmF;oBACnF,oFAAoF;oBACpF,yFAAyF;oBACzF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,aAAa,CAAC,EAAE;YACzC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,qCAAqC;oBACjD,sEAAsE;oBACtE,0EAA0E;oBAC1E,yEAAyE;oBACzE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;qBACtB,CAAC;iBACH,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,mCAAmC;oBAC/C,kEAAkE;oBAClE,kDAAkD;oBAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;qBACb,CAAC;iBACH,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE;YACrC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,KAAK;oBAClD,sEAAsE;oBACtE,sEAAsE;oBACtE,sEAAsE;oBACtE,sDAAsD;oBACtD,iBAAiB,EAAE,0BAA0B;iBAC9C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Billing Account Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...billingAccountsPolymorphicFactories\n *\n * @see polymorphic-scope-approach-A-expansion.md — Phase 3\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { BILLING_CHECKOUT_MAX_QUANTITY, BILLING_RESERVED_METADATA_KEY_PREFIX } from './billing-enums.shared.schemas';\nimport { billingAccountsPolymorphicDeclaration } from './billing-account.shared.schemas';\nimport { BillingStateResponseSchema } from './billing-types.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingAccount_Operations {\n  /** Create a Stripe Checkout Session for the user to complete payment */\n  OPEN_CHECKOUT = 'open_checkout',\n  /** Open the Stripe Customer Portal for self-service management */\n  OPEN_PORTAL = 'open_portal',\n  /** Fetch aggregated billing state (account, subscription, products, prices, credit pools) */\n  GET_STATE = 'get_state',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/** Request DTO for OPEN_CHECKOUT operation */\nexport const BillingAccount_OpenCheckoutRequestDto = z.object({\n  productKey: z.string().min(1),\n  priceId: z.string().min(1),\n  successUrl: z.url(),\n  cancelUrl: z.url(),\n  /**\n   * Bounded by the same constant the webhook consumer honours. An unbounded quantity here would be\n   * billed by the provider and then refused on the way back in, charging the customer for credits\n   * that never arrive.\n   */\n  quantity: z.number().int().min(1).max(BILLING_CHECKOUT_MAX_QUANTITY).default(1),\n  trialDays: z.number().min(0).optional(),\n  promotionCode: z.string().optional(),\n  /**\n   * Caller-supplied tags mirrored to the provider for the application's own analytics or\n   * reconciliation. They carry NO authority.\n   *\n   * Keys in the framework-reserved namespace are REFUSED here rather than silently dropped: the\n   * caller is trying to write into the namespace that decides which billing account gets credited\n   * and by how much, and an app developer who typed a reserved key deserves to be told, not to\n   * watch their tag vanish. Refusal at the DTO is the loud, outermost half of the boundary; the\n   * builder's write-reserved-last ordering and the consumer's read-only-reserved rule are the two\n   * structural halves. See {@link BILLING_RESERVED_METADATA_KEY_PREFIX}.\n   *\n   * The refinement sits on the KEY schema, not on the record: it keeps the DTO a plain `ZodRecord`\n   * for the OpenAPI projector and the request-validation pipeline, where a wrapping effect would\n   * change the node type every consumer of this DTO narrows on.\n   */\n  metadata: z\n    .record(\n      z.string().refine(\n        (key) => !key.startsWith(BILLING_RESERVED_METADATA_KEY_PREFIX),\n        `Metadata keys starting with \"${BILLING_RESERVED_METADATA_KEY_PREFIX}\" are reserved by the framework and cannot be supplied by the caller`,\n      ),\n      z.string(),\n    )\n    .optional(),\n});\n\n/** Request DTO for OPEN_PORTAL operation */\nexport const BillingAccount_OpenPortalRequestDto = z.object({\n  returnUrl: z.url(),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/**\n * Polymorphic factory map for billing accounts.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...billingAccountsPolymorphicFactories\n *\n * Produces entries for:\n *   - organizationBillingAccounts\n *   - userBillingAccounts\n */\nexport const billingAccountsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  billingAccountsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // System-context CREATE opt-in (fail-closed default is FORBIDDEN). The billing\n    // account is auto-created by `BillingStateBackendService.getState()` on first\n    // access via `SystemAccessBackendService.createAsSystem` — a trusted in-process\n    // write with no HTTP surface and no request context to seed the scope FK. That\n    // path relocates the ACL onto the billing service (which has already resolved\n    // the scope) and injects the scope FK (`organizationId` / `userId`) through the\n    // execution context map. Resource-level and shared by BOTH scope variants\n    // (org + user) per the polymorphic-resource contract on ResourceSystemAccessPolicy.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own billing account. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      // System-context LIST opt-in. Subject erasure must enumerate the erased person's billing\n      // accounts to reach their provider customer (cancel subscriptions, anonymize, detach payment\n      // methods). That runs with no request context — the subject is being erased — so it reads\n      // through `SystemAccessBackendService.listAsSystem`, which is fail-closed and refuses a\n      // resource that has not opted in here.\n      //\n      // Safe to grant: LIST is the READ side, and the erasure path filters by the subject's own\n      // scope FK. The default LIST variant is API_CALL, so it resolves through\n      // `getServiceOperationPathDefault` — a REPOSITORY_ONLY-only LIST would pass this grant and\n      // then fail to resolve at erasure time, which is the failure mode this comment exists to\n      // stop someone from reintroducing.\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the provider customer id.\n *\n * The financial record is kept for the tax/audit obligation this family exists to serve, and — as the\n * family's authoring rule states — erasure scrubs the linked USER rather than these rows, because the\n * person is a foreign key. `providerCustomerId` is the exception the rule does not cover: it is a stable\n * handle that re-identifies the person INSIDE the payment provider, so it is personal data this row holds.\n * It takes `REMOVE`; everything else is retained.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    customOperation: BillingAccount_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: the billing account is a user-facing record (Settings Hub → Billing →\n          // Account, and the resource presets' LIST/READ views). REPOSITORY_ONLY would strip\n          // the op from the frontend registry and register no HTTP route. Writes (auto-create\n          // + webhook sync) are INTERNAL_CALL — run through the service pipeline, no HTTP surface.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [BillingAccount_Operations.OPEN_CHECKOUT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingAccount_OpenCheckoutRequestDto,\n          // Borrows UPDATE for its route/verb but returns the provider checkout\n          // session, NOT the billing-account resource. Without this the DTO builder\n          // would validate the service output against the resource schema and 500.\n          customResponseDto: z.object({\n            url: z.url(),\n            sessionId: z.string(),\n          }),\n        }],\n      },\n      [BillingAccount_Operations.OPEN_PORTAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: BillingAccount_OpenPortalRequestDto,\n          // Borrows READ for its route/verb but returns the provider portal\n          // redirect URL, NOT the billing-account resource.\n          customResponseDto: z.object({\n            url: z.url(),\n          }),\n        }],\n      },\n      [BillingAccount_Operations.GET_STATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.COUNT,\n          // Borrows COUNT for its route/verb but returns the aggregated billing\n          // state bundle, NOT a `{ count }`. Without this the DTO builder would\n          // assign the COUNT default envelope and the service output would fail\n          // `transformOutput`'s `internalDto.parse` → HTTP 500.\n          customResponseDto: BillingStateResponseSchema,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"billing-account.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACrH,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,yBAOX;AAPD,WAAY,yBAAyB;IACnC,wEAAwE;IACxE,4DAA+B,CAAA;IAC/B,kEAAkE;IAClE,wDAA2B,CAAA;IAC3B,6FAA6F;IAC7F,oDAAuB,CAAA;AACzB,CAAC,EAPW,yBAAyB,KAAzB,yBAAyB,QAOpC;AAED,wEAAwE;AAExE,sHAAsH;AACtH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;IAClB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,oCAAoC,CAAC,EAC9D,gCAAgC,oCAAoC,sEAAsE,CAC3I,EACD,CAAC,CAAC,MAAM,EAAE,CACX;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;CACnB,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,oFAAoF;IACpF,kBAAkB,EAAE;QAClB,oSAAoS;QACpS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,yFAAyF;QACzF,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,uCAAuC;QACvC,EAAE;QACF,0FAA0F;QAC1F,yEAAyE;QACzE,2FAA2F;QAC3F,yFAAyF;QACzF,mCAAmC;QACnC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,eAAe,EAAE,yBAAyB;IAC1C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,kFAAkF;oBAClF,mFAAmF;oBACnF,oFAAoF;oBACpF,yFAAyF;oBACzF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,aAAa,CAAC,EAAE;YACzC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,qCAAqC;oBACjD,sEAAsE;oBACtE,0EAA0E;oBAC1E,yEAAyE;oBACzE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;qBACtB,CAAC;iBACH,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,mCAAmC;oBAC/C,kEAAkE;oBAClE,kDAAkD;oBAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;qBACb,CAAC;iBACH,CAAC;SACH;QACD,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE;YACrC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,KAAK;oBAClD,sEAAsE;oBACtE,sEAAsE;oBACtE,sEAAsE;oBACtE,sDAAsD;oBACtD,iBAAiB,EAAE,0BAA0B;iBAC9C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Billing Account Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...billingAccountsPolymorphicFactories\n *\n * @see polymorphic-scope-approach-A-expansion.md — Phase 3\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { BILLING_CHECKOUT_MAX_QUANTITY, BILLING_RESERVED_METADATA_KEY_PREFIX } from './billing-enums.shared.schemas';\nimport { billingAccountsPolymorphicDeclaration } from './billing-account.shared.schemas';\nimport { BillingStateResponseSchema } from './billing-types.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingAccount_Operations {\n  /** Create a Stripe Checkout Session for the user to complete payment */\n  OPEN_CHECKOUT = 'open_checkout',\n  /** Open the Stripe Customer Portal for self-service management */\n  OPEN_PORTAL = 'open_portal',\n  /** Fetch aggregated billing state (account, subscription, products, prices, credit pools) */\n  GET_STATE = 'get_state',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/** Request DTO for OPEN_CHECKOUT. Trial duration is server-owned product/application policy, never a payer option. */\nexport const BillingAccount_OpenCheckoutRequestDto = z.object({\n  productKey: z.string().min(1),\n  priceId: z.string().min(1),\n  successUrl: z.url(),\n  cancelUrl: z.url(),\n  /**\n   * Bounded by the same constant the webhook consumer honours. An unbounded quantity here would be\n   * billed by the provider and then refused on the way back in, charging the customer for credits\n   * that never arrive.\n   */\n  quantity: z.number().int().min(1).max(BILLING_CHECKOUT_MAX_QUANTITY).default(1),\n  promotionCode: z.string().optional(),\n  /**\n   * Caller-supplied tags mirrored to the provider for the application's own analytics or\n   * reconciliation. They carry NO authority.\n   *\n   * Keys in the framework-reserved namespace are REFUSED here rather than silently dropped: the\n   * caller is trying to write into the namespace that decides which billing account gets credited\n   * and by how much, and an app developer who typed a reserved key deserves to be told, not to\n   * watch their tag vanish. Refusal at the DTO is the loud, outermost half of the boundary; the\n   * builder's write-reserved-last ordering and the consumer's read-only-reserved rule are the two\n   * structural halves. See {@link BILLING_RESERVED_METADATA_KEY_PREFIX}.\n   *\n   * The refinement sits on the KEY schema, not on the record: it keeps the DTO a plain `ZodRecord`\n   * for the OpenAPI projector and the request-validation pipeline, where a wrapping effect would\n   * change the node type every consumer of this DTO narrows on.\n   */\n  metadata: z\n    .record(\n      z.string().refine(\n        (key) => !key.startsWith(BILLING_RESERVED_METADATA_KEY_PREFIX),\n        `Metadata keys starting with \"${BILLING_RESERVED_METADATA_KEY_PREFIX}\" are reserved by the framework and cannot be supplied by the caller`,\n      ),\n      z.string(),\n    )\n    .optional(),\n});\n\n/** Request DTO for OPEN_PORTAL operation */\nexport const BillingAccount_OpenPortalRequestDto = z.object({\n  returnUrl: z.url(),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/**\n * Polymorphic factory map for billing accounts.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...billingAccountsPolymorphicFactories\n *\n * Produces entries for:\n *   - organizationBillingAccounts\n *   - userBillingAccounts\n */\nexport const billingAccountsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  billingAccountsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // System-context CREATE opt-in (fail-closed default is FORBIDDEN). The billing\n    // account is auto-created by `BillingStateBackendService.getState()` on first\n    // access via `SystemAccessBackendService.createAsSystem` — a trusted in-process\n    // write with no HTTP surface and no request context to seed the scope FK. That\n    // path relocates the ACL onto the billing service (which has already resolved\n    // the scope) and injects the scope FK (`organizationId` / `userId`) through the\n    // execution context map. Resource-level and shared by BOTH scope variants\n    // (org + user) per the polymorphic-resource contract on ResourceSystemAccessPolicy.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own billing account. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      // System-context LIST opt-in. Subject erasure must enumerate the erased person's billing\n      // accounts to reach their provider customer (cancel subscriptions, anonymize, detach payment\n      // methods). That runs with no request context — the subject is being erased — so it reads\n      // through `SystemAccessBackendService.listAsSystem`, which is fail-closed and refuses a\n      // resource that has not opted in here.\n      //\n      // Safe to grant: LIST is the READ side, and the erasure path filters by the subject's own\n      // scope FK. The default LIST variant is API_CALL, so it resolves through\n      // `getServiceOperationPathDefault` — a REPOSITORY_ONLY-only LIST would pass this grant and\n      // then fail to resolve at erasure time, which is the failure mode this comment exists to\n      // stop someone from reintroducing.\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the provider customer id.\n *\n * The financial record is kept for the tax/audit obligation this family exists to serve, and — as the\n * family's authoring rule states — erasure scrubs the linked USER rather than these rows, because the\n * person is a foreign key. `providerCustomerId` is the exception the rule does not cover: it is a stable\n * handle that re-identifies the person INSIDE the payment provider, so it is personal data this row holds.\n * It takes `REMOVE`; everything else is retained.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    customOperation: BillingAccount_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: the billing account is a user-facing record (Settings Hub → Billing →\n          // Account, and the resource presets' LIST/READ views). REPOSITORY_ONLY would strip\n          // the op from the frontend registry and register no HTTP route. Writes (auto-create\n          // + webhook sync) are INTERNAL_CALL — run through the service pipeline, no HTTP surface.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [BillingAccount_Operations.OPEN_CHECKOUT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: BillingAccount_OpenCheckoutRequestDto,\n          // Borrows UPDATE for its route/verb but returns the provider checkout\n          // session, NOT the billing-account resource. Without this the DTO builder\n          // would validate the service output against the resource schema and 500.\n          customResponseDto: z.object({\n            url: z.url(),\n            sessionId: z.string(),\n          }),\n        }],\n      },\n      [BillingAccount_Operations.OPEN_PORTAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: BillingAccount_OpenPortalRequestDto,\n          // Borrows READ for its route/verb but returns the provider portal\n          // redirect URL, NOT the billing-account resource.\n          customResponseDto: z.object({\n            url: z.url(),\n          }),\n        }],\n      },\n      [BillingAccount_Operations.GET_STATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.COUNT,\n          // Borrows COUNT for its route/verb but returns the aggregated billing\n          // state bundle, NOT a `{ count }`. Without this the DTO builder would\n          // assign the COUNT default envelope and the service output would fail\n          // `transformOutput`'s `internalDto.parse` → HTTP 500.\n          customResponseDto: BillingStateResponseSchema,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/billing-enums.shared.schemas.d.ts

@@ -20,11 +20,11 @@ export { PricingModel, BillingInterval, TaxDisplayMode, SubscriptionStatus, Invo
  * Imported from `@wildo-ai/saas-models`. `PricingModel`, `BillingInterval` and `ProrationBehavior`
  * are re-exported from the connector models, because their values ARE the provider's wire values.
  *
- * ⚠️ **The catalogue is ONE-WAY.** Sync pushes only rows that have no provider link yet, so a product
- * or price edited in the provider's own dashboard is never read back, never reconciled, and never
- * reported. Removing a product from the array does not retire it at the provider and does not
- * deactivate the existing row — nothing detects that a previously synced key has disappeared. Treat
- * the array as the source of truth and make every change through it.
+ * The authored catalogue is the source of truth; provider-dashboard edits are not read back.
+ * A complete sync detects active local product keys absent from the array and deactivates those
+ * products and their active local prices, retaining the rows and reporting live subscribers.
+ * It does not archive provider products/prices or migrate/cancel subscribers. Treat provider
+ * retirement and customer migration as separate decisions, and inspect the complete sync result.
  *
  * Product types available in the billing catalog.
  *
@@ -139,6 +139,75 @@ export declare enum UsageRecordUnreportableReason {
      */
     BILLING_ACCOUNT_DELETED = "billing_account_deleted"
 }
+/**
+ * What KIND of disagreement a billing reconciliation run found between local billing state and the
+ * provider.
+ *
+ * A closed vocabulary rather than free text on a log line, because each kind has a different
+ * treatment and a different meaning when it persists, and a recorded run has to be able to say
+ * which one it saw how many times:
+ *
+ * - the two DRIFT kinds and the MISSING kind are REPAIRED, within the provider-authoritative field
+ *   set only;
+ * - {@link SUBSCRIPTION_PROVIDER_STATE_UNREADABLE} is NEVER repaired — a failed read, including a
+ *   provider saying the subscription does not exist, is not evidence the subscription ended, so it
+ *   is reported and nothing is written.
+ *
+ * A steady non-zero count of any repaired kind means webhook delivery is failing and the sweep is
+ * papering over it; that is a different problem from the sweep failing, and only a per-kind count
+ * can tell them apart.
+ */
+export declare enum BillingReconciliationDivergenceKind {
+    /** A live, provider-linked subscription disagreed with the provider on at least one provider-authoritative field. */
+    SUBSCRIPTION_FIELD_DRIFT = "subscription_field_drift",
+    /** The provider's state for a provider-linked subscription could not be read. Reported only; local state is untouched. */
+    SUBSCRIPTION_PROVIDER_STATE_UNREADABLE = "subscription_provider_state_unreadable",
+    /** An invoice the provider holds for a known customer had no local record — its webhook was never delivered. */
+    INVOICE_MISSING_LOCALLY = "invoice_missing_locally",
+    /** A locally recorded invoice carried a different status from the provider's. */
+    INVOICE_STATUS_DRIFT = "invoice_status_drift"
+}
+/**
+ * A population a reconciliation run met and deliberately did NOT compare against the provider.
+ *
+ * Counted per run, because a sweep that silently skips rows is indistinguishable from one that
+ * compared them and found agreement — and "we reconciled everything" is only a true sentence when
+ * the skipped populations are stated beside it. Each member is a DECISION with a reason, not a gap:
+ *
+ * Populations that are never compared by design and therefore never met at all — terminal
+ * subscriptions, subscriptions known only to the provider, subscription items, invoice totals, and
+ * invoices older than the per-customer lookback — are named on `BillingReconciliationBackendService`
+ * rather than here, because a run cannot count what it never selects.
+ */
+export declare enum BillingReconciliationUncomparedPopulation {
+    /** A local subscription with no provider link: there is no provider record to compare it against. */
+    SUBSCRIPTION_WITHOUT_PROVIDER_LINK = "subscription_without_provider_link",
+    /**
+     * A provider-linked subscription whose mutation slot holds a PREPARED admission: one of its mutations is
+     * about to call the provider, so the run neither read nor wrote it. Its next run re-reads it.
+     */
+    SUBSCRIPTION_MUTATION_ADMISSION_PREPARED = "subscription_mutation_admission_prepared",
+    /**
+     * A provider-linked subscription the run read and found disagreeing, but whose mutation slot was written after that read, so nothing
+     * was written: the difference may already be gone. The writer is not always a mutation or a webhook — recovery moving a held
+     * generation behind newer ones advances the same version without settling anything — so this counts a read to REPEAT, never a
+     * mutation observed. Counted here rather than as a divergence the run cannot confirm. Its next run re-reads it.
+     */
+    SUBSCRIPTION_SUPERSEDED_BEFORE_REPAIR = "subscription_superseded_before_repair",
+    /**
+     * A provider-linked subscription whose billing account or provider link no longer matches the identity its mutation slot
+     * records. A mutation refuses the same condition as `slot_identity_changed`; the run neither compares nor writes it, and it
+     * stays held until recovery resolves the slot.
+     */
+    SUBSCRIPTION_SLOT_IDENTITY_CHANGED = "subscription_slot_identity_changed",
+    /** A billing account with no provider customer: nothing at the provider can hold its invoices. */
+    BILLING_ACCOUNT_WITHOUT_PROVIDER_CUSTOMER = "billing_account_without_provider_customer",
+    /**
+     * A billing scope whose rows exceeded one run's page ceiling. The remainder is left to the next run:
+     * reconciliation is idempotent, so a prefix is safe, but the count says the run did not cover the scope.
+     */
+    SCOPE_TRUNCATED_AT_PAGE_CEILING = "scope_truncated_at_page_ceiling"
+}
 /**
  * Tax calculation mode: provider-managed or disabled.
  */
@@ -286,6 +355,19 @@ export declare enum BillingCheckoutMetadataKey {
      */
     QUANTITY = "wildo_quantity"
 }
+/**
+ * Framework-authoritative metadata keys the engine writes on a provider SUBSCRIPTION (#535), in the same reserved namespace
+ * as {@link BillingCheckoutMetadataKey} and under the same rule: every member starts with
+ * {@link BILLING_RESERVED_METADATA_KEY_PREFIX}, so no caller-authored metadata can be mistaken for it.
+ */
+export declare enum BillingSubscriptionMetadataKey {
+    /**
+     * `<slotId>:<generation>` of the subscription mutation that sent the update. Written so reconciliation can match a
+     * provider object to the durable mutation that caused it — including a change whose response was lost. A reference, never
+     * authority on its own: a match is confirmed against the stored mutation's identity.
+     */
+    MUTATION = "wildo_mutation"
+}
 /**
  * Upper bound on a single checkout's line-item quantity, applied on BOTH sides of the provider
  * round trip: the OPEN_CHECKOUT request DTO refuses more, and the webhook consumer refuses to

package/dist/esm/billing/billing-enums.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-enums.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-enums.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAI3J;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,oBAAY,WAAW;IACrB,gEAAgE;IAChE,IAAI,SAAS;IACb,6DAA6D;IAC7D,KAAK,UAAU;IACf,kEAAkE;IAClE,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,sEAAsE;IACtE,WAAW,gBAAgB;IAC3B,0EAA0E;IAC1E,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAID;;GAEG;AAKH;;GAEG;AACH,oBAAY,aAAa;IACvB,SAAS,cAAc;IACvB,aAAa,kBAAkB;CAChC;AACD,sEAAsE;AAMtE;;GAEG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;CAC1C;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,cAAc,mBAAmB;IACjC,MAAM,WAAW;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;GASG;AACH,oBAAY,6BAA6B;IACvC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAMD;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;CACtB;AAYD;;;;;GAKG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,SAAS,cAAc;CACxB;AAID;;GAEG;AACH,oBAAY,aAAa;IACvB,sBAAsB;IACtB,MAAM,WAAW;IACjB,0BAA0B;IAC1B,cAAc,mBAAmB;IACjC,uBAAuB;IACvB,QAAQ,aAAa;IACrB,yBAAyB;IACzB,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,YAAY;IACtB,UAAU,eAAe;IACzB,YAAY,iBAAiB;CAC9B;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,eAAe,oBAAoB;CACpC;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC,WAAW,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC;;;;;;OAMG;IACH,kBAAkB,2BAA2B;IAC7C,kGAAkG;IAClG,WAAW,qBAAqB;IAChC;;;;;;;;;;;;OAYG;IACH,YAAY,sBAAsB;IAClC;;;OAGG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,SAAU,CAAC"}
+{"version":3,"file":"billing-enums.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-enums.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAI3J;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,oBAAY,WAAW;IACrB,gEAAgE;IAChE,IAAI,SAAS;IACb,6DAA6D;IAC7D,KAAK,UAAU;IACf,kEAAkE;IAClE,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,sEAAsE;IACtE,WAAW,gBAAgB;IAC3B,0EAA0E;IAC1E,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAID;;GAEG;AAKH;;GAEG;AACH,oBAAY,aAAa;IACvB,SAAS,cAAc;IACvB,aAAa,kBAAkB;CAChC;AACD,sEAAsE;AAMtE;;GAEG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;CAC1C;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,cAAc,mBAAmB;IACjC,MAAM,WAAW;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;GASG;AACH,oBAAY,6BAA6B;IACvC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,mCAAmC;IAC7C,qHAAqH;IACrH,wBAAwB,6BAA6B;IACrD,0HAA0H;IAC1H,sCAAsC,2CAA2C;IACjF,gHAAgH;IAChH,uBAAuB,4BAA4B;IACnD,iFAAiF;IACjF,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,yCAAyC;IACnD,qGAAqG;IACrG,kCAAkC,uCAAuC;IACzE;;;OAGG;IACH,wCAAwC,6CAA6C;IACrF;;;;;OAKG;IACH,qCAAqC,0CAA0C;IAC/E;;;;OAIG;IACH,kCAAkC,uCAAuC;IACzE,kGAAkG;IAClG,yCAAyC,8CAA8C;IACvF;;;OAGG;IACH,+BAA+B,oCAAoC;CACpE;AAMD;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;CACtB;AAYD;;;;;GAKG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,SAAS,cAAc;CACxB;AAID;;GAEG;AACH,oBAAY,aAAa;IACvB,sBAAsB;IACtB,MAAM,WAAW;IACjB,0BAA0B;IAC1B,cAAc,mBAAmB;IACjC,uBAAuB;IACvB,QAAQ,aAAa;IACrB,yBAAyB;IACzB,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,YAAY;IACtB,UAAU,eAAe;IACzB,YAAY,iBAAiB;CAC9B;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,eAAe,oBAAoB;CACpC;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC,WAAW,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC;;;;;;OAMG;IACH,kBAAkB,2BAA2B;IAC7C,kGAAkG;IAClG,WAAW,qBAAqB;IAChC;;;;;;;;;;;;OAYG;IACH,YAAY,sBAAsB;IAClC;;;OAGG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;GAIG;AACH,oBAAY,8BAA8B;IACxC;;;;OAIG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,SAAU,CAAC"}