@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/resources/utils/composition-cascade-deletability.validation.d.ts

@@ -3,10 +3,10 @@ import { ResourceType, CoreResourceOperation } from '../resources.shared.core.de
 import { ChildLifecycleStrategy } from '../child-operations.shared.schemas';
 import type { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';
 /**
- * Registry-level guardrail for the composition `onParentDelete` lifecycle — the
+ * Registry-level guardrail for the effective `onParentDelete` lifecycle — the
  * DELETE-side counterpart to `validateCompositionSeedability`.
  *
- * A composition relationship that OPTS IN to the delete cascade
+ * A relationship that OPTS IN to the delete cascade
  * (`childOperations.lifecycle.onParentDelete.enabled = true`) must actually be
  * cascade-deletable, or the runtime cascade throws `ErrorType.CONFIGURATION`
  * INSIDE the parent's delete transaction and ROLLS BACK the parent delete. Two
@@ -29,6 +29,10 @@ import type { ErasureRetentionMode } from '../../compliance/privacy/impersonaliz
  * which the resource factory guarantees also carries the UPDATE_MANY scrub grant +
  * the `retentionStatus` marker). Discovery (point 1) is shared by both strategies.
  *
+ * REFUSE_WHILE_CHILDREN_EXIST tears nothing down and lists nothing. The parent's delete probes for one
+ * remaining child with a repository READ on the edge's foreign key, whatever the cardinality, so READ
+ * is its whole requirement. Without it every delete of the parent would be refused with CONFIGURATION.
+ *
  * ## Why this is separate from (and dual to) seedability
  *
  * `onParentCreate` (seed) and `onParentDelete` (cascade) are orthogonal DDD axes
@@ -57,8 +61,8 @@ import type { ErasureRetentionMode } from '../../compliance/privacy/impersonaliz
  *
  * ## Fail-closed, fail-open on ambiguity
  *
- * A genuine violation (a reachable adopter missing a discovery/teardown op) is a
- * boot-time throw. When the edge cannot be classified (parent absent from the
+ * A retention violation is a boot-time throw; hard-delete prerequisite findings
+ * are reported separately by the startup caller. When the edge cannot be classified (parent absent from the
  * map) the check skips (fail-open) so it never false-positives or blocks
  * startup. Pure and side-effect free.
  */
@@ -66,8 +70,9 @@ import type { ErasureRetentionMode } from '../../compliance/privacy/impersonaliz
 export interface CompositionCascadeDeletabilityResourceInput {
     resourceIdentifier: ResourceType;
     /**
-     * Flattened per-variant operations — read exactly like the runtime
-     * `supportsOperation` (`op.operationIdentifier === verb && op.isOperationDefault`).
+     * Flattened per-variant operations. Parent reachability includes every callable
+     * variant; child discovery/teardown follows runtime `supportsOperation`
+     * (`op.operationIdentifier === verb && op.isOperationDefault`).
      *
      * `resourceOperationLike` is carried because a CUSTOM operation borrowing a core verb reaches the
      * same repository primitive as the core operation, and so fires the same cascade — see
@@ -92,15 +97,19 @@ export interface CompositionCascadeDeletabilityResourceInput {
     };
     resourceRelationships?: {
         parentRelationships?: ResourceRelationship[];
+        selfRelationships?: ResourceRelationship[];
     };
 }
 export interface CompositionCascadeDeletabilityViolation {
     childResourceType: ResourceType;
     parentResourceType: ResourceType;
     cardinality: 'one-to-one' | 'one-to-many';
-    /** The teardown strategy the edge declared: DELETE (hard-delete) or IMPERSONALIZE_AND_RETAIN (scrub+keep). */
+    /** The strategy the edge declared: DELETE (hard-delete), IMPERSONALIZE_AND_RETAIN (scrub+keep) or REFUSE_WHILE_CHILDREN_EXIST. */
     strategy: ChildLifecycleStrategy;
-    /** The discovery op the cascade needs but the child lacks (READ for 1:1, LIST for 1:many), if any. Shared by both strategies. */
+    /**
+     * The op the edge needs but the child lacks, if any: the cascade's discovery op (READ for 1:1, LIST for
+     * 1:many, shared by DELETE and IMPERSONALIZE_AND_RETAIN), or READ, the existence probe, for REFUSE_WHILE_CHILDREN_EXIST.
+     */
     missingDiscoveryOp?: CoreResourceOperation;
     /** DELETE strategy only: true when the child supports neither DELETE nor DELETE_MANY. */
     missingTeardownOp: boolean;
@@ -118,16 +127,39 @@ export interface CompositionCascadeDeletabilityViolation {
     message: string;
 }
 /**
- * Validate that every composition relationship which opted into
+ * Whether this resource can reach the DELETE post-op logic that fires an `onParentDelete` cascade.
+ *
+ * NOT the same question as `supportsOperation(resource, DELETE)`. A CUSTOM operation declaring
+ * `resourceOperationLike: DELETE` carries its own `operationIdentifier`, so `supportsOperation`
+ * says no — yet it reaches `_doDelete` all the same: the service resolves the core verb through
+ * `getCoreResourceOperationFromOperation` (which falls back to `resourceOperationLike`) and calls
+ * the repository by OPERATION PATH, and the repository's operations map is built from EVERY
+ * configured operation, custom ones included. The `coreOperations` gate on the public
+ * `RepositoryResourceBackendService.delete()` convenience method is simply not on that path.
+ *
+ * Reading only the core verb made the parent-reachability skip below unsound, and it cost real
+ * damage: `user_self | delete_account` (removed 2026-08-01) declared no core DELETE, so this guard
+ * cleared its two `onParentDelete` edges as dormant — while at runtime the custom op fired the
+ * cascade into `USER_SELF_PROFILES` / `USER_SELF_PREFERENCES`, neither of which declares a
+ * teardown op. The cascade threw `ErrorType.CONFIGURATION` inside the delete transaction, so the
+ * delete rolled back for any user who had one of those rows and committed for any user who had
+ * neither. A boot guard that cannot see custom delete-like ops cannot protect that edge.
+ *
+ * `DELETE_MANY` is included for the same reason: `deleteMany` is the cascade's preferred teardown
+ * path and a custom op may borrow it just as readily.
+ */
+export declare function canFireDeleteCascade(resource: CompositionCascadeDeletabilityResourceInput | undefined): boolean;
+/**
+ * Validate that every effective relationship lifecycle which opted into
  * `onParentDelete.enabled` is actually cascade-deletable (its child has the
  * cardinality-appropriate discovery op + a DELETE/DELETE_MANY teardown op),
  * unless the edge is structurally unreachable because the parent cannot fire the
- * cascade. Returns the list of violations (empty when clean); the caller throws
- * on any (fail-closed).
+ * cascade. Returns the list of violations (empty when clean); startup rejects
+ * retention violations and reports hard-delete prerequisites separately.
  *
  * @param resourceConfigurations - the registry's `resourceConfigurations` map
  *   (`resourceType → built configuration`). Each entry is the CHILD in its
- *   `parentRelationships`; parents are looked up in the same map for the
+ *   `parentRelationships` and `selfRelationships`; parents are looked up in the same map for the
  *   reachability skip.
  */
 export declare function validateCompositionCascadeDeletability(resourceConfigurations: Record<string, CompositionCascadeDeletabilityResourceInput>): CompositionCascadeDeletabilityViolation[];

package/dist/esm/resources/utils/composition-cascade-deletability.validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composition-cascade-deletability.validation.d.ts","sourceRoot":"","sources":["../../../../src/resources/utils/composition-cascade-deletability.validation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EAGrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAsB,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,gFAAgF;AAChF,MAAM,WAAW,2CAA2C;IAC1D,kBAAkB,EAAE,YAAY,CAAC;IACjC;;;;;;;;;OASG;IACH,UAAU,EAAE,aAAa,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;KAC/C,CAAC,CAAC;IACH;;;;;;OAMG;IACH,eAAe,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAClD,qBAAqB,CAAC,EAAE;QACtB,mBAAmB,CAAC,EAAE,oBAAoB,EAAE,CAAC;KAC9C,CAAC;CACH;AAED,MAAM,WAAW,uCAAuC;IACtD,iBAAiB,EAAE,YAAY,CAAC;IAChC,kBAAkB,EAAE,YAAY,CAAC;IACjC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAC;IAC1C,8GAA8G;IAC9G,QAAQ,EAAE,sBAAsB,CAAC;IACjC,iIAAiI;IACjI,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C,yFAAyF;IACzF,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAoDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sCAAsC,CACpD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,GAClF,uCAAuC,EAAE,CA6H3C"}
+{"version":3,"file":"composition-cascade-deletability.validation.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/composition-cascade-deletability.validation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EAErB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAsB,sBAAsB,EAAyC,MAAM,oCAAoC,CAAC;AAGvI,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,gFAAgF;AAChF,MAAM,WAAW,2CAA2C;IAC1D,kBAAkB,EAAE,YAAY,CAAC;IACjC;;;;;;;;;;OAUG;IACH,UAAU,EAAE,aAAa,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;KAC/C,CAAC,CAAC;IACH;;;;;;OAMG;IACH,eAAe,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAClD,qBAAqB,CAAC,EAAE;QACtB,mBAAmB,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAC7C,iBAAiB,CAAC,EAAE,oBAAoB,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,MAAM,WAAW,uCAAuC;IACtD,iBAAiB,EAAE,YAAY,CAAC;IAChC,kBAAkB,EAAE,YAAY,CAAC;IACjC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAC;IAC1C,kIAAkI;IAClI,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C,yFAAyF;IACzF,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,2CAA2C,GAAG,SAAS,GAChE,OAAO,CAaT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sCAAsC,CACpD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,GAClF,uCAAuC,EAAE,CAmJ3C"}

package/dist/esm/resources/utils/composition-cascade-deletability.validation.js

@@ -1,6 +1,8 @@
-import { RelationshipNature, isOneToOneCardinality, } from '../resources.shared.schemas.js';
+import { isOneToOneCardinality, } from '../resources.shared.schemas.js';
 import { CoreResourceOperation } from '../resources.shared.core.definitions.js';
-import { ChildLifecycleMode, ChildLifecycleStrategy } from '../child-operations.shared.schemas.js';
+import { ChildLifecycleMode, ChildLifecycleStrategy, resolveChildLifecycleTeardownStrategy } from '../child-operations.shared.schemas.js';
+import { Resources_SharedUtils } from '../resources.shared.utils.js';
+import { getParentDirectionRelationships } from '../resources-config.shared.schemas.js';
 /** Runtime-truthful `supportsOperation`: a default variant for the verb exists. */
 function supportsOperation(resource, verb) {
     return (resource?.operations?.some((op) => op.operationIdentifier === verb && op.isOperationDefault === true) ?? false);
@@ -27,12 +29,12 @@ function supportsOperation(resource, verb) {
  * `DELETE_MANY` is included for the same reason: `deleteMany` is the cascade's preferred teardown
  * path and a custom op may borrow it just as readily.
  */
-function canFireDeleteCascade(resource) {
+export function canFireDeleteCascade(resource) {
     if (!resource?.operations)
         return false;
     return resource.operations.some((op) => {
-        if (op.isOperationDefault !== true)
-            return false;
+        // A selected operation path can invoke any variant. Only child discovery/teardown
+        // convenience calls require defaults; parent reachability must include keyed variants.
         // A core operation carries the verb as its own identifier; a custom one borrows it.
         const effectiveVerb = op.operationIdentifier === CoreResourceOperation.DELETE
             || op.operationIdentifier === CoreResourceOperation.DELETE_MANY
@@ -43,30 +45,30 @@ function canFireDeleteCascade(resource) {
     });
 }
 /**
- * Validate that every composition relationship which opted into
+ * Validate that every effective relationship lifecycle which opted into
  * `onParentDelete.enabled` is actually cascade-deletable (its child has the
  * cardinality-appropriate discovery op + a DELETE/DELETE_MANY teardown op),
  * unless the edge is structurally unreachable because the parent cannot fire the
- * cascade. Returns the list of violations (empty when clean); the caller throws
- * on any (fail-closed).
+ * cascade. Returns the list of violations (empty when clean); startup rejects
+ * retention violations and reports hard-delete prerequisites separately.
  *
  * @param resourceConfigurations - the registry's `resourceConfigurations` map
  *   (`resourceType → built configuration`). Each entry is the CHILD in its
- *   `parentRelationships`; parents are looked up in the same map for the
+ *   `parentRelationships` and `selfRelationships`; parents are looked up in the same map for the
  *   reachability skip.
  */
 export function validateCompositionCascadeDeletability(resourceConfigurations) {
     const violations = [];
     for (const child of Object.values(resourceConfigurations)) {
-        const parentRelationships = child.resourceRelationships?.parentRelationships ?? [];
+        const parentRelationships = getParentDirectionRelationships({
+            parentRelationships: child.resourceRelationships?.parentRelationships ?? [],
+            selfRelationships: child.resourceRelationships?.selfRelationships ?? [],
+            childRelationships: [],
+        });
         for (const relationship of parentRelationships) {
-            if (relationship.nature !== RelationshipNature.COMPOSITION) {
-                continue;
-            }
-            // Only an ENABLED onParentDelete cascade must be cascade-deletable. A
-            // composition WITHOUT it leaves orphans by design choice — not this guard's
-            // concern.
-            const onParentDelete = relationship.childOperations?.lifecycle?.onParentDelete;
+            // Use the same compiled lifecycle policy as execution. Authored nature alone
+            // misses association-to-junction cascades; INDEPENDENT relationships are dormant.
+            const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(relationship);
             if (onParentDelete?.enabled !== true) {
                 continue;
             }
@@ -86,6 +88,27 @@ export function validateCompositionCascadeDeletability(resourceConfigurations) {
             if (!canFireDeleteCascade(parent)) {
                 continue; // structurally unreachable edge — no core AND no delete-like custom op
             }
+            // RESTRICT posture: no discovery list and no teardown. The refusal probes existence with ONE
+            // repository READ on the edge's foreign key, whatever the cardinality, so READ is the whole requirement.
+            if (onParentDelete.strategy === ChildLifecycleStrategy.REFUSE_WHILE_CHILDREN_EXIST) {
+                if (supportsOperation(child, CoreResourceOperation.READ)) {
+                    continue;
+                }
+                violations.push({
+                    childResourceType: child.resourceIdentifier,
+                    parentResourceType: relationship.resourceType1,
+                    cardinality: isOneToOneCardinality(relationship.cardinality2) ? 'one-to-one' : 'one-to-many',
+                    strategy: ChildLifecycleStrategy.REFUSE_WHILE_CHILDREN_EXIST,
+                    missingDiscoveryOp: CoreResourceOperation.READ,
+                    missingTeardownOp: false,
+                    message: `Lifecycle child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +
+                        `declares onParentDelete strategy REFUSE_WHILE_CHILDREN_EXIST but does not support READ. The ` +
+                        `parent's delete probes for a remaining child with a repository READ before it writes anything, ` +
+                        `so every delete of the parent would be refused with CONFIGURATION. Add a READ operation to the ` +
+                        `child (a REPOSITORY_ONLY variant is enough), or declare another strategy.`,
+                });
+                continue;
+            }
             // Discovery op depends on cardinality: 1:1 discovered via READ, 1:many via LIST. SHARED by both
             // teardown strategies — impersonalizeChildrenImmediate reads the same way before scrubbing.
             const oneToOne = isOneToOneCardinality(relationship.cardinality2);
@@ -93,15 +116,15 @@ export function validateCompositionCascadeDeletability(resourceConfigurations) {
             const hasDiscovery = supportsOperation(child, discoveryOp);
             // The teardown STRATEGY decides what the child needs beyond discovery: DELETE (default) needs a
             // DELETE/DELETE_MANY op; IMPERSONALIZE_AND_RETAIN needs the child to be retention-governed.
-            const strategy = onParentDelete.strategy ?? ChildLifecycleStrategy.DELETE;
+            const strategy = resolveChildLifecycleTeardownStrategy(onParentDelete);
             if (strategy === ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN) {
                 // Retain-and-scrub teardown (via updateManyAsSystem), NOT a hard delete. The child must be
                 // retention-governed: only `retentionPolicy` injects the retentionStatus
                 // marker AND derives the UPDATE_MANY scrub grant. A non-retention child has nothing to flip →
                 // impersonalizeChildrenImmediate throws CONFIGURATION and rolls back the parent delete.
                 const isRetentionGoverned = child.retentionPolicy?.mode !== undefined;
-                // v1 executes the retain-and-scrub only in IMMEDIATE mode. A LAZY retain edge parses, boots and
-                // passes CI, then throws on the FIRST production erasure — inside the parent transaction, so a
+                // v1 executes retain-and-scrub only in IMMEDIATE mode. Without this guard, a LAZY retain
+                // edge could pass startup and throw on the first erasure — inside the parent transaction, so a
                 // GDPR deletion request fails. Catch the unsupported combination here instead.
                 const isUnsupportedLazyMode = onParentDelete.mode === ChildLifecycleMode.LAZY;
                 if (hasDiscovery && isRetentionGoverned && !isUnsupportedLazyMode) {
@@ -126,10 +149,10 @@ export function validateCompositionCascadeDeletability(resourceConfigurations) {
                     missingTeardownOp: false, // teardown is a scrub, not a delete op
                     missingRetentionGovernance: !isRetentionGoverned,
                     unsupportedLazyRetainMode: isUnsupportedLazyMode,
-                    message: `Composition child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +
+                    message: `Lifecycle child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +
                         `enabled onParentDelete with strategy IMPERSONALIZE_AND_RETAIN but is NOT impersonalize-able: ` +
                         `missing ${missing.join(' and ')}. The retain-and-scrub cascade (impersonalizeChildrenImmediate) ` +
-                        `would throw ErrorType.CONFIGURATION and roll back the parent delete once a child row exists. ` +
+                        `would fail during parent deletion once a child row exists. ` +
                         `Opt the child into retentionPolicy (RETAIN_ONLY or RETAIN_AND_IMPERSONALIZE), or use strategy DELETE.`,
                 });
                 continue;
@@ -154,7 +177,7 @@ export function validateCompositionCascadeDeletability(resourceConfigurations) {
                 strategy,
                 missingDiscoveryOp: hasDiscovery ? undefined : discoveryOp,
                 missingTeardownOp: !hasTeardown,
-                message: `Composition child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +
+                message: `Lifecycle child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +
                     `enabled onParentDelete but is NOT cascade-deletable: missing ${missing.join(' and ')}. ` +
                     `The delete cascade (deleteChildrenImmediate) would throw ErrorType.CONFIGURATION and roll ` +
                     `back the parent delete once a child row exists. Add the missing op(s) (a REPOSITORY_ONLY ` +

package/dist/esm/resources/utils/composition-cascade-deletability.validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"composition-cascade-deletability.validation.js","sourceRoot":"","sources":["../../../../../src/resources/utils/composition-cascade-deletability.validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAgB,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAuHhG,mFAAmF;AACnF,SAAS,iBAAiB,CACxB,QAAiE,EACjE,IAA2B;IAE3B,OAAO,CACL,QAAQ,EAAE,UAAU,EAAE,IAAI,CACxB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC,kBAAkB,KAAK,IAAI,CAC1E,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,oBAAoB,CAC3B,QAAiE;IAEjE,IAAI,CAAC,QAAQ,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QACrC,IAAI,EAAE,CAAC,kBAAkB,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjD,oFAAoF;QACpF,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;eACxE,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,WAAW;YAC/D,CAAC,CAAE,EAAE,CAAC,mBAA6C;YACnD,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC;QAC7B,OAAO,aAAa,KAAK,qBAAqB,CAAC,MAAM;eAChD,aAAa,KAAK,qBAAqB,CAAC,WAAW,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sCAAsC,CACpD,sBAAmF;IAEnF,MAAM,UAAU,GAA8C,EAAE,CAAC;IAEjE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC1D,MAAM,mBAAmB,GAAG,KAAK,CAAC,qBAAqB,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAEnF,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;YAC/C,IAAI,YAAY,CAAC,MAAM,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;gBAC3D,SAAS;YACX,CAAC;YAED,sEAAsE;YACtE,4EAA4E;YAC5E,WAAW;YACX,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,EAAE,SAAS,EAAE,cAAc,CAAC;YAC/E,IAAI,cAAc,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAED,6FAA6F;YAC7F,sFAAsF;YACtF,8FAA8F;YAC9F,mBAAmB;YACnB,EAAE;YACF,8FAA8F;YAC9F,4FAA4F;YAC5F,2FAA2F;YAC3F,kDAAkD;YAClD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,SAAS,CAAC,qDAAqD;YACjE,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,uEAAuE;YACnF,CAAC;YAED,gGAAgG;YAChG,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;YAClE,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;YACvF,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAE3D,gGAAgG;YAChG,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,IAAI,sBAAsB,CAAC,MAAM,CAAC;YAE1E,IAAI,QAAQ,KAAK,sBAAsB,CAAC,wBAAwB,EAAE,CAAC;gBACjE,2FAA2F;gBAC3F,yEAAyE;gBACzE,8FAA8F;gBAC9F,wFAAwF;gBACxF,MAAM,mBAAmB,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,KAAK,SAAS,CAAC;gBACtE,gGAAgG;gBAChG,+FAA+F;gBAC/F,+EAA+E;gBAC/E,MAAM,qBAAqB,GAAG,cAAc,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,CAAC;gBAC9E,IAAI,YAAY,IAAI,mBAAmB,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAClE,SAAS,CAAC,qBAAqB;gBACjC,CAAC;gBAED,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,iBAAiB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC;gBACzF,CAAC;gBACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,OAAO,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;gBACrH,CAAC;gBACD,IAAI,qBAAqB,EAAE,CAAC;oBAC1B,OAAO,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;gBAC5G,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC;oBACd,iBAAiB,EAAE,KAAK,CAAC,kBAAkB;oBAC3C,kBAAkB,EAAE,YAAY,CAAC,aAAa;oBAC9C,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa;oBACpD,QAAQ;oBACR,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;oBAC1D,iBAAiB,EAAE,KAAK,EAAE,uCAAuC;oBACjE,0BAA0B,EAAE,CAAC,mBAAmB;oBAChD,yBAAyB,EAAE,qBAAqB;oBAChD,OAAO,EACL,sBAAsB,KAAK,CAAC,kBAAkB,cAAc,YAAY,CAAC,aAAa,KAAK;wBAC3F,+FAA+F;wBAC/F,WAAW,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kEAAkE;wBAClG,+FAA+F;wBAC/F,uGAAuG;iBAC1G,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,wGAAwG;YACxG,MAAM,WAAW,GACf,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC;gBAC3D,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAEzD,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;gBAChC,SAAS,CAAC,oBAAoB;YAChC,CAAC;YAED,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,iBAAiB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC5D,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,iBAAiB,EAAE,KAAK,CAAC,kBAAkB;gBAC3C,kBAAkB,EAAE,YAAY,CAAC,aAAa;gBAC9C,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa;gBACpD,QAAQ;gBACR,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;gBAC1D,iBAAiB,EAAE,CAAC,WAAW;gBAC/B,OAAO,EACL,sBAAsB,KAAK,CAAC,kBAAkB,cAAc,YAAY,CAAC,aAAa,KAAK;oBAC3F,gEAAgE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACzF,4FAA4F;oBAC5F,2FAA2F;oBAC3F,iEAAiE;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  ResourceRelationship,\n  RelationshipNature,\n  isOneToOneCardinality,\n} from '../resources.shared.schemas';\nimport { ResourceType, CoreResourceOperation } from '../resources.shared.core.definitions';\nimport { ChildLifecycleMode, ChildLifecycleStrategy } from '../child-operations.shared.schemas';\nimport type { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Registry-level guardrail for the composition `onParentDelete` lifecycle — the\n * DELETE-side counterpart to `validateCompositionSeedability`.\n *\n * A composition relationship that OPTS IN to the delete cascade\n * (`childOperations.lifecycle.onParentDelete.enabled = true`) must actually be\n * cascade-deletable, or the runtime cascade throws `ErrorType.CONFIGURATION`\n * INSIDE the parent's delete transaction and ROLLS BACK the parent delete. Two\n * things must hold on the child, checked here with the exact predicate the\n * runtime uses (`supportsOperation`: the op has a default variant):\n *\n *  1. **Discovery** — `deleteChildrenImmediate` loads the children before\n *     deleting them: a 1:1 child via READ, a 1:many child via LIST. Missing that\n *     op → `CONFIGURATION` throw.\n *  2. **Teardown** — it then removes them via DELETE_MANY (preferred) or a\n *     per-row DELETE loop. Missing BOTH → `CONFIGURATION` throw. (DELETE strategy.)\n *\n * ## Two teardown strategies (`onParentDelete.strategy`)\n *\n * DELETE (default) hard-deletes the child, so it needs the DELETE/DELETE_MANY\n * teardown op above. IMPERSONALIZE_AND_RETAIN instead scrubs the child's personal\n * fields IN PLACE and KEEPS the row (retain-for-audit, GDPR Art. 17(3)(b)), via the\n * trusted `updateManyAsSystem` writer — so it needs NO delete op. It instead needs\n * the child to be retention-governed (`retentionPolicy`,\n * which the resource factory guarantees also carries the UPDATE_MANY scrub grant +\n * the `retentionStatus` marker). Discovery (point 1) is shared by both strategies.\n *\n * ## Why this is separate from (and dual to) seedability\n *\n * `onParentCreate` (seed) and `onParentDelete` (cascade) are orthogonal DDD axes\n * (created-with vs dies-with). The seed resolves the child's CREATE through the\n * SERVICE tier (rejects REPOSITORY_ONLY); the cascade deletes through the\n * REPOSITORY tier (variant-agnostic). So the two guards check different ops on\n * different resolution paths and neither implies the other — a child can be\n * seedable but not cascade-deletable (exactly the gap that shipped for the\n * lifecycle / guidance / progression / preferences / notifications adopters).\n *\n * ## Unreachable edges are NOT violations (parent-reachability skip)\n *\n * The cascade runs ONLY from the PARENT's DELETE / DELETE_MANY post-op logic. If\n * the parent can reach neither, the edge is structurally unreachable — dormant,\n * never fired — and is intentionally skipped (e.g. `USER_SELF` exposes only\n * READ/UPDATE, so `USER_SELF → USER_SELF_PREFERENCES/PROFILES` never cascades;\n * real user deletion runs through `USERS`, whose profile/preferences children DO\n * carry DELETE). This skip is self-correcting: the day the parent gains a delete\n * path, its dormant edges become reachable and this guard fires.\n *\n * \"Can reach\" means {@link canFireDeleteCascade}, not `supportsOperation` — a\n * CUSTOM operation borrowing the verb through `resourceOperationLike` fires the\n * cascade exactly as a core DELETE does. Reading only the core verb made this\n * skip unsound; `user_self | delete_account` (removed 2026-08-01) was the live\n * case, and its two edges reported clean here while throwing at runtime.\n *\n * ## Fail-closed, fail-open on ambiguity\n *\n * A genuine violation (a reachable adopter missing a discovery/teardown op) is a\n * boot-time throw. When the edge cannot be classified (parent absent from the\n * map) the check skips (fail-open) so it never false-positives or blocks\n * startup. Pure and side-effect free.\n */\n\n/** Structural subset of a built resource configuration this validator needs. */\nexport interface CompositionCascadeDeletabilityResourceInput {\n  resourceIdentifier: ResourceType;\n  /**\n   * Flattened per-variant operations — read exactly like the runtime\n   * `supportsOperation` (`op.operationIdentifier === verb && op.isOperationDefault`).\n   *\n   * `resourceOperationLike` is carried because a CUSTOM operation borrowing a core verb reaches the\n   * same repository primitive as the core operation, and so fires the same cascade — see\n   * {@link canFireDeleteCascade}. A child's teardown capability is still read through\n   * {@link supportsOperation} (the runtime `supportsOperation` the cascade itself calls), so the\n   * extra field matters only on the PARENT side.\n   */\n  operations: ReadonlyArray<{\n    operationIdentifier: string;\n    isOperationDefault?: boolean;\n    resourceOperationLike?: CoreResourceOperation;\n  }>;\n  /**\n   * Resolved retention policy, present (and normalized to opted-in) IFF this resource is\n   * retention-governed (`retentionPolicy`). Only such resources carry the\n   * factory-injected `retentionStatus` marker AND the derived UPDATE_MANY scrub grant, so only they\n   * can be the CHILD of an `IMPERSONALIZE_AND_RETAIN` onParentDelete edge. Absent = not\n   * retention-governed → an `IMPERSONALIZE_AND_RETAIN` edge toward it is a violation.\n   */\n  retentionPolicy?: { mode?: ErasureRetentionMode };\n  resourceRelationships?: {\n    parentRelationships?: ResourceRelationship[];\n  };\n}\n\nexport interface CompositionCascadeDeletabilityViolation {\n  childResourceType: ResourceType;\n  parentResourceType: ResourceType;\n  cardinality: 'one-to-one' | 'one-to-many';\n  /** The teardown strategy the edge declared: DELETE (hard-delete) or IMPERSONALIZE_AND_RETAIN (scrub+keep). */\n  strategy: ChildLifecycleStrategy;\n  /** The discovery op the cascade needs but the child lacks (READ for 1:1, LIST for 1:many), if any. Shared by both strategies. */\n  missingDiscoveryOp?: CoreResourceOperation;\n  /** DELETE strategy only: true when the child supports neither DELETE nor DELETE_MANY. */\n  missingTeardownOp: boolean;\n  /**\n   * IMPERSONALIZE_AND_RETAIN strategy only: true when the child is NOT retention-governed\n   * (no `retentionPolicy` → no `retentionStatus` marker + no derived\n   * UPDATE_MANY scrub grant to flip it with).\n   */\n  missingRetentionGovernance?: boolean;\n  /**\n   * IMPERSONALIZE_AND_RETAIN strategy only: true when the edge declares `mode: LAZY`, which v1 cannot\n   * execute (there is no async retain-and-scrub) and which would otherwise throw on the first erasure.\n   */\n  unsupportedLazyRetainMode?: boolean;\n  message: string;\n}\n\n/** Runtime-truthful `supportsOperation`: a default variant for the verb exists. */\nfunction supportsOperation(\n  resource: CompositionCascadeDeletabilityResourceInput | undefined,\n  verb: CoreResourceOperation,\n): boolean {\n  return (\n    resource?.operations?.some(\n      (op) => op.operationIdentifier === verb && op.isOperationDefault === true,\n    ) ?? false\n  );\n}\n\n/**\n * Whether this resource can reach the DELETE post-op logic that fires an `onParentDelete` cascade.\n *\n * NOT the same question as `supportsOperation(resource, DELETE)`. A CUSTOM operation declaring\n * `resourceOperationLike: DELETE` carries its own `operationIdentifier`, so `supportsOperation`\n * says no — yet it reaches `_doDelete` all the same: the service resolves the core verb through\n * `getCoreResourceOperationFromOperation` (which falls back to `resourceOperationLike`) and calls\n * the repository by OPERATION PATH, and the repository's operations map is built from EVERY\n * configured operation, custom ones included. The `coreOperations` gate on the public\n * `RepositoryResourceBackendService.delete()` convenience method is simply not on that path.\n *\n * Reading only the core verb made the parent-reachability skip below unsound, and it cost real\n * damage: `user_self | delete_account` (removed 2026-08-01) declared no core DELETE, so this guard\n * cleared its two `onParentDelete` edges as dormant — while at runtime the custom op fired the\n * cascade into `USER_SELF_PROFILES` / `USER_SELF_PREFERENCES`, neither of which declares a\n * teardown op. The cascade threw `ErrorType.CONFIGURATION` inside the delete transaction, so the\n * delete rolled back for any user who had one of those rows and committed for any user who had\n * neither. A boot guard that cannot see custom delete-like ops cannot protect that edge.\n *\n * `DELETE_MANY` is included for the same reason: `deleteMany` is the cascade's preferred teardown\n * path and a custom op may borrow it just as readily.\n */\nfunction canFireDeleteCascade(\n  resource: CompositionCascadeDeletabilityResourceInput | undefined,\n): boolean {\n  if (!resource?.operations) return false;\n  return resource.operations.some((op) => {\n    if (op.isOperationDefault !== true) return false;\n    // A core operation carries the verb as its own identifier; a custom one borrows it.\n    const effectiveVerb = op.operationIdentifier === CoreResourceOperation.DELETE\n      || op.operationIdentifier === CoreResourceOperation.DELETE_MANY\n      ? (op.operationIdentifier as CoreResourceOperation)\n      : op.resourceOperationLike;\n    return effectiveVerb === CoreResourceOperation.DELETE\n      || effectiveVerb === CoreResourceOperation.DELETE_MANY;\n  });\n}\n\n/**\n * Validate that every composition relationship which opted into\n * `onParentDelete.enabled` is actually cascade-deletable (its child has the\n * cardinality-appropriate discovery op + a DELETE/DELETE_MANY teardown op),\n * unless the edge is structurally unreachable because the parent cannot fire the\n * cascade. Returns the list of violations (empty when clean); the caller throws\n * on any (fail-closed).\n *\n * @param resourceConfigurations - the registry's `resourceConfigurations` map\n *   (`resourceType → built configuration`). Each entry is the CHILD in its\n *   `parentRelationships`; parents are looked up in the same map for the\n *   reachability skip.\n */\nexport function validateCompositionCascadeDeletability(\n  resourceConfigurations: Record<string, CompositionCascadeDeletabilityResourceInput>,\n): CompositionCascadeDeletabilityViolation[] {\n  const violations: CompositionCascadeDeletabilityViolation[] = [];\n\n  for (const child of Object.values(resourceConfigurations)) {\n    const parentRelationships = child.resourceRelationships?.parentRelationships ?? [];\n\n    for (const relationship of parentRelationships) {\n      if (relationship.nature !== RelationshipNature.COMPOSITION) {\n        continue;\n      }\n\n      // Only an ENABLED onParentDelete cascade must be cascade-deletable. A\n      // composition WITHOUT it leaves orphans by design choice — not this guard's\n      // concern.\n      const onParentDelete = relationship.childOperations?.lifecycle?.onParentDelete;\n      if (onParentDelete?.enabled !== true) {\n        continue;\n      }\n\n      // Parent-reachability skip: the cascade fires from the parent's DELETE / DELETE_MANY post-op\n      // logic. A parent that can reach neither can never trigger this edge → dormant, not a\n      // violation. Self-correcting: the day the parent gains a delete path, this stops skipping and\n      // the guard fires.\n      //\n      // Reachability is `canFireDeleteCascade`, NOT `supportsOperation` — a CUSTOM op borrowing the\n      // verb via `resourceOperationLike` fires the cascade too, and reading only the core verb is\n      // what let `user_self | delete_account` cascade into two teardown-less children while this\n      // guard reported clean. See the function's JSDoc.\n      const parent = resourceConfigurations[relationship.resourceType1];\n      if (!parent) {\n        continue; // fail-open: parent not in this map, cannot classify\n      }\n      if (!canFireDeleteCascade(parent)) {\n        continue; // structurally unreachable edge — no core AND no delete-like custom op\n      }\n\n      // Discovery op depends on cardinality: 1:1 discovered via READ, 1:many via LIST. SHARED by both\n      // teardown strategies — impersonalizeChildrenImmediate reads the same way before scrubbing.\n      const oneToOne = isOneToOneCardinality(relationship.cardinality2);\n      const discoveryOp = oneToOne ? CoreResourceOperation.READ : CoreResourceOperation.LIST;\n      const hasDiscovery = supportsOperation(child, discoveryOp);\n\n      // The teardown STRATEGY decides what the child needs beyond discovery: DELETE (default) needs a\n      // DELETE/DELETE_MANY op; IMPERSONALIZE_AND_RETAIN needs the child to be retention-governed.\n      const strategy = onParentDelete.strategy ?? ChildLifecycleStrategy.DELETE;\n\n      if (strategy === ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN) {\n        // Retain-and-scrub teardown (via updateManyAsSystem), NOT a hard delete. The child must be\n        // retention-governed: only `retentionPolicy` injects the retentionStatus\n        // marker AND derives the UPDATE_MANY scrub grant. A non-retention child has nothing to flip →\n        // impersonalizeChildrenImmediate throws CONFIGURATION and rolls back the parent delete.\n        const isRetentionGoverned = child.retentionPolicy?.mode !== undefined;\n        // v1 executes the retain-and-scrub only in IMMEDIATE mode. A LAZY retain edge parses, boots and\n        // passes CI, then throws on the FIRST production erasure — inside the parent transaction, so a\n        // GDPR deletion request fails. Catch the unsupported combination here instead.\n        const isUnsupportedLazyMode = onParentDelete.mode === ChildLifecycleMode.LAZY;\n        if (hasDiscovery && isRetentionGoverned && !isUnsupportedLazyMode) {\n          continue; // impersonalize-able\n        }\n\n        const missing: string[] = [];\n        if (!hasDiscovery) {\n          missing.push(`${discoveryOp} (to discover ${oneToOne ? '1:1' : '1:many'} dependents)`);\n        }\n        if (!isRetentionGoverned) {\n          missing.push('retentionPolicy (either mode — to carry the retentionStatus marker + the UPDATE_MANY retain grant)');\n        }\n        if (isUnsupportedLazyMode) {\n          missing.push('mode: IMMEDIATE (v1 has no async retain-and-scrub; LAZY would throw on the first erasure)');\n        }\n\n        violations.push({\n          childResourceType: child.resourceIdentifier,\n          parentResourceType: relationship.resourceType1,\n          cardinality: oneToOne ? 'one-to-one' : 'one-to-many',\n          strategy,\n          missingDiscoveryOp: hasDiscovery ? undefined : discoveryOp,\n          missingTeardownOp: false, // teardown is a scrub, not a delete op\n          missingRetentionGovernance: !isRetentionGoverned,\n          unsupportedLazyRetainMode: isUnsupportedLazyMode,\n          message:\n            `Composition child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +\n            `enabled onParentDelete with strategy IMPERSONALIZE_AND_RETAIN but is NOT impersonalize-able: ` +\n            `missing ${missing.join(' and ')}. The retain-and-scrub cascade (impersonalizeChildrenImmediate) ` +\n            `would throw ErrorType.CONFIGURATION and roll back the parent delete once a child row exists. ` +\n            `Opt the child into retentionPolicy (RETAIN_ONLY or RETAIN_AND_IMPERSONALIZE), or use strategy DELETE.`,\n        });\n        continue;\n      }\n\n      // DELETE strategy (default): teardown op is DELETE_MANY (preferred by the cascade) or a per-row DELETE.\n      const hasTeardown =\n        supportsOperation(child, CoreResourceOperation.DELETE_MANY) ||\n        supportsOperation(child, CoreResourceOperation.DELETE);\n\n      if (hasDiscovery && hasTeardown) {\n        continue; // cascade-deletable\n      }\n\n      const missing: string[] = [];\n      if (!hasDiscovery) {\n        missing.push(`${discoveryOp} (to discover ${oneToOne ? '1:1' : '1:many'} dependents)`);\n      }\n      if (!hasTeardown) {\n        missing.push('DELETE or DELETE_MANY (to remove the row)');\n      }\n\n      violations.push({\n        childResourceType: child.resourceIdentifier,\n        parentResourceType: relationship.resourceType1,\n        cardinality: oneToOne ? 'one-to-one' : 'one-to-many',\n        strategy,\n        missingDiscoveryOp: hasDiscovery ? undefined : discoveryOp,\n        missingTeardownOp: !hasTeardown,\n        message:\n          `Composition child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +\n          `enabled onParentDelete but is NOT cascade-deletable: missing ${missing.join(' and ')}. ` +\n          `The delete cascade (deleteChildrenImmediate) would throw ErrorType.CONFIGURATION and roll ` +\n          `back the parent delete once a child row exists. Add the missing op(s) (a REPOSITORY_ONLY ` +\n          `DELETE is enough for teardown), or drop onParentDelete.enabled.`,\n      });\n    }\n  }\n\n  return violations;\n}\n"]}
+{"version":3,"file":"composition-cascade-deletability.validation.js","sourceRoot":"","sources":["../../../../../src/resources/utils/composition-cascade-deletability.validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAgB,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAC;AACvI,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,+BAA+B,EAAE,MAAM,oCAAoC,CAAC;AAgIrF,mFAAmF;AACnF,SAAS,iBAAiB,CACxB,QAAiE,EACjE,IAA2B;IAE3B,OAAO,CACL,QAAQ,EAAE,UAAU,EAAE,IAAI,CACxB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC,kBAAkB,KAAK,IAAI,CAC1E,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAiE;IAEjE,IAAI,CAAC,QAAQ,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QACrC,kFAAkF;QAClF,uFAAuF;QACvF,oFAAoF;QACpF,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;eACxE,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,WAAW;YAC/D,CAAC,CAAE,EAAE,CAAC,mBAA6C;YACnD,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC;QAC7B,OAAO,aAAa,KAAK,qBAAqB,CAAC,MAAM;eAChD,aAAa,KAAK,qBAAqB,CAAC,WAAW,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sCAAsC,CACpD,sBAAmF;IAEnF,MAAM,UAAU,GAA8C,EAAE,CAAC;IAEjE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC1D,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;YAC1D,mBAAmB,EAAE,KAAK,CAAC,qBAAqB,EAAE,mBAAmB,IAAI,EAAE;YAC3E,iBAAiB,EAAE,KAAK,CAAC,qBAAqB,EAAE,iBAAiB,IAAI,EAAE;YACvE,kBAAkB,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;YAC/C,6EAA6E;YAC7E,kFAAkF;YAClF,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAAC,YAAY,CAAC,CAAC;YAC5G,IAAI,cAAc,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAED,6FAA6F;YAC7F,sFAAsF;YACtF,8FAA8F;YAC9F,mBAAmB;YACnB,EAAE;YACF,8FAA8F;YAC9F,4FAA4F;YAC5F,2FAA2F;YAC3F,kDAAkD;YAClD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,SAAS,CAAC,qDAAqD;YACjE,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,uEAAuE;YACnF,CAAC;YAED,6FAA6F;YAC7F,yGAAyG;YACzG,IAAI,cAAc,CAAC,QAAQ,KAAK,sBAAsB,CAAC,2BAA2B,EAAE,CAAC;gBACnF,IAAI,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzD,SAAS;gBACX,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC;oBACd,iBAAiB,EAAE,KAAK,CAAC,kBAAkB;oBAC3C,kBAAkB,EAAE,YAAY,CAAC,aAAa;oBAC9C,WAAW,EAAE,qBAAqB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa;oBAC5F,QAAQ,EAAE,sBAAsB,CAAC,2BAA2B;oBAC5D,kBAAkB,EAAE,qBAAqB,CAAC,IAAI;oBAC9C,iBAAiB,EAAE,KAAK;oBACxB,OAAO,EACL,oBAAoB,KAAK,CAAC,kBAAkB,cAAc,YAAY,CAAC,aAAa,KAAK;wBACzF,8FAA8F;wBAC9F,iGAAiG;wBACjG,iGAAiG;wBACjG,2EAA2E;iBAC9E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,gGAAgG;YAChG,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;YAClE,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;YACvF,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAE3D,gGAAgG;YAChG,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,qCAAqC,CAAC,cAAc,CAAE,CAAC;YAExE,IAAI,QAAQ,KAAK,sBAAsB,CAAC,wBAAwB,EAAE,CAAC;gBACjE,2FAA2F;gBAC3F,yEAAyE;gBACzE,8FAA8F;gBAC9F,wFAAwF;gBACxF,MAAM,mBAAmB,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,KAAK,SAAS,CAAC;gBACtE,yFAAyF;gBACzF,+FAA+F;gBAC/F,+EAA+E;gBAC/E,MAAM,qBAAqB,GAAG,cAAc,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,CAAC;gBAC9E,IAAI,YAAY,IAAI,mBAAmB,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAClE,SAAS,CAAC,qBAAqB;gBACjC,CAAC;gBAED,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,iBAAiB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC;gBACzF,CAAC;gBACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,OAAO,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;gBACrH,CAAC;gBACD,IAAI,qBAAqB,EAAE,CAAC;oBAC1B,OAAO,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;gBAC5G,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC;oBACd,iBAAiB,EAAE,KAAK,CAAC,kBAAkB;oBAC3C,kBAAkB,EAAE,YAAY,CAAC,aAAa;oBAC9C,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa;oBACpD,QAAQ;oBACR,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;oBAC1D,iBAAiB,EAAE,KAAK,EAAE,uCAAuC;oBACjE,0BAA0B,EAAE,CAAC,mBAAmB;oBAChD,yBAAyB,EAAE,qBAAqB;oBAChD,OAAO,EACL,oBAAoB,KAAK,CAAC,kBAAkB,cAAc,YAAY,CAAC,aAAa,KAAK;wBACzF,+FAA+F;wBAC/F,WAAW,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kEAAkE;wBAClG,6DAA6D;wBAC7D,uGAAuG;iBAC1G,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,wGAAwG;YACxG,MAAM,WAAW,GACf,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC;gBAC3D,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAEzD,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;gBAChC,SAAS,CAAC,oBAAoB;YAChC,CAAC;YAED,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,iBAAiB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC5D,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,iBAAiB,EAAE,KAAK,CAAC,kBAAkB;gBAC3C,kBAAkB,EAAE,YAAY,CAAC,aAAa;gBAC9C,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa;gBACpD,QAAQ;gBACR,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;gBAC1D,iBAAiB,EAAE,CAAC,WAAW;gBAC/B,OAAO,EACL,oBAAoB,KAAK,CAAC,kBAAkB,cAAc,YAAY,CAAC,aAAa,KAAK;oBACzF,gEAAgE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACzF,4FAA4F;oBAC5F,2FAA2F;oBAC3F,iEAAiE;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  ResourceRelationship,\n  isOneToOneCardinality,\n} from '../resources.shared.schemas';\nimport { ResourceType, CoreResourceOperation } from '../resources.shared.core.definitions';\nimport { ChildLifecycleMode, ChildLifecycleStrategy, resolveChildLifecycleTeardownStrategy } from '../child-operations.shared.schemas';\nimport { Resources_SharedUtils } from '../resources.shared.utils';\nimport { getParentDirectionRelationships } from '../resources-config.shared.schemas';\nimport type { ErasureRetentionMode } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Registry-level guardrail for the effective `onParentDelete` lifecycle — the\n * DELETE-side counterpart to `validateCompositionSeedability`.\n *\n * A relationship that OPTS IN to the delete cascade\n * (`childOperations.lifecycle.onParentDelete.enabled = true`) must actually be\n * cascade-deletable, or the runtime cascade throws `ErrorType.CONFIGURATION`\n * INSIDE the parent's delete transaction and ROLLS BACK the parent delete. Two\n * things must hold on the child, checked here with the exact predicate the\n * runtime uses (`supportsOperation`: the op has a default variant):\n *\n *  1. **Discovery** — `deleteChildrenImmediate` loads the children before\n *     deleting them: a 1:1 child via READ, a 1:many child via LIST. Missing that\n *     op → `CONFIGURATION` throw.\n *  2. **Teardown** — it then removes them via DELETE_MANY (preferred) or a\n *     per-row DELETE loop. Missing BOTH → `CONFIGURATION` throw. (DELETE strategy.)\n *\n * ## Two teardown strategies (`onParentDelete.strategy`)\n *\n * DELETE (default) hard-deletes the child, so it needs the DELETE/DELETE_MANY\n * teardown op above. IMPERSONALIZE_AND_RETAIN instead scrubs the child's personal\n * fields IN PLACE and KEEPS the row (retain-for-audit, GDPR Art. 17(3)(b)), via the\n * trusted `updateManyAsSystem` writer — so it needs NO delete op. It instead needs\n * the child to be retention-governed (`retentionPolicy`,\n * which the resource factory guarantees also carries the UPDATE_MANY scrub grant +\n * the `retentionStatus` marker). Discovery (point 1) is shared by both strategies.\n *\n * REFUSE_WHILE_CHILDREN_EXIST tears nothing down and lists nothing. The parent's delete probes for one\n * remaining child with a repository READ on the edge's foreign key, whatever the cardinality, so READ\n * is its whole requirement. Without it every delete of the parent would be refused with CONFIGURATION.\n *\n * ## Why this is separate from (and dual to) seedability\n *\n * `onParentCreate` (seed) and `onParentDelete` (cascade) are orthogonal DDD axes\n * (created-with vs dies-with). The seed resolves the child's CREATE through the\n * SERVICE tier (rejects REPOSITORY_ONLY); the cascade deletes through the\n * REPOSITORY tier (variant-agnostic). So the two guards check different ops on\n * different resolution paths and neither implies the other — a child can be\n * seedable but not cascade-deletable (exactly the gap that shipped for the\n * lifecycle / guidance / progression / preferences / notifications adopters).\n *\n * ## Unreachable edges are NOT violations (parent-reachability skip)\n *\n * The cascade runs ONLY from the PARENT's DELETE / DELETE_MANY post-op logic. If\n * the parent can reach neither, the edge is structurally unreachable — dormant,\n * never fired — and is intentionally skipped (e.g. `USER_SELF` exposes only\n * READ/UPDATE, so `USER_SELF → USER_SELF_PREFERENCES/PROFILES` never cascades;\n * real user deletion runs through `USERS`, whose profile/preferences children DO\n * carry DELETE). This skip is self-correcting: the day the parent gains a delete\n * path, its dormant edges become reachable and this guard fires.\n *\n * \"Can reach\" means {@link canFireDeleteCascade}, not `supportsOperation` — a\n * CUSTOM operation borrowing the verb through `resourceOperationLike` fires the\n * cascade exactly as a core DELETE does. Reading only the core verb made this\n * skip unsound; `user_self | delete_account` (removed 2026-08-01) was the live\n * case, and its two edges reported clean here while throwing at runtime.\n *\n * ## Fail-closed, fail-open on ambiguity\n *\n * A retention violation is a boot-time throw; hard-delete prerequisite findings\n * are reported separately by the startup caller. When the edge cannot be classified (parent absent from the\n * map) the check skips (fail-open) so it never false-positives or blocks\n * startup. Pure and side-effect free.\n */\n\n/** Structural subset of a built resource configuration this validator needs. */\nexport interface CompositionCascadeDeletabilityResourceInput {\n  resourceIdentifier: ResourceType;\n  /**\n   * Flattened per-variant operations. Parent reachability includes every callable\n   * variant; child discovery/teardown follows runtime `supportsOperation`\n   * (`op.operationIdentifier === verb && op.isOperationDefault`).\n   *\n   * `resourceOperationLike` is carried because a CUSTOM operation borrowing a core verb reaches the\n   * same repository primitive as the core operation, and so fires the same cascade — see\n   * {@link canFireDeleteCascade}. A child's teardown capability is still read through\n   * {@link supportsOperation} (the runtime `supportsOperation` the cascade itself calls), so the\n   * extra field matters only on the PARENT side.\n   */\n  operations: ReadonlyArray<{\n    operationIdentifier: string;\n    isOperationDefault?: boolean;\n    resourceOperationLike?: CoreResourceOperation;\n  }>;\n  /**\n   * Resolved retention policy, present (and normalized to opted-in) IFF this resource is\n   * retention-governed (`retentionPolicy`). Only such resources carry the\n   * factory-injected `retentionStatus` marker AND the derived UPDATE_MANY scrub grant, so only they\n   * can be the CHILD of an `IMPERSONALIZE_AND_RETAIN` onParentDelete edge. Absent = not\n   * retention-governed → an `IMPERSONALIZE_AND_RETAIN` edge toward it is a violation.\n   */\n  retentionPolicy?: { mode?: ErasureRetentionMode };\n  resourceRelationships?: {\n    parentRelationships?: ResourceRelationship[];\n    selfRelationships?: ResourceRelationship[];\n  };\n}\n\nexport interface CompositionCascadeDeletabilityViolation {\n  childResourceType: ResourceType;\n  parentResourceType: ResourceType;\n  cardinality: 'one-to-one' | 'one-to-many';\n  /** The strategy the edge declared: DELETE (hard-delete), IMPERSONALIZE_AND_RETAIN (scrub+keep) or REFUSE_WHILE_CHILDREN_EXIST. */\n  strategy: ChildLifecycleStrategy;\n  /**\n   * The op the edge needs but the child lacks, if any: the cascade's discovery op (READ for 1:1, LIST for\n   * 1:many, shared by DELETE and IMPERSONALIZE_AND_RETAIN), or READ, the existence probe, for REFUSE_WHILE_CHILDREN_EXIST.\n   */\n  missingDiscoveryOp?: CoreResourceOperation;\n  /** DELETE strategy only: true when the child supports neither DELETE nor DELETE_MANY. */\n  missingTeardownOp: boolean;\n  /**\n   * IMPERSONALIZE_AND_RETAIN strategy only: true when the child is NOT retention-governed\n   * (no `retentionPolicy` → no `retentionStatus` marker + no derived\n   * UPDATE_MANY scrub grant to flip it with).\n   */\n  missingRetentionGovernance?: boolean;\n  /**\n   * IMPERSONALIZE_AND_RETAIN strategy only: true when the edge declares `mode: LAZY`, which v1 cannot\n   * execute (there is no async retain-and-scrub) and which would otherwise throw on the first erasure.\n   */\n  unsupportedLazyRetainMode?: boolean;\n  message: string;\n}\n\n/** Runtime-truthful `supportsOperation`: a default variant for the verb exists. */\nfunction supportsOperation(\n  resource: CompositionCascadeDeletabilityResourceInput | undefined,\n  verb: CoreResourceOperation,\n): boolean {\n  return (\n    resource?.operations?.some(\n      (op) => op.operationIdentifier === verb && op.isOperationDefault === true,\n    ) ?? false\n  );\n}\n\n/**\n * Whether this resource can reach the DELETE post-op logic that fires an `onParentDelete` cascade.\n *\n * NOT the same question as `supportsOperation(resource, DELETE)`. A CUSTOM operation declaring\n * `resourceOperationLike: DELETE` carries its own `operationIdentifier`, so `supportsOperation`\n * says no — yet it reaches `_doDelete` all the same: the service resolves the core verb through\n * `getCoreResourceOperationFromOperation` (which falls back to `resourceOperationLike`) and calls\n * the repository by OPERATION PATH, and the repository's operations map is built from EVERY\n * configured operation, custom ones included. The `coreOperations` gate on the public\n * `RepositoryResourceBackendService.delete()` convenience method is simply not on that path.\n *\n * Reading only the core verb made the parent-reachability skip below unsound, and it cost real\n * damage: `user_self | delete_account` (removed 2026-08-01) declared no core DELETE, so this guard\n * cleared its two `onParentDelete` edges as dormant — while at runtime the custom op fired the\n * cascade into `USER_SELF_PROFILES` / `USER_SELF_PREFERENCES`, neither of which declares a\n * teardown op. The cascade threw `ErrorType.CONFIGURATION` inside the delete transaction, so the\n * delete rolled back for any user who had one of those rows and committed for any user who had\n * neither. A boot guard that cannot see custom delete-like ops cannot protect that edge.\n *\n * `DELETE_MANY` is included for the same reason: `deleteMany` is the cascade's preferred teardown\n * path and a custom op may borrow it just as readily.\n */\nexport function canFireDeleteCascade(\n  resource: CompositionCascadeDeletabilityResourceInput | undefined,\n): boolean {\n  if (!resource?.operations) return false;\n  return resource.operations.some((op) => {\n    // A selected operation path can invoke any variant. Only child discovery/teardown\n    // convenience calls require defaults; parent reachability must include keyed variants.\n    // A core operation carries the verb as its own identifier; a custom one borrows it.\n    const effectiveVerb = op.operationIdentifier === CoreResourceOperation.DELETE\n      || op.operationIdentifier === CoreResourceOperation.DELETE_MANY\n      ? (op.operationIdentifier as CoreResourceOperation)\n      : op.resourceOperationLike;\n    return effectiveVerb === CoreResourceOperation.DELETE\n      || effectiveVerb === CoreResourceOperation.DELETE_MANY;\n  });\n}\n\n/**\n * Validate that every effective relationship lifecycle which opted into\n * `onParentDelete.enabled` is actually cascade-deletable (its child has the\n * cardinality-appropriate discovery op + a DELETE/DELETE_MANY teardown op),\n * unless the edge is structurally unreachable because the parent cannot fire the\n * cascade. Returns the list of violations (empty when clean); startup rejects\n * retention violations and reports hard-delete prerequisites separately.\n *\n * @param resourceConfigurations - the registry's `resourceConfigurations` map\n *   (`resourceType → built configuration`). Each entry is the CHILD in its\n *   `parentRelationships` and `selfRelationships`; parents are looked up in the same map for the\n *   reachability skip.\n */\nexport function validateCompositionCascadeDeletability(\n  resourceConfigurations: Record<string, CompositionCascadeDeletabilityResourceInput>,\n): CompositionCascadeDeletabilityViolation[] {\n  const violations: CompositionCascadeDeletabilityViolation[] = [];\n\n  for (const child of Object.values(resourceConfigurations)) {\n    const parentRelationships = getParentDirectionRelationships({\n      parentRelationships: child.resourceRelationships?.parentRelationships ?? [],\n      selfRelationships: child.resourceRelationships?.selfRelationships ?? [],\n      childRelationships: [],\n    });\n\n    for (const relationship of parentRelationships) {\n      // Use the same compiled lifecycle policy as execution. Authored nature alone\n      // misses association-to-junction cascades; INDEPENDENT relationships are dormant.\n      const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(relationship);\n      if (onParentDelete?.enabled !== true) {\n        continue;\n      }\n\n      // Parent-reachability skip: the cascade fires from the parent's DELETE / DELETE_MANY post-op\n      // logic. A parent that can reach neither can never trigger this edge → dormant, not a\n      // violation. Self-correcting: the day the parent gains a delete path, this stops skipping and\n      // the guard fires.\n      //\n      // Reachability is `canFireDeleteCascade`, NOT `supportsOperation` — a CUSTOM op borrowing the\n      // verb via `resourceOperationLike` fires the cascade too, and reading only the core verb is\n      // what let `user_self | delete_account` cascade into two teardown-less children while this\n      // guard reported clean. See the function's JSDoc.\n      const parent = resourceConfigurations[relationship.resourceType1];\n      if (!parent) {\n        continue; // fail-open: parent not in this map, cannot classify\n      }\n      if (!canFireDeleteCascade(parent)) {\n        continue; // structurally unreachable edge — no core AND no delete-like custom op\n      }\n\n      // RESTRICT posture: no discovery list and no teardown. The refusal probes existence with ONE\n      // repository READ on the edge's foreign key, whatever the cardinality, so READ is the whole requirement.\n      if (onParentDelete.strategy === ChildLifecycleStrategy.REFUSE_WHILE_CHILDREN_EXIST) {\n        if (supportsOperation(child, CoreResourceOperation.READ)) {\n          continue;\n        }\n        violations.push({\n          childResourceType: child.resourceIdentifier,\n          parentResourceType: relationship.resourceType1,\n          cardinality: isOneToOneCardinality(relationship.cardinality2) ? 'one-to-one' : 'one-to-many',\n          strategy: ChildLifecycleStrategy.REFUSE_WHILE_CHILDREN_EXIST,\n          missingDiscoveryOp: CoreResourceOperation.READ,\n          missingTeardownOp: false,\n          message:\n            `Lifecycle child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +\n            `declares onParentDelete strategy REFUSE_WHILE_CHILDREN_EXIST but does not support READ. The ` +\n            `parent's delete probes for a remaining child with a repository READ before it writes anything, ` +\n            `so every delete of the parent would be refused with CONFIGURATION. Add a READ operation to the ` +\n            `child (a REPOSITORY_ONLY variant is enough), or declare another strategy.`,\n        });\n        continue;\n      }\n\n      // Discovery op depends on cardinality: 1:1 discovered via READ, 1:many via LIST. SHARED by both\n      // teardown strategies — impersonalizeChildrenImmediate reads the same way before scrubbing.\n      const oneToOne = isOneToOneCardinality(relationship.cardinality2);\n      const discoveryOp = oneToOne ? CoreResourceOperation.READ : CoreResourceOperation.LIST;\n      const hasDiscovery = supportsOperation(child, discoveryOp);\n\n      // The teardown STRATEGY decides what the child needs beyond discovery: DELETE (default) needs a\n      // DELETE/DELETE_MANY op; IMPERSONALIZE_AND_RETAIN needs the child to be retention-governed.\n      const strategy = resolveChildLifecycleTeardownStrategy(onParentDelete)!;\n\n      if (strategy === ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN) {\n        // Retain-and-scrub teardown (via updateManyAsSystem), NOT a hard delete. The child must be\n        // retention-governed: only `retentionPolicy` injects the retentionStatus\n        // marker AND derives the UPDATE_MANY scrub grant. A non-retention child has nothing to flip →\n        // impersonalizeChildrenImmediate throws CONFIGURATION and rolls back the parent delete.\n        const isRetentionGoverned = child.retentionPolicy?.mode !== undefined;\n        // v1 executes retain-and-scrub only in IMMEDIATE mode. Without this guard, a LAZY retain\n        // edge could pass startup and throw on the first erasure — inside the parent transaction, so a\n        // GDPR deletion request fails. Catch the unsupported combination here instead.\n        const isUnsupportedLazyMode = onParentDelete.mode === ChildLifecycleMode.LAZY;\n        if (hasDiscovery && isRetentionGoverned && !isUnsupportedLazyMode) {\n          continue; // impersonalize-able\n        }\n\n        const missing: string[] = [];\n        if (!hasDiscovery) {\n          missing.push(`${discoveryOp} (to discover ${oneToOne ? '1:1' : '1:many'} dependents)`);\n        }\n        if (!isRetentionGoverned) {\n          missing.push('retentionPolicy (either mode — to carry the retentionStatus marker + the UPDATE_MANY retain grant)');\n        }\n        if (isUnsupportedLazyMode) {\n          missing.push('mode: IMMEDIATE (v1 has no async retain-and-scrub; LAZY would throw on the first erasure)');\n        }\n\n        violations.push({\n          childResourceType: child.resourceIdentifier,\n          parentResourceType: relationship.resourceType1,\n          cardinality: oneToOne ? 'one-to-one' : 'one-to-many',\n          strategy,\n          missingDiscoveryOp: hasDiscovery ? undefined : discoveryOp,\n          missingTeardownOp: false, // teardown is a scrub, not a delete op\n          missingRetentionGovernance: !isRetentionGoverned,\n          unsupportedLazyRetainMode: isUnsupportedLazyMode,\n          message:\n            `Lifecycle child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +\n            `enabled onParentDelete with strategy IMPERSONALIZE_AND_RETAIN but is NOT impersonalize-able: ` +\n            `missing ${missing.join(' and ')}. The retain-and-scrub cascade (impersonalizeChildrenImmediate) ` +\n            `would fail during parent deletion once a child row exists. ` +\n            `Opt the child into retentionPolicy (RETAIN_ONLY or RETAIN_AND_IMPERSONALIZE), or use strategy DELETE.`,\n        });\n        continue;\n      }\n\n      // DELETE strategy (default): teardown op is DELETE_MANY (preferred by the cascade) or a per-row DELETE.\n      const hasTeardown =\n        supportsOperation(child, CoreResourceOperation.DELETE_MANY) ||\n        supportsOperation(child, CoreResourceOperation.DELETE);\n\n      if (hasDiscovery && hasTeardown) {\n        continue; // cascade-deletable\n      }\n\n      const missing: string[] = [];\n      if (!hasDiscovery) {\n        missing.push(`${discoveryOp} (to discover ${oneToOne ? '1:1' : '1:many'} dependents)`);\n      }\n      if (!hasTeardown) {\n        missing.push('DELETE or DELETE_MANY (to remove the row)');\n      }\n\n      violations.push({\n        childResourceType: child.resourceIdentifier,\n        parentResourceType: relationship.resourceType1,\n        cardinality: oneToOne ? 'one-to-one' : 'one-to-many',\n        strategy,\n        missingDiscoveryOp: hasDiscovery ? undefined : discoveryOp,\n        missingTeardownOp: !hasTeardown,\n        message:\n          `Lifecycle child '${child.resourceIdentifier}' (parent '${relationship.resourceType1}') ` +\n          `enabled onParentDelete but is NOT cascade-deletable: missing ${missing.join(' and ')}. ` +\n          `The delete cascade (deleteChildrenImmediate) would throw ErrorType.CONFIGURATION and roll ` +\n          `back the parent delete once a child row exists. Add the missing op(s) (a REPOSITORY_ONLY ` +\n          `DELETE is enough for teardown), or drop onParentDelete.enabled.`,\n      });\n    }\n  }\n\n  return violations;\n}\n"]}

package/dist/esm/resources/utils/composition-seedability.validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composition-seedability.validation.d.ts","sourceRoot":"","sources":["../../../../src/resources/utils/composition-seedability.validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oBAAoB,EAErB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAGpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,mCAAmC;IAClD,kBAAkB,EAAE,YAAY,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;IACzB,qBAAqB,EAAE;QACrB,mBAAmB,EAAE,oBAAoB,EAAE,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,EAAE,YAAY,CAAC;IAChC,kBAAkB,EAAE,YAAY,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,mCAAmC,CAAC,GAC1E,+BAA+B,EAAE,CAoEnC"}
+{"version":3,"file":"composition-seedability.validation.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/composition-seedability.validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oBAAoB,EAErB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAGpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,mCAAmC;IAClD,kBAAkB,EAAE,YAAY,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;IACzB,qBAAqB,EAAE;QACrB,mBAAmB,EAAE,oBAAoB,EAAE,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,EAAE,YAAY,CAAC;IAChC,kBAAkB,EAAE,YAAY,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,mCAAmC,CAAC,GAC1E,+BAA+B,EAAE,CAoEnC"}

package/dist/esm/resources/utils/context-addressed-composition-singleton.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-addressed-composition-singleton.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/resources/utils/context-addressed-composition-singleton.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,oCAAoC,CAAC;AACtG,OAAO,EAKL,KAAK,oBAAoB,EACzB,KAAK,YAAY,EAClB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,WAAW,yDAAyD;IACxE,YAAY,EAAE,oBAAoB,CAAC;IACnC,kBAAkB,EAAE,YAAY,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kDAAkD,CAChE,YAAY,EAAE,oBAAoB,GACjC,OAAO,CAeT;AAED,wBAAgB,6DAA6D,CAC3E,qBAAqB,EAAE,2CAA2C,GACjE,yDAAyD,EAAE,CAQ7D"}
+{"version":3,"file":"context-addressed-composition-singleton.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/context-addressed-composition-singleton.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,oCAAoC,CAAC;AACtG,OAAO,EAKL,KAAK,oBAAoB,EACzB,KAAK,YAAY,EAClB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,WAAW,yDAAyD;IACxE,YAAY,EAAE,oBAAoB,CAAC;IACnC,kBAAkB,EAAE,YAAY,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kDAAkD,CAChE,YAAY,EAAE,oBAAoB,GACjC,OAAO,CAeT;AAED,wBAAgB,6DAA6D,CAC3E,qBAAqB,EAAE,2CAA2C,GACjE,yDAAyD,EAAE,CAQ7D"}

package/dist/esm/resources/utils/dependent-lifecycle-classification.validation.d.ts

@@ -0,0 +1,61 @@
+import type { ResourceType } from '../resources.shared.core.definitions';
+import { SubjectErasureDisposition } from '../../compliance/privacy/subject-erasure.shared.schemas';
+import { type CompositionCascadeDeletabilityResourceInput } from './composition-cascade-deletability.validation';
+/**
+ * One DEPENDENT edge whose lifecycle nobody has classified (#1095).
+ *
+ * The classification is the erasure runtime's own — `classifySubjectErasureDisposition` — so the
+ * report and the runtime cannot disagree about what an edge says. Two dispositions are reported,
+ * exactly the ones {@link isBlockingSubjectErasureDisposition} refuses at runtime:
+ *
+ *  - `UNCLASSIFIED`: a COMPOSITION edge (`lifecycleModelMode: DEPENDENT`) with NO `onParentDelete`
+ *    at all. `enabled` defaults to `false`, so deleting the parent leaves the children in place under
+ *    a parent that no longer exists. The tenant purge dispatches the ordinary `ORGANIZATIONS | DELETE`
+ *    and relies on the same cascade, so an `ORGANIZATIONS → X` edge in this state leaves X's rows
+ *    behind after the tenant is destroyed; a subject erasure reaching the edge is REFUSED outright.
+ *  - `UNSUPPORTED_DEFERRED`: `mode: LAZY`, which a subject erasure cannot execute.
+ */
+export interface UnclassifiedDependentLifecycleEdge {
+    parentResourceType: ResourceType;
+    childResourceType: ResourceType;
+    foreignKeyField?: string;
+    disposition: SubjectErasureDisposition;
+    /** The classifier's own justification, naming the declaration that would settle the edge. */
+    reason: string;
+}
+/**
+ * Collect every DEPENDENT edge whose parent-delete lifecycle the author never classified — the
+ * boot-time report `isBlockingSubjectErasureDisposition` was exported for ("the erasure analogue of
+ * `validateCompositionCascadeDeletability`").
+ *
+ * ## Why a REPORT and not a refusal
+ *
+ * `validateCompositionCascadeDeletability` guards edges that OPTED IN to the cascade and cannot run
+ * it. This guard is its complement: edges that never opted either way. An undeclared edge is a
+ * missing declaration, and the honest reading of "the framework asked nothing, so the author said
+ * nothing" is a gap to derive and surface, total over the registry, rather than a refusal wired
+ * into boot (`application-creation-directive.md`: mark, do not block). The two runtimes that meet
+ * such an edge already answer for themselves — the erasure refuses at the edge, the plain delete and
+ * the tenant purge orphan silently — and the second is the one nothing reported until now.
+ *
+ * ## Population
+ *
+ * Total over every relationship of every configuration, read through the SAME helper the delete
+ * cascade and the erasure walker read (`resolveRelationshipLifecycleOnParentDeleteConfig`, inside the
+ * classifier). A disabled relationship is not part of the live graph and is skipped by the
+ * classifier itself (`NOT_OWNED`).
+ *
+ * ## Parent-reachability skip, shared with the cascade-deletability guard
+ *
+ * The delete cascade fires only from the parent's DELETE / DELETE_MANY post-op logic. A parent that
+ * can reach neither can never orphan anything, so its undeclared edges are dormant and are NOT
+ * reported — `canFireDeleteCascade`, the same predicate the sibling guard uses, so the two guards
+ * agree on which edges are live. Self-correcting: the day the parent gains a delete path, its dormant
+ * edges are reported.
+ *
+ * @param resourceConfigurations - the registry's `resourceConfigurations` map (`resourceType →
+ *   built configuration`). Each entry is the CHILD in its `parentRelationships` and
+ *   `selfRelationships`; parents are looked up in the same map for the reachability skip.
+ */
+export declare function collectUnclassifiedDependentLifecycleEdges(resourceConfigurations: Record<string, CompositionCascadeDeletabilityResourceInput>): UnclassifiedDependentLifecycleEdge[];
+//# sourceMappingURL=dependent-lifecycle-classification.validation.d.ts.map

package/dist/esm/resources/utils/dependent-lifecycle-classification.validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependent-lifecycle-classification.validation.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/dependent-lifecycle-classification.validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEzE,OAAO,EAGL,yBAAyB,EAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAEL,KAAK,2CAA2C,EACjD,MAAM,+CAA+C,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,kCAAkC;IACjD,kBAAkB,EAAE,YAAY,CAAC;IACjC,iBAAiB,EAAE,YAAY,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,yBAAyB,CAAC;IACvC,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,0CAA0C,CACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,GAClF,kCAAkC,EAAE,CAgDtC"}

package/dist/esm/resources/utils/dependent-lifecycle-classification.validation.js

@@ -0,0 +1,79 @@
+import { getParentDirectionRelationships } from '../resources-config.shared.schemas.js';
+import { classifySubjectErasureDisposition, isBlockingSubjectErasureDisposition, } from '../../compliance/privacy/subject-erasure.shared.schemas.js';
+import { canFireDeleteCascade, } from './composition-cascade-deletability.validation.js';
+/**
+ * Collect every DEPENDENT edge whose parent-delete lifecycle the author never classified — the
+ * boot-time report `isBlockingSubjectErasureDisposition` was exported for ("the erasure analogue of
+ * `validateCompositionCascadeDeletability`").
+ *
+ * ## Why a REPORT and not a refusal
+ *
+ * `validateCompositionCascadeDeletability` guards edges that OPTED IN to the cascade and cannot run
+ * it. This guard is its complement: edges that never opted either way. An undeclared edge is a
+ * missing declaration, and the honest reading of "the framework asked nothing, so the author said
+ * nothing" is a gap to derive and surface, total over the registry, rather than a refusal wired
+ * into boot (`application-creation-directive.md`: mark, do not block). The two runtimes that meet
+ * such an edge already answer for themselves — the erasure refuses at the edge, the plain delete and
+ * the tenant purge orphan silently — and the second is the one nothing reported until now.
+ *
+ * ## Population
+ *
+ * Total over every relationship of every configuration, read through the SAME helper the delete
+ * cascade and the erasure walker read (`resolveRelationshipLifecycleOnParentDeleteConfig`, inside the
+ * classifier). A disabled relationship is not part of the live graph and is skipped by the
+ * classifier itself (`NOT_OWNED`).
+ *
+ * ## Parent-reachability skip, shared with the cascade-deletability guard
+ *
+ * The delete cascade fires only from the parent's DELETE / DELETE_MANY post-op logic. A parent that
+ * can reach neither can never orphan anything, so its undeclared edges are dormant and are NOT
+ * reported — `canFireDeleteCascade`, the same predicate the sibling guard uses, so the two guards
+ * agree on which edges are live. Self-correcting: the day the parent gains a delete path, its dormant
+ * edges are reported.
+ *
+ * @param resourceConfigurations - the registry's `resourceConfigurations` map (`resourceType →
+ *   built configuration`). Each entry is the CHILD in its `parentRelationships` and
+ *   `selfRelationships`; parents are looked up in the same map for the reachability skip.
+ */
+export function collectUnclassifiedDependentLifecycleEdges(resourceConfigurations) {
+    const edges = [];
+    const reported = new Set();
+    for (const child of Object.values(resourceConfigurations)) {
+        const parentRelationships = getParentDirectionRelationships({
+            parentRelationships: child.resourceRelationships?.parentRelationships ?? [],
+            selfRelationships: child.resourceRelationships?.selfRelationships ?? [],
+            childRelationships: [],
+        });
+        for (const relationship of parentRelationships) {
+            const parent = resourceConfigurations[relationship.resourceType1];
+            if (!parent) {
+                continue; // fail-open: parent not in this map, cannot classify
+            }
+            if (!canFireDeleteCascade(parent)) {
+                continue; // structurally unreachable edge — the parent has no delete path to orphan from
+            }
+            // #1279: the classifier reads the CHILD's own `retentionPolicy` — the declaration that states
+            // what an erasure does to its rows — so this guard reports exactly what the runtime will do.
+            // The map is keyed by resource type and already carries the resolved policy, so the lookup is
+            // the same one the reachability skip above makes.
+            const classification = classifySubjectErasureDisposition(relationship, (resourceType) => resourceConfigurations[String(resourceType)]?.retentionPolicy);
+            if (!isBlockingSubjectErasureDisposition(classification.disposition)) {
+                continue;
+            }
+            // The same relationship object is registered on both sides of the graph; report each edge once.
+            const key = `${String(relationship.resourceType1)}→${String(relationship.resourceType2)}:${String(relationship.foreignKeyField ?? '')}`;
+            if (reported.has(key))
+                continue;
+            reported.add(key);
+            edges.push({
+                parentResourceType: relationship.resourceType1,
+                childResourceType: relationship.resourceType2,
+                ...(relationship.foreignKeyField ? { foreignKeyField: relationship.foreignKeyField } : {}),
+                disposition: classification.disposition,
+                reason: classification.reason,
+            });
+        }
+    }
+    return edges;
+}
+//# sourceMappingURL=dependent-lifecycle-classification.validation.js.map

package/dist/esm/resources/utils/dependent-lifecycle-classification.validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependent-lifecycle-classification.validation.js","sourceRoot":"","sources":["../../../../../src/resources/utils/dependent-lifecycle-classification.validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,EACL,iCAAiC,EACjC,mCAAmC,GAEpC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,oBAAoB,GAErB,MAAM,+CAA+C,CAAC;AAyBvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,0CAA0C,CACxD,sBAAmF;IAEnF,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC1D,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;YAC1D,mBAAmB,EAAE,KAAK,CAAC,qBAAqB,EAAE,mBAAmB,IAAI,EAAE;YAC3E,iBAAiB,EAAE,KAAK,CAAC,qBAAqB,EAAE,iBAAiB,IAAI,EAAE;YACvE,kBAAkB,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,SAAS,CAAC,qDAAqD;YACjE,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,+EAA+E;YAC3F,CAAC;YAED,8FAA8F;YAC9F,6FAA6F;YAC7F,8FAA8F;YAC9F,kDAAkD;YAClD,MAAM,cAAc,GAAG,iCAAiC,CACtD,YAAY,EACZ,CAAC,YAAY,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAChF,CAAC;YACF,IAAI,CAAC,mCAAmC,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrE,SAAS;YACX,CAAC;YAED,gGAAgG;YAChG,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;YACxI,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAElB,KAAK,CAAC,IAAI,CAAC;gBACT,kBAAkB,EAAE,YAAY,CAAC,aAAa;gBAC9C,iBAAiB,EAAE,YAAY,CAAC,aAAa;gBAC7C,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,WAAW,EAAE,cAAc,CAAC,WAAW;gBACvC,MAAM,EAAE,cAAc,CAAC,MAAM;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { ResourceType } from '../resources.shared.core.definitions';\nimport { getParentDirectionRelationships } from '../resources-config.shared.schemas';\nimport {\n  classifySubjectErasureDisposition,\n  isBlockingSubjectErasureDisposition,\n  SubjectErasureDisposition,\n} from '../../compliance/privacy/subject-erasure.shared.schemas';\nimport {\n  canFireDeleteCascade,\n  type CompositionCascadeDeletabilityResourceInput,\n} from './composition-cascade-deletability.validation';\n\n/**\n * One DEPENDENT edge whose lifecycle nobody has classified (#1095).\n *\n * The classification is the erasure runtime's own — `classifySubjectErasureDisposition` — so the\n * report and the runtime cannot disagree about what an edge says. Two dispositions are reported,\n * exactly the ones {@link isBlockingSubjectErasureDisposition} refuses at runtime:\n *\n *  - `UNCLASSIFIED`: a COMPOSITION edge (`lifecycleModelMode: DEPENDENT`) with NO `onParentDelete`\n *    at all. `enabled` defaults to `false`, so deleting the parent leaves the children in place under\n *    a parent that no longer exists. The tenant purge dispatches the ordinary `ORGANIZATIONS | DELETE`\n *    and relies on the same cascade, so an `ORGANIZATIONS → X` edge in this state leaves X's rows\n *    behind after the tenant is destroyed; a subject erasure reaching the edge is REFUSED outright.\n *  - `UNSUPPORTED_DEFERRED`: `mode: LAZY`, which a subject erasure cannot execute.\n */\nexport interface UnclassifiedDependentLifecycleEdge {\n  parentResourceType: ResourceType;\n  childResourceType: ResourceType;\n  foreignKeyField?: string;\n  disposition: SubjectErasureDisposition;\n  /** The classifier's own justification, naming the declaration that would settle the edge. */\n  reason: string;\n}\n\n/**\n * Collect every DEPENDENT edge whose parent-delete lifecycle the author never classified — the\n * boot-time report `isBlockingSubjectErasureDisposition` was exported for (\"the erasure analogue of\n * `validateCompositionCascadeDeletability`\").\n *\n * ## Why a REPORT and not a refusal\n *\n * `validateCompositionCascadeDeletability` guards edges that OPTED IN to the cascade and cannot run\n * it. This guard is its complement: edges that never opted either way. An undeclared edge is a\n * missing declaration, and the honest reading of \"the framework asked nothing, so the author said\n * nothing\" is a gap to derive and surface, total over the registry, rather than a refusal wired\n * into boot (`application-creation-directive.md`: mark, do not block). The two runtimes that meet\n * such an edge already answer for themselves — the erasure refuses at the edge, the plain delete and\n * the tenant purge orphan silently — and the second is the one nothing reported until now.\n *\n * ## Population\n *\n * Total over every relationship of every configuration, read through the SAME helper the delete\n * cascade and the erasure walker read (`resolveRelationshipLifecycleOnParentDeleteConfig`, inside the\n * classifier). A disabled relationship is not part of the live graph and is skipped by the\n * classifier itself (`NOT_OWNED`).\n *\n * ## Parent-reachability skip, shared with the cascade-deletability guard\n *\n * The delete cascade fires only from the parent's DELETE / DELETE_MANY post-op logic. A parent that\n * can reach neither can never orphan anything, so its undeclared edges are dormant and are NOT\n * reported — `canFireDeleteCascade`, the same predicate the sibling guard uses, so the two guards\n * agree on which edges are live. Self-correcting: the day the parent gains a delete path, its dormant\n * edges are reported.\n *\n * @param resourceConfigurations - the registry's `resourceConfigurations` map (`resourceType →\n *   built configuration`). Each entry is the CHILD in its `parentRelationships` and\n *   `selfRelationships`; parents are looked up in the same map for the reachability skip.\n */\nexport function collectUnclassifiedDependentLifecycleEdges(\n  resourceConfigurations: Record<string, CompositionCascadeDeletabilityResourceInput>,\n): UnclassifiedDependentLifecycleEdge[] {\n  const edges: UnclassifiedDependentLifecycleEdge[] = [];\n  const reported = new Set<string>();\n\n  for (const child of Object.values(resourceConfigurations)) {\n    const parentRelationships = getParentDirectionRelationships({\n      parentRelationships: child.resourceRelationships?.parentRelationships ?? [],\n      selfRelationships: child.resourceRelationships?.selfRelationships ?? [],\n      childRelationships: [],\n    });\n\n    for (const relationship of parentRelationships) {\n      const parent = resourceConfigurations[relationship.resourceType1];\n      if (!parent) {\n        continue; // fail-open: parent not in this map, cannot classify\n      }\n      if (!canFireDeleteCascade(parent)) {\n        continue; // structurally unreachable edge — the parent has no delete path to orphan from\n      }\n\n      // #1279: the classifier reads the CHILD's own `retentionPolicy` — the declaration that states\n      // what an erasure does to its rows — so this guard reports exactly what the runtime will do.\n      // The map is keyed by resource type and already carries the resolved policy, so the lookup is\n      // the same one the reachability skip above makes.\n      const classification = classifySubjectErasureDisposition(\n        relationship,\n        (resourceType) => resourceConfigurations[String(resourceType)]?.retentionPolicy,\n      );\n      if (!isBlockingSubjectErasureDisposition(classification.disposition)) {\n        continue;\n      }\n\n      // The same relationship object is registered on both sides of the graph; report each edge once.\n      const key = `${String(relationship.resourceType1)}→${String(relationship.resourceType2)}:${String(relationship.foreignKeyField ?? '')}`;\n      if (reported.has(key)) continue;\n      reported.add(key);\n\n      edges.push({\n        parentResourceType: relationship.resourceType1,\n        childResourceType: relationship.resourceType2,\n        ...(relationship.foreignKeyField ? { foreignKeyField: relationship.foreignKeyField } : {}),\n        disposition: classification.disposition,\n        reason: classification.reason,\n      });\n    }\n  }\n\n  return edges;\n}\n"]}

package/dist/esm/resources/utils/duplicate-relationship-registration.validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate-relationship-registration.validation.d.ts","sourceRoot":"","sources":["../../../../src/resources/utils/duplicate-relationship-registration.validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,iCAAiC;IAChD,kBAAkB,EAAE,YAAY,CAAC;IACjC,iBAAiB,EAAE,YAAY,CAAC;IAChC,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,YAAY,EAAE,oBAAoB,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAqDD;;;;;;;;;;;GAWG;AACH,wBAAgB,sCAAsC,CACpD,aAAa,EAAE,SAAS,oBAAoB,EAAE,GAC7C,iCAAiC,EAAE,CAgErC"}
+{"version":3,"file":"duplicate-relationship-registration.validation.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/duplicate-relationship-registration.validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,iCAAiC;IAChD,kBAAkB,EAAE,YAAY,CAAC;IACjC,iBAAiB,EAAE,YAAY,CAAC;IAChC,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,YAAY,EAAE,oBAAoB,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAqDD;;;;;;;;;;;GAWG;AACH,wBAAgB,sCAAsC,CACpD,aAAa,EAAE,SAAS,oBAAoB,EAAE,GAC7C,iCAAiC,EAAE,CAgErC"}

package/dist/esm/resources/utils/field-value-disclosure.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field-value-disclosure.utils.d.ts","sourceRoot":"","sources":["../../../../src/resources/utils/field-value-disclosure.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAE7E"}
+{"version":3,"file":"field-value-disclosure.utils.d.ts","sourceRoot":"","sources":["../../../../../src/resources/utils/field-value-disclosure.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAE7E"}

package/dist/esm/resources/utils/field-value-disclosure.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"field-value-disclosure.utils.js","sourceRoot":"","sources":["../../../../src/resources/utils/field-value-disclosure.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAyB;IAClE,OAAO,kBAAkB,CAAC,WAAW,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { isBackendOnlyField, isWriteOnlySecretField } from '@wildo-ai/zod-decorators';\n\n/**\n * THE ONE RULE for \"may this field's VALUE leave the backend?\" — the disclosure seam every\n * outward-facing surface derives from, rather than restating.\n *\n * ## What it answers, and what it deliberately does not\n *\n * A field's value is non-disclosable when it is `.isBackendOnly()` (the response DTO drops it) or\n * `.isWriteOnlySecret()` (the response DTO masks it). Those two decorators ARE the disclosure\n * boundary; nothing else is. In particular:\n *\n *  - `.isHidden()` gates CHART AGGREGATES (`field-access-validator`), which is a question about\n *    which aggregate may expose a value, not about whether the value may be disclosed at all;\n *  - `.isEphemeral()` gates the audit field-access trail and a one-time frontend display. An\n *    ephemeral field is RETURNED — once, deliberately — so withholding it here would withhold\n *    something the response contract promises.\n *\n * Adding either to this predicate would silently narrow surfaces that are working as designed, so\n * they are named here as considered-and-excluded rather than left to the next reader to re-derive.\n *\n * ## Why BOTH decorators are tested, rather than one implying the other\n *\n * They are independent decorators. A future authoring form — or an application — may set one\n * without the other, and a predicate that assumed the implication would open a disclosure path the\n * day that happened. This reasoning is not new: `isFieldWithheldFromSubjectExport` wrote it down\n * for the subject-export surface first, and this module is that rule extracted so the two surfaces\n * cannot drift apart.\n *\n * ## Why it exists as its own module (issue #95)\n *\n * The rule had TWO independent hand-written copies and one surface that carried only half of it:\n *\n * | surface | `.isBackendOnly()` | `.isWriteOnlySecret()` |\n * |---|---|---|\n * | response DTO / `toResponseSafeToolOutput` (REST, MCP `tools/call`, A2A resource tools) | dropped | masked |\n * | subject export (`isFieldWithheldFromSubjectExport`) | withheld | withheld |\n * | RAG retrieval row header (`getSummaryFieldNames`) | excluded | **rendered in full** |\n *\n * The third row is the defect this module closes. A resource may declare a field BOTH\n * `.isSummaryField()` and `.isWriteOnlySecret()` — nothing forbids it — and the retrieval header\n * would then render, verbatim and into a provider payload, the value the response DTO exists to\n * mask. No resource declares that pair today, so the hole was latent; the header is assembled from\n * declarations an application controls, so it stays latent only until one does.\n *\n * assurance-control: WILDO.DATA.CONFIDENTIALITY — material a schema declares non-disclosable does\n * not cross the client boundary. The registered objective names `.isBackendOnly()`; this rule is\n * where its sibling decorator `.isWriteOnlySecret()` is held to the same boundary, since both\n * describe a value the response DTO refuses to emit as authored.\n */\nexport function isNonDisclosableFieldValue(fieldSchema: z.ZodTypeAny): boolean {\n  return isBackendOnlyField(fieldSchema) || isWriteOnlySecretField(fieldSchema);\n}\n"]}
+{"version":3,"file":"field-value-disclosure.utils.js","sourceRoot":"","sources":["../../../../../src/resources/utils/field-value-disclosure.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAyB;IAClE,OAAO,kBAAkB,CAAC,WAAW,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { isBackendOnlyField, isWriteOnlySecretField } from '@wildo-ai/zod-decorators';\n\n/**\n * THE ONE RULE for \"may this field's VALUE leave the backend?\" — the disclosure seam every\n * outward-facing surface derives from, rather than restating.\n *\n * ## What it answers, and what it deliberately does not\n *\n * A field's value is non-disclosable when it is `.isBackendOnly()` (the response DTO drops it) or\n * `.isWriteOnlySecret()` (the response DTO masks it). Those two decorators ARE the disclosure\n * boundary; nothing else is. In particular:\n *\n *  - `.isHidden()` gates CHART AGGREGATES (`field-access-validator`), which is a question about\n *    which aggregate may expose a value, not about whether the value may be disclosed at all;\n *  - `.isEphemeral()` gates the audit field-access trail and a one-time frontend display. An\n *    ephemeral field is RETURNED — once, deliberately — so withholding it here would withhold\n *    something the response contract promises.\n *\n * Adding either to this predicate would silently narrow surfaces that are working as designed, so\n * they are named here as considered-and-excluded rather than left to the next reader to re-derive.\n *\n * ## Why BOTH decorators are tested, rather than one implying the other\n *\n * They are independent decorators. A future authoring form — or an application — may set one\n * without the other, and a predicate that assumed the implication would open a disclosure path the\n * day that happened. This reasoning is not new: `isFieldWithheldFromSubjectExport` wrote it down\n * for the subject-export surface first, and this module is that rule extracted so the two surfaces\n * cannot drift apart.\n *\n * ## Why it exists as its own module (issue #95)\n *\n * The rule had TWO independent hand-written copies and one surface that carried only half of it:\n *\n * | surface | `.isBackendOnly()` | `.isWriteOnlySecret()` |\n * |---|---|---|\n * | response DTO / `toResponseSafeToolOutput` (REST, MCP `tools/call`, A2A resource tools) | dropped | masked |\n * | subject export (`isFieldWithheldFromSubjectExport`) | withheld | withheld |\n * | RAG retrieval row header (`getSummaryFieldNames`) | excluded | **rendered in full** |\n *\n * The third row is the defect this module closes. A resource may declare a field BOTH\n * `.isSummaryField()` and `.isWriteOnlySecret()` — nothing forbids it — and the retrieval header\n * would then render, verbatim and into a provider payload, the value the response DTO exists to\n * mask. No resource declares that pair today, so the hole was latent; the header is assembled from\n * declarations an application controls, so it stays latent only until one does.\n *\n * assurance-control: WILDO.DATA.CONFIDENTIALITY — material a schema declares non-disclosable does\n * not cross the client boundary. The registered objective names `.isBackendOnly()`; this rule is\n * where its sibling decorator `.isWriteOnlySecret()` is held to the same boundary, since both\n * describe a value the response DTO refuses to emit as authored.\n */\nexport function isNonDisclosableFieldValue(fieldSchema: z.ZodTypeAny): boolean {\n  return isBackendOnlyField(fieldSchema) || isWriteOnlySecretField(fieldSchema);\n}\n"]}