npm - @wildo-ai/saas-models - Versions diffs - 1.1.3 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.3 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (890) hide show

package/dist/esm/notifications/email/email-template-registry.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"email-template-registry.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/email/email-template-registry.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAEvC,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,sBAoBX;AApBD,WAAY,sBAAsB;IAChC,iEAAiE;IACjE,gEAAsC,CAAA;IACtC,kEAAwC,CAAA;IACxC,0EAAgD,CAAA;IAChD,wDAA8B,CAAA;IAC9B,0DAAgC,CAAA;IAEhC,iEAAiE;IACjE,oFAA0D,CAAA;IAC1D,4FAAkE,CAAA;IAElE,iEAAiE;IACjE,wFAA8D,CAAA;IAC9D,kFAAwD,CAAA;IACxD,kEAAwC,CAAA;IAExC,iEAAiE;IACjE,kEAAwC,CAAA;IACxC,sEAA4C,CAAA;AAC9C,CAAC,EApBW,sBAAsB,KAAtB,sBAAsB,QAoBjC;AA2CD,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,wCAAwC;AACxC,MAAM,CAAC,MAAM,2BAA2B,GAAkE;IACxG,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,aAAa;QACjD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SAClB,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE;QACvC,WAAW,EAAE,sBAAsB,CAAC,cAAc;QAClD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;YACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC9C,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE;QAC3C,WAAW,EAAE,sBAAsB,CAAC,kBAAkB;QACtD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;YAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;SACvD,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE;QAClC,WAAW,EAAE,sBAAsB,CAAC,SAAS;QAC7C,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC9C,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;QACnC,WAAW,EAAE,sBAAsB,CAAC,UAAU;QAC9C,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC9C,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE;QAChD,WAAW,EAAE,sBAAsB,CAAC,uBAAuB;QAC3D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,YAAY;QACtC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;YAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC3C,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE;QACpD,WAAW,EAAE,sBAAsB,CAAC,2BAA2B;QAC/D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,YAAY;QACtC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE;QAClD,WAAW,EAAE,sBAAsB,CAAC,yBAAyB;QAC7D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC5C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAChC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE;SACtB,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE;QAC/C,WAAW,EAAE,sBAAsB,CAAC,sBAAsB;QAC1D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC9B,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE;QACvC,WAAW,EAAE,sBAAsB,CAAC,cAAc;QAClD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC1B,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;SAC1B,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE;QACvC,WAAW,EAAE,sBAAsB,CAAC,cAAc;QAClD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YACnG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE;SAC7B,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE;QACzC,WAAW,EAAE,sBAAsB,CAAC,gBAAgB;QACpD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC1B,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE;SACzB,CAAC;KACH;CACF,CAAC;AAEF,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,oCAAoC;AACpC,MAAM,UAAU,wBAAwB;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAC/C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,2BAA2B,CAAC,GAA2B;IACrE,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,OAAO,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,WAAqC,CAAC,CAAC;AAC1F,CAAC","sourcesContent":["/*\n System Email Template Registry\n \n Runtime identity contract for system-level (non-resource-attached) email\n * templates. Carries only mechanical information: `templateRef`, routing\n * classifications (`type`, `frequency`, `scope`), and the Zod schema for the\n * event payload.\n \n *All human-readable / spec-oriented content (purpose prose, tone, text\n slots, event-data field narration) lives in\n * `@wildo-ai/saas-specifications`** — specifically in\n * `SystemEmailTemplateSpecificationConfig` under\n * `src/engine/notifications/system-emails/`. The runtime registry must stay\n * free of i18n/spec prose so the companion translation/transposition\n * pipeline owns the single source of truth for authored semantics.\n /\n\nimport { z } from 'zod';\nimport {\n EmailTemplateType,\n EmailTemplateFrequency,\n EmailTemplateScope,\n} from './email-template.shared.enums';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SYSTEM EMAIL TEMPLATE REF ENUM\n// ─────────────────────────────────────────────────────────────────────────────\n\n/\n System email template registry — non-resource related.\n * Uses dot notation for namespacing (`system.`).\n /\nexport enum SystemEmailTemplateRef {\n // ─── Authentication ───────────────────────────────────────────\n WELCOME_EMAIL = \"system.welcome_email\",\n PASSWORD_RESET = \"system.password_reset\",\n EMAIL_VERIFICATION = \"system.email_verification\",\n EMAIL_OTP = \"system.email_otp\",\n MAGIC_LINK = \"system.magic_link\",\n\n // ─── Organization ─────────────────────────────────────────────\n ORGANIZATION_INVITATION = \"system.organization_invitation\",\n ORGANIZATION_MEMBER_REMOVED = \"system.organization_member_removed\",\n\n // ─── Subscription & Billing ───────────────────────────────────\n SUBSCRIPTION_CONFIRMATION = \"system.subscription_confirmation\",\n SUBSCRIPTION_CANCELLED = \"system.subscription_cancelled\",\n PAYMENT_FAILED = \"system.payment_failed\",\n\n // ─── Security ─────────────────────────────────────────────────\n SECURITY_ALERT = \"system.security_alert\",\n NEW_DEVICE_LOGIN = \"system.new_device_login\",\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SYSTEM TEMPLATE DEFINITION INTERFACE\n// ─────────────────────────────────────────────────────────────────────────────\n\n/*\n Runtime identity for a system email template.\n \n System templates use the same context structure as resource-based templates:\n * - `objectContext`: contains `primaryScopeContext` (appName, organizationName, etc.)\n * - `userContext`: recipient info (email, name, preferences) — changes per recipient\n * - `eventData`: system-event-specific payload (replaces `currentObject` for\n * non-resource emails).\n \n ⚠️ Nothing parses a send against `eventDataSchema`. The payload travels in the untyped\n * `additionalContext` slot of the send request and each template casts it, so a misspelled or\n * missing field renders as empty text rather than being refused. Treat the schema below as the\n * DOCUMENTED shape a caller is expected to supply, not as a check that it did.\n /\nexport interface SystemEmailTemplateDefinition {\n /* Unique template reference. /\n templateRef: SystemEmailTemplateRef;\n /* Email type for provider routing. /\n type: EmailTemplateType;\n /* Frequency for lifecycle management. /\n frequency: EmailTemplateFrequency;\n /* Scope for header/footer behavior. /\n scope: EmailTemplateScope;\n /\n Zod schema DOCUMENTING the event-specific payload (`eventData`).\n \n This is the system-event payload, NOT a flattened input DTO.\n * Common fields (appName, recipientEmail) come from\n * `objectContext` / `userContext`.\n \n It is declarative: no send path parses against it. Keep it accurate anyway, because it is the\n * only statement of what a template needs, and a caller that disagrees with it produces a blank\n * region in the rendered email instead of an error.\n /\n eventDataSchema: z.ZodType<unknown>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SYSTEM TEMPLATE REGISTRY\n// ─────────────────────────────────────────────────────────────────────────────\n\n/* Registry of all system templates. /\nexport const SystemEmailTemplateRegistry: Record<SystemEmailTemplateRef, SystemEmailTemplateDefinition> = {\n [SystemEmailTemplateRef.WELCOME_EMAIL]: {\n templateRef: SystemEmailTemplateRef.WELCOME_EMAIL,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n loginUrl: z.url(),\n }),\n },\n\n [SystemEmailTemplateRef.PASSWORD_RESET]: {\n templateRef: SystemEmailTemplateRef.PASSWORD_RESET,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n resetUrl: z.url(),\n expiresInMinutes: z.number().int().positive(),\n }),\n },\n\n [SystemEmailTemplateRef.EMAIL_VERIFICATION]: {\n templateRef: SystemEmailTemplateRef.EMAIL_VERIFICATION,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n verifyUrl: z.url(),\n expiresInHours: z.number().int().positive().optional(),\n }),\n },\n\n [SystemEmailTemplateRef.EMAIL_OTP]: {\n templateRef: SystemEmailTemplateRef.EMAIL_OTP,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n otpCode: z.string().min(4).max(8),\n expiresInMinutes: z.number().int().positive(),\n }),\n },\n\n [SystemEmailTemplateRef.MAGIC_LINK]: {\n templateRef: SystemEmailTemplateRef.MAGIC_LINK,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n magicLinkUrl: z.url(),\n tokenValue: z.string(),\n expiresInMinutes: z.number().int().positive(),\n }),\n },\n\n [SystemEmailTemplateRef.ORGANIZATION_INVITATION]: {\n templateRef: SystemEmailTemplateRef.ORGANIZATION_INVITATION,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.ORGANIZATION,\n eventDataSchema: z.object({\n inviterName: z.string(),\n organizationName: z.string(),\n role: z.string(),\n acceptUrl: z.url(),\n expiresInDays: z.number().int().positive(),\n }),\n },\n\n [SystemEmailTemplateRef.ORGANIZATION_MEMBER_REMOVED]: {\n templateRef: SystemEmailTemplateRef.ORGANIZATION_MEMBER_REMOVED,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.ORGANIZATION,\n eventDataSchema: z.object({\n organizationName: z.string(),\n removedByName: z.string().optional(),\n reason: z.string().optional(),\n }),\n },\n\n [SystemEmailTemplateRef.SUBSCRIPTION_CONFIRMATION]: {\n templateRef: SystemEmailTemplateRef.SUBSCRIPTION_CONFIRMATION,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n planName: z.string(),\n amount: z.number().positive(),\n currency: z.string().length(3),\n billingPeriod: z.enum(['monthly', 'yearly']),\n nextBillingDate: z.coerce.date(),\n dashboardUrl: z.url(),\n }),\n },\n\n [SystemEmailTemplateRef.SUBSCRIPTION_CANCELLED]: {\n templateRef: SystemEmailTemplateRef.SUBSCRIPTION_CANCELLED,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n planName: z.string(),\n effectiveDate: z.coerce.date(),\n reactivateUrl: z.url().optional(),\n }),\n },\n\n [SystemEmailTemplateRef.PAYMENT_FAILED]: {\n templateRef: SystemEmailTemplateRef.PAYMENT_FAILED,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n amount: z.number().positive(),\n currency: z.string().length(3),\n lastFourDigits: z.string().length(4),\n retryDate: z.coerce.date(),\n updatePaymentUrl: z.url(),\n }),\n },\n\n [SystemEmailTemplateRef.SECURITY_ALERT]: {\n templateRef: SystemEmailTemplateRef.SECURITY_ALERT,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n alertType: z.enum(['suspicious_login', 'password_changed', 'mfa_disabled', 'new_api_key', 'other']),\n description: z.string(),\n timestamp: z.coerce.date(),\n ipAddress: z.string().optional(),\n location: z.string().optional(),\n securitySettingsUrl: z.url(),\n }),\n },\n\n [SystemEmailTemplateRef.NEW_DEVICE_LOGIN]: {\n templateRef: SystemEmailTemplateRef.NEW_DEVICE_LOGIN,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n deviceType: z.string(),\n browser: z.string(),\n operatingSystem: z.string(),\n ipAddress: z.string(),\n location: z.string().optional(),\n loginTime: z.coerce.date(),\n revokeAccessUrl: z.url(),\n }),\n },\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// HELPER FUNCTIONS\n// ─────────────────────────────────────────────────────────────────────────────\n\n/* Get all system template refs. /\nexport function getAllSystemTemplateRefs(): SystemEmailTemplateRef[] {\n return Object.values(SystemEmailTemplateRef);\n}\n\n/* Get system template definition by ref. /\nexport function getSystemTemplateDefinition(ref: SystemEmailTemplateRef): SystemEmailTemplateDefinition {\n return SystemEmailTemplateRegistry[ref];\n}\n\n/* Check if a templateRef is a system template. */\nexport function isSystemTemplateRef(templateRef: string): templateRef is SystemEmailTemplateRef {\n return templateRef.startsWith('system.') &&\n Object.values(SystemEmailTemplateRef).includes(templateRef as SystemEmailTemplateRef);\n}\n"]}
1	+ {"version":3,"file":"email-template-registry.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/email/email-template-registry.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAE1F,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,sBAoBX;AApBD,WAAY,sBAAsB;IAChC,iEAAiE;IACjE,gEAAsC,CAAA;IACtC,kEAAwC,CAAA;IACxC,0EAAgD,CAAA;IAChD,wDAA8B,CAAA;IAC9B,0DAAgC,CAAA;IAEhC,iEAAiE;IACjE,oFAA0D,CAAA;IAC1D,4FAAkE,CAAA;IAElE,iEAAiE;IACjE,wFAA8D,CAAA;IAC9D,kFAAwD,CAAA;IACxD,kEAAwC,CAAA;IAExC,iEAAiE;IACjE,kEAAwC,CAAA;IACxC,sEAA4C,CAAA;AAC9C,CAAC,EApBW,sBAAsB,KAAtB,sBAAsB,QAoBjC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBA4BX;AA5BD,WAAY,iBAAiB;IAC3B,0DAAqC,CAAA;IACrC,0DAAqC,CAAA;IACrC,kDAA6B,CAAA;IAC7B,gDAA2B,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,gEAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,oEAA+C,CAAA;IAC/C,oCAAe,CAAA;AACjB,CAAC,EA5BW,iBAAiB,KAAjB,iBAAiB,QA4B5B;AA2CD,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,wCAAwC;AACxC,MAAM,CAAC,MAAM,2BAA2B,GAAkE;IACxG,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,aAAa;QACjD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SAClB,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE;QACvC,WAAW,EAAE,sBAAsB,CAAC,cAAc;QAClD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;YACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC9C,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE;QAC3C,WAAW,EAAE,sBAAsB,CAAC,kBAAkB;QACtD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;YAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;SACvD,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE;QAClC,WAAW,EAAE,sBAAsB,CAAC,SAAS;QAC7C,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC9C,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;QACnC,WAAW,EAAE,sBAAsB,CAAC,UAAU;QAC9C,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC9C,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE;QAChD,WAAW,EAAE,sBAAsB,CAAC,uBAAuB;QAC3D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,YAAY;QACtC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;YAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC3C,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE;QACpD,WAAW,EAAE,sBAAsB,CAAC,2BAA2B;QAC/D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,YAAY;QACtC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE;QAClD,WAAW,EAAE,sBAAsB,CAAC,yBAAyB;QAC7D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC5C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAChC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE;SACtB,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE;QAC/C,WAAW,EAAE,sBAAsB,CAAC,sBAAsB;QAC1D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC9B,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE;QACvC,WAAW,EAAE,sBAAsB,CAAC,cAAc;QAClD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC1B,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;SAC1B,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE;QACvC,WAAW,EAAE,sBAAsB,CAAC,cAAc;QAClD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;YACpC;;;;eAIG;YACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;YACzC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B;;;eAGG;YACH,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SACxC,CAAC;KACH;IAED,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE;QACzC,WAAW,EAAE,sBAAsB,CAAC,gBAAgB;QACpD,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,KAAK,EAAE,kBAAkB,CAAC,WAAW;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC1B,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE;SACzB,CAAC;KACH;CACF,CAAC;AAEF,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,oCAAoC;AACpC,MAAM,UAAU,wBAAwB;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAC/C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,2BAA2B,CAAC,GAA2B;IACrE,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,OAAO,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,WAAqC,CAAC,CAAC;AAC1F,CAAC","sourcesContent":["/*\n System Email Template Registry\n \n Runtime identity contract for system-level (non-resource-attached) email\n * templates. Carries only mechanical information: `templateRef`, routing\n * classifications (`type`, `frequency`, `scope`), and the Zod schema for the\n * event payload.\n \n *All human-readable / spec-oriented content (purpose prose, tone, text\n slots, event-data field narration) lives in\n * `@wildo-ai/saas-specifications`** — specifically in\n * `SystemEmailTemplateSpecificationConfig` under\n * `src/engine/notifications/system-emails/`. The runtime registry must stay\n * free of i18n/spec prose so the companion translation/transposition\n * pipeline owns the single source of truth for authored semantics.\n /\n\nimport { z } from 'zod';\nimport {\n EmailTemplateType,\n EmailTemplateFrequency,\n EmailTemplateScope,\n} from './email-template.shared.enums';\nimport { AuthMethod } from '../../security/authentications/authentication.shared.schemas';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SYSTEM EMAIL TEMPLATE REF ENUM\n// ─────────────────────────────────────────────────────────────────────────────\n\n/\n System email template registry — non-resource related.\n * Uses dot notation for namespacing (`system.`).\n /\nexport enum SystemEmailTemplateRef {\n // ─── Authentication ───────────────────────────────────────────\n WELCOME_EMAIL = \"system.welcome_email\",\n PASSWORD_RESET = \"system.password_reset\",\n EMAIL_VERIFICATION = \"system.email_verification\",\n EMAIL_OTP = \"system.email_otp\",\n MAGIC_LINK = \"system.magic_link\",\n\n // ─── Organization ─────────────────────────────────────────────\n ORGANIZATION_INVITATION = \"system.organization_invitation\",\n ORGANIZATION_MEMBER_REMOVED = \"system.organization_member_removed\",\n\n // ─── Subscription & Billing ───────────────────────────────────\n SUBSCRIPTION_CONFIRMATION = \"system.subscription_confirmation\",\n SUBSCRIPTION_CANCELLED = \"system.subscription_cancelled\",\n PAYMENT_FAILED = \"system.payment_failed\",\n\n // ─── Security ─────────────────────────────────────────────────\n SECURITY_ALERT = \"system.security_alert\",\n NEW_DEVICE_LOGIN = \"system.new_device_login\",\n}\n\n/*\n What happened, in a `SystemEmailTemplateRef.SECURITY_ALERT` email.\n \n One named vocabulary so each member can carry its own authored WORDS in the template's labels —\n * the template used to turn the wire value into text by swapping its underscores for spaces, which produced\n * \"authenticator added\" in English for every locale and could not be worded by anyone.\n /\nexport enum SecurityAlertType {\n SUSPICIOUS_LOGIN = 'suspicious_login',\n PASSWORD_CHANGED = 'password_changed',\n MFA_DISABLED = 'mfa_disabled',\n NEW_API_KEY = 'new_api_key',\n /\n An authenticator was bound to the account: a passkey registered, TOTP confirmed, a phone\n * confirmed, a password set, or a sign-in identity linked (a social account auto-linked by its\n * verified email, or an enterprise identity linked to an existing account). Sent on every successful\n * binding, to the account's email — a channel independent of the\n * browser session that did the binding, which is what NIST SP 800-63B-4 Sec. 4.1.2.1 requires: \"When\n * an authenticator is added, the CSP SHALL notify the subscriber via a mechanism independent of the\n * transaction binding the new authenticator\".\n * spec-cite: NIST SP 800-63B-4 Sec. 4.1.2.1, fetched 2026-09-21 from\n * https://pages.nist.gov/800-63-4/sp800-63b/events/\n /\n AUTHENTICATOR_ADDED = 'authenticator_added',\n /\n A way to sign in was removed by the account holder: a passkey removed or a linked identity\n * unlinked. Turning TOTP off is `MFA_DISABLED`, which names the stronger consequence. NIST SP\n * 800-63B-4 Sec. 4.5: \"The CSP SHOULD notify the subscriber when an authenticator is invalidated\".\n * Removal is where a stolen session quietly takes a way in AWAY from the account holder, so the email\n * is how they find out.\n * spec-cite: NIST SP 800-63B-4 Sec. 4.5, fetched 2026-09-21 from\n * https://pages.nist.gov/800-63-4/sp800-63b/events/\n /\n AUTHENTICATOR_REMOVED = 'authenticator_removed',\n OTHER = 'other',\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SYSTEM TEMPLATE DEFINITION INTERFACE\n// ─────────────────────────────────────────────────────────────────────────────\n\n/\n Runtime identity for a system email template.\n \n System templates use the same context structure as resource-based templates:\n * - `objectContext`: contains `primaryScopeContext` (appName, organizationName, etc.)\n * - `userContext`: recipient info (email, name, preferences) — changes per recipient\n * - `eventData`: system-event-specific payload (replaces `currentObject` for\n * non-resource emails).\n \n ⚠️ Nothing parses a send against `eventDataSchema`. The payload travels in the untyped\n * `additionalContext` slot of the send request and each template casts it, so a misspelled or\n * missing field renders as empty text rather than being refused. Treat the schema below as the\n * DOCUMENTED shape a caller is expected to supply, not as a check that it did.\n /\nexport interface SystemEmailTemplateDefinition {\n /* Unique template reference. /\n templateRef: SystemEmailTemplateRef;\n /* Email type for provider routing. /\n type: EmailTemplateType;\n /* Frequency for lifecycle management. /\n frequency: EmailTemplateFrequency;\n /* Scope for header/footer behavior. /\n scope: EmailTemplateScope;\n /\n Zod schema DOCUMENTING the event-specific payload (`eventData`).\n \n This is the system-event payload, NOT a flattened input DTO.\n * Common fields (appName, recipientEmail) come from\n * `objectContext` / `userContext`.\n \n It is declarative: no send path parses against it. Keep it accurate anyway, because it is the\n * only statement of what a template needs, and a caller that disagrees with it produces a blank\n * region in the rendered email instead of an error.\n /\n eventDataSchema: z.ZodType<unknown>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SYSTEM TEMPLATE REGISTRY\n// ─────────────────────────────────────────────────────────────────────────────\n\n/* Registry of all system templates. /\nexport const SystemEmailTemplateRegistry: Record<SystemEmailTemplateRef, SystemEmailTemplateDefinition> = {\n [SystemEmailTemplateRef.WELCOME_EMAIL]: {\n templateRef: SystemEmailTemplateRef.WELCOME_EMAIL,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n loginUrl: z.url(),\n }),\n },\n\n [SystemEmailTemplateRef.PASSWORD_RESET]: {\n templateRef: SystemEmailTemplateRef.PASSWORD_RESET,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n resetUrl: z.url(),\n expiresInMinutes: z.number().int().positive(),\n }),\n },\n\n [SystemEmailTemplateRef.EMAIL_VERIFICATION]: {\n templateRef: SystemEmailTemplateRef.EMAIL_VERIFICATION,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n verifyUrl: z.url(),\n expiresInHours: z.number().int().positive().optional(),\n }),\n },\n\n [SystemEmailTemplateRef.EMAIL_OTP]: {\n templateRef: SystemEmailTemplateRef.EMAIL_OTP,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n otpCode: z.string().min(4).max(8),\n expiresInMinutes: z.number().int().positive(),\n }),\n },\n\n [SystemEmailTemplateRef.MAGIC_LINK]: {\n templateRef: SystemEmailTemplateRef.MAGIC_LINK,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n magicLinkUrl: z.url(),\n tokenValue: z.string(),\n expiresInMinutes: z.number().int().positive(),\n }),\n },\n\n [SystemEmailTemplateRef.ORGANIZATION_INVITATION]: {\n templateRef: SystemEmailTemplateRef.ORGANIZATION_INVITATION,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.ORGANIZATION,\n eventDataSchema: z.object({\n inviterName: z.string(),\n organizationName: z.string(),\n role: z.string(),\n acceptUrl: z.url(),\n expiresInDays: z.number().int().positive(),\n }),\n },\n\n [SystemEmailTemplateRef.ORGANIZATION_MEMBER_REMOVED]: {\n templateRef: SystemEmailTemplateRef.ORGANIZATION_MEMBER_REMOVED,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.ORGANIZATION,\n eventDataSchema: z.object({\n organizationName: z.string(),\n removedByName: z.string().optional(),\n reason: z.string().optional(),\n }),\n },\n\n [SystemEmailTemplateRef.SUBSCRIPTION_CONFIRMATION]: {\n templateRef: SystemEmailTemplateRef.SUBSCRIPTION_CONFIRMATION,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n planName: z.string(),\n amount: z.number().positive(),\n currency: z.string().length(3),\n billingPeriod: z.enum(['monthly', 'yearly']),\n nextBillingDate: z.coerce.date(),\n dashboardUrl: z.url(),\n }),\n },\n\n [SystemEmailTemplateRef.SUBSCRIPTION_CANCELLED]: {\n templateRef: SystemEmailTemplateRef.SUBSCRIPTION_CANCELLED,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n planName: z.string(),\n effectiveDate: z.coerce.date(),\n reactivateUrl: z.url().optional(),\n }),\n },\n\n [SystemEmailTemplateRef.PAYMENT_FAILED]: {\n templateRef: SystemEmailTemplateRef.PAYMENT_FAILED,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n amount: z.number().positive(),\n currency: z.string().length(3),\n lastFourDigits: z.string().length(4),\n retryDate: z.coerce.date(),\n updatePaymentUrl: z.url(),\n }),\n },\n\n [SystemEmailTemplateRef.SECURITY_ALERT]: {\n templateRef: SystemEmailTemplateRef.SECURITY_ALERT,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n alertType: z.enum(SecurityAlertType),\n /\n Which authenticator was added, for `AUTHENTICATOR_ADDED`. There is no free-text description\n * any more: the words for each alert come from the template's labels, so they can be translated\n * and worded by whoever owns the copy. A caller-written sentence could be neither.\n /\n authMethod: z.enum(AuthMethod).optional(),\n timestamp: z.coerce.date(),\n ipAddress: z.string().optional(),\n location: z.string().optional(),\n /\n Optional: the notification matters more than the link, so it is still sent when the frontend\n * the request came from cannot be resolved.\n /\n securitySettingsUrl: z.url().optional(),\n }),\n },\n\n [SystemEmailTemplateRef.NEW_DEVICE_LOGIN]: {\n templateRef: SystemEmailTemplateRef.NEW_DEVICE_LOGIN,\n type: EmailTemplateType.TRANSACTIONAL,\n frequency: EmailTemplateFrequency.RECURRENT,\n scope: EmailTemplateScope.APPLICATION,\n eventDataSchema: z.object({\n deviceType: z.string(),\n browser: z.string(),\n operatingSystem: z.string(),\n ipAddress: z.string(),\n location: z.string().optional(),\n loginTime: z.coerce.date(),\n revokeAccessUrl: z.url(),\n }),\n },\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// HELPER FUNCTIONS\n// ─────────────────────────────────────────────────────────────────────────────\n\n/* Get all system template refs. /\nexport function getAllSystemTemplateRefs(): SystemEmailTemplateRef[] {\n return Object.values(SystemEmailTemplateRef);\n}\n\n/* Get system template definition by ref. /\nexport function getSystemTemplateDefinition(ref: SystemEmailTemplateRef): SystemEmailTemplateDefinition {\n return SystemEmailTemplateRegistry[ref];\n}\n\n/* Check if a templateRef is a system template. */\nexport function isSystemTemplateRef(templateRef: string): templateRef is SystemEmailTemplateRef {\n return templateRef.startsWith('system.') &&\n Object.values(SystemEmailTemplateRef).includes(templateRef as SystemEmailTemplateRef);\n}\n"]}

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"m2m-webhook-delivery-log.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EAEtB,MAAM,mDAAmD,CAAC;~~AAiB3D~~,oBAAY,gCAAgC;IAC1C,wFAAwF;IACxF,KAAK,UAAU;IACf,0EAA0E;IAC1E,SAAS,aAAa;CACvB;AAMD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,iCAAqB,CAAC;AAExE,eAAO,MAAM,wCAAwC;;iBAGnD,CAAC;AAMH,eAAO,MAAM,yCAAyC,~~oVA+KrD~~,CAAC"}
1	+ {"version":3,"file":"m2m-webhook-delivery-log.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EAEtB,MAAM,mDAAmD,CAAC;AAkB3D,oBAAY,gCAAgC;IAC1C,wFAAwF;IACxF,KAAK,UAAU;IACf,0EAA0E;IAC1E,SAAS,aAAa;CACvB;AAMD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,iCAAqB,CAAC;AAExE,eAAO,MAAM,wCAAwC;;iBAGnD,CAAC;AAMH,eAAO,MAAM,yCAAyC,oVAkLrD,CAAC"}

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.js CHANGED Viewed

@@ -24,7 +24,7 @@
  */
 import { z } from 'zod';
 import { CoreResourceOperation, CoreResourceType, } from '../../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourceOperationVariantType, } from '../../resources/resources.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../../resources/utils/resource-polymorphism.factory.js';
 import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas.js';
 import { CoreM2MNotificationChannel } from '../notifications.shared.schemas.js';
@@ -208,6 +208,9 @@ export const m2mWebhookDeliveryLogPolymorphicFactories = createPolymorphicResour
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // IRREVERSIBLE: Deletes delivery-log rows outright. Nothing retains them afterwards.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): purging
                     // rows older than `olderThanDays` acts on the whole scope, so it needs a
                     // collection route (`…/m2m-webhook-delivery-log/purge-old`, no `:id`) —

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"m2m-webhook-delivery-log.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,2CAA2C,EAC3C,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAN,IAAY,gCAKX;AALD,WAAY,gCAAgC;IAC1C,wFAAwF;IACxF,mDAAe,CAAA;IACf,0EAA0E;IAC1E,0DAAsB,CAAA;AACxB,CAAC,EALW,gCAAgC,KAAhC,gCAAgC,QAK3C;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACpD,CAAC,CAAC;AAEH,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,yCAAyC,GAAG,uCAAuC,CAC9F,2CAA2C,EAC3C;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,gCAAgC;IACjD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qEAAqE;QACrE,4DAA4D;QAC5D,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,eAAe,CAAC;oBAC9F,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;wBAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;wBACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAU;iBAC7D;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,sDAAsD;QACtD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,mEAAmE;QACnE,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,qCAAqC;iBAClD;aACF;SACF;QACD,CAAC,gCAAgC,CAAC,SAAS,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,uEAAuE;oBACvE,yEAAyE;oBACzE,wEAAwE;oBACxE,yEAAyE;oBACzE,yEAAyE;oBACzE,mEAAmE;oBACnE,yEAAyE;oBACzE,gFAAgF;oBAChF,0EAA0E;oBAC1E,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,wCAAwC;oBACpD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;qBACpB,CAAC;iBACH;aACF;SACF;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n M2M Webhook Delivery Log Resource Configuration — Polymorphic dual-scope\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...m2mWebhookDeliveryLogPolymorphicFactories\n \n Operation set (per Plan §D3 / Step 5):\n * - READ (API) : admin views a single delivery row\n * - LIST (API) : admin browses recent deliveries\n * - SEARCH (API) : admin filters deliveries (status / endpoint / date)\n * - CREATE (REPOSITORY_ONLY) : dispatcher-only — never externally callable\n * - DELETE (REPOSITORY_ONLY) : reserved for `PURGE_OLD` bulk path; no\n * external single-row delete to keep the\n * audit trail stable\n * - RETRY (custom, API) : re-enqueue a `FAILED` row (mirrors\n * SIEM DLQ `RETRY_SINGLE`)\n * - PURGE_OLD (custom, API) : delete `DELIVERED`/`FAILED` rows older\n * than N days (mirrors SIEM DLQ\n * `PURGE_ALL` but date-bounded)\n \n @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5\n * @see security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts\n /\n\nimport { z } from 'zod';\nimport {\n CoreResourceOperation,\n CoreResourceType,\n} from '../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { CoreM2MNotificationChannel } from '../notifications.shared.schemas';\nimport {\n m2mWebhookDeliveryLogPolymorphicDeclaration,\n M2MWebhookDeliveryLogStatus,\n} from './m2m-webhook-delivery-log.shared.schemas';\n\n// =============================================================================\n// CUSTOM OPERATIONS\n// =============================================================================\n\nexport enum M2MWebhookDeliveryLog_Operations {\n /* Re-enqueue a single `FAILED` row (resets `status → PENDING`, `attemptCount → 0`). /\n RETRY = 'retry',\n /* Bulk delete `DELIVERED` / `FAILED` rows older than `olderThanDays`. /\n PURGE_OLD = 'purgeOld',\n}\n\n// =============================================================================\n// REQUEST DTOs\n// =============================================================================\n\n/\n RETRY addresses exactly one delivery row through the route path. Keeping the\n * body empty prevents two independently supplied ids from disagreeing; the\n * backend custom implementation uses the framework-resolved entity id.\n /\nexport const M2MWebhookDeliveryLog_RetryRequestDto = z.strictObject({});\n\nexport const M2MWebhookDeliveryLog_PurgeOldRequestDto = z.object({\n /* Rows whose `createdAt` is older than `now() - olderThanDays` are eligible. */\n olderThanDays: z.number().int().positive().max(365),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY\n// =============================================================================\n\nexport const m2mWebhookDeliveryLogPolymorphicFactories = createPolymorphicResourceConfigurations(\n m2mWebhookDeliveryLogPolymorphicDeclaration,\n {\n isSystemResource: true,\n customOperation: M2MWebhookDeliveryLog_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n // UPDATE is the delivery lifecycle: the dispatcher/worker drives the\n // PENDING → IN_FLIGHT → DELIVERED/FAILED status transitions\n // (markInFlight / markDelivered / markFailedAttempt / markFinallyFailed)\n // through the generic `repository.update`, which requires a DEFAULT UPDATE\n // operation. REPOSITORY_ONLY like CREATE — never a public HTTP surface\n // (admins act via the RETRY custom operation, which owns request/response).\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.DELETE_MANY,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['endpointId', 'resourceIdentifier', 'operationIdentifier', 'failureReason'],\n filterFields: {\n status: z.enum(M2MWebhookDeliveryLogStatus),\n channel: z.enum(CoreM2MNotificationChannel),\n endpointId: z.string(),\n createdAt: z.date(),\n },\n sortFields: ['createdAt', 'status', 'attemptCount'] as const,\n },\n ],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n // Delivery-lifecycle status transitions (dispatcher/worker only). Mirrors\n // CREATE: REPOSITORY_ONLY default so `repository.update` resolves a default\n // UPDATE op; never exposed as a public HTTP mutation.\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n },\n ],\n },\n // Bulk twin of DELETE — the actual `PURGE_OLD` write path: the custom impl\n // routes through the repository's `deleteMany` (which requires a default\n // DELETE_MANY operation) to drop terminal DELIVERED/FAILED rows older\n // than the requested retention window in one round trip. REPOSITORY_ONLY:\n // never a public HTTP surface — admins purge via the PURGE_OLD custom\n // operation, which owns the request validation + response summary.\n [CoreResourceOperation.DELETE_MANY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n },\n ],\n },\n [M2MWebhookDeliveryLog_Operations.RETRY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: M2MWebhookDeliveryLog_RetryRequestDto,\n },\n ],\n },\n [M2MWebhookDeliveryLog_Operations.PURGE_OLD]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): purging\n // rows older than `olderThanDays` acts on the whole scope, so it needs a\n // collection route (`…/m2m-webhook-delivery-log/purge-old`, no `:id`) —\n // a scope-level maintenance action has no single row to address. Mirrors\n // SIEM DLQ `PURGE_ALL`. `isBulkOperation` stays unset (collection-level,\n // not a selection bulk). Returns a purge summary, NOT the borrowed\n // bulk-delete default `{ deletedIds, deletedCount }` — customResponseDto\n // overrides it. Impl: `m2m-webhook-delivery-log.custom-impl.backend.service.ts`\n // (saas-backend-lib) — deleteMany of terminal rows older than the window.\n resourceOperationLike: CoreResourceOperation.DELETE_MANY,\n requestDto: M2MWebhookDeliveryLog_PurgeOldRequestDto,\n customResponseDto: z.object({\n purgedCount: z.number(),\n message: z.string(),\n }),\n },\n ],\n },\n },\n },\n);\n"]}
1	+ {"version":3,"file":"m2m-webhook-delivery-log.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,2CAA2C,EAC3C,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAN,IAAY,gCAKX;AALD,WAAY,gCAAgC;IAC1C,wFAAwF;IACxF,mDAAe,CAAA;IACf,0EAA0E;IAC1E,0DAAsB,CAAA;AACxB,CAAC,EALW,gCAAgC,KAAhC,gCAAgC,QAK3C;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACpD,CAAC,CAAC;AAEH,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,yCAAyC,GAAG,uCAAuC,CAC9F,2CAA2C,EAC3C;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,gCAAgC;IACjD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qEAAqE;QACrE,4DAA4D;QAC5D,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,eAAe,CAAC;oBAC9F,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;wBAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;wBACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAU;iBAC7D;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,sDAAsD;QACtD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,mEAAmE;QACnE,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,qCAAqC;iBAClD;aACF;SACF;QACD,CAAC,gCAAgC,CAAC,SAAS,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qFAAqF;oBACrF,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,uEAAuE;oBACvE,yEAAyE;oBACzE,wEAAwE;oBACxE,yEAAyE;oBACzE,yEAAyE;oBACzE,mEAAmE;oBACnE,yEAAyE;oBACzE,gFAAgF;oBAChF,0EAA0E;oBAC1E,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,wCAAwC;oBACpD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;qBACpB,CAAC;iBACH;aACF;SACF;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n M2M Webhook Delivery Log Resource Configuration — Polymorphic dual-scope\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...m2mWebhookDeliveryLogPolymorphicFactories\n \n Operation set (per Plan §D3 / Step 5):\n * - READ (API) : admin views a single delivery row\n * - LIST (API) : admin browses recent deliveries\n * - SEARCH (API) : admin filters deliveries (status / endpoint / date)\n * - CREATE (REPOSITORY_ONLY) : dispatcher-only — never externally callable\n * - DELETE (REPOSITORY_ONLY) : reserved for `PURGE_OLD` bulk path; no\n * external single-row delete to keep the\n * audit trail stable\n * - RETRY (custom, API) : re-enqueue a `FAILED` row (mirrors\n * SIEM DLQ `RETRY_SINGLE`)\n * - PURGE_OLD (custom, API) : delete `DELIVERED`/`FAILED` rows older\n * than N days (mirrors SIEM DLQ\n * `PURGE_ALL` but date-bounded)\n \n @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5\n * @see security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts\n /\n\nimport { z } from 'zod';\nimport {\n CoreResourceOperation,\n CoreResourceType,\n} from '../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationReversibility,\n ResourceOperationVariantType,\n} from '../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { CoreM2MNotificationChannel } from '../notifications.shared.schemas';\nimport {\n m2mWebhookDeliveryLogPolymorphicDeclaration,\n M2MWebhookDeliveryLogStatus,\n} from './m2m-webhook-delivery-log.shared.schemas';\n\n// =============================================================================\n// CUSTOM OPERATIONS\n// =============================================================================\n\nexport enum M2MWebhookDeliveryLog_Operations {\n /* Re-enqueue a single `FAILED` row (resets `status → PENDING`, `attemptCount → 0`). /\n RETRY = 'retry',\n /* Bulk delete `DELIVERED` / `FAILED` rows older than `olderThanDays`. /\n PURGE_OLD = 'purgeOld',\n}\n\n// =============================================================================\n// REQUEST DTOs\n// =============================================================================\n\n/\n RETRY addresses exactly one delivery row through the route path. Keeping the\n * body empty prevents two independently supplied ids from disagreeing; the\n * backend custom implementation uses the framework-resolved entity id.\n /\nexport const M2MWebhookDeliveryLog_RetryRequestDto = z.strictObject({});\n\nexport const M2MWebhookDeliveryLog_PurgeOldRequestDto = z.object({\n /* Rows whose `createdAt` is older than `now() - olderThanDays` are eligible. */\n olderThanDays: z.number().int().positive().max(365),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY\n// =============================================================================\n\nexport const m2mWebhookDeliveryLogPolymorphicFactories = createPolymorphicResourceConfigurations(\n m2mWebhookDeliveryLogPolymorphicDeclaration,\n {\n isSystemResource: true,\n customOperation: M2MWebhookDeliveryLog_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n // UPDATE is the delivery lifecycle: the dispatcher/worker drives the\n // PENDING → IN_FLIGHT → DELIVERED/FAILED status transitions\n // (markInFlight / markDelivered / markFailedAttempt / markFinallyFailed)\n // through the generic `repository.update`, which requires a DEFAULT UPDATE\n // operation. REPOSITORY_ONLY like CREATE — never a public HTTP surface\n // (admins act via the RETRY custom operation, which owns request/response).\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.DELETE_MANY,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['endpointId', 'resourceIdentifier', 'operationIdentifier', 'failureReason'],\n filterFields: {\n status: z.enum(M2MWebhookDeliveryLogStatus),\n channel: z.enum(CoreM2MNotificationChannel),\n endpointId: z.string(),\n createdAt: z.date(),\n },\n sortFields: ['createdAt', 'status', 'attemptCount'] as const,\n },\n ],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n // Delivery-lifecycle status transitions (dispatcher/worker only). Mirrors\n // CREATE: REPOSITORY_ONLY default so `repository.update` resolves a default\n // UPDATE op; never exposed as a public HTTP mutation.\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n },\n ],\n },\n // Bulk twin of DELETE — the actual `PURGE_OLD` write path: the custom impl\n // routes through the repository's `deleteMany` (which requires a default\n // DELETE_MANY operation) to drop terminal DELIVERED/FAILED rows older\n // than the requested retention window in one round trip. REPOSITORY_ONLY:\n // never a public HTTP surface — admins purge via the PURGE_OLD custom\n // operation, which owns the request validation + response summary.\n [CoreResourceOperation.DELETE_MANY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n },\n ],\n },\n [M2MWebhookDeliveryLog_Operations.RETRY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: M2MWebhookDeliveryLog_RetryRequestDto,\n },\n ],\n },\n [M2MWebhookDeliveryLog_Operations.PURGE_OLD]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: Deletes delivery-log rows outright. Nothing retains them afterwards.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): purging\n // rows older than `olderThanDays` acts on the whole scope, so it needs a\n // collection route (`…/m2m-webhook-delivery-log/purge-old`, no `:id`) —\n // a scope-level maintenance action has no single row to address. Mirrors\n // SIEM DLQ `PURGE_ALL`. `isBulkOperation` stays unset (collection-level,\n // not a selection bulk). Returns a purge summary, NOT the borrowed\n // bulk-delete default `{ deletedIds, deletedCount }` — customResponseDto\n // overrides it. Impl: `m2m-webhook-delivery-log.custom-impl.backend.service.ts`\n // (saas-backend-lib) — deleteMany of terminal rows older than the window.\n resourceOperationLike: CoreResourceOperation.DELETE_MANY,\n requestDto: M2MWebhookDeliveryLog_PurgeOldRequestDto,\n customResponseDto: z.object({\n purgedCount: z.number(),\n message: z.string(),\n }),\n },\n ],\n },\n },\n },\n);\n"]}

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.d.ts CHANGED Viewed

@@ -71,7 +71,8 @@ export type M2MWebhookDeliveryLogStatus = (typeof M2MWebhookDeliveryLogStatus)[k
  *                             when this reaches the cap (Plan §D6).
  * - `lastAttemptAt?` /
  *   `nextAttemptAt?`        : Retry scheduling. `nextAttemptAt` is
- *                             cleared on `DELIVERED` / `FAILED`.
+ *                             considered only while PENDING; terminal rows
+ *                             may retain the previous scheduled value.
  * - `responseStatus?`       : HTTP status code from last attempt
  *                             (populated even on success for analytics).
  * - `responseBodyTruncated?`: First 4 KB of response body (per Plan §D3

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"m2m-webhook-delivery-log.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAwC7E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;CAK9B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAMjF~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG~~;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwD1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQtD,CAAC"}
1	+ {"version":3,"file":"m2m-webhook-delivery-log.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAwC7E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;CAK9B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAMjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwD1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQtD,CAAC"}

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.js CHANGED Viewed

@@ -103,7 +103,8 @@ export const M2MWebhookDeliveryLogStatus = {
  *                             when this reaches the cap (Plan §D6).
  * - `lastAttemptAt?` /
  *   `nextAttemptAt?`        : Retry scheduling. `nextAttemptAt` is
- *                             cleared on `DELIVERED` / `FAILED`.
+ *                             considered only while PENDING; terminal rows
+ *                             may retain the previous scheduled value.
  * - `responseStatus?`       : HTTP status code from last attempt
  *                             (populated even on success for analytics).
  * - `responseBodyTruncated?`: First 4 KB of response body (per Plan §D3
@@ -184,7 +185,7 @@ export const m2mWebhookDeliveryLogPolymorphicDeclaration = declarePolymorphicSch
     baseFieldIdentifier: 'm2mWebhookDeliveryLogId',
     baseEnumKey: 'M2M_WEBHOOK_DELIVERY_LOG',
     baseSchema: M2MWebhookDeliveryLogBaseSchema,
-    // Many-rows-per-scope (each delivery attempt is its own document) — opt out
+    // Many-rows-per-scope (one document per endpoint delivery, updated across retries) — opt out
     // of the polymorphism engine's singleton-per-scope business-key auto-default.
     variants: M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL.map(optOutPolymorphicAutoBusinessKey),
 });

package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"m2m-webhook-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAmC;IACvE;QACE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa;QAClD,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC;QACzF,cAAc,EAAE,IAAI;KACrB;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;QAChD,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;QACvF,cAAc,EAAE,IAAI;KACrB;CACF,CAAC;AAEF,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAKX,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE;IAE5D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACtD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,mGAAmG;IACnG,oGAAoG;IACpG,EAAE;IACF,uFAAuF;IACvF,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC;IAE1E,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,2BAA2B,CAAC;SACjC,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC;SAC5C,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,sEAAsE;IACtE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;QACd,0EAA0E;QAC1E,sEAAsE;QACtE,oEAAoE;SACnE,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;IACtB,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;CACvB,CAAC,CAAC;AAIH,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,yBAAyB,CAAC;IACnF,gBAAgB,EAAE,uBAAuB;IACzC,mBAAmB,EAAE,yBAAyB;IAC9C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,+BAA+B;IAC3C,4EAA4E;IAC5E,8EAA8E;IAC9E,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/*\n M2M Webhook Delivery Log Schema (Shared) — Polymorphic dual-scope\n \n Persistence collection that triple-purposes as:\n * 1. The pending delivery queue the worker drains (`status =\n * PENDING`, polled by `(status, nextAttemptAt)`).\n * 2. The user-facing webhook event log (queryable by admins via\n * READ/LIST/SEARCH; scope-appropriate role gating per\n * `.shared.resources-config.schemas.ts`).\n 3. The retry checkpoint — failed attempts increment `attemptCount`\n * and bump `nextAttemptAt`; final failure flips `status = FAILED`\n * with `failureReason` populated.\n \n One row per (delivery target × notification fire). The polymorphism\n * engine injects `organizationId` (org variant) or `applicationId`\n * (app variant) — never both on the same row, so cross-tenant leaks are\n * structurally impossible.\n \n @see m2m-webhook-organization-delivery.md — Phase 2 / Step 4 (D3 lock-in)\n * @see security/authentications/siem/siem-delivery-dlq.shared.schemas.ts\n * for the dual-scope polymorphic precedent this mirrors.\n /\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories } from '@wildo-ai/zod-decorators';\nimport { CoreM2MNotificationChannel } from '../notifications.shared.schemas';\nimport {\n declarePolymorphicSchemas,\n optOutPolymorphicAutoBusinessKey,\n type PolymorphicVariantDefinition,\n} from '../../resources/utils/resource-polymorphism.schemas';\nimport {\n CoreResourceType,\n coreResourceShared_FieldIdentifier,\n} from '../../resources/resources.shared.core.definitions';\n\n// =============================================================================\n// SHARED VARIANT DEFINITIONS\n// =============================================================================\n\n/\n Local copy of `M2M_WEBHOOK_SCOPE_VARIANTS` to avoid a sibling import\n * (which would couple the delivery-log schema to the config schema's\n * load order). The constant is intentionally re-declared identically;\n * any drift would be caught by Phase 3's runtime invariant in the\n * dispatcher (which asserts the resolved channel scope matches the\n * resource's primary scope).\n /\nconst M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL: PolymorphicVariantDefinition[] = [\n {\n parentResourceType: CoreResourceType.ORGANIZATIONS,\n parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS],\n isPrimaryScope: true,\n },\n {\n parentResourceType: CoreResourceType.APPLICATION,\n parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n isPrimaryScope: true,\n },\n];\n\n// =============================================================================\n// STATUS ENUM (4-state finite machine)\n// =============================================================================\n\n/\n Lifecycle transitions:\n * PENDING → IN_FLIGHT → DELIVERED (success path)\n * PENDING → IN_FLIGHT → PENDING (transient failure, retry scheduled)\n * PENDING → IN_FLIGHT → FAILED (final failure — `attemptCount` reached cap)\n \n The worker uses `(status, nextAttemptAt)` to find rows ready for\n * delivery; `IN_FLIGHT` is held only while a worker holds the lease.\n /\nexport const M2MWebhookDeliveryLogStatus = {\n PENDING: 'pending',\n IN_FLIGHT: 'in_flight',\n DELIVERED: 'delivered',\n FAILED: 'failed',\n} as const;\n\nexport type M2MWebhookDeliveryLogStatus =\n (typeof M2MWebhookDeliveryLogStatus)[keyof typeof M2MWebhookDeliveryLogStatus];\n\n// =============================================================================\n// BASE SCHEMA (polymorphism injects the scope FK at variant time)\n// =============================================================================\n\n/\n Field rationale (per Plan §D3 lock-in):\n \n - `endpointId` : Stable FK into `WebhookConfig.endpoints[].id` —\n * survives endpoint rename/url-edit so historical\n * rows remain reconcilable.\n * - `channel` : Which notification channel triggered this row.\n * Pinned to `CoreM2MNotificationChannel` for type\n * safety; the spec/runtime invariant in the\n * dispatcher guarantees the channel is\n * scope-compatible with the resource.\n * - `resourceIdentifier` /\n * `operationIdentifier` /\n * `variantKey?` : Provenance — what spec'd op fired the\n * notification (used by admin UIs and audit\n * correlation).\n * - `httpUrl` : Snapshot of the destination URL at enqueue\n * time. Decoupled from `WebhookConfig.endpoints`\n * so URL edits don't rewrite history.\n * - `payloadHash` (sha256) : Integrity tag — also embedded in the JWT\n * `bodyHash` claim. Lets consumers detect\n * body-vs-claim mismatch independently.\n * - `payload` : Full POST body retained per Q1 lock-in\n * (`full` retention). Treated as `unknown` here\n * — the runtime shape is whatever\n * `serializeOperationResultForResponse(...)`\n * produced for the originating operation.\n * - `status` : See `M2MWebhookDeliveryLogStatus`.\n * - `attemptCount` : Incremented per attempt (success and\n * transient failure). Worker stops retrying\n * when this reaches the cap (Plan §D6).\n * - `lastAttemptAt?` /\n * `nextAttemptAt?` : Retry scheduling. `nextAttemptAt` is\n * cleared on `DELIVERED` / `FAILED`.\n * - `responseStatus?` : HTTP status code from last attempt\n * (populated even on success for analytics).\n * - `responseBodyTruncated?`: First 4 KB of response body (per Plan §D3\n * retention cap) — useful for debugging.\n * - `failureReason?` : Human-readable error summary for `FAILED`\n * rows.\n * - `signatureJti` : JWT `jti` claim used to sign this delivery.\n * Stored so consumers can replay-detect.\n * - `deliveredAt?` /\n * `failedAt?` : Terminal-state timestamps.\n * - `createdAt` : Enqueue time (immutable).\n \n Indexes (asserted at repository init in Phase 3):\n * - `(<scopeId>, createdAt)` — admin UI queries (LIST/SEARCH)\n * - `(status, nextAttemptAt)` — worker drain queries\n /\nexport const M2MWebhookDeliveryLogBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n endpointId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n channel: z.enum(CoreM2MNotificationChannel).isSummaryField(),\n\n resourceIdentifier: z.string().min(1).isSummaryField(),\n operationIdentifier: z.string().min(1).isSummaryField(),\n variantKey: z.string().optional(),\n\n httpUrl: z.url(),\n\n payloadHash: z.string().min(1),\n // USER_CONTENT — the resource row being delivered OUTWARD to a customer's endpoint, so it can hold\n // any personal data the resource holds. Same shape and same reasoning as the A2A push delivery log.\n //\n // `addDataCategories` because `z.unknown()` carries no prototype-installed decorators.\n payload: addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n\n status: z\n .enum(M2MWebhookDeliveryLogStatus)\n .default(M2MWebhookDeliveryLogStatus.PENDING)\n .isDBIndexed()\n .isSummaryField(),\n\n attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n lastAttemptAt: z.date().optional(),\n nextAttemptAt: z.date().optional().isDBIndexed(),\n\n responseStatus: z.number().int().optional(),\n /* Capped at 4 KB by the worker before persistence (see Plan §D3). /\n responseBodyTruncated: z.string().optional(),\n failureReason: z.string().optional().isSummaryField(),\n\n signatureJti: z.string().min(1),\n\n deliveredAt: z.date().optional(),\n failedAt: z.date().optional(),\n\n createdAt: z\n .date()\n .default(() => new Date())\n .isDBIndexed()\n // Summary field: the enqueue time is core row identity for a delivery-log\n // list (dashboards show per-row time and day-group by it — the LIST's\n // `temporalGroupField: 'createdAt'` reads it from the SUMMARY DTO).\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate(),\n updatedAt: z\n .date()\n .default(() => new Date())\n .excludeFromCreate()\n .excludeFromUpdate(),\n});\n\nexport type M2MWebhookDeliveryLogBase = z.infer<typeof M2MWebhookDeliveryLogBaseSchema>;\n\n// =============================================================================\n// POLYMORPHIC DECLARATION\n// =============================================================================\n\n/\n Yields two `CoreResourceType` variants:\n * - `organizationM2mWebhookDeliveryLog` (FK: `organizationId`)\n * - `applicationM2mWebhookDeliveryLog` (FK: `applicationId`)\n \n Both are MANY-cardinality children of their respective scope —\n * wired in `resources-registry.shared.core.definitions.ts` via\n * `createPolymorphicScopeRelationships(...)` with `nature:\n * COMPOSITION` and `onParentDelete: IMMEDIATE` so deleting the org/app\n * cleanly drops its delivery history.\n */\nexport const m2mWebhookDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'm2mWebhookDeliveryLog',\n baseFieldIdentifier: 'm2mWebhookDeliveryLogId',\n baseEnumKey: 'M2M_WEBHOOK_DELIVERY_LOG',\n baseSchema: M2MWebhookDeliveryLogBaseSchema,\n // Many-rows-per-scope (each delivery attempt is its own document) — opt out\n // of the polymorphism engine's singleton-per-scope business-key auto-default.\n variants: M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
1	+ {"version":3,"file":"m2m-webhook-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAmC;IACvE;QACE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa;QAClD,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC;QACzF,cAAc,EAAE,IAAI;KACrB;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;QAChD,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;QACvF,cAAc,EAAE,IAAI;KACrB;CACF,CAAC;AAEF,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAKX,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE;IAE5D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACtD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,mGAAmG;IACnG,oGAAoG;IACpG,EAAE;IACF,uFAAuF;IACvF,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC;IAE1E,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,2BAA2B,CAAC;SACjC,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC;SAC5C,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,sEAAsE;IACtE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;QACd,0EAA0E;QAC1E,sEAAsE;QACtE,oEAAoE;SACnE,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;IACtB,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;CACvB,CAAC,CAAC;AAIH,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,yBAAyB,CAAC;IACnF,gBAAgB,EAAE,uBAAuB;IACzC,mBAAmB,EAAE,yBAAyB;IAC9C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,+BAA+B;IAC3C,6FAA6F;IAC7F,8EAA8E;IAC9E,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/*\n M2M Webhook Delivery Log Schema (Shared) — Polymorphic dual-scope\n \n Persistence collection that triple-purposes as:\n * 1. The pending delivery queue the worker drains (`status =\n * PENDING`, polled by `(status, nextAttemptAt)`).\n * 2. The user-facing webhook event log (queryable by admins via\n * READ/LIST/SEARCH; scope-appropriate role gating per\n * `.shared.resources-config.schemas.ts`).\n 3. The retry checkpoint — failed attempts increment `attemptCount`\n * and bump `nextAttemptAt`; final failure flips `status = FAILED`\n * with `failureReason` populated.\n \n One row per (delivery target × notification fire). The polymorphism\n * engine injects `organizationId` (org variant) or `applicationId`\n * (app variant) — never both on the same row, so cross-tenant leaks are\n * structurally impossible.\n \n @see m2m-webhook-organization-delivery.md — Phase 2 / Step 4 (D3 lock-in)\n * @see security/authentications/siem/siem-delivery-dlq.shared.schemas.ts\n * for the dual-scope polymorphic precedent this mirrors.\n /\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories } from '@wildo-ai/zod-decorators';\nimport { CoreM2MNotificationChannel } from '../notifications.shared.schemas';\nimport {\n declarePolymorphicSchemas,\n optOutPolymorphicAutoBusinessKey,\n type PolymorphicVariantDefinition,\n} from '../../resources/utils/resource-polymorphism.schemas';\nimport {\n CoreResourceType,\n coreResourceShared_FieldIdentifier,\n} from '../../resources/resources.shared.core.definitions';\n\n// =============================================================================\n// SHARED VARIANT DEFINITIONS\n// =============================================================================\n\n/\n Local copy of `M2M_WEBHOOK_SCOPE_VARIANTS` to avoid a sibling import\n * (which would couple the delivery-log schema to the config schema's\n * load order). The constant is intentionally re-declared identically;\n * any drift would be caught by Phase 3's runtime invariant in the\n * dispatcher (which asserts the resolved channel scope matches the\n * resource's primary scope).\n /\nconst M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL: PolymorphicVariantDefinition[] = [\n {\n parentResourceType: CoreResourceType.ORGANIZATIONS,\n parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS],\n isPrimaryScope: true,\n },\n {\n parentResourceType: CoreResourceType.APPLICATION,\n parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n isPrimaryScope: true,\n },\n];\n\n// =============================================================================\n// STATUS ENUM (4-state finite machine)\n// =============================================================================\n\n/\n Lifecycle transitions:\n * PENDING → IN_FLIGHT → DELIVERED (success path)\n * PENDING → IN_FLIGHT → PENDING (transient failure, retry scheduled)\n * PENDING → IN_FLIGHT → FAILED (final failure — `attemptCount` reached cap)\n \n The worker uses `(status, nextAttemptAt)` to find rows ready for\n * delivery; `IN_FLIGHT` is held only while a worker holds the lease.\n /\nexport const M2MWebhookDeliveryLogStatus = {\n PENDING: 'pending',\n IN_FLIGHT: 'in_flight',\n DELIVERED: 'delivered',\n FAILED: 'failed',\n} as const;\n\nexport type M2MWebhookDeliveryLogStatus =\n (typeof M2MWebhookDeliveryLogStatus)[keyof typeof M2MWebhookDeliveryLogStatus];\n\n// =============================================================================\n// BASE SCHEMA (polymorphism injects the scope FK at variant time)\n// =============================================================================\n\n/\n Field rationale (per Plan §D3 lock-in):\n \n - `endpointId` : Stable FK into `WebhookConfig.endpoints[].id` —\n * survives endpoint rename/url-edit so historical\n * rows remain reconcilable.\n * - `channel` : Which notification channel triggered this row.\n * Pinned to `CoreM2MNotificationChannel` for type\n * safety; the spec/runtime invariant in the\n * dispatcher guarantees the channel is\n * scope-compatible with the resource.\n * - `resourceIdentifier` /\n * `operationIdentifier` /\n * `variantKey?` : Provenance — what spec'd op fired the\n * notification (used by admin UIs and audit\n * correlation).\n * - `httpUrl` : Snapshot of the destination URL at enqueue\n * time. Decoupled from `WebhookConfig.endpoints`\n * so URL edits don't rewrite history.\n * - `payloadHash` (sha256) : Integrity tag — also embedded in the JWT\n * `bodyHash` claim. Lets consumers detect\n * body-vs-claim mismatch independently.\n * - `payload` : Full POST body retained per Q1 lock-in\n * (`full` retention). Treated as `unknown` here\n * — the runtime shape is whatever\n * `serializeOperationResultForResponse(...)`\n * produced for the originating operation.\n * - `status` : See `M2MWebhookDeliveryLogStatus`.\n * - `attemptCount` : Incremented per attempt (success and\n * transient failure). Worker stops retrying\n * when this reaches the cap (Plan §D6).\n * - `lastAttemptAt?` /\n * `nextAttemptAt?` : Retry scheduling. `nextAttemptAt` is\n * considered only while PENDING; terminal rows\n * may retain the previous scheduled value.\n * - `responseStatus?` : HTTP status code from last attempt\n * (populated even on success for analytics).\n * - `responseBodyTruncated?`: First 4 KB of response body (per Plan §D3\n * retention cap) — useful for debugging.\n * - `failureReason?` : Human-readable error summary for `FAILED`\n * rows.\n * - `signatureJti` : JWT `jti` claim used to sign this delivery.\n * Stored so consumers can replay-detect.\n * - `deliveredAt?` /\n * `failedAt?` : Terminal-state timestamps.\n * - `createdAt` : Enqueue time (immutable).\n \n Indexes (asserted at repository init in Phase 3):\n * - `(<scopeId>, createdAt)` — admin UI queries (LIST/SEARCH)\n * - `(status, nextAttemptAt)` — worker drain queries\n /\nexport const M2MWebhookDeliveryLogBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n endpointId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n channel: z.enum(CoreM2MNotificationChannel).isSummaryField(),\n\n resourceIdentifier: z.string().min(1).isSummaryField(),\n operationIdentifier: z.string().min(1).isSummaryField(),\n variantKey: z.string().optional(),\n\n httpUrl: z.url(),\n\n payloadHash: z.string().min(1),\n // USER_CONTENT — the resource row being delivered OUTWARD to a customer's endpoint, so it can hold\n // any personal data the resource holds. Same shape and same reasoning as the A2A push delivery log.\n //\n // `addDataCategories` because `z.unknown()` carries no prototype-installed decorators.\n payload: addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n\n status: z\n .enum(M2MWebhookDeliveryLogStatus)\n .default(M2MWebhookDeliveryLogStatus.PENDING)\n .isDBIndexed()\n .isSummaryField(),\n\n attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n lastAttemptAt: z.date().optional(),\n nextAttemptAt: z.date().optional().isDBIndexed(),\n\n responseStatus: z.number().int().optional(),\n /* Capped at 4 KB by the worker before persistence (see Plan §D3). /\n responseBodyTruncated: z.string().optional(),\n failureReason: z.string().optional().isSummaryField(),\n\n signatureJti: z.string().min(1),\n\n deliveredAt: z.date().optional(),\n failedAt: z.date().optional(),\n\n createdAt: z\n .date()\n .default(() => new Date())\n .isDBIndexed()\n // Summary field: the enqueue time is core row identity for a delivery-log\n // list (dashboards show per-row time and day-group by it — the LIST's\n // `temporalGroupField: 'createdAt'` reads it from the SUMMARY DTO).\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate(),\n updatedAt: z\n .date()\n .default(() => new Date())\n .excludeFromCreate()\n .excludeFromUpdate(),\n});\n\nexport type M2MWebhookDeliveryLogBase = z.infer<typeof M2MWebhookDeliveryLogBaseSchema>;\n\n// =============================================================================\n// POLYMORPHIC DECLARATION\n// =============================================================================\n\n/\n Yields two `CoreResourceType` variants:\n * - `organizationM2mWebhookDeliveryLog` (FK: `organizationId`)\n * - `applicationM2mWebhookDeliveryLog` (FK: `applicationId`)\n \n Both are MANY-cardinality children of their respective scope —\n * wired in `resources-registry.shared.core.definitions.ts` via\n * `createPolymorphicScopeRelationships(...)` with `nature:\n * COMPOSITION` and `onParentDelete: IMMEDIATE` so deleting the org/app\n * cleanly drops its delivery history.\n */\nexport const m2mWebhookDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'm2mWebhookDeliveryLog',\n baseFieldIdentifier: 'm2mWebhookDeliveryLogId',\n baseEnumKey: 'M2M_WEBHOOK_DELIVERY_LOG',\n baseSchema: M2MWebhookDeliveryLogBaseSchema,\n // Many-rows-per-scope (one document per endpoint delivery, updated across retries) — opt out\n // of the polymorphism engine's singleton-per-scope business-key auto-default.\n variants: M2M_WEBHOOK_SCOPE_VARIANTS_LOCAL.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/notifications/m2m/webhook-config.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"webhook-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/webhook-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EAEtB,MAAM,mDAAmD,CAAC;AAQ3D,OAAO,EAAuC,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAMnH,oBAAY,wBAAwB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,iBAAiB;CAC/B;AAMD,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;iBAsChD,CAAC;AAMH,eAAO,MAAM,iCAAiC,~~4OAkG7C~~,CAAC"}
1	+ {"version":3,"file":"webhook-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/m2m/webhook-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EAEtB,MAAM,mDAAmD,CAAC;AAQ3D,OAAO,EAAuC,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAMnH,oBAAY,wBAAwB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,iBAAiB;CAC/B;AAMD,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;iBAsChD,CAAC;AAMH,eAAO,MAAM,iCAAiC,4OA2I7C,CAAC"}

package/dist/esm/notifications/m2m/webhook-config.shared.resources-config.schemas.js CHANGED Viewed

@@ -107,8 +107,23 @@ export const webhookConfigPolymorphicFactories = createPolymorphicResourceConfig
     isSystemResource: true,
     // Server-internal webhook delivery loads the (org/app) endpoint config via
     // `readAsSystem`, independent of the triggering user's roles — the config
-    // governs runtime delivery behaviour, not user-facing data. READ-only.
-    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED },
+    // governs runtime delivery behaviour, not user-facing data.
+    //
+    // CREATE joined it on 2026-09-18, matching the three enterprise-config singletons
+    // (SSO / SCIM / SIEM) this resource is otherwise shaped like. It said "READ-only"
+    // because, unlike them, it had no lazy materialiser of its own — not because a default
+    // row would be wrong. #1179's seam reads this declaration before materialising a
+    // context-addressed singleton on an UPDATE or DELETE the caller never named, so an
+    // administrator can start configuring webhooks for a scope that has no row yet.
+    //
+    // It does NOT make a READ materialise — measured 2026-09-19, that seam is never entered on
+    // the read route — so an unconfigured scope still 404s when the settings pane reads it.
+    // Making the row exist for an organization that predates the `afterCreate` default seed is
+    // a SEEDING question, and is where that defect belongs.
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+    },
     customOperation: WebhookConfig_Operations,
     coreOperations: [
         CoreResourceOperation.READ,
@@ -143,10 +158,36 @@ export const webhookConfigPolymorphicFactories = createPolymorphicResourceConfig
                 },
             ],
         },
+        /*
+         * API_CALL — the administrator's edit door, and the only caller of this write.
+         *
+         * It was REPOSITORY_ONLY, which is route-less, and nothing in the engine called it: the
+         * scope's row is seeded by `webhook-config-defaults.seeds.ts` through CREATE, the two
+         * registered custom implementations are keyed on READ and on `testEndpoint`, and
+         * `WebhookConfigBackendService` never updates. So the declared write had no caller on either
+         * side of the boundary — no route for an administrator, no service reaching it internally —
+         * and a webhook configuration is nothing BUT settings: whether outbound delivery is on, the
+         * endpoints, the event selection, the retry posture.
+         *
+         * Worse than unreachable, and this is why it moved rather than being deleted: with no
+         * addressable literal `update`, the frontend's update resolution fell through to whatever
+         * operation borrowed UPDATE semantics — and here that is `testEndpoint`
+         * (`resourceOperationLike: UPDATE`, API_CALL). Every writable field on the webhook settings
+         * pane was a control that would have FIRED A TEST DELIVERY at the configured endpoint instead
+         * of saving. `pickInlineFieldWriteOperation` now refuses a borrowed verb outright, so the
+         * mis-wiring is closed whatever this variant says; the door is what makes the pane work.
+         *
+         * Nothing moves in lockstep: no custom implementation is registered on this operation. Should
+         * an internal writer ever need the repository path, `getInternalRepositoryOperationPathDefault`
+         * falls back to the URL-bearing default for exactly this shape.
+         *
+         * CREATE stays REPOSITORY_ONLY beside it: the row is seeded once per scope and is never
+         * created self-serve. Admin tier / MEDIUM, unchanged.
+         */
         [CoreResourceOperation.UPDATE]: {
             variants: [
                 {
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],

package/dist/esm/notifications/m2m/webhook-config.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"webhook-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/m2m/webhook-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAEnH,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAN,IAAY,wBAkBX;AAlBD,WAAY,wBAAwB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,0DAA8B,CAAA;AAChC,CAAC,EAlBW,wBAAwB,KAAxB,wBAAwB,QAkBnC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC5C,mFAAmF;IACnF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,mFAAmF;IACnF,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,qFAAqF;IACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAC9D,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,yEAAyE;QACzE,gFAAgF;QAChF,8EAA8E;QAC9E,+EAA+E;QAC/E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qEAAqE;oBACrE,kEAAkE;oBAClE,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,oCAAoC;oBAChD,iEAAiE;oBACjE,gEAAgE;oBAChE,oEAAoE;oBACpE,kEAAkE;oBAClE,qCAAqC;oBACrC,iBAAiB,EAAE,qCAAqC;iBACzD;aACF;SACF;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n M2M Webhook Config Resource Configuration — Polymorphic dual-scope\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...webhookConfigPolymorphicFactories\n \n Operation set (mirrors SIEM Export Config singleton precedent):\n * - READ (API) : admin reads the config + derived public key\n * - CREATE (REPOSITORY_ONLY) : seeded once per scope; not externally callable\n * - UPDATE (REPOSITORY_ONLY) : admin edits via dedicated endpoint flow (not a public REST PUT)\n * - TEST_ENDPOINT (custom) : fires a synthetic delivery to verify URL reachability\n \n @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5\n * @see security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts\n /\n\nimport { z } from 'zod';\nimport {\n CoreResourceOperation,\n CoreResourceType,\n} from '../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { webhookConfigPolymorphicDeclaration, WebhookEndpointProbeOutcome } from './webhook-config.shared.schemas';\n\n// =============================================================================\n// CUSTOM OPERATIONS\n// =============================================================================\n\nexport enum WebhookConfig_Operations {\n /\n Synthetic delivery to verify URL reachability + signature\n * verification on the consumer side. Targets a single endpoint\n * (selected by `endpointId` in the request body); does not write to\n * `M2MWebhookDeliveryLog` (test deliveries are excluded from the user\n * event log to keep the log clean).\n \n The probe is `resourceOperationLike: UPDATE`, NOT `READ`. It performs no\n * database write, but it DOES have an external side effect — a live signed\n * POST leaves the platform and arrives at a customer-controlled URL. Borrowing\n * READ made this a `GET` whose OpenAPI entry had to declare `x-idempotent: false`,\n * a self-contradiction, and pushed `endpointId` into a query string. Borrowing\n * UPDATE yields a `PUT` on the same custom-op sub-path, matching the\n * `M2MWebhookDeliveryLog.retry` precedent (also a no-DB-write-of-its-own verb\n * that triggers a delivery).\n /\n TEST_ENDPOINT = 'testEndpoint',\n}\n\n// =============================================================================\n// REQUEST DTOs\n// =============================================================================\n\nexport const WebhookConfig_TestEndpointRequestDto = z.object({\n endpointId: z.string().min(1),\n});\n\n// =============================================================================\n// RESPONSE DTOs\n// =============================================================================\n\n/\n Diagnostic returned synchronously by `testEndpoint`.\n \n A transport-level failure at the customer endpoint is a successful PROBE and\n * therefore answers HTTP 200 carrying `outcome: UNREACHABLE` — it is not an API\n * error. API errors are reserved for faults in the request itself (unknown\n * `endpointId`, no config row, rate limit exceeded).\n /\nexport const WebhookConfig_TestEndpointResponseDto = z.object({\n endpointId: z.string(),\n /* Destination actually contacted, echoed so the admin can confirm the stored URL. /\n url: z.string(),\n /\n True when that destination is plaintext `http://`, so the signature JWT travelled in the clear.\n \n ## Why the exposure is reported HERE (#492)\n \n Plaintext endpoints are admitted, deliberately, and the reasoning is recorded on\n * `WebhookEndpointSchema.url`. The cost of admitting them is that the decision becomes invisible:\n * a documented exposure nobody encounters is the same as an undocumented one, and the JSDoc\n * reaches only someone reading the schema.\n \n This probe is the one place an admin acts on a SINGLE endpoint and reads a per-endpoint answer,\n * so it is where the exposure can actually be met. It rides beside `outcome` rather than replacing\n * it, because the two say different things: `ACCEPTED` over `http://` is a working endpoint AND a\n * credential on the wire, and collapsing that into a failure would be false.\n \n Reported for every outcome, including `NOT_SENT` — the scheme is a property of the stored\n * destination, not of the attempt, and an admin fixing a signing fault should still be told.\n /\n transportIsPlaintext: z.boolean(),\n outcome: z.enum(WebhookEndpointProbeOutcome),\n /* HTTP status returned by the endpoint. Absent for `UNREACHABLE` / `NOT_SENT`. /\n responseStatus: z.number().int().optional(),\n /* Truncated response body, to let an admin read the consumer's own error text. /\n responseBodyTruncated: z.string().optional(),\n /* Network / timeout / signing failure detail. Absent when the endpoint answered. /\n failureReason: z.string().optional(),\n durationMs: z.number().int().nonnegative(),\n /\n `jti` of the signed probe. Stated so an admin can correlate this attempt with\n * the entry in their own consumer's logs — the same dedup key a real delivery\n * carries.\n */\n signatureJti: z.string(),\n attemptedAt: z.date(),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY\n// =============================================================================\n\nexport const webhookConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n webhookConfigPolymorphicDeclaration,\n {\n isSystemResource: true,\n // Server-internal webhook delivery loads the (org/app) endpoint config via\n // `readAsSystem`, independent of the triggering user's roles — the config\n // governs runtime delivery behaviour, not user-facing data. READ-only.\n systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED },\n customOperation: WebhookConfig_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n },\n ],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n },\n ],\n },\n // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n // onParentDelete cascade so this one-per-scope webhook-config row is physically\n // removed when its owning org/app is deleted. Without a DELETE op the cascade\n // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n // config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n },\n ],\n },\n [WebhookConfig_Operations.TEST_ENDPOINT]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // UPDATE-like, not READ-like — see the JSDoc on `TEST_ENDPOINT`. The\n // operation writes nothing, but it emits a live outbound request.\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: WebhookConfig_TestEndpointRequestDto,\n // Implemented by `createWebhookConfigTestEndpointFactories()` in\n // saas-backend-lib (REPLACE_CORE_OPERATIONS): the core write is\n // replaced by the synthetic delivery, and this diagnostic — NOT the\n // config row — is what the caller receives. Keep this contract in\n // lockstep with that implementation.\n customResponseDto: WebhookConfig_TestEndpointResponseDto,\n },\n ],\n },\n },\n },\n);\n"]}
1	+ {"version":3,"file":"webhook-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/notifications/m2m/webhook-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAEnH,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAN,IAAY,wBAkBX;AAlBD,WAAY,wBAAwB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,0DAA8B,CAAA;AAChC,CAAC,EAlBW,wBAAwB,KAAxB,wBAAwB,QAkBnC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC5C,mFAAmF;IACnF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,mFAAmF;IACnF,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,qFAAqF;IACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,2EAA2E;IAC3E,0EAA0E;IAC1E,4DAA4D;IAC5D,EAAE;IACF,kFAAkF;IAClF,kFAAkF;IAClF,uFAAuF;IACvF,iFAAiF;IACjF,mFAAmF;IACnF,gFAAgF;IAChF,EAAE;IACF,2FAA2F;IAC3F,wFAAwF;IACxF,2FAA2F;IAC3F,wDAAwD;IACxD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,yEAAyE;QACzE,gFAAgF;QAChF,8EAA8E;QAC9E,+EAA+E;QAC/E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qEAAqE;oBACrE,kEAAkE;oBAClE,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,oCAAoC;oBAChD,iEAAiE;oBACjE,gEAAgE;oBAChE,oEAAoE;oBACpE,kEAAkE;oBAClE,qCAAqC;oBACrC,iBAAiB,EAAE,qCAAqC;iBACzD;aACF;SACF;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n M2M Webhook Config Resource Configuration — Polymorphic dual-scope\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...webhookConfigPolymorphicFactories\n \n Operation set (mirrors SIEM Export Config singleton precedent):\n * - READ (API) : admin reads the config + derived public key\n * - CREATE (REPOSITORY_ONLY) : seeded once per scope; not externally callable\n * - UPDATE (REPOSITORY_ONLY) : admin edits via dedicated endpoint flow (not a public REST PUT)\n * - TEST_ENDPOINT (custom) : fires a synthetic delivery to verify URL reachability\n \n @see m2m-webhook-organization-delivery.md — Phase 2 / Step 5\n * @see security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts\n /\n\nimport { z } from 'zod';\nimport {\n CoreResourceOperation,\n CoreResourceType,\n} from '../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { webhookConfigPolymorphicDeclaration, WebhookEndpointProbeOutcome } from './webhook-config.shared.schemas';\n\n// =============================================================================\n// CUSTOM OPERATIONS\n// =============================================================================\n\nexport enum WebhookConfig_Operations {\n /\n Synthetic delivery to verify URL reachability + signature\n * verification on the consumer side. Targets a single endpoint\n * (selected by `endpointId` in the request body); does not write to\n * `M2MWebhookDeliveryLog` (test deliveries are excluded from the user\n * event log to keep the log clean).\n \n The probe is `resourceOperationLike: UPDATE`, NOT `READ`. It performs no\n * database write, but it DOES have an external side effect — a live signed\n * POST leaves the platform and arrives at a customer-controlled URL. Borrowing\n * READ made this a `GET` whose OpenAPI entry had to declare `x-idempotent: false`,\n * a self-contradiction, and pushed `endpointId` into a query string. Borrowing\n * UPDATE yields a `PUT` on the same custom-op sub-path, matching the\n * `M2MWebhookDeliveryLog.retry` precedent (also a no-DB-write-of-its-own verb\n * that triggers a delivery).\n /\n TEST_ENDPOINT = 'testEndpoint',\n}\n\n// =============================================================================\n// REQUEST DTOs\n// =============================================================================\n\nexport const WebhookConfig_TestEndpointRequestDto = z.object({\n endpointId: z.string().min(1),\n});\n\n// =============================================================================\n// RESPONSE DTOs\n// =============================================================================\n\n/\n Diagnostic returned synchronously by `testEndpoint`.\n \n A transport-level failure at the customer endpoint is a successful PROBE and\n * therefore answers HTTP 200 carrying `outcome: UNREACHABLE` — it is not an API\n * error. API errors are reserved for faults in the request itself (unknown\n * `endpointId`, no config row, rate limit exceeded).\n /\nexport const WebhookConfig_TestEndpointResponseDto = z.object({\n endpointId: z.string(),\n /* Destination actually contacted, echoed so the admin can confirm the stored URL. /\n url: z.string(),\n /\n True when that destination is plaintext `http://`, so the signature JWT travelled in the clear.\n \n ## Why the exposure is reported HERE (#492)\n \n Plaintext endpoints are admitted, deliberately, and the reasoning is recorded on\n * `WebhookEndpointSchema.url`. The cost of admitting them is that the decision becomes invisible:\n * a documented exposure nobody encounters is the same as an undocumented one, and the JSDoc\n * reaches only someone reading the schema.\n \n This probe is the one place an admin acts on a SINGLE endpoint and reads a per-endpoint answer,\n * so it is where the exposure can actually be met. It rides beside `outcome` rather than replacing\n * it, because the two say different things: `ACCEPTED` over `http://` is a working endpoint AND a\n * credential on the wire, and collapsing that into a failure would be false.\n \n Reported for every outcome, including `NOT_SENT` — the scheme is a property of the stored\n * destination, not of the attempt, and an admin fixing a signing fault should still be told.\n /\n transportIsPlaintext: z.boolean(),\n outcome: z.enum(WebhookEndpointProbeOutcome),\n /* HTTP status returned by the endpoint. Absent for `UNREACHABLE` / `NOT_SENT`. /\n responseStatus: z.number().int().optional(),\n /* Truncated response body, to let an admin read the consumer's own error text. /\n responseBodyTruncated: z.string().optional(),\n /* Network / timeout / signing failure detail. Absent when the endpoint answered. /\n failureReason: z.string().optional(),\n durationMs: z.number().int().nonnegative(),\n /\n `jti` of the signed probe. Stated so an admin can correlate this attempt with\n * the entry in their own consumer's logs — the same dedup key a real delivery\n * carries.\n /\n signatureJti: z.string(),\n attemptedAt: z.date(),\n});\n\n// =============================================================================\n// POLYMORPHIC FACTORY\n// =============================================================================\n\nexport const webhookConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n webhookConfigPolymorphicDeclaration,\n {\n isSystemResource: true,\n // Server-internal webhook delivery loads the (org/app) endpoint config via\n // `readAsSystem`, independent of the triggering user's roles — the config\n // governs runtime delivery behaviour, not user-facing data.\n //\n // CREATE joined it on 2026-09-18, matching the three enterprise-config singletons\n // (SSO / SCIM / SIEM) this resource is otherwise shaped like. It said \"READ-only\"\n // because, unlike them, it had no lazy materialiser of its own — not because a default\n // row would be wrong. #1179's seam reads this declaration before materialising a\n // context-addressed singleton on an UPDATE or DELETE the caller never named, so an\n // administrator can start configuring webhooks for a scope that has no row yet.\n //\n // It does NOT make a READ materialise — measured 2026-09-19, that seam is never entered on\n // the read route — so an unconfigured scope still 404s when the settings pane reads it.\n // Making the row exist for an organization that predates the `afterCreate` default seed is\n // a SEEDING question, and is where that defect belongs.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n customOperation: WebhookConfig_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n },\n ],\n },\n /\n * API_CALL — the administrator's edit door, and the only caller of this write.\n \n It was REPOSITORY_ONLY, which is route-less, and nothing in the engine called it: the\n * scope's row is seeded by `webhook-config-defaults.seeds.ts` through CREATE, the two\n * registered custom implementations are keyed on READ and on `testEndpoint`, and\n * `WebhookConfigBackendService` never updates. So the declared write had no caller on either\n * side of the boundary — no route for an administrator, no service reaching it internally —\n * and a webhook configuration is nothing BUT settings: whether outbound delivery is on, the\n * endpoints, the event selection, the retry posture.\n \n Worse than unreachable, and this is why it moved rather than being deleted: with no\n * addressable literal `update`, the frontend's update resolution fell through to whatever\n * operation borrowed UPDATE semantics — and here that is `testEndpoint`\n * (`resourceOperationLike: UPDATE`, API_CALL). Every writable field on the webhook settings\n * pane was a control that would have FIRED A TEST DELIVERY at the configured endpoint instead\n * of saving. `pickInlineFieldWriteOperation` now refuses a borrowed verb outright, so the\n * mis-wiring is closed whatever this variant says; the door is what makes the pane work.\n \n Nothing moves in lockstep: no custom implementation is registered on this operation. Should\n * an internal writer ever need the repository path, `getInternalRepositoryOperationPathDefault`\n * falls back to the URL-bearing default for exactly this shape.\n \n CREATE stays REPOSITORY_ONLY beside it: the row is seeded once per scope and is never\n * created self-serve. Admin tier / MEDIUM, unchanged.\n */\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n },\n ],\n },\n // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n // onParentDelete cascade so this one-per-scope webhook-config row is physically\n // removed when its owning org/app is deleted. Without a DELETE op the cascade\n // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n // config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n },\n ],\n },\n [WebhookConfig_Operations.TEST_ENDPOINT]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // UPDATE-like, not READ-like — see the JSDoc on `TEST_ENDPOINT`. The\n // operation writes nothing, but it emits a live outbound request.\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: WebhookConfig_TestEndpointRequestDto,\n // Implemented by `createWebhookConfigTestEndpointFactories()` in\n // saas-backend-lib (REPLACE_CORE_OPERATIONS): the core write is\n // replaced by the synthetic delivery, and this diagnostic — NOT the\n // config row — is what the caller receives. Keep this contract in\n // lockstep with that implementation.\n customResponseDto: WebhookConfig_TestEndpointResponseDto,\n },\n ],\n },\n },\n },\n);\n"]}

package/dist/esm/notifications/notification-badges.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -39,7 +39,7 @@ import { NotificationBadgeUserSelfSchema, NotificationBadgeOrganizationSchema }
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
 import { ResourceRelationship } from '../resources/resources.shared.schemas';
 import { ResourceConfiguration } from '../resources/resources-config.shared.schemas';
-type UserNotificationBadgesCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
+type UserNotificationBadgesCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;
 export declare const userNotificationBadgesResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => ResourceConfiguration<undefined, UserNotificationBadgesCoreOperations, typeof NotificationBadgeUserSelfSchema>;
 type OrganizationNotificationBadgesCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;
 export declare const organizationNotificationBadgesResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => ResourceConfiguration<undefined, OrganizationNotificationBadgesCoreOperations, typeof NotificationBadgeOrganizationSchema>;

package/dist/esm/notifications/notification-badges.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"notification-badges.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/notifications/notification-badges.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACpC,MAAM,+BAA+B,CAAC;~~AAGvC~~,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAOrF,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,~~GAC5B,qBAAqB,~~CAAC~~,WAAW,CAAC~~;~~AAEtC~~,eAAO,MAAM,iEAAiE,GAC5E,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CACtB,SAAS,EACT,oCAAoC,EACpC,OAAO,+BAA+B,~~CA+HtC~~,CAAC;AAIH,KAAK,4CAA4C,GAC7C,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,yEAAyE,GACpF,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CACtB,SAAS,EACT,4CAA4C,EAC5C,OAAO,mCAAmC,CAoF1C,CAAC"}
1	+ {"version":3,"file":"notification-badges.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/notifications/notification-badges.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACpC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAOrF,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,iEAAiE,GAC5E,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CACtB,SAAS,EACT,oCAAoC,EACpC,OAAO,+BAA+B,CA0GtC,CAAC;AAIH,KAAK,4CAA4C,GAC7C,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,yEAAyE,GACpF,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CACtB,SAAS,EACT,4CAA4C,EAC5C,OAAO,mCAAmC,CAoF1C,CAAC"}

package/dist/esm/notifications/notification-badges.shared.resources-config.schemas.js CHANGED Viewed

@@ -37,7 +37,6 @@
  */
 import { NotificationBadgeUserSelfSchema, NotificationBadgeOrganizationSchema, } from './notification-badges.schemas.js';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
-import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier, } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
@@ -52,24 +51,21 @@ export const userNotificationBadgesResourceConfiguration_InitializationFactory =
     /** Subject-export disclosure. The subject's own data. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. */
     systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },
-    /**
-     * Subject erasure RETAINS the badge row and scrubs nothing, because a badge holds nothing to scrub.
+    /*
+     * NO `retentionPolicy`, so a subject erasure DESTROYS the badge rows (#1569, decided by Paul
+     * 2026-09-24).
      *
-     * `RETAIN_ONLY` is a positive assertion: a badge is a COUNTER and the reference to what it counts.
-     * Its only link to a person is the scope foreign key, which the never-scrub floor protects in every
-     * mode. The factory refuses this mode if any field declares an impersonalize treatment, so the
-     * claim is checked rather than trusted.
+     * It declared `RETAIN_ONLY` — "a badge holds nothing to scrub" — and since #1279 an erasure takes a
+     * silent edge's treatment from that declaration, so an erased person's unread counters stayed live and
+     * frozen. A counter of someone's unread items has no retention value once that someone is erased, so
+     * the USERS → USER_NOTIFICATION_BADGES edge AUTHORS `strategy: DELETE`, and re-adding a retention mode
+     * here would be refused as a contradiction. Only the USER_SELF badge is in the subject-erasure
+     * population; the organization badge below is tenant-scoped and was never affected.
      *
-     * Only the USER_SELF badge declares this. The organization badge is scoped to a tenant rather than
-     * a person and declares no `exportSubject`, so it is outside the subject-erasure population
-     * entirely — the two configs live in one file but address different collections, and nothing
-     * pairs them.
+     * And so no `dataSubjectPolicy` either: the factory pairs the two in both directions, because only a
+     * retention-governed resource can be passed to an erasure as its SUBJECT. This row is never the
+     * subject of an erasure; it is a child an erasure destroys.
      */
-    retentionPolicy: {
-        mode: ErasureRetentionMode.RETAIN_ONLY,
-    },
-    /** The subject is the person whose unread counts these are, reached through the scope key. */
-    dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
@@ -80,25 +76,8 @@ export const userNotificationBadgesResourceConfiguration_InitializationFactory =
         // must physically remove the row when its owning user/org is deleted. Without it
         // the cascade throws ErrorType.CONFIGURATION on any parent that has a badge row.
         CoreResourceOperation.DELETE,
-        // Route-less; `retentionPolicy` requires it (READ + LIST are already declared above).
-        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
-        /*
-         * Route-less retention plumbing. INTERNAL_CALL registers no route, and must not be
-         * REPOSITORY_ONLY — the retention primitives resolve through `getServiceOperationPathDefault`,
-         * which excludes it, so that spelling passes the boot guard and fails when an erasure runs.
-         */
-        [CoreResourceOperation.UPDATE_MANY]: {
-            variants: [
-                {
-                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
-                    isDefault: true,
-                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
-                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
-                },
-            ],
-        },
         [CoreResourceOperation.READ]: {
             variants: [
                 {