npm - @wildo-ai/saas-models - Versions diffs - 1.1.3 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.3 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (890) hide show

package/dist/esm/billing/subscription.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subscription.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,0CAA0C,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,8BAWX;AAXD,WAAY,8BAA8B;IACxC,6DAA6D;IAC7D,mDAAiB,CAAA;IACjB,wDAAwD;IACxD,mDAAiB,CAAA;IACjB,qDAAqD;IACrD,6DAA2B,CAAA;IAC3B,+CAA+C;IAC/C,yDAAuB,CAAA;IACvB,oDAAoD;IACpD,+DAA6B,CAAA;AAC/B,CAAC,EAXW,8BAA8B,KAA9B,8BAA8B,QAWzC;AAED,wEAAwE;AAExE,wFAAwF;AACxF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,uCAAuC,CAC7F,0CAA0C,EAC1C;IACE,gBAAgB,EAAE,IAAI;IACtB,gGAAgG;IAChG,4FAA4F;IAC5F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,+FAA+F;IAC/F,wDAAwD;IACxD,kBAAkB,EAAE;QAClB,kSAAkS;QAClS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,eAAe,EAAE,8BAA8B;IAC/C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,iFAAiF;oBACjF,mFAAmF;oBACnF,6EAA6E;oBAC7E,wFAAwF;oBACxF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,oCAAoC;iBACjD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,mFAAmF;oBACnF,iFAAiF;oBACjF,oFAAoF;oBACpF,+EAA+E;oBAC/E,+EAA+E;oBAC/E,gFAAgF;oBAChF,kCAAkC;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAAE;YAC5C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,wCAAwC;iBACrD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,sCAAsC;iBACnD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,YAAY,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n Subscription Resource Configuration — Polymorphic\n \n Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...billingSubscriptionsPolymorphicFactories\n \n @see polymorphic-scope-approach-A-expansion.md — Phase 3\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { billingSubscriptionsPolymorphicDeclaration } from './subscription.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingSubscription_Operations {\n /* Cancel the subscription (at period end or immediately) /\n CANCEL = 'cancel',\n /* Resume a cancelled subscription before period end /\n RESUME = 'resume',\n /* Change to a different plan (upgrade/downgrade) /\n CHANGE_PLAN = 'change_plan',\n /* Add an addon product to the subscription /\n ADD_ADDON = 'add_addon',\n /* Remove an addon product from the subscription /\n REMOVE_ADDON = 'remove_addon',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/* Request DTO for CANCEL operation — shared between resource config and custom impl /\nexport const BillingSubscription_CancelRequestDto = z.object({\n /\n OPTIONAL, with no default — and the absence of a default is the point (#408, 2026-09-08).\n \n It carried `.default(false)` until then, which materialized `false` at parse and made \"the\n * caller expressed no preference\" a state the handler could never observe. That erased the only\n * input `ProductBehaviorPolicy.cancellation.defaultBehavior` exists to answer, so an authored\n * product default was unimplementable rather than merely unimplemented — a field one layer up\n * had already decided for it.\n \n The resolution order is now: the caller's explicit choice, then the plan product's\n * `defaultBehavior`, then period-end as the framework floor. Omitting it still ends in period-end\n * for a product that authors no policy, so nothing changes for an existing caller — what changes\n * is that a product declaring IMMEDIATE now gets it.\n /\n cancelImmediately: z.boolean().optional(),\n reason: z.string().max(500).optional(),\n});\n\n/* Request DTO for CHANGE_PLAN operation — shared between resource config and custom impl /\nexport const BillingSubscription_ChangePlanRequestDto = z.object({\n newProductKey: z.string().min(1),\n newPriceId: z.string().min(1),\n});\n\n/* Request DTO for ADD_ADDON operation — shared between resource config and custom impl /\nexport const BillingSubscription_AddAddonRequestDto = z.object({\n addonProductKey: z.string().min(1),\n priceId: z.string().min(1),\n});\n\n/* Request DTO for REMOVE_ADDON operation — shared between resource config and custom impl /\nexport const BillingSubscription_RemoveAddonRequestDto = z.object({\n addonProductKey: z.string().min(1),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/\n Polymorphic factory map for subscriptions.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n * ...billingSubscriptionsPolymorphicFactories\n \n Produces entries for:\n * - organizationSubscriptions\n * - userSubscriptions\n /\nexport const billingSubscriptionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n billingSubscriptionsPolymorphicDeclaration,\n {\n isSystemResource: true,\n // System-context LIST opt-in (fail-closed default is FORBIDDEN). Subject erasure enumerates the\n // erased person's live subscriptions so it can cancel them at the provider immediately — an\n // erased subject must stop being billed. There is no request context on that path (the subject\n // is being erased), so it reads through `SystemAccessBackendService.listAsSystem`, which refuses\n // any resource that has not opted in here. LIST's default variant is API_CALL and therefore\n // resolves through `getServiceOperationPathDefault`; a REPOSITORY_ONLY-only LIST would satisfy\n // this grant and still fail to resolve at erasure time.\n systemAccessPolicy: {\n // Subject-export disclosure. The subject's own subscriptions. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n /\n Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n \n `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * subscription terms — plan and price references, status and period boundaries — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n \n The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_ONLY,\n },\n\n /\n Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n * record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n * session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n customOperation: BillingSubscription_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n operationsConfiguration: {\n /\n * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n * verb the impersonalize writer uses to stamp the retention markers.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n }],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [{\n // API_CALL: subscriptions are a user-facing collection (Settings Hub → Billing →\n // Subscriptions, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n // strip the op from the frontend registry and register no HTTP route. Writes\n // (checkout + webhook sync) are INTERNAL_CALL (service-pipeline) / custom API_CALL ops.\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n }],\n },\n [BillingSubscription_Operations.CANCEL]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: BillingSubscription_CancelRequestDto,\n }],\n },\n [BillingSubscription_Operations.RESUME]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // RESUME clears a pending cancellation at the provider and mirrors the result — it\n // takes no caller input. Its implementation already ignores the payload, but the\n // dispatcher MERGES a prefix's return onto the caller payload rather than replacing\n // it, so an unnarrowed contract is still writable. Omitting `requestDto` would\n // auto-derive the FULL subscription update DTO (`status`, `items`, `discount`,\n // `currentPeriodEnd`, `cancelledAt`, …), letting a subscriber rewrite their own\n // billing state through \"resume\".\n requestDto: z.object({}),\n }],\n },\n [BillingSubscription_Operations.CHANGE_PLAN]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: BillingSubscription_ChangePlanRequestDto,\n }],\n },\n [BillingSubscription_Operations.ADD_ADDON]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: BillingSubscription_AddAddonRequestDto,\n }],\n },\n [BillingSubscription_Operations.REMOVE_ADDON]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: BillingSubscription_RemoveAddonRequestDto,\n }],\n },\n },\n },\n);\n"]}
1	+ {"version":3,"file":"subscription.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,0CAA0C,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,oCAAoC,CAAC;AAEhG,wEAAwE;AAExE,MAAM,CAAN,IAAY,8BAaX;AAbD,WAAY,8BAA8B;IACxC,6DAA6D;IAC7D,mDAAiB,CAAA;IACjB,wDAAwD;IACxD,mDAAiB,CAAA;IACjB,qDAAqD;IACrD,6DAA2B,CAAA;IAC3B,+EAA+E;IAC/E,6EAA2C,CAAA;IAC3C,+CAA+C;IAC/C,yDAAuB,CAAA;IACvB,oDAAoD;IACpD,+DAA6B,CAAA;AAC/B,CAAC,EAbW,8BAA8B,KAA9B,8BAA8B,QAazC;AAED,wEAAwE;AAExE,wFAAwF;AACxF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,uFAAuF;AACvF,MAAM,CAAC,MAAM,wCAAwC,GAAG,+CAA+C,CAAC,MAAM,CAAC;IAC7G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;CAC5C,CAAC,CAAC;AAEH,6GAA6G;AAC7G,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC1B,6DAA6D;IAC7D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;CAC5C,CAAC,CAAC;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEH,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,uCAAuC,CAC7F,0CAA0C,EAC1C;IACE,gBAAgB,EAAE,IAAI;IACtB,gGAAgG;IAChG,4FAA4F;IAC5F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,+FAA+F;IAC/F,wDAAwD;IACxD,kBAAkB,EAAE;QAClB,kSAAkS;QAClS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,eAAe,EAAE,8BAA8B;IAC/C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,iFAAiF;oBACjF,mFAAmF;oBACnF,6EAA6E;oBAC7E,wFAAwF;oBACxF,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,oCAAoC;oBAChD,qHAAqH;oBACrH,mHAAmH;oBACnH,cAAc,EAAE,0CAA0C,CAAC,QAAQ;iBACpE,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,mFAAmF;oBACnF,iFAAiF;oBACjF,oFAAoF;oBACpF,+EAA+E;oBAC/E,+EAA+E;oBAC/E,gFAAgF;oBAChF,kCAAkC;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,+GAA+G;oBAC/G,2CAA2C;oBAC3C,cAAc,EAAE,0CAA0C,CAAC,QAAQ;iBACpE,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,mBAAmB,CAAC,EAAE;YACpD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,+CAA+C;oBAC3D,iBAAiB,EAAE,gDAAgD;iBACpE,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAAE;YAC5C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,wCAAwC;iBACrD,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,sCAAsC;oBAClD,yHAAyH;oBACzH,0HAA0H;oBAC1H,8GAA8G;oBAC9G,cAAc,EAAE,0CAA0C,CAAC,QAAQ;iBACpE,CAAC;SACH;QACD,CAAC,8BAA8B,CAAC,YAAY,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,yHAAyH;oBACzH,4HAA4H;oBAC5H,cAAc,EAAE,0CAA0C,CAAC,QAAQ;iBACpE,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n Subscription Resource Configuration — Polymorphic\n \n Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...billingSubscriptionsPolymorphicFactories\n \n @see polymorphic-scope-approach-A-expansion.md — Phase 3\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { billingSubscriptionsPolymorphicDeclaration } from './subscription.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { ResourceOperationIdempotencyKeyRequirement } from '../requests/idempotency-key.shared';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum BillingSubscription_Operations {\n /* Cancel the subscription (at period end or immediately) /\n CANCEL = 'cancel',\n /* Resume a cancelled subscription before period end /\n RESUME = 'resume',\n /* Change to a different plan (upgrade/downgrade) /\n CHANGE_PLAN = 'change_plan',\n /* Calculate a provider invoice estimate without changing the subscription. /\n PREVIEW_PLAN_CHANGE = 'preview_plan_change',\n /* Add an addon product to the subscription /\n ADD_ADDON = 'add_addon',\n /* Remove an addon product from the subscription /\n REMOVE_ADDON = 'remove_addon',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/* Request DTO for CANCEL operation — shared between resource config and custom impl /\nexport const BillingSubscription_CancelRequestDto = z.object({\n /\n OPTIONAL, with no default — and the absence of a default is the point (#408, 2026-09-08).\n \n It carried `.default(false)` until then, which materialized `false` at parse and made \"the\n * caller expressed no preference\" a state the handler could never observe. That erased the only\n * input `ProductBehaviorPolicy.cancellation.defaultBehavior` exists to answer, so an authored\n * product default was unimplementable rather than merely unimplemented — a field one layer up\n * had already decided for it.\n \n The resolution order is now: the caller's explicit choice, then the plan product's\n * `defaultBehavior`, then period-end as the framework floor. Omitting it still ends in period-end\n * for a product that authors no policy, so nothing changes for an existing caller — what changes\n * is that a product declaring IMMEDIATE now gets it.\n /\n cancelImmediately: z.boolean().optional(),\n reason: z.string().max(500).optional(),\n});\n\n/* Selection sent for a provider-computed preview; it does not authorize a change. /\nexport const BillingSubscription_PreviewPlanChangeRequestDto = z.object({\n newProductKey: z.string().min(1),\n newPriceId: z.string().min(1),\n});\n\n/* Confirmation must carry the server-issued preview bound to this exact selection. /\nexport const BillingSubscription_ChangePlanRequestDto = BillingSubscription_PreviewPlanChangeRequestDto.extend({\n previewToken: z.string().min(1).max(65_536),\n});\n\n/* Provider invoice estimate plus a short-lived confirmation binding; normal authorization still applies. /\nexport const BillingSubscription_PlanChangePreviewResponseDto = z.object({\n amount: z.number().int(),\n currency: z.string().min(1),\n lineItems: z.array(z.object({ description: z.string(), amount: z.number().int(), quantity: z.number() })),\n periodStart: z.coerce.date(),\n periodEnd: z.coerce.date(),\n /* Server-generated calculation instant, in Unix seconds. /\n prorationDate: z.number().int().nonnegative(),\n previewToken: z.string().min(1).max(65_536),\n});\n\n/* Request DTO for ADD_ADDON operation — shared between resource config and custom impl /\nexport const BillingSubscription_AddAddonRequestDto = z.object({\n addonProductKey: z.string().min(1),\n priceId: z.string().min(1),\n});\n\n/* Request DTO for REMOVE_ADDON operation — shared between resource config and custom impl /\nexport const BillingSubscription_RemoveAddonRequestDto = z.object({\n addonProductKey: z.string().min(1),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY — 2 variants (org, user)\n// =============================================================================\n\n/\n Polymorphic factory map for subscriptions.\n * Spread into `coreShared_ResourcesConfigurations_FactoryMap`:\n * ...billingSubscriptionsPolymorphicFactories\n \n Produces entries for:\n * - organizationSubscriptions\n * - userSubscriptions\n /\nexport const billingSubscriptionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n billingSubscriptionsPolymorphicDeclaration,\n {\n isSystemResource: true,\n // System-context LIST opt-in (fail-closed default is FORBIDDEN). Subject erasure enumerates the\n // erased person's live subscriptions so it can cancel them at the provider immediately — an\n // erased subject must stop being billed. There is no request context on that path (the subject\n // is being erased), so it reads through `SystemAccessBackendService.listAsSystem`, which refuses\n // any resource that has not opted in here. LIST's default variant is API_CALL and therefore\n // resolves through `getServiceOperationPathDefault`; a REPOSITORY_ONLY-only LIST would satisfy\n // this grant and still fail to resolve at erasure time.\n systemAccessPolicy: {\n // Subject-export disclosure. The subject's own subscriptions. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n /\n Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n \n `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * subscription terms — plan and price references, status and period boundaries — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n \n The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_ONLY,\n },\n\n /\n Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n * record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n * session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n customOperation: BillingSubscription_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n operationsConfiguration: {\n /\n * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n * verb the impersonalize writer uses to stamp the retention markers.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n }],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [{\n // API_CALL: subscriptions are a user-facing collection (Settings Hub → Billing →\n // Subscriptions, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n // strip the op from the frontend registry and register no HTTP route. Writes\n // (checkout + webhook sync) are INTERNAL_CALL (service-pipeline) / custom API_CALL ops.\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n }],\n },\n [BillingSubscription_Operations.CANCEL]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n auditableEvent: { reasonField: 'reason' },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: BillingSubscription_CancelRequestDto,\n // A caller may send an Idempotency-Key: a repeat with it replays the committed cancellation, and the same key with a\n // different request is refused (#535 S5a). Optional, because a repeat without one still converges at the provider.\n idempotencyKey: ResourceOperationIdempotencyKeyRequirement.ACCEPTED,\n }],\n },\n [BillingSubscription_Operations.RESUME]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // RESUME clears a pending cancellation at the provider and mirrors the result — it\n // takes no caller input. Its implementation already ignores the payload, but the\n // dispatcher MERGES a prefix's return onto the caller payload rather than replacing\n // it, so an unnarrowed contract is still writable. Omitting `requestDto` would\n // auto-derive the FULL subscription update DTO (`status`, `items`, `discount`,\n // `currentPeriodEnd`, `cancelledAt`, …), letting a subscriber rewrite their own\n // billing state through \"resume\".\n requestDto: z.object({}),\n // A caller may send an Idempotency-Key: a repeat with it replays the committed resume, and the same key with a\n // different request is refused (#535 S5a).\n idempotencyKey: ResourceOperationIdempotencyKeyRequirement.ACCEPTED,\n }],\n },\n [BillingSubscription_Operations.PREVIEW_PLAN_CHANGE]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n requestDto: BillingSubscription_PreviewPlanChangeRequestDto,\n customResponseDto: BillingSubscription_PlanChangePreviewResponseDto,\n }],\n },\n [BillingSubscription_Operations.CHANGE_PLAN]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: BillingSubscription_ChangePlanRequestDto,\n }],\n },\n [BillingSubscription_Operations.ADD_ADDON]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: BillingSubscription_AddAddonRequestDto,\n // REQUIRED, not ACCEPTED (#535 S5b): repeating an addition is a second line and a second charge, so a retry after a lost\n // response must be recognizable as the same request. Every external caller sends the key and a repeat with it replays the\n // committed addition. Kept off MCP, whose tool calls carry no key (boot refuses REQUIRED on an exposed tool).\n idempotencyKey: ResourceOperationIdempotencyKeyRequirement.REQUIRED,\n }],\n },\n [BillingSubscription_Operations.REMOVE_ADDON]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: BillingSubscription_RemoveAddonRequestDto,\n // REQUIRED (#535 S5b): a repeat after the removal committed no longer finds the add-on, so without a key a retry after a\n // lost response cannot learn that its removal succeeded. A repeat with the key replays the committed removal. Kept off MCP.\n idempotencyKey: ResourceOperationIdempotencyKeyRequirement.REQUIRED,\n }],\n },\n },\n },\n);\n"]}

package/dist/esm/billing/subscription.shared.schemas.d.ts CHANGED Viewed

@@ -14,6 +14,7 @@
  * @see billing-and-features-system.md §6.3 (Subscription & Subscription Items)
  */
 import { z } from 'zod';
+import '@wildo-ai/zod-decorators';
 import { SubscriptionStatus } from './billing-enums.shared.schemas';
 /**
  * A line item within a subscription (one product/price pair).

package/dist/esm/billing/subscription.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subscription.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIpE;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAUjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0ExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;;;GASG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQrD,CAAC"}
1	+ {"version":3,"file":"subscription.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAGlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIpE;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAUjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0ExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;;;GASG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQrD,CAAC"}

package/dist/esm/billing/subscription.shared.schemas.js CHANGED Viewed

@@ -14,6 +14,9 @@
  * @see billing-and-features-system.md §6.3 (Subscription & Subscription Items)
  */
 import { z } from 'zod';
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —
+// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.
+import '@wildo-ai/zod-decorators';
 import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas.js';
 import { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas.js';
 import { SubscriptionStatus } from './billing-enums.shared.schemas.js';

package/dist/esm/billing/subscription.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subscription.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9E,sCAAsC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5E,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACvD,oBAAoB;IACpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;CAClE,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEnI,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,wFAAwF;IACxF,6FAA6F;IAC7F,sFAAsF;IACtF,kGAAkG;IAClG,kFAAkF;IAClF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,eAAe,EAAE;IAEpH,6DAA6D;IAC7D,gGAAgG;IAChG,2FAA2F;IAC3F,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C,aAAa;IACb,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;IAC1D,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAEzE,YAAY;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE9D,mBAAmB;IACnB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAC9D,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACzB,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B,uEAAuE;IACvE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,yBAAyB,CAAC;IAClF,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,gBAAgB;IACrC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,6BAA6B;IACzC,qEAAqE;IACrE,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/*\n Subscription & Subscription Item Schemas (Shared) — Polymorphic\n \n Subscriptions are scope-expanded alongside BillingAccounts. Each subscription\n * variant gets the scope identity FK injected (organizationId / userId)\n * and keeps `billingAccountId` as the FK to its parent billing account variant.\n \n The polymorphic expansion produces 2 concrete resources:\n * - organizationSubscriptions (with organizationId + organizationBillingAccountId)\n * - userSubscriptions (with userId + userBillingAccountId)\n \n \n * @see polymorphic-scope-approach-A-expansion.md\n * @see billing-and-features-system.md §6.3 (Subscription & Subscription Items)\n /\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { SubscriptionStatus } from './billing-enums.shared.schemas';\n\n// ── Subscription Item ──────────────────────────────────────────────\n\n/\n A line item within a subscription (one product/price pair).\n /\nexport const SubscriptionItemSchema = z.object({\n _id: z.string().min(1).isPrimaryKey(),\n /* Reference to the product /\n productId: z.string().min(1).isForeignKey().isSummaryField({ populate: true }),\n /* Reference to the specific price /\n priceId: z.string().min(1).isForeignKey().isSummaryField({ populate: true }),\n /* Quantity (e.g., number of seats) /\n quantity: z.number().min(1).default(1).isSummaryField(),\n /* Provider sync /\n providerSubscriptionItemId: z.string().optional().isBackendOnly(),\n});\nexport type SubscriptionItem = z.infer<typeof SubscriptionItemSchema>;\n\n// ── Subscription Base Schema ───────────────────────────────────────\n\n/\n Subscription base schema — NO identity scope fields.\n * The polymorphic declaration injects the parent scope FK automatically per variant.\n * `billingAccountId` is kept as the FK to the parent billing account variant.\n /\nexport const BillingSubscriptionBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n /* References the parent billing account (polymorphic FK — renamed per variant) /\n billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n\n // `.isAuditEvidence()` — subscription status is the ENTITLEMENT gate: the feature resolver\n // derives a scope's capabilities from it, so a transition to/from ACTIVE silently widens or\n // narrows what the tenant may do. Recording the before/after states makes an entitlement\n // dispute answerable from the trail instead of from the payment provider's own records.\n // Marked on the STATUS only — the provider identifiers on this schema are `.isBackendOnly()`\n // and the money/customer fields are not authorization evidence, so neither is marked.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a subscription status transition widens or\n // narrows tenant capability, so the before/after states are entitlement evidence.\n status: z.enum(SubscriptionStatus).isDBIndexed().isSummaryField().systemEnum('SubscriptionStatus').isAuditEvidence(),\n\n /* Subscription items (what products/prices are included) /\n // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. What the account holder pays\n // for, at what quantity; the lifecycle `status` beside it is a state machine, not a datum.\n // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n // resource config (#138).\n items: z.array(SubscriptionItemSchema).min(1),\n\n /* Period /\n currentPeriodStart: z.date().isDBIndexed().isNotEditable(),\n currentPeriodEnd: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n /* Trial /\n trialStart: z.date().optional().isNotEditable(),\n trialEnd: z.date().optional().isSummaryField().isNotEditable(),\n\n /* Cancellation /\n cancelAtPeriodEnd: z.boolean().default(false).isSummaryField(),\n cancelledAt: z.date().optional().isNotEditable(),\n cancellationReason: z.string().optional(),\n\n /* Active discount from a coupon/promotion applied to this subscription (populated from provider) /\n discount: z.object({\n providerCouponId: z.string().optional(),\n percentOff: z.number().optional(),\n amountOff: z.number().optional(),\n currency: z.string().optional(),\n duration: z.string().optional(),\n durationInMonths: z.number().optional(),\n end: z.date().optional(),\n }).optional().isNotEditable(),\n\n /* Provider sync (payment methods are managed entirely by provider) /\n providerSubscriptionId: z.string().optional().isBackendOnly(),\n\n /\n Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n \n ⚠️ AUTHORING RULE — never store personal data here. This row is RETAINED when its subject is\n * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n * personal data of its own — the person is a foreign key. An open bag is the one place that\n * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n * keys it does not know.\n \n Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n * breach that the retained label makes look intentional.\n \n Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n * Revisit only if an app is found using the bag this way.\n /\n metadata: z.record(z.string(), z.string()).optional(),\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type BillingSubscriptionBase = z.infer<typeof BillingSubscriptionBaseSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\n/\n Polymorphic declaration for Subscriptions.\n * Produces 2 variants:\n * - organizations → organizationSubscriptions (organizationId injected)\n * - users → userSubscriptions (userId injected)\n \n \n * Each variant gets `billingAccountId` renamed to the scoped FK\n * (e.g., `organizationBillingAccountId`) via polymorphic FK transformation.\n */\nexport const billingSubscriptionsPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'subscriptions',\n baseFieldIdentifier: 'subscriptionId',\n baseEnumKey: 'SUBSCRIPTIONS',\n baseSchema: BillingSubscriptionBaseSchema,\n // Many subscriptions per scope (LIST/CREATE/UPDATE) — opt out of the\n // polymorphism engine's singleton-per-scope business-key auto-default.\n variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n\n"]}
1	+ {"version":3,"file":"subscription.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/subscription.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9E,sCAAsC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5E,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACvD,oBAAoB;IACpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;CAClE,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEnI,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,wFAAwF;IACxF,6FAA6F;IAC7F,sFAAsF;IACtF,kGAAkG;IAClG,kFAAkF;IAClF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,eAAe,EAAE;IAEpH,6DAA6D;IAC7D,gGAAgG;IAChG,2FAA2F;IAC3F,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C,aAAa;IACb,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;IAC1D,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAEzE,YAAY;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE9D,mBAAmB;IACnB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAC9D,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACzB,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B,uEAAuE;IACvE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,yBAAyB,CAAC;IAClF,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,gBAAgB;IACrC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,6BAA6B;IACzC,qEAAqE;IACrE,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/*\n Subscription & Subscription Item Schemas (Shared) — Polymorphic\n \n Subscriptions are scope-expanded alongside BillingAccounts. Each subscription\n * variant gets the scope identity FK injected (organizationId / userId)\n * and keeps `billingAccountId` as the FK to its parent billing account variant.\n \n The polymorphic expansion produces 2 concrete resources:\n * - organizationSubscriptions (with organizationId + organizationBillingAccountId)\n * - userSubscriptions (with userId + userBillingAccountId)\n \n \n * @see polymorphic-scope-approach-A-expansion.md\n * @see billing-and-features-system.md §6.3 (Subscription & Subscription Items)\n /\n\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { SubscriptionStatus } from './billing-enums.shared.schemas';\n\n// ── Subscription Item ──────────────────────────────────────────────\n\n/\n A line item within a subscription (one product/price pair).\n /\nexport const SubscriptionItemSchema = z.object({\n _id: z.string().min(1).isPrimaryKey(),\n /* Reference to the product /\n productId: z.string().min(1).isForeignKey().isSummaryField({ populate: true }),\n /* Reference to the specific price /\n priceId: z.string().min(1).isForeignKey().isSummaryField({ populate: true }),\n /* Quantity (e.g., number of seats) /\n quantity: z.number().min(1).default(1).isSummaryField(),\n /* Provider sync /\n providerSubscriptionItemId: z.string().optional().isBackendOnly(),\n});\nexport type SubscriptionItem = z.infer<typeof SubscriptionItemSchema>;\n\n// ── Subscription Base Schema ───────────────────────────────────────\n\n/\n Subscription base schema — NO identity scope fields.\n * The polymorphic declaration injects the parent scope FK automatically per variant.\n * `billingAccountId` is kept as the FK to the parent billing account variant.\n /\nexport const BillingSubscriptionBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n /* References the parent billing account (polymorphic FK — renamed per variant) /\n billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n\n // `.isAuditEvidence()` — subscription status is the ENTITLEMENT gate: the feature resolver\n // derives a scope's capabilities from it, so a transition to/from ACTIVE silently widens or\n // narrows what the tenant may do. Recording the before/after states makes an entitlement\n // dispute answerable from the trail instead of from the payment provider's own records.\n // Marked on the STATUS only — the provider identifiers on this schema are `.isBackendOnly()`\n // and the money/customer fields are not authorization evidence, so neither is marked.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a subscription status transition widens or\n // narrows tenant capability, so the before/after states are entitlement evidence.\n status: z.enum(SubscriptionStatus).isDBIndexed().isSummaryField().systemEnum('SubscriptionStatus').isAuditEvidence(),\n\n /* Subscription items (what products/prices are included) /\n // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. What the account holder pays\n // for, at what quantity; the lifecycle `status` beside it is a state machine, not a datum.\n // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n // resource config (#138).\n items: z.array(SubscriptionItemSchema).min(1),\n\n /* Period /\n currentPeriodStart: z.date().isDBIndexed().isNotEditable(),\n currentPeriodEnd: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n /* Trial /\n trialStart: z.date().optional().isNotEditable(),\n trialEnd: z.date().optional().isSummaryField().isNotEditable(),\n\n /* Cancellation /\n cancelAtPeriodEnd: z.boolean().default(false).isSummaryField(),\n cancelledAt: z.date().optional().isNotEditable(),\n cancellationReason: z.string().optional(),\n\n /* Active discount from a coupon/promotion applied to this subscription (populated from provider) /\n discount: z.object({\n providerCouponId: z.string().optional(),\n percentOff: z.number().optional(),\n amountOff: z.number().optional(),\n currency: z.string().optional(),\n duration: z.string().optional(),\n durationInMonths: z.number().optional(),\n end: z.date().optional(),\n }).optional().isNotEditable(),\n\n /* Provider sync (payment methods are managed entirely by provider) /\n providerSubscriptionId: z.string().optional().isBackendOnly(),\n\n /\n Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n \n ⚠️ AUTHORING RULE — never store personal data here. This row is RETAINED when its subject is\n * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n * personal data of its own — the person is a foreign key. An open bag is the one place that\n * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n * keys it does not know.\n \n Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n * breach that the retained label makes look intentional.\n \n Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n * Revisit only if an app is found using the bag this way.\n /\n metadata: z.record(z.string(), z.string()).optional(),\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type BillingSubscriptionBase = z.infer<typeof BillingSubscriptionBaseSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\n/\n Polymorphic declaration for Subscriptions.\n * Produces 2 variants:\n * - organizations → organizationSubscriptions (organizationId injected)\n * - users → userSubscriptions (userId injected)\n \n \n * Each variant gets `billingAccountId` renamed to the scoped FK\n * (e.g., `organizationBillingAccountId`) via polymorphic FK transformation.\n */\nexport const billingSubscriptionsPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'subscriptions',\n baseFieldIdentifier: 'subscriptionId',\n baseEnumKey: 'SUBSCRIPTIONS',\n baseSchema: BillingSubscriptionBaseSchema,\n // Many subscriptions per scope (LIST/CREATE/UPDATE) — opt out of the\n // polymorphism engine's singleton-per-scope business-key auto-default.\n variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n\n"]}

package/dist/esm/billing/usage-flush-evidence.shared.schemas.d.ts ADDED Viewed

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+import { UsageRecordUnreportableReason } from './billing-enums.shared.schemas';
+/**
+ * # The usage flush's terminal states, summarized for an evidence reader
+ *
+ * assurance-control: WILDO.BILLING.USAGE_REPORTING — a usage row that can never be reported is marked
+ * so with a reason, and the marking is answerable without reading any row.
+ *
+ * What `GET /assurance/usage-flush-evidence` returns for `evidence-requirement:usage-flush-run-record`
+ * C3 ("a row that can never be reported is marked unreportable with a reason, never reported and never
+ * retried forever"). The usage rows are the engine-owned store that answers it directly: each carries
+ * its flush state, and an unreportable one its reason and the instant it was decided.
+ *
+ * ## A STATE, plus the decisions in the window
+ *
+ * The clause is about where rows STAND, so the counts are over every row the stores hold, not only
+ * rows from the window: an unreportable row decided last year is still one that must never be
+ * reported. The window adds one thing, how many rows were DECIDED unreportable inside it.
+ *
+ * ## The contradictions are counted apart
+ *
+ * Each is a way the clause can be broken while the totals look fine: an unreportable row with no
+ * reason, one with no decision instant, and one that also carries `reportedAt`, which would mean a
+ * quantity was both billed and declared unbillable. "Never retried" needs no count of its own: the
+ * flush selects exactly `pending`, so a row in any other state is not work.
+ *
+ * Counts only: a usage row names a tenant or a person and a quantity, which an evidence reader has
+ * no need to hold.
+ */
+export declare const UsageFlushEvidenceSchema: z.ZodObject<{
+    window: z.ZodObject<{
+        from: z.ZodString;
+        to: z.ZodString;
+    }, z.core.$strip>;
+    stores: z.ZodArray<z.ZodString>;
+    pending: z.ZodNumber;
+    reported: z.ZodNumber;
+    unreportable: z.ZodNumber;
+    unreportableByReason: z.ZodArray<z.ZodObject<{
+        reason: z.ZodNullable<z.ZodEnum<typeof UsageRecordUnreportableReason>>;
+        rows: z.ZodNumber;
+    }, z.core.$strip>>;
+    unreportableWithoutReason: z.ZodNumber;
+    unreportableWithoutDecidedAt: z.ZodNumber;
+    unreportableAlsoMarkedReported: z.ZodNumber;
+    unreportableDecidedInWindow: z.ZodNumber;
+}, z.core.$strip>;
+export type UsageFlushEvidence = z.infer<typeof UsageFlushEvidenceSchema>;
+//# sourceMappingURL=usage-flush-evidence.shared.schemas.d.ts.map

package/dist/esm/billing/usage-flush-evidence.shared.schemas.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"usage-flush-evidence.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-flush-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/billing/usage-flush-evidence.shared.schemas.js ADDED Viewed

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+import { UsageRecordUnreportableReason } from './billing-enums.shared.schemas.js';
+/**
+ * # The usage flush's terminal states, summarized for an evidence reader
+ *
+ * assurance-control: WILDO.BILLING.USAGE_REPORTING — a usage row that can never be reported is marked
+ * so with a reason, and the marking is answerable without reading any row.
+ *
+ * What `GET /assurance/usage-flush-evidence` returns for `evidence-requirement:usage-flush-run-record`
+ * C3 ("a row that can never be reported is marked unreportable with a reason, never reported and never
+ * retried forever"). The usage rows are the engine-owned store that answers it directly: each carries
+ * its flush state, and an unreportable one its reason and the instant it was decided.
+ *
+ * ## A STATE, plus the decisions in the window
+ *
+ * The clause is about where rows STAND, so the counts are over every row the stores hold, not only
+ * rows from the window: an unreportable row decided last year is still one that must never be
+ * reported. The window adds one thing, how many rows were DECIDED unreportable inside it.
+ *
+ * ## The contradictions are counted apart
+ *
+ * Each is a way the clause can be broken while the totals look fine: an unreportable row with no
+ * reason, one with no decision instant, and one that also carries `reportedAt`, which would mean a
+ * quantity was both billed and declared unbillable. "Never retried" needs no count of its own: the
+ * flush selects exactly `pending`, so a row in any other state is not work.
+ *
+ * Counts only: a usage row names a tenant or a person and a quantity, which an evidence reader has
+ * no need to hold.
+ */
+export const UsageFlushEvidenceSchema = z.object({
+    window: z.object({ from: z.string(), to: z.string() }),
+    /** The usage stores measured. An application with billing off registers none, which is an answer. */
+    stores: z.array(z.string()),
+    pending: z.number().int().min(0),
+    reported: z.number().int().min(0),
+    unreportable: z.number().int().min(0),
+    unreportableByReason: z.array(z.object({
+        reason: z.enum(UsageRecordUnreportableReason).nullable(),
+        rows: z.number().int().min(0),
+    })),
+    unreportableWithoutReason: z.number().int().min(0),
+    unreportableWithoutDecidedAt: z.number().int().min(0),
+    /** Unreportable rows that ALSO carry `reportedAt`: billed and declared unbillable at once. */
+    unreportableAlsoMarkedReported: z.number().int().min(0),
+    /** Rows decided unreportable inside the window. */
+    unreportableDecidedInWindow: z.number().int().min(0),
+});
+//# sourceMappingURL=usage-flush-evidence.shared.schemas.js.map

package/dist/esm/billing/usage-flush-evidence.shared.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"usage-flush-evidence.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/usage-flush-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,qGAAqG;IACrG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE;QACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC9B,CAAC,CAAC;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,8FAA8F;IAC9F,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,mDAAmD;IACnD,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACrD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { UsageRecordUnreportableReason } from './billing-enums.shared.schemas';\n\n/**\n * # The usage flush's terminal states, summarized for an evidence reader\n *\n * assurance-control: WILDO.BILLING.USAGE_REPORTING — a usage row that can never be reported is marked\n * so with a reason, and the marking is answerable without reading any row.\n *\n * What `GET /assurance/usage-flush-evidence` returns for `evidence-requirement:usage-flush-run-record`\n * C3 (\"a row that can never be reported is marked unreportable with a reason, never reported and never\n * retried forever\"). The usage rows are the engine-owned store that answers it directly: each carries\n * its flush state, and an unreportable one its reason and the instant it was decided.\n *\n * ## A STATE, plus the decisions in the window\n *\n * The clause is about where rows STAND, so the counts are over every row the stores hold, not only\n * rows from the window: an unreportable row decided last year is still one that must never be\n * reported. The window adds one thing, how many rows were DECIDED unreportable inside it.\n *\n * ## The contradictions are counted apart\n *\n * Each is a way the clause can be broken while the totals look fine: an unreportable row with no\n * reason, one with no decision instant, and one that also carries `reportedAt`, which would mean a\n * quantity was both billed and declared unbillable. \"Never retried\" needs no count of its own: the\n * flush selects exactly `pending`, so a row in any other state is not work.\n *\n * Counts only: a usage row names a tenant or a person and a quantity, which an evidence reader has\n * no need to hold.\n */\nexport const UsageFlushEvidenceSchema = z.object({\n window: z.object({ from: z.string(), to: z.string() }),\n /** The usage stores measured. An application with billing off registers none, which is an answer. */\n stores: z.array(z.string()),\n pending: z.number().int().min(0),\n reported: z.number().int().min(0),\n unreportable: z.number().int().min(0),\n unreportableByReason: z.array(z.object({\n reason: z.enum(UsageRecordUnreportableReason).nullable(),\n rows: z.number().int().min(0),\n })),\n unreportableWithoutReason: z.number().int().min(0),\n unreportableWithoutDecidedAt: z.number().int().min(0),\n /** Unreportable rows that ALSO carry `reportedAt`: billed and declared unbillable at once. */\n unreportableAlsoMarkedReported: z.number().int().min(0),\n /** Rows decided unreportable inside the window. */\n unreportableDecidedInWindow: z.number().int().min(0),\n});\nexport type UsageFlushEvidence = z.infer<typeof UsageFlushEvidenceSchema>;\n"]}

package/dist/esm/billing/usage-record.shared.schemas.d.ts CHANGED Viewed

@@ -16,6 +16,7 @@
  * @see billing-and-features-system.md §6.6 (Usage Records)
  */
 import { z } from 'zod';
+import '@wildo-ai/zod-decorators';
 import { UsageRecordFlushState, UsageRecordUnreportableReason, UsageSourceType } from './billing-enums.shared.schemas';
 export declare const UsageRecordSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;

package/dist/esm/billing/usage-record.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"usage-record.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEvH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;iBAsE5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;kBAQ7C,CAAC"}
1	+ {"version":3,"file":"usage-record.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAGlC,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEvH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;iBAsE5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;kBAQ7C,CAAC"}

package/dist/esm/billing/usage-record.shared.schemas.js CHANGED Viewed

@@ -16,6 +16,9 @@
  * @see billing-and-features-system.md §6.6 (Usage Records)
  */
 import { z } from 'zod';
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —
+// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.
+import '@wildo-ai/zod-decorators';
 import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas.js';
 import { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas.js';
 import { UsageRecordFlushState, UsageRecordUnreportableReason, UsageSourceType } from './billing-enums.shared.schemas.js';

package/dist/esm/billing/usage-record.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"usage-record.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEvH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnI,sEAAsE;IACtE,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,qBAAqB;IACrB,+FAA+F;IAC/F,gGAAgG;IAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC5C,8BAA8B;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAElE,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAClJ,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAC/C;;;;;;OAMG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAChI,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAEnD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,kCAAkC,GAAG,yBAAyB,CAAC;IAC1E,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,eAAe;IACpC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,iBAAiB;IAC7B,2EAA2E;IAC3E,iDAAiD;IACjD,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/*\n Usage Record Schema (Shared) — Polymorphic\n \n Tracks metered usage for METERED products. The current metering service groups\n * unreported rows by billing account and product when its scheduled flush runs.\n * `ProductBehaviorPolicy.metering` is an authored policy surface, but the current\n * flush scheduler does not consume its interval, window or retry members; do not\n * present those values as an effective reporting schedule until that runtime join exists.\n \n POLYMORPHIC EXPANSION: Like subscriptions, usage records are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n * - organizationUsageRecords (with organizationId + organizationBillingAccountId)\n * - userUsageRecords (with userId + userBillingAccountId)\n \n \n * @see billing-and-features-system.md §6.6 (Usage Records)\n /\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { UsageRecordFlushState, UsageRecordUnreportableReason, UsageSourceType } from './billing-enums.shared.schemas';\n\nexport const UsageRecordSchema = z.object({\n _id: z.string().min(1).isPrimaryKey(),\n billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n /* Product key for grouping/lookup (matches ProductDefinition.key) /\n // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n // resource config (#138).\n productKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable(),\n\n /* Usage quantity /\n // USAGE, not FINANCIAL. A metered quantity is what the person DID in the product; the money it\n // becomes lives on the invoice. Two different sentences in a notice, and they read differently.\n quantity: z.number().min(0).isSummaryField(),\n /* When the usage occurred /\n timestamp: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n /* What generated this usage /\n source: z.object({\n type: z.enum(UsageSourceType),\n resourceType: z.string().optional(),\n operationIdentifier: z.string().optional(),\n description: z.string().optional(),\n }).optional().isNotEditable(),\n\n /\n Where this row stands with respect to the provider flush.\n \n The flush selects exactly `PENDING`, so this ONE indexed field decides whether a row is still\n * work. It replaced a `reportedToProvider` boolean on 2026-09-09 (#512): a boolean has no way to\n * say \"this can never be reported\", so rows whose billing account had been deleted were\n * re-selected by every run forever. See {@link UsageRecordFlushState} for why all three states are\n * semantically distinct and why the shortcut of marking them reported was refused.\n /\n flushState: z.enum(UsageRecordFlushState).default(UsageRecordFlushState.PENDING).isDBIndexed().isNotEditable().systemEnum('UsageRecordFlushState'),\n /* When the PROVIDER acknowledged the quantity. Set only alongside `flushState: reported`. /\n reportedAt: z.date().optional().isNotEditable(),\n /\n Why this row can never be reported. Set only alongside `flushState: unreportable`.\n \n Separate from `reportedAt` on purpose: that timestamp records an acknowledgement by the\n * provider, this pair records a determination made locally, and merging them would put two\n * different events under one name.\n /\n unreportableReason: z.enum(UsageRecordUnreportableReason).optional().isNotEditable().systemEnum('UsageRecordUnreportableReason'),\n /* When the flush determined this row unreportable. Set only alongside `unreportableReason`. /\n unreportableAt: z.date().optional().isNotEditable(),\n\n /\n Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n \n ⚠️ AUTHORING RULE — never store personal data here. This row is RETAINED when its subject is\n * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n * personal data of its own — the person is a foreign key. An open bag is the one place that\n * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n * keys it does not know.\n \n Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n * breach that the retained label makes look intentional.\n \n Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n * Revisit only if an app is found using the bag this way.\n */\n metadata: z.record(z.string(), z.string()).optional(),\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type UsageRecord = z.infer<typeof UsageRecordSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const usageRecordsPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'usageRecords',\n baseFieldIdentifier: 'usageRecordId',\n baseEnumKey: 'USAGE_RECORDS',\n baseSchema: UsageRecordSchema,\n // Many metered usage rows per scope — opt out of the polymorphism engine's\n // singleton-per-scope business-key auto-default.\n variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
1	+ {"version":3,"file":"usage-record.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEvH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnI,sEAAsE;IACtE,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,qBAAqB;IACrB,+FAA+F;IAC/F,gGAAgG;IAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC5C,8BAA8B;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAElE,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAClJ,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAC/C;;;;;;OAMG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAChI,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAEnD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,kCAAkC,GAAG,yBAAyB,CAAC;IAC1E,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,eAAe;IACpC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,iBAAiB;IAC7B,2EAA2E;IAC3E,iDAAiD;IACjD,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/*\n Usage Record Schema (Shared) — Polymorphic\n \n Tracks metered usage for METERED products. The current metering service groups\n * unreported rows by billing account and product when its scheduled flush runs.\n * `ProductBehaviorPolicy.metering` is an authored policy surface, but the current\n * flush scheduler does not consume its interval, window or retry members; do not\n * present those values as an effective reporting schedule until that runtime join exists.\n \n POLYMORPHIC EXPANSION: Like subscriptions, usage records are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n * - organizationUsageRecords (with organizationId + organizationBillingAccountId)\n * - userUsageRecords (with userId + userBillingAccountId)\n \n \n * @see billing-and-features-system.md §6.6 (Usage Records)\n /\n\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { UsageRecordFlushState, UsageRecordUnreportableReason, UsageSourceType } from './billing-enums.shared.schemas';\n\nexport const UsageRecordSchema = z.object({\n _id: z.string().min(1).isPrimaryKey(),\n billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n /* Product key for grouping/lookup (matches ProductDefinition.key) /\n // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n // resource config (#138).\n productKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable(),\n\n /* Usage quantity /\n // USAGE, not FINANCIAL. A metered quantity is what the person DID in the product; the money it\n // becomes lives on the invoice. Two different sentences in a notice, and they read differently.\n quantity: z.number().min(0).isSummaryField(),\n /* When the usage occurred /\n timestamp: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n /* What generated this usage /\n source: z.object({\n type: z.enum(UsageSourceType),\n resourceType: z.string().optional(),\n operationIdentifier: z.string().optional(),\n description: z.string().optional(),\n }).optional().isNotEditable(),\n\n /\n Where this row stands with respect to the provider flush.\n \n The flush selects exactly `PENDING`, so this ONE indexed field decides whether a row is still\n * work. It replaced a `reportedToProvider` boolean on 2026-09-09 (#512): a boolean has no way to\n * say \"this can never be reported\", so rows whose billing account had been deleted were\n * re-selected by every run forever. See {@link UsageRecordFlushState} for why all three states are\n * semantically distinct and why the shortcut of marking them reported was refused.\n /\n flushState: z.enum(UsageRecordFlushState).default(UsageRecordFlushState.PENDING).isDBIndexed().isNotEditable().systemEnum('UsageRecordFlushState'),\n /* When the PROVIDER acknowledged the quantity. Set only alongside `flushState: reported`. /\n reportedAt: z.date().optional().isNotEditable(),\n /\n Why this row can never be reported. Set only alongside `flushState: unreportable`.\n \n Separate from `reportedAt` on purpose: that timestamp records an acknowledgement by the\n * provider, this pair records a determination made locally, and merging them would put two\n * different events under one name.\n /\n unreportableReason: z.enum(UsageRecordUnreportableReason).optional().isNotEditable().systemEnum('UsageRecordUnreportableReason'),\n /* When the flush determined this row unreportable. Set only alongside `unreportableReason`. /\n unreportableAt: z.date().optional().isNotEditable(),\n\n /\n Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n \n ⚠️ AUTHORING RULE — never store personal data here. This row is RETAINED when its subject is\n * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n * personal data of its own — the person is a foreign key. An open bag is the one place that\n * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n * keys it does not know.\n \n Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n * breach that the retained label makes look intentional.\n \n Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n * Revisit only if an app is found using the bag this way.\n */\n metadata: z.record(z.string(), z.string()).optional(),\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type UsageRecord = z.infer<typeof UsageRecordSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const usageRecordsPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'usageRecords',\n baseFieldIdentifier: 'usageRecordId',\n baseEnumKey: 'USAGE_RECORDS',\n baseSchema: UsageRecordSchema,\n // Many metered usage rows per scope — opt out of the polymorphism engine's\n // singleton-per-scope business-key auto-default.\n variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/companion/provider-discovery.shared.schemas.d.ts CHANGED Viewed

@@ -184,6 +184,14 @@ export declare const ProviderCompanionContributionSchema: z.ZodObject<{
         components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("..").ProviderFrontendSelectionDelivery>>;
         }, z.core.$strict>>>;
+        publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        fileStorage: z.ZodOptional<z.ZodEnum<{
+            readonly WILDO_MANAGED: "wildo_managed";
+            readonly LOCAL_DIRECTORY: "local_directory";
+            readonly ONEDRIVE: "onedrive";
+            readonly GOOGLE_DRIVE: "google_drive";
+            readonly DROPBOX: "dropbox";
+        }>>;
     }, z.core.$loose>>;
     /**
      * Optional app module owner when the provider implementation belongs to one

package/dist/esm/companion/provider-discovery.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-discovery.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/companion/provider-discovery.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAI5F;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0CAA0C;;;kBAGrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;4BAgB/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;;;kBAKjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC;;;;;mBA+B5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;IAE9C;;;;;;OAMG;;;;;;;;;;;;;;IAEH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;IAOH;;;;;OAKG~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~IAEH;;;OAGG;;iBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,MAAM,WAAW,4BAA4B;IAC3C,qBAAqB,CAAC,EAAE,6BAA6B,EAAE,CAAC;CACzD"}
1	+ {"version":3,"file":"provider-discovery.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/companion/provider-discovery.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAI5F;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0CAA0C;;;kBAGrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;4BAgB/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;;;kBAKjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC;;;;;mBA+B5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;IAE9C;;;;;;OAMG;;;;;;;;;;;;;;IAEH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;IAOH;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAEH;;;OAGG;;iBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,MAAM,WAAW,4BAA4B;IAC3C,qBAAqB,CAAC,EAAE,6BAA6B,EAAE,CAAC;CACzD"}

package/dist/esm/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -2,6 +2,16 @@ import { z } from 'zod';
 import { AuditEventCategory, AuditEventSeverity } from './auditable-events.shared.schema';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
 import { ResourceOperationRiskLevel, ResourceRelationship } from '../../resources/resources.shared.schemas';
+import { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';
+/**
+ * The roles the application audit door's READ, LIST and SEARCH accept — ONE list, so the three verbs
+ * cannot disagree about who may read the trail.
+ *
+ * `APP_ADMIN_SUPER_ADMIN` for the operator who investigates and then acts; `APP_AUDIT_EVIDENCE_READER`
+ * for a party that must read and must NOT act — an assurance collector's machine credential, an
+ * external auditor. Neither is an organization role: the rows behind this door span every tenant.
+ */
+export declare const APPLICATION_AUDIT_LOG_READ_ROLES: readonly CORE_APP_ROLES[];
 /**
  * The APPLICATION-scoped door onto the audit trail.
  *
@@ -36,8 +46,9 @@ import { ResourceOperationRiskLevel, ResourceRelationship } from '../../resource
  * per-DOOR obligation rather than a property of the rows:
  *
  * - the organization door keeps its tenant filter and its organization roles, unchanged;
- * - this door is `APP_ADMIN_SUPER_ADMIN`-ONLY on every operation. An organization role must never
- *   reach it — the rows behind it span every tenant;
+ * - this door accepts {@link APPLICATION_AUDIT_LOG_READ_ROLES} and nothing else — `APP_ADMIN_SUPER_ADMIN`
+ *   or the read-only `APP_AUDIT_EVIDENCE_READER`. An organization role must never reach it — the rows
+ *   behind it span every tenant;
  * - a read here that touches a tenant-attributed row is a CROSS-TENANT read and OWES an audit
  *   emission. **It is wired**, by the two halves below acting together, and neither is optional:
  *   each read variant declares `admitsCrossTenantPlatformAdministration`, and
@@ -67,7 +78,7 @@ import { ResourceOperationRiskLevel, ResourceRelationship } from '../../resource
  */
 export declare const applicationAuditLogsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     applicationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;

package/dist/esm/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAgC,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;~~AAI1I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG~~;AACH,eAAO,MAAM,+DAA+D,GAC1E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;~~kBA8F9C~~,CAAC"}
1	+ {"version":3,"file":"application-audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAgC,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AAGpF;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,cAAc,EAGpE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,eAAO,MAAM,+DAA+D,GAC1E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBA+F9C,CAAC"}

package/dist/esm/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.js CHANGED Viewed

@@ -5,6 +5,18 @@ import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdenti
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas.js';
 import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+/**
+ * The roles the application audit door's READ, LIST and SEARCH accept — ONE list, so the three verbs
+ * cannot disagree about who may read the trail.
+ *
+ * `APP_ADMIN_SUPER_ADMIN` for the operator who investigates and then acts; `APP_AUDIT_EVIDENCE_READER`
+ * for a party that must read and must NOT act — an assurance collector's machine credential, an
+ * external auditor. Neither is an organization role: the rows behind this door span every tenant.
+ */
+export const APPLICATION_AUDIT_LOG_READ_ROLES = Object.freeze([
+    CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,
+    CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER,
+]);
 /**
  * The APPLICATION-scoped door onto the audit trail.
  *
@@ -39,8 +51,9 @@ import { ResourceSystemAccessMode } from '../../resources/resources-config.share
  * per-DOOR obligation rather than a property of the rows:
  *
  * - the organization door keeps its tenant filter and its organization roles, unchanged;
- * - this door is `APP_ADMIN_SUPER_ADMIN`-ONLY on every operation. An organization role must never
- *   reach it — the rows behind it span every tenant;
+ * - this door accepts {@link APPLICATION_AUDIT_LOG_READ_ROLES} and nothing else — `APP_ADMIN_SUPER_ADMIN`
+ *   or the read-only `APP_AUDIT_EVIDENCE_READER`. An organization role must never reach it — the rows
+ *   behind it span every tenant;
  * - a read here that touches a tenant-attributed row is a CROSS-TENANT read and OWES an audit
  *   emission. **It is wired**, by the two halves below acting together, and neither is optional:
  *   each read variant declares `admitsCrossTenantPlatformAdministration`, and
@@ -86,8 +99,7 @@ export const applicationAuditLogsResourceConfiguration_InitializationFactory = (
             variants: [{
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    /** APP_ADMIN_SUPER_ADMIN ONLY — never an organization role. The rows behind this door span every tenant. */
-                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     /**
                      * Reading ONE tenant's audit row through the application door IS a crossing, so the cheapest
@@ -103,11 +115,12 @@ export const applicationAuditLogsResourceConfiguration_InitializationFactory = (
             variants: [{
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     /** The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. */
                     admitsCrossTenantPlatformAdministration: true,
                     filterFields: {
+                        applicationId: z.string(),
                         eventType: z.string(),
                         eventCategory: z.enum(AuditEventCategory),
                         severity: z.enum(AuditEventSeverity),
@@ -132,13 +145,14 @@ export const applicationAuditLogsResourceConfiguration_InitializationFactory = (
             variants: [{
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     /** The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. */
                     admitsCrossTenantPlatformAdministration: true,
-                    isSearchable: false,
+                    isSearchable: true,
                     searchableFields: [],
                     filterFields: {
+                        applicationId: z.string(),
                         eventType: z.string(),
                         eventCategory: z.enum(AuditEventCategory),
                         severity: z.enum(AuditEventSeverity),

package/dist/esm/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-audit-logs.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrH,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAC7E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,8KAA8K;IAC9K,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,4GAA4G;oBAC5G,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C;;;;;;uBAMG;oBACH,uCAAuC,EAAE,IAAI;iBAC9C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB;;;;;2BAKG;wBACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,qLAAqL;oBACrL,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAU;oBACtE,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAU;oBAC3D,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { AuditEventCategory, AuditEventSeverity, AuditableEvent_BaseSchema } from './auditable-events.shared.schema';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\n\n/*\n The APPLICATION-scoped door onto the audit trail.\n \n ## Why this exists at all\n \n `AUDIT_LOGS` is organization-scoped and its only route is\n * `/organizations/{organizationId}/audit-logs`, so it returns exactly the rows carrying that\n * tenant. A large share of security events carry NO organization by design — `logUserLogin` takes\n * `organizationId` as optional because no organization is selected at login, and the same is true\n * of session eviction, token refresh and application-wide authentication-policy changes. Measured\n * on a dogfood application (#317): 94 of 127 rows had no organization, and were reachable\n * through no API. An operator could see 26% of the trail and could not attest the rest, while a\n * reader querying the only available surface saw `user_login: 0` for a control that had emitted 21.\n \n ## Why a SEPARATE resource type rather than a second route\n \n `generateParentCombinations` composes every URL as\n * `[...primaryScope, ...mandatoryContext, ...optionalCombo]`, so a routed application edge on\n * `AUDIT_LOGS` would appear in EVERY combination and rewrite the organization route to\n * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` — breaking all eight of\n * its documented paths and their consumers. Making the organization edge optional does not help:\n * the empty combination is skipped whenever any parent exists, so no bare route is emitted either.\n * A sibling type carrying ONE application parent takes the route it needs and leaves the existing\n * door byte-identical. The pattern is the engine's own: notification badges are dual-scope with a\n * type per scope, `APPLICATION_API_KEYS` shows the application routing shape, and `USER_SELF`\n * shows a distinct type addressing another's rows.\n \n ## Two doors, ONE record set — the security contract\n \n Both types resolve to the `auditLogs` collection through\n * `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES`. That makes the isolation properties a\n * per-DOOR obligation rather than a property of the rows:\n \n - the organization door keeps its tenant filter and its organization roles, unchanged;\n * - this door is `APP_ADMIN_SUPER_ADMIN`-ONLY on every operation. An organization role must never\n * reach it — the rows behind it span every tenant;\n * - a read here that touches a tenant-attributed row is a CROSS-TENANT read and OWES an audit\n * emission. It is wired, by the two halves below acting together, and neither is optional:\n * each read variant declares `admitsCrossTenantPlatformAdministration`, and\n * `ServicesRegistryHandler.recordCrossTenantReadAccess` observes every enrolled read and emits\n * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` once per TENANT the returned rows belong to. The\n * declaration is what enrols the read: `authorizeOrganizations` — where that event is otherwise\n * emitted — runs only for ORGANIZATIONS-scoped resources and decides on ONE fetched row, so it\n * never sees this door at all. Grouping per tenant is what makes the crossing visible to the\n * REACHED tenant, in its own organization-scoped viewer, rather than only to the operator.\n * `.claude/rules/administrative-continuity-floors.md` requires every crossing to be named in the\n * trail, and the trail is the worst possible surface on which to make an operator read invisible.\n * See `security/authorizations/cross-tenant-read-observation.backend.ts` for why an UNDECLARED\n * door is deliberately not observed instead of being observed with a false `admissionDeclared`.\n \n ## Deliberately mirrored from the organization resource\n \n `isSystemResource`, `systemAccessPolicy.exportSubject: FORBIDDEN` and the ABSENCE of a\n * `retentionPolicy` are copied ON PURPOSE. They are properties of the ROWS, and the rows are the\n * same ones — a second door that disagreed about whether the audit trail is subject-exportable, or\n * about how long it is kept, would be a policy fork over one record set. See the organization\n * config for the reasoning behind each; do not change one without the other.\n \n ## Deliberately NOT mirrored\n \n There is no CREATE. The organization resource carries a `REPOSITORY_ONLY` CREATE because that is\n * how audit rows are written; writing is not a scope question and must keep exactly one door.\n /\nexport const applicationAuditLogsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<\n undefined,\n CoreResourceOperation.READ \| CoreResourceOperation.LIST \| CoreResourceOperation.SEARCH,\n typeof AuditableEvent_BaseSchema\n>({\n mainSchema: AuditableEvent_BaseSchema,\n resourceIdentifier: CoreResourceType.APPLICATION_AUDIT_LOGS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_AUDIT_LOGS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n /* Mirrored from the organization door — the same rows, so the same answer. Disclosing the monitoring trail to its own subject is self-defeating and out of Art. 20 scope. /\n systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n ],\n\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n /* APP_ADMIN_SUPER_ADMIN ONLY — never an organization role. The rows behind this door span every tenant. /\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n /\n Reading ONE tenant's audit row through the application door IS a crossing, so the cheapest\n * reach — fetch by id — is declared and audited exactly like the collection verbs. Declaring\n * it is also what stops `assignInitiatorOrganizationConfinementToFilter` silently narrowing\n * this door to an operator who happens to carry an ambient organization, which would make a\n * surface documented as spanning every tenant return one tenant and report success.\n /\n admitsCrossTenantPlatformAdministration: true,\n }],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n /* The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. /\n admitsCrossTenantPlatformAdministration: true,\n filterFields: {\n eventType: z.string(),\n eventCategory: z.enum(AuditEventCategory),\n severity: z.enum(AuditEventSeverity),\n userId: z.string(),\n /\n Filterable so an operator can narrow to one tenant THROUGH this door, which is the\n * cross-tenant investigation this surface exists for. It is a FILTER, never the isolation\n * boundary: isolation on this door is the role gate above, and narrowing to a tenant does\n * not make the read any less cross-tenant for audit purposes.\n /\n organizationId: z.string(),\n correlationId: z.string(),\n clientInstanceId: z.string(),\n createdAt: z.date(),\n },\n /* `eventId` last, as the keyset tie-breaker — `createdAt` is not unique under boot/seed bursts. Mirrors the organization door; removing it reintroduces a paging data-loss path. /\n sortFields: ['createdAt', 'severity', 'eventType', 'eventId'] as const,\n maxPaginatedResultPerPageLimit: 100,\n }],\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n /* The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. */\n admitsCrossTenantPlatformAdministration: true,\n isSearchable: false,\n searchableFields: [],\n filterFields: {\n eventType: z.string(),\n eventCategory: z.enum(AuditEventCategory),\n severity: z.enum(AuditEventSeverity),\n userId: z.string(),\n organizationId: z.string(),\n correlationId: z.string(),\n clientInstanceId: z.string(),\n createdAt: z.date(),\n },\n sortFields: ['createdAt', 'severity', 'eventType'] as const,\n maxPaginatedResultPerPageLimit: 100,\n }],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"application-audit-logs.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrH,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA8B,MAAM,CAAC,MAAM,CAAC;IACvF,cAAc,CAAC,qBAAqB;IACpC,cAAc,CAAC,yBAAyB;CACzC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAC7E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,8KAA8K;IAC9K,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C;;;;;;uBAMG;oBACH,uCAAuC,EAAE,IAAI;iBAC9C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,YAAY,EAAE;wBACZ,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB;;;;;2BAKG;wBACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,qLAAqL;oBACrL,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAU;oBACtE,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,mGAAmG;oBACnG,uCAAuC,EAAE,IAAI;oBAC7C,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,EAAE;oBACpB,YAAY,EAAE;wBACZ,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAU;oBAC3D,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { AuditEventCategory, AuditEventSeverity, AuditableEvent_BaseSchema } from './auditable-events.shared.schema';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\n\n/*\n The roles the application audit door's READ, LIST and SEARCH accept — ONE list, so the three verbs\n * cannot disagree about who may read the trail.\n \n `APP_ADMIN_SUPER_ADMIN` for the operator who investigates and then acts; `APP_AUDIT_EVIDENCE_READER`\n * for a party that must read and must NOT act — an assurance collector's machine credential, an\n * external auditor. Neither is an organization role: the rows behind this door span every tenant.\n /\nexport const APPLICATION_AUDIT_LOG_READ_ROLES: readonly CORE_APP_ROLES[] = Object.freeze([\n CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,\n CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER,\n]);\n\n/\n The APPLICATION-scoped door onto the audit trail.\n \n ## Why this exists at all\n \n `AUDIT_LOGS` is organization-scoped and its only route is\n * `/organizations/{organizationId}/audit-logs`, so it returns exactly the rows carrying that\n * tenant. A large share of security events carry NO organization by design — `logUserLogin` takes\n * `organizationId` as optional because no organization is selected at login, and the same is true\n * of session eviction, token refresh and application-wide authentication-policy changes. Measured\n * on a dogfood application (#317): 94 of 127 rows had no organization, and were reachable\n * through no API. An operator could see 26% of the trail and could not attest the rest, while a\n * reader querying the only available surface saw `user_login: 0` for a control that had emitted 21.\n \n ## Why a SEPARATE resource type rather than a second route\n \n `generateParentCombinations` composes every URL as\n * `[...primaryScope, ...mandatoryContext, ...optionalCombo]`, so a routed application edge on\n * `AUDIT_LOGS` would appear in EVERY combination and rewrite the organization route to\n * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` — breaking all eight of\n * its documented paths and their consumers. Making the organization edge optional does not help:\n * the empty combination is skipped whenever any parent exists, so no bare route is emitted either.\n * A sibling type carrying ONE application parent takes the route it needs and leaves the existing\n * door byte-identical. The pattern is the engine's own: notification badges are dual-scope with a\n * type per scope, `APPLICATION_API_KEYS` shows the application routing shape, and `USER_SELF`\n * shows a distinct type addressing another's rows.\n \n ## Two doors, ONE record set — the security contract\n \n Both types resolve to the `auditLogs` collection through\n * `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES`. That makes the isolation properties a\n * per-DOOR obligation rather than a property of the rows:\n \n - the organization door keeps its tenant filter and its organization roles, unchanged;\n * - this door accepts {@link APPLICATION_AUDIT_LOG_READ_ROLES} and nothing else — `APP_ADMIN_SUPER_ADMIN`\n * or the read-only `APP_AUDIT_EVIDENCE_READER`. An organization role must never reach it — the rows\n * behind it span every tenant;\n * - a read here that touches a tenant-attributed row is a CROSS-TENANT read and OWES an audit\n * emission. It is wired, by the two halves below acting together, and neither is optional:\n * each read variant declares `admitsCrossTenantPlatformAdministration`, and\n * `ServicesRegistryHandler.recordCrossTenantReadAccess` observes every enrolled read and emits\n * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` once per TENANT the returned rows belong to. The\n * declaration is what enrols the read: `authorizeOrganizations` — where that event is otherwise\n * emitted — runs only for ORGANIZATIONS-scoped resources and decides on ONE fetched row, so it\n * never sees this door at all. Grouping per tenant is what makes the crossing visible to the\n * REACHED tenant, in its own organization-scoped viewer, rather than only to the operator.\n * `.claude/rules/administrative-continuity-floors.md` requires every crossing to be named in the\n * trail, and the trail is the worst possible surface on which to make an operator read invisible.\n * See `security/authorizations/cross-tenant-read-observation.backend.ts` for why an UNDECLARED\n * door is deliberately not observed instead of being observed with a false `admissionDeclared`.\n \n ## Deliberately mirrored from the organization resource\n \n `isSystemResource`, `systemAccessPolicy.exportSubject: FORBIDDEN` and the ABSENCE of a\n * `retentionPolicy` are copied ON PURPOSE. They are properties of the ROWS, and the rows are the\n * same ones — a second door that disagreed about whether the audit trail is subject-exportable, or\n * about how long it is kept, would be a policy fork over one record set. See the organization\n * config for the reasoning behind each; do not change one without the other.\n \n ## Deliberately NOT mirrored\n \n There is no CREATE. The organization resource carries a `REPOSITORY_ONLY` CREATE because that is\n * how audit rows are written; writing is not a scope question and must keep exactly one door.\n /\nexport const applicationAuditLogsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<\n undefined,\n CoreResourceOperation.READ \| CoreResourceOperation.LIST \| CoreResourceOperation.SEARCH,\n typeof AuditableEvent_BaseSchema\n>({\n mainSchema: AuditableEvent_BaseSchema,\n resourceIdentifier: CoreResourceType.APPLICATION_AUDIT_LOGS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_AUDIT_LOGS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n /* Mirrored from the organization door — the same rows, so the same answer. Disclosing the monitoring trail to its own subject is self-defeating and out of Art. 20 scope. /\n systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n ],\n\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n /\n Reading ONE tenant's audit row through the application door IS a crossing, so the cheapest\n * reach — fetch by id — is declared and audited exactly like the collection verbs. Declaring\n * it is also what stops `assignInitiatorOrganizationConfinementToFilter` silently narrowing\n * this door to an operator who happens to carry an ambient organization, which would make a\n * surface documented as spanning every tenant return one tenant and report success.\n /\n admitsCrossTenantPlatformAdministration: true,\n }],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n /* The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. /\n admitsCrossTenantPlatformAdministration: true,\n filterFields: {\n applicationId: z.string(),\n eventType: z.string(),\n eventCategory: z.enum(AuditEventCategory),\n severity: z.enum(AuditEventSeverity),\n userId: z.string(),\n /\n Filterable so an operator can narrow to one tenant THROUGH this door, which is the\n * cross-tenant investigation this surface exists for. It is a FILTER, never the isolation\n * boundary: isolation on this door is the role gate above, and narrowing to a tenant does\n * not make the read any less cross-tenant for audit purposes.\n /\n organizationId: z.string(),\n correlationId: z.string(),\n clientInstanceId: z.string(),\n createdAt: z.date(),\n },\n /* `eventId` last, as the keyset tie-breaker — `createdAt` is not unique under boot/seed bursts. Mirrors the organization door; removing it reintroduces a paging data-loss path. /\n sortFields: ['createdAt', 'severity', 'eventType', 'eventId'] as const,\n maxPaginatedResultPerPageLimit: 100,\n }],\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n /* The declared crossing — see READ. Every enrolled read emits one crossing per tenant reached. */\n admitsCrossTenantPlatformAdministration: true,\n isSearchable: true,\n searchableFields: [],\n filterFields: {\n applicationId: z.string(),\n eventType: z.string(),\n eventCategory: z.enum(AuditEventCategory),\n severity: z.enum(AuditEventSeverity),\n userId: z.string(),\n organizationId: z.string(),\n correlationId: z.string(),\n clientInstanceId: z.string(),\n createdAt: z.date(),\n },\n sortFields: ['createdAt', 'severity', 'eventType'] as const,\n maxPaginatedResultPerPageLimit: 100,\n }],\n },\n },\n});\n"]}