@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/organizations/organizations.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAKjF,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;IACvB,qCAAe,CAAA;IACf,qDAA+B,CAAA;IAC/B,6CAAuB,CAAA;IACvB;;;;;;;OAOG;IACH,yCAAmB,CAAA;AACrB,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAoC,IAAI,GAAG,CAAC;IAC9F,kBAAkB,CAAC,OAAO;IAC1B,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAsC;IAC5F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,uCAAuC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAID,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D;;;;;;;;OAQG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAChE;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACb,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,WAAW,EAAE;SACb,QAAQ,CAAC,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,wBAAwB,EAAE,CAAC;SAC5F,cAAc,EAAE;SAChB,iBAAiB,EAAE;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAExH;;;;;;;;;;;;;;;;OAgBG;IACH,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAE5E,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAE3H;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,kEAAkE;IAClE,YAAY,EAAE,gCAAgC;IAC9C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAE1C,gDAAgD;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,6BAA6B;IACjE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,yDAAyD;IACzD,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC","sourcesContent":["/**\n * Core Organization Shared Schemas\n *\n * Lean organization schema optimized for frequent fetching.\n * Related data moved to separate relational models.\n */\n\nimport { z } from 'zod';\nimport { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions';\nimport { OrganizationProfileSchema } from './organization-profile.shared.schemas';\nimport { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas';\nimport { OrganizationNotificationsSchema } from './organization-notifications.shared.schemas';\nimport { ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas';\nimport { OrganizationMemberSchema } from './organization-members.shared.schemas';\n\n\n\n\nexport enum OrganizationStatus {\n  ACTIVE = 'ACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  TRIAL = 'TRIAL',\n  TRIAL_EXPIRED = 'TRIAL_EXPIRED',\n  CANCELLED = 'CANCELLED',\n  /**\n   * Marked for deletion and inside its retention window — NOT removed.\n   *\n   * Written by the `request_deletion` lifecycle operation, cleared by `restore`, and consumed by\n   * the `organization-purge` batch once {@link Organization.purgeScheduledAt} has elapsed. A row\n   * in this state is authorization-dead (see\n   * {@link isAuthorityConferringOrganizationStatus}) and data-alive.\n   */\n  DELETED = 'DELETED'\n}\n\n/**\n * Organization statuses under which a membership STOPS conferring authority.\n *\n * ## Why this exists as a named authority\n *\n * Until 2026-08-01 `OrganizationStatus` had **zero backend readers**: the execution-context\n * creator built `initiatorRoles` straight from ACTIVE membership rows without ever looking at the\n * organization, so no status value affected anything. That made tenant soft-delete impossible to\n * express — a tenant marked for purge would have kept handing out `ORG_ADMIN` for its whole\n * retention window, which is the original hazard with a longer fuse rather than a fix.\n *\n * The set is declared here, beside the enum it partitions, rather than inline at the consumer, so\n * that adding a future non-operational status is one edit in the place a reader is already\n * looking. Consumers call {@link isAuthorityConferringOrganizationStatus}; they must not test\n * `status === DELETED` inline.\n *\n * ## Why these three\n *\n * - `DELETED` — marked for purge. The whole point of the soft-delete phase.\n * - `SUSPENDED` — an administratively halted tenant. Membership must not survive the halt.\n * - `CANCELLED` — a terminated subscription/tenant. Terminal, like `DELETED`.\n *\n * `TRIAL_EXPIRED` is deliberately NOT here: an expired trial still needs its administrators to\n * sign in and pay, so revoking their authority would make the tenant unrecoverable by its owner.\n * `ACTIVE` and `TRIAL` are the operational states.\n *\n * ⚠️ Fail-CLOSED direction: an unresolvable organization is treated as non-conferring by the\n * consumer, so a missing row can never widen authority.\n *\n * assurance-control: WILDO.ACCESS.LIFECYCLE — access rights are removed when the\n * scope granting them stops being operational, without waiting for the data to be destroyed.\n */\nexport const ORGANIZATION_STATUSES_WITHOUT_AUTHORITY: ReadonlySet<OrganizationStatus> = new Set([\n  OrganizationStatus.DELETED,\n  OrganizationStatus.SUSPENDED,\n  OrganizationStatus.CANCELLED,\n]);\n\n/**\n * True when a membership in an organization of this status still confers its roles.\n *\n * The single authority behind the execution-context membership gate. See\n * {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} for the rationale and the deliberate\n * `TRIAL_EXPIRED` exclusion.\n */\nexport function isAuthorityConferringOrganizationStatus(status: OrganizationStatus | undefined): boolean {\n  if (status === undefined) return false;\n  return !ORGANIZATION_STATUSES_WITHOUT_AUTHORITY.has(status);\n}\n\n\n\nexport const OrganizationSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n  /**\n   * Org type from config (for example `seller` or `corporate_buyer`).\n   *\n   * The type selects role policy, membership-derived user-type grants, and\n   * authentication overrides. A generic patch cannot migrate those dependent\n   * invariants atomically, so the value is creation-time identity. A future\n   * type transition must be a dedicated migration operation that reconciles\n   * every dependent member and policy surface.\n   */\n  type: z.string().optional().isSummaryField().excludeFromUpdate(),\n  /**\n   * The tenant's URL-safe identity.\n   *\n   * `.isUnique()` since 2026-08-01, and it closes a real hole rather than restating a known rule:\n   * uniqueness was promised by the resource specification's 409 and enforced by NOTHING — no index\n   * and no application guard — so two organizations could take the same slug. Because the field is\n   * also `.excludeFromUpdate()` (creation-time identity, not an editable label), such a collision\n   * could never be resolved through the API afterwards. It has to be refused at creation.\n   *\n   * Uniqueness is collection-wide, which IS per-application: an application's organizations live in\n   * that application's own database, and the schema carries no `applicationId` to scope by.\n   *\n   * ⚠️ MongoDB-only today. The SQL planner records uniqueness as intent and leaves enforcement\n   * migration-owned, so on a SQL adapter this is a declaration rather than a guarantee.\n   */\n  slug: z.string()\n    .min(1)\n    .max(50)\n    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/)\n    .isDBIndexed()\n    .isUnique({ conflictMessageReference: ErrorCustomMessageReference.ORGANIZATION_SLUG_EXISTS })\n    .isSummaryField()\n    .excludeFromUpdate(),\n  /**\n   * Tenant lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01, and that exclusion is the whole point of the field.\n   * Before it, generic UPDATE carried `status` and the DEFAULT variant of that operation is gated\n   * to `ORG_ADMIN` — while SUSPEND / ACTIVATE are `APP_ADMIN_SUPER_ADMIN`-only and gated by an\n   * `enabledCondition` on the current status. So the org admin of a SUSPENDED tenant could\n   * `PUT /organizations/{id}` with `{\"status\":\"ACTIVE\"}` and lift the platform's suspension on\n   * their own organization: the control was defeatable by exactly the party it exists to control.\n   * The configuration had claimed otherwise for a long time — both UPDATE variants carried a\n   * `// status manually excluded for this variant` comment that nothing implemented.\n   *\n   * Lifecycle transitions belong to the dedicated verbs, which own the state machine, the reason,\n   * and the audit trail. This mirrors `OrganizationMemberSchema.status`, whose JSDoc has always\n   * described the same rule for the same reason.\n   *\n   * KNOWN CONSEQUENCE, ACCEPTED: the platform apps-manager's `upsertEntity` re-asserts\n   * `status: ACTIVE` on its update branch when reconciling an existing organization. That write is\n   * now dropped. This is the intended outcome — a provisioning re-run silently returning a\n   * suspended tenant to ACTIVE is the same defect from the other direction. A path that must set\n   * the status goes through the transition operations or a trusted `updateAsSystem`, not a generic\n   * field patch.\n   *\n   * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — a tenant may not lift a platform-imposed\n   * restriction on itself.\n   */\n  status: z.enum(OrganizationStatus).default(OrganizationStatus.ACTIVE).isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n  /**\n   * Does a platform operator need THIS tenant's approval before an elevation becomes usable?\n   *\n   * The Customer Lockbox posture, and opt-in per tenant exactly as Microsoft and Google ship it. A\n   * tenant that has not staffed an approver must not thereby become unable to receive support, so\n   * the default is `false`: elevations still require a request, a justification, a 4-hour ceiling and\n   * an audit trail — they simply do not wait for a human in the tenant.\n   *\n   * Turning it ON is the strongest available posture and is what regulated buyers ask for by name.\n   *\n   * ⚠️ It does NOT make the tenant unreachable when it has no administrator. A tenant with no\n   * administratively usable owner cannot approve anything, and requiring approval from it would make\n   * its own repair impossible — see `PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE`,\n   * which is measured with the owner floor's own predicate rather than assumed.\n   *\n   * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — customer-approved operator access.\n   */\n  platformAccessApprovalRequired: z.boolean().default(false).isAuditEvidence(),\n\n  // Basic timestamps (lifecycle audit is in separate collection)\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  // Tenant teardown — soft-delete marks (WS-A)\n  /**\n   * When the tenant was MARKED for deletion — the start of its retention window.\n   *\n   * Written by the `request_deletion` lifecycle operation together with `status: DELETED`, and\n   * cleared by `restore`. Both fields move together: `status` is the authorization-relevant half\n   * (it is what {@link isAuthorityConferringOrganizationStatus} reads) and this is the evidence\n   * half.\n   *\n   * ## Why this is not called `deletedAt`\n   *\n   * It replaced a field of that name on 2026-08-01, and the rename is not cosmetic in two separate\n   * ways.\n   *\n   * First, `deletedAt` is RESERVED framework vocabulary: it appears in\n   * `createOrUpdateMandatoryDiscardFields`, so the runtime strips it from every create and update\n   * payload on every resource. A lifecycle operation could therefore never write it — the value\n   * would be discarded and the operation would answer success having recorded nothing, which is\n   * the exact silent-no-op class this workstream exists to remove. No `authoritativeFields`\n   * declaration rescues it; the discard happens regardless.\n   *\n   * Second, the two names mean different things. `deletedAt` answers \"when was this row deleted\",\n   * and the row is emphatically NOT deleted — it is fully present and restorable for the whole\n   * retention window. Reusing the name would have made every reader who trusts the framework's\n   * vocabulary wrong about the state of the tenant in front of them.\n   *\n   * The predecessor field had zero readers and zero writers in the entire repository, so nothing\n   * observable was lost by replacing it.\n   *\n   * Never a user-facing value on a live organization — it only ever renders as an empty \"—\", so it\n   * stays hidden from every auto-rendered display/edit surface via `.isHidden()`. An admin/audit\n   * surface that needs to inspect marked rows must opt it back in explicitly.\n   *\n   * ⚠️ This is NOT the purge predicate. Purge eligibility is {@link purgeScheduledAt} — see the\n   * reasoning there.\n   *\n   * ## Why `.nullish()` and not `.optional()`\n   *\n   * `restore` CLEARS this field, and clearing means writing `null` — `undefined` merely omits the\n   * key and leaves the stale mark in place. `preserveServerInjectedFields` copies the authored\n   * value verbatim past the strict re-parse (`hasOwnProperty` + assign), so the `null` genuinely\n   * reaches persistence. With `.optional()` alone the row would then be UNREADABLE: the main schema\n   * rejects `null` for a `z.date()`, so every subsequent read of a restored tenant would throw on\n   * output projection. Verified by probing the real schema rather than assumed.\n   */\n  deletionRequestedAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden(),\n  /**\n   * Serialization token for the organization-owner floor. Never read for meaning — only WRITTEN, to\n   * make concurrent owner-reducing operations conflict with each other.\n   *\n   * ## Why a stored field is the fix rather than a better check\n   *\n   * The floor is a check-then-act on a COUNT: it measures the usable-owner population, then the\n   * caller writes. Under snapshot isolation that is textbook WRITE SKEW — two transactions each\n   * remove a DIFFERENT owner, each observes the other still present, and both commit, producing a\n   * tenant with zero owners that neither was individually permitted to create. No amount of\n   * additional checking closes it, because each transaction's view is internally consistent; a\n   * re-measure after the write cannot see the other transaction's uncommitted row either.\n   *\n   * The standard remedy is to give the two transactions something to collide ON. Every owner-reducing\n   * operation bumps this token on the tenant's own row inside its transaction, so two of them touch\n   * the same document and the storage engine aborts the loser. Verified as a race in\n   * `organization-owner-floor-hostile.mongo.integration.test.ts` (H-2).\n   *\n   * Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a\n   * modification of the organization, and it would corrupt every \"recently changed tenants\" surface);\n   * a separate lock collection (a new resource, a new registration, and a second thing to keep\n   * consistent with the floor); an application-level mutex (does not survive multiple processes,\n   * which is exactly the deployment this must work in).\n   *\n   * `.nullish()` because existing tenants predate it and a tenant that has never had an\n   * owner-reducing write legitimately has no token. Absent and zero mean the same thing.\n   */\n  ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n\n  /**\n   * When the `organization-purge` batch becomes allowed to destroy this tenant.\n   *\n   * ## Why this is stored rather than derived from `deletionRequestedAt` + a configured window\n   *\n   * The retention window is a PROMISE made to the tenant at the moment of the mark (\"your data is\n   * recoverable until <date>\"). Deriving eligibility as `deletionRequestedAt < now - window`\n   * re-evaluates that promise against whatever the configuration says at PURGE time, so lowering\n   * the window would retroactively shorten — or immediately expire — every tenant already inside\n   * one. Pinning the deadline at mark time makes the commitment immutable, which is the property\n   * a data-retention commitment has to have, and it makes a per-tenant legal hold expressible\n   * later by moving one field rather than by special-casing the batch predicate.\n   *\n   * The `FILES` soft-delete precedent derives its cutoff instead. That is defensible there — an\n   * orphaned upload is nobody's commitment — and is precisely why the two should not share one\n   * mechanism.\n   *\n   * Server-owned: written only by the lifecycle operations that own the state machine, never by a\n   * client patch.\n   *\n   * `.nullish()` for the same reason as {@link deletionRequestedAt} — `restore` clears it, and a\n   * persisted `null` has to survive the next read.\n   */\n  purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()\n});\n\n\nexport type Organization = z.infer<typeof OrganizationSchema>;\n\n/**\n * Organization Context - Core organization with frequently accessed related data\n *\n * Lifecycle audit information is now tracked through auditable events\n */\nexport const OrganizationContextSchema = OrganizationSchema.extend({\n  // Scope features (stored separately from billing, scope-agnostic)\n  planFeatures: ScopeFeaturesWithOverridesSchema,\n  members: z.array(OrganizationMemberSchema),\n\n  // Basic display info (most frequently accessed)\n  displayName: z.string().optional(), // Can be different from name\n  logoUrl: z.url().optional(),\n\n  // Extended related data (optional - populated as needed)\n  profile: OrganizationProfileSchema.optional(),\n  preferences: OrganizationPreferencesSchema.optional(),\n  notifications: OrganizationNotificationsSchema.optional()\n});\n\n\nexport type OrganizationContext = z.infer<typeof OrganizationContextSchema>;\n"]}
+{"version":3,"file":"organizations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAK1F,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;IACvB,qCAAe,CAAA;IACf,qDAA+B,CAAA;IAC/B,6CAAuB,CAAA;IACvB;;;;;;;OAOG;IACH,yCAAmB,CAAA;AACrB,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAoC,IAAI,GAAG,CAAC;IAC9F,kBAAkB,CAAC,OAAO;IAC1B,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAsC;IAC5F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,uCAAuC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAID,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5D;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACb,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,WAAW,EAAE;SACb,QAAQ,CAAC,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,wBAAwB,EAAE,CAAC;SAC5F,cAAc,EAAE;SAChB,iBAAiB,EAAE;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAExH;;;;;;;;;;;;;;;;OAgBG;IACH,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAE5E,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAE3H;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC;AAKH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC","sourcesContent":["/**\n * Core Organization Shared Schemas\n *\n * Lean organization schema optimized for frequent fetching.\n * Related data moved to separate relational models.\n */\n\nimport { z } from 'zod';\nimport { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions';\nimport { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas';\n\n\n\n\nexport enum OrganizationStatus {\n  ACTIVE = 'ACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  TRIAL = 'TRIAL',\n  TRIAL_EXPIRED = 'TRIAL_EXPIRED',\n  CANCELLED = 'CANCELLED',\n  /**\n   * Marked for deletion and inside its retention window — NOT removed.\n   *\n   * Written by the `request_deletion` lifecycle operation, cleared by `restore`, and consumed by\n   * the `organization-purge` batch once {@link Organization.purgeScheduledAt} has elapsed. A row\n   * in this state is authorization-dead (see\n   * {@link isAuthorityConferringOrganizationStatus}) and data-alive.\n   */\n  DELETED = 'DELETED'\n}\n\n/**\n * Organization statuses under which a membership STOPS conferring authority.\n *\n * ## Why this exists as a named authority\n *\n * Until 2026-08-01 `OrganizationStatus` had **zero backend readers**: the execution-context\n * creator built `initiatorRoles` straight from ACTIVE membership rows without ever looking at the\n * organization, so no status value affected anything. That made tenant soft-delete impossible to\n * express — a tenant marked for purge would have kept handing out `ORG_ADMIN` for its whole\n * retention window, which is the original hazard with a longer fuse rather than a fix.\n *\n * The set is declared here, beside the enum it partitions, rather than inline at the consumer, so\n * that adding a future non-operational status is one edit in the place a reader is already\n * looking. Consumers call {@link isAuthorityConferringOrganizationStatus}; they must not test\n * `status === DELETED` inline.\n *\n * ## Why these three\n *\n * - `DELETED` — marked for purge. The whole point of the soft-delete phase.\n * - `SUSPENDED` — an administratively halted tenant. Membership must not survive the halt.\n * - `CANCELLED` — a terminated subscription/tenant. Terminal, like `DELETED`.\n *\n * `TRIAL_EXPIRED` is deliberately NOT here: an expired trial still needs its administrators to\n * sign in and pay, so revoking their authority would make the tenant unrecoverable by its owner.\n * `ACTIVE` and `TRIAL` are the operational states.\n *\n * ⚠️ Fail-CLOSED direction: an unresolvable organization is treated as non-conferring by the\n * consumer, so a missing row can never widen authority.\n *\n * assurance-control: WILDO.ACCESS.LIFECYCLE — access rights are removed when the\n * scope granting them stops being operational, without waiting for the data to be destroyed.\n */\nexport const ORGANIZATION_STATUSES_WITHOUT_AUTHORITY: ReadonlySet<OrganizationStatus> = new Set([\n  OrganizationStatus.DELETED,\n  OrganizationStatus.SUSPENDED,\n  OrganizationStatus.CANCELLED,\n]);\n\n/**\n * True when a membership in an organization of this status still confers its roles.\n *\n * The single authority behind the execution-context membership gate. See\n * {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} for the rationale and the deliberate\n * `TRIAL_EXPIRED` exclusion.\n */\nexport function isAuthorityConferringOrganizationStatus(status: OrganizationStatus | undefined): boolean {\n  if (status === undefined) return false;\n  return !ORGANIZATION_STATUSES_WITHOUT_AUTHORITY.has(status);\n}\n\n\n\nexport const OrganizationSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n  /**\n   * Org type from config (for example `seller` or `corporate_buyer`) — REQUIRED, and it must name an entry in\n   * the application's declared `organizationTypes`.\n   *\n   * The type selects role policy, membership-derived user-type grants, and\n   * authentication overrides. A generic patch cannot migrate those dependent\n   * invariants atomically, so the value is creation-time identity. A future\n   * type transition must be a dedicated migration operation that reconciles\n   * every dependent member and policy surface.\n   *\n   * ONE such operation exists: `organizations.promoteToOwnerOrganization` (#1054), the paired mutation\n   * path for the one transition the framework needs — naming the organization that OPERATES the\n   * application. It discharges the sentence above by REFUSING rather than reconciling: the target type\n   * must already cover every user type the source grants, every role a membership holds must be\n   * available in it, and a SCIM binding may not be lost. So no member's authority moves, which is what\n   * makes a transition safe without a cross-resource reconciliation. Any future transition owes the\n   * same bar — refuse, or reconcile in one transaction; a generic patch still may not write this.\n   *\n   * Required since #1032: the sign-in resolver refuses a member of an organization whose type resolves to no\n   * declared entry, so an optional type was a way to create a tenant nobody could sign in to. Organizations stored\n   * before it was required are typed by the engine at boot when the application declares a single type, and the\n   * application refuses to start naming them when it declares several.\n   */\n  type: z.string().min(1).isSummaryField().excludeFromUpdate(),\n  /**\n   * The tenant's URL-safe identity.\n   *\n   * `.isUnique()` since 2026-08-01, and it closes a real hole rather than restating a known rule:\n   * uniqueness was promised by the resource specification's 409 and enforced by NOTHING — no index\n   * and no application guard — so two organizations could take the same slug. Because the field is\n   * also `.excludeFromUpdate()` (creation-time identity, not an editable label), such a collision\n   * could never be resolved through the API afterwards. It has to be refused at creation.\n   *\n   * Uniqueness is collection-wide, which IS per-application: an application's organizations live in\n   * that application's own database, and the schema carries no `applicationId` to scope by.\n   *\n   * ⚠️ MongoDB-only today. The SQL planner records uniqueness as intent and leaves enforcement\n   * migration-owned, so on a SQL adapter this is a declaration rather than a guarantee.\n   */\n  slug: z.string()\n    .min(1)\n    .max(50)\n    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/)\n    .isDBIndexed()\n    .isUnique({ conflictMessageReference: ErrorCustomMessageReference.ORGANIZATION_SLUG_EXISTS })\n    .isSummaryField()\n    .excludeFromUpdate(),\n  /**\n   * Tenant lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01, and that exclusion is the whole point of the field.\n   * Before it, generic UPDATE carried `status` and the DEFAULT variant of that operation is gated\n   * to `ORG_ADMIN` — while SUSPEND / ACTIVATE are `APP_ADMIN_SUPER_ADMIN`-only and gated by an\n   * `enabledCondition` on the current status. So the org admin of a SUSPENDED tenant could\n   * `PUT /organizations/{id}` with `{\"status\":\"ACTIVE\"}` and lift the platform's suspension on\n   * their own organization: the control was defeatable by exactly the party it exists to control.\n   * The configuration had claimed otherwise for a long time — both UPDATE variants carried a\n   * `// status manually excluded for this variant` comment that nothing implemented.\n   *\n   * Lifecycle transitions belong to the dedicated verbs, which own the state machine, the reason,\n   * and the audit trail. This mirrors `OrganizationMemberSchema.status`, whose JSDoc has always\n   * described the same rule for the same reason.\n   *\n   * KNOWN CONSEQUENCE, ACCEPTED: the platform apps-manager's `upsertEntity` re-asserts\n   * `status: ACTIVE` on its update branch when reconciling an existing organization. That write is\n   * now dropped. This is the intended outcome — a provisioning re-run silently returning a\n   * suspended tenant to ACTIVE is the same defect from the other direction. A path that must set\n   * the status goes through the transition operations or a trusted `updateAsSystem`, not a generic\n   * field patch.\n   *\n   * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — a tenant may not lift a platform-imposed\n   * restriction on itself.\n   */\n  status: z.enum(OrganizationStatus).default(OrganizationStatus.ACTIVE).isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n  /**\n   * Does a platform operator need THIS tenant's approval before an elevation becomes usable?\n   *\n   * The Customer Lockbox posture, and opt-in per tenant exactly as Microsoft and Google ship it. A\n   * tenant that has not staffed an approver must not thereby become unable to receive support, so\n   * the default is `false`: elevations still require a request, a justification, a 4-hour ceiling and\n   * an audit trail — they simply do not wait for a human in the tenant.\n   *\n   * Turning it ON is the strongest available posture and is what regulated buyers ask for by name.\n   *\n   * ⚠️ It does NOT make the tenant unreachable when it has no administrator. A tenant with no\n   * administratively usable owner cannot approve anything, and requiring approval from it would make\n   * its own repair impossible — see `PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE`,\n   * which is measured with the owner floor's own predicate rather than assumed.\n   *\n   * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — customer-approved operator access.\n   */\n  platformAccessApprovalRequired: z.boolean().default(false).isAuditEvidence(),\n\n  // Basic timestamps (lifecycle audit is in separate collection)\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  // Tenant teardown — soft-delete marks (WS-A)\n  /**\n   * When the tenant was MARKED for deletion — the start of its retention window.\n   *\n   * Written by the `request_deletion` lifecycle operation together with `status: DELETED`, and\n   * cleared by `restore`. Both fields move together: `status` is the authorization-relevant half\n   * (it is what {@link isAuthorityConferringOrganizationStatus} reads) and this is the evidence\n   * half.\n   *\n   * ## Why this is not called `deletedAt`\n   *\n   * It replaced a field of that name on 2026-08-01, and the rename is not cosmetic in two separate\n   * ways.\n   *\n   * First, `deletedAt` is RESERVED framework vocabulary: it appears in\n   * `createOrUpdateMandatoryDiscardFields`, so the runtime strips it from every create and update\n   * payload on every resource. A lifecycle operation could therefore never write it — the value\n   * would be discarded and the operation would answer success having recorded nothing, which is\n   * the exact silent-no-op class this workstream exists to remove. No `authoritativeFields`\n   * declaration rescues it; the discard happens regardless.\n   *\n   * Second, the two names mean different things. `deletedAt` answers \"when was this row deleted\",\n   * and the row is emphatically NOT deleted — it is fully present and restorable for the whole\n   * retention window. Reusing the name would have made every reader who trusts the framework's\n   * vocabulary wrong about the state of the tenant in front of them.\n   *\n   * The predecessor field had zero readers and zero writers in the entire repository, so nothing\n   * observable was lost by replacing it.\n   *\n   * Never a user-facing value on a live organization — it only ever renders as an empty \"—\", so it\n   * stays hidden from every auto-rendered display/edit surface via `.isHidden()`. An admin/audit\n   * surface that needs to inspect marked rows must opt it back in explicitly.\n   *\n   * ⚠️ This is NOT the purge predicate. Purge eligibility is {@link purgeScheduledAt} — see the\n   * reasoning there.\n   *\n   * ## Why `.nullish()` and not `.optional()`\n   *\n   * `restore` CLEARS this field, and clearing means writing `null` — `undefined` merely omits the\n   * key and leaves the stale mark in place. `preserveServerInjectedFields` copies the authored\n   * value verbatim past the strict re-parse (`hasOwnProperty` + assign), so the `null` genuinely\n   * reaches persistence. With `.optional()` alone the row would then be UNREADABLE: the main schema\n   * rejects `null` for a `z.date()`, so every subsequent read of a restored tenant would throw on\n   * output projection. Verified by probing the real schema rather than assumed.\n   */\n  deletionRequestedAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden(),\n  /**\n   * Serialization token for the organization-owner floor. Never read for meaning — only WRITTEN, to\n   * make concurrent owner-reducing operations conflict with each other.\n   *\n   * ## Why a stored field is the fix rather than a better check\n   *\n   * The floor is a check-then-act on a COUNT: it measures the usable-owner population, then the\n   * caller writes. Under snapshot isolation that is textbook WRITE SKEW — two transactions each\n   * remove a DIFFERENT owner, each observes the other still present, and both commit, producing a\n   * tenant with zero owners that neither was individually permitted to create. No amount of\n   * additional checking closes it, because each transaction's view is internally consistent; a\n   * re-measure after the write cannot see the other transaction's uncommitted row either.\n   *\n   * The standard remedy is to give the two transactions something to collide ON. Every owner-reducing\n   * operation bumps this token on the tenant's own row inside its transaction, so two of them touch\n   * the same document and the storage engine aborts the loser. That holds only when the operation's\n   * transaction reaches the floor, which every owner-reducing prefix now passes as `transaction`; until\n   * 2026-09-15 none did, and the write autocommitted beside the removal. Observed on a live replica set\n   * in `organization-owner-floor-concurrent-removal.mongo-replset.integration.test.ts`, which also\n   * drives the unforwarded shape and watches it leave the tenant with no owner.\n   *\n   * Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a\n   * modification of the organization, and it would corrupt every \"recently changed tenants\" surface);\n   * a separate lock collection (a new resource, a new registration, and a second thing to keep\n   * consistent with the floor); an application-level mutex (does not survive multiple processes,\n   * which is exactly the deployment this must work in).\n   *\n   * `.nullish()` because existing tenants predate it and a tenant that has never had an\n   * owner-reducing write legitimately has no token. Absent and zero mean the same thing.\n   */\n  ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n\n  /**\n   * When the `organization-purge` batch becomes allowed to destroy this tenant.\n   *\n   * ## Why this is stored rather than derived from `deletionRequestedAt` + a configured window\n   *\n   * The retention window is a PROMISE made to the tenant at the moment of the mark (\"your data is\n   * recoverable until <date>\"). Deriving eligibility as `deletionRequestedAt < now - window`\n   * re-evaluates that promise against whatever the configuration says at PURGE time, so lowering\n   * the window would retroactively shorten — or immediately expire — every tenant already inside\n   * one. Pinning the deadline at mark time makes the commitment immutable, which is the property\n   * a data-retention commitment has to have, and it makes a per-tenant legal hold expressible\n   * later by moving one field rather than by special-casing the batch predicate.\n   *\n   * The `FILES` soft-delete precedent derives its cutoff instead. That is defensible there — an\n   * orphaned upload is nobody's commitment — and is precisely why the two should not share one\n   * mechanism.\n   *\n   * Server-owned: written only by the lifecycle operations that own the state machine, never by a\n   * client patch.\n   *\n   * `.nullish()` for the same reason as {@link deletionRequestedAt} — `restore` clears it, and a\n   * persisted `null` has to survive the next read.\n   */\n  purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()\n});\n\n\nexport type Organization = z.infer<typeof OrganizationSchema>;\n\n/**\n * An organization as the frontend holds it for a signed-in member: the organization row plus what\n * session restore fetches beside it.\n *\n * **Every field here has a producer, and that is the rule for adding one.** `UserOrgsContext` obtains\n * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field\n * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema\n * declared five such fields, two of them REQUIRED:\n *\n * | removed | why |\n * |---|---|\n * | `planFeatures` (required) | no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. |\n * | `members` (required) | no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. |\n * | `profile`, `notifications` | no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). |\n * | `displayName`, `logoUrl` | no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. |\n *\n * `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and\n * tolerates its absence (#563).\n */\nexport const OrganizationContextSchema = OrganizationSchema.extend({\n  preferences: OrganizationPreferencesSchema.optional(),\n});\n\n\nexport type OrganizationContext = z.infer<typeof OrganizationContextSchema>;\n"]}

package/dist/esm/organizations/tenant-teardown-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-teardown-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/tenant-teardown-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kHAAkH;AAClH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,0BAA0B;;;;iBAkCrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,sFAAsF;AACtF,eAAO,MAAM,+BAA+B,EAAE,oBAA2D,CAAC;AAC1G,gEAAgE;AAEhE;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,IAAI,CAGN"}
+{"version":3,"file":"tenant-teardown-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/tenant-teardown-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kHAAkH;AAClH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,0BAA0B;;;;iBAkCrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,sFAAsF;AACtF,eAAO,MAAM,+BAA+B,EAAE,oBAA2D,CAAC;AAC1G,gEAAgE;AAEhE;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,IAAI,CAGN"}

package/dist/esm/organizations/tenant-teardown-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-teardown-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/tenant-teardown-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kHAAkH;AAClH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;;;;;;;;;OAaG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE5D;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAElD;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAIH,sFAAsF;AACtF,MAAM,CAAC,MAAM,+BAA+B,GAAyB,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1G,gEAAgE;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,QAAc,EACd,MAAwC;IAExC,MAAM,mBAAmB,GAAG,MAAM,EAAE,mBAAmB,IAAI,+BAA+B,CAAC,mBAAmB,CAAC;IAC/G,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAClF,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** @wildo_source:part:start saas.models.config.tenant-teardown facet:layer:shared facet:audience:app-developer */\n/**\n * Tenant teardown — the operator-tunable half of soft-delete + retention window + purge.\n *\n * Declared as the optional `tenantTeardown` block of your application's backend-authored\n * configuration (`backend-api/src/saas-config.backend.ts`), beside `lifecycle` and `compliance`.\n *\n * ## What it governs, and why you cannot ignore it by omitting it\n *\n * Deleting a tenant is TWO acts. Requesting deletion MARKS the organization, at which point it\n * stops conferring any authority and its data is still entirely intact; an engine-owned batch\n * destroys it later. The three fields here decide how long \"later\" is, when the batch runs, and how\n * many tenants one run may destroy — so an application that declares nothing still deletes its\n * customers' tenants, on this block's defaults, thirty days after the mark.\n *\n * ## Why this is its own config block\n *\n * `LifecycleConfigSchema` already exists and is about the USER lifecycle (activation, engagement,\n * dormancy detection). Folding tenant teardown into it would merge two unrelated concerns behind\n * one master switch — and that switch defaults to `enabled: false`, which would make an\n * organization's retention window silently depend on whether the app opted into user-engagement\n * tracking. Tenant teardown has no such opt-in: an application that deletes tenants always has a\n * retention window, so the block is optional only in the sense that its defaults are usually right.\n *\n * ## Why every value has a default\n *\n * Omitting the block entirely must produce a working, safe configuration — the alternative is an\n * application that ships without a purge schedule and accumulates marked-but-never-destroyed\n * tenants, which is the failure mode a retention window is supposed to prevent.\n */\nexport const TenantTeardownConfigSchema = z.object({\n  /**\n   * How long a marked tenant stays restorable before the purge batch may destroy it.\n   *\n   * Default 30 days. The window is a commitment, not a scheduling hint: the value is read ONCE,\n   * when the tenant is marked, and pinned onto `Organization.purgeScheduledAt`. Lowering this\n   * setting therefore affects only tenants marked afterwards — tenants already inside a window\n   * keep the deadline they were promised. See `Organization.purgeScheduledAt` for why the deadline\n   * is stored rather than recomputed.\n   *\n   * 30 days sits inside the band comparable products use (roughly 20–90 days) and inside the\n   * one-month response period GDPR Art. 12(3) allows for acting on an erasure request, so the\n   * default does not put an application in breach by itself. It is not legal advice: an\n   * application with its own retention obligations must set this deliberately.\n   */\n  retentionWindowDays: z.number().int().positive().default(30),\n\n  /**\n   * Cron schedule for the engine-owned `organization-purge` batch. Default 03:00 daily.\n   *\n   * Daily rather than hourly on purpose: the window is measured in days, so a finer cadence buys\n   * no promptness that anyone can observe and only multiplies the scans.\n   */\n  purgeCronSchedule: z.string().default('0 3 * * *'),\n\n  /**\n   * Maximum tenants destroyed per purge run.\n   *\n   * A purge cascades across every child resource of a tenant, so an unbounded run after a mass\n   * offboarding could hold database resources for a long time. Anything not reached this run is\n   * reached by the next one — the deadline has passed, so there is no correctness cost to\n   * spreading the work, and a bounded run keeps one bad batch from becoming an outage.\n   */\n  purgeBatchSize: z.number().int().positive().default(50),\n});\n\nexport type TenantTeardownConfig = z.infer<typeof TenantTeardownConfigSchema>;\n\n/** Defaults applied when an application declares no `tenantTeardown` block at all. */\nexport const TENANT_TEARDOWN_CONFIG_DEFAULTS: TenantTeardownConfig = TenantTeardownConfigSchema.parse({});\n/** @wildo_source:part:end saas.models.config.tenant-teardown */\n\n/**\n * Resolve the purge deadline for a tenant being marked right now.\n *\n * Shared by the lifecycle operation that writes `purgeScheduledAt` and by the tests that pin it,\n * so the window arithmetic has one home. Takes `markedAt` explicitly rather than reading the clock\n * so the caller's transaction timestamp and the deadline cannot disagree.\n */\nexport function resolveOrganizationPurgeScheduledAt(\n  markedAt: Date,\n  config: TenantTeardownConfig | undefined,\n): Date {\n  const retentionWindowDays = config?.retentionWindowDays ?? TENANT_TEARDOWN_CONFIG_DEFAULTS.retentionWindowDays;\n  return new Date(markedAt.getTime() + retentionWindowDays * 24 * 60 * 60 * 1000);\n}\n"]}
+{"version":3,"file":"tenant-teardown-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/tenant-teardown-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kHAAkH;AAClH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;;;;;;;;;OAaG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE5D;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAElD;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAIH,sFAAsF;AACtF,MAAM,CAAC,MAAM,+BAA+B,GAAyB,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1G,gEAAgE;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,QAAc,EACd,MAAwC;IAExC,MAAM,mBAAmB,GAAG,MAAM,EAAE,mBAAmB,IAAI,+BAA+B,CAAC,mBAAmB,CAAC;IAC/G,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAClF,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** @wildo_source:part:start saas.models.config.tenant-teardown facet:layer:shared facet:audience:app-developer */\n/**\n * Tenant teardown — the operator-tunable half of soft-delete + retention window + purge.\n *\n * Declared as the optional `tenantTeardown` block of your application's backend-authored\n * configuration (`backend-api/src/saas-config.backend.ts`), beside `lifecycle` and `compliance`.\n *\n * ## What it governs, and why you cannot ignore it by omitting it\n *\n * Deleting a tenant is TWO acts. Requesting deletion MARKS the organization, at which point it\n * stops conferring any authority and its data is still entirely intact; an engine-owned batch\n * destroys it later. The three fields here decide how long \"later\" is, when the batch runs, and how\n * many tenants one run may destroy — so an application that declares nothing still deletes its\n * customers' tenants, on this block's defaults, thirty days after the mark.\n *\n * ## Why this is its own config block\n *\n * `LifecycleConfigSchema` already exists and is about the USER lifecycle (activation, engagement,\n * dormancy detection). Folding tenant teardown into it would merge two unrelated concerns behind\n * one master switch — and that switch defaults to `enabled: false`, which would make an\n * organization's retention window silently depend on whether the app opted into user-engagement\n * tracking. Tenant teardown has no such opt-in: an application that deletes tenants always has a\n * retention window, so the block is optional only in the sense that its defaults are usually right.\n *\n * ## Why every value has a default\n *\n * Omitting the block entirely must produce a working, safe configuration — the alternative is an\n * application that ships without a purge schedule and accumulates marked-but-never-destroyed\n * tenants, which is the failure mode a retention window is supposed to prevent.\n */\nexport const TenantTeardownConfigSchema = z.object({\n  /**\n   * How long a marked tenant stays restorable before the purge batch may destroy it.\n   *\n   * Default 30 days. The window is a commitment, not a scheduling hint: the value is read ONCE,\n   * when the tenant is marked, and pinned onto `Organization.purgeScheduledAt`. Lowering this\n   * setting therefore affects only tenants marked afterwards — tenants already inside a window\n   * keep the deadline they were promised. See `Organization.purgeScheduledAt` for why the deadline\n   * is stored rather than recomputed.\n   *\n   * 30 days sits inside the band comparable products use (roughly 20–90 days) and inside the\n   * one-month response period GDPR Art. 12(3) allows for acting on an erasure request, so the\n   * default does not put an application in breach by itself. It is not legal advice: an\n   * application with its own retention obligations must set this deliberately.\n   */\n  retentionWindowDays: z.number().int().positive().default(30),\n\n  /**\n   * Cron schedule for the engine-owned `organization-purge` batch. Default 03:00 daily.\n   *\n   * Daily rather than hourly on purpose: the window is measured in days, so a finer cadence buys\n   * no promptness that anyone can observe and only multiplies the scans.\n   */\n  purgeCronSchedule: z.string().default('0 3 * * *'),\n\n  /**\n   * Maximum tenants destroyed per purge run.\n   *\n   * A purge cascades across every child resource of a tenant, so an unbounded run after a mass\n   * offboarding could hold database resources for a long time. Anything not reached this run is\n   * reached by the next one — the deadline has passed, so there is no correctness cost to\n   * spreading the work, and a bounded run keeps one bad batch from becoming an outage.\n   */\n  purgeBatchSize: z.number().int().positive().default(50),\n});\n\nexport type TenantTeardownConfig = z.infer<typeof TenantTeardownConfigSchema>;\n\n/** Defaults applied when an application declares no `tenantTeardown` block at all. */\nexport const TENANT_TEARDOWN_CONFIG_DEFAULTS: TenantTeardownConfig = TenantTeardownConfigSchema.parse({});\n/** @wildo_source:part:end saas.models.config.tenant-teardown */\n\n/**\n * Resolve the purge deadline for a tenant being marked right now.\n *\n * Shared by the lifecycle operation that writes `purgeScheduledAt` and by the tests that pin it,\n * so the window arithmetic has one home. Takes `markedAt` explicitly rather than reading the clock\n * so the caller's transaction timestamp and the deadline cannot disagree.\n */\nexport function resolveOrganizationPurgeScheduledAt(\n  markedAt: Date,\n  config: TenantTeardownConfig | undefined,\n): Date {\n  const retentionWindowDays = config?.retentionWindowDays ?? TENANT_TEARDOWN_CONFIG_DEFAULTS.retentionWindowDays;\n  return new Date(markedAt.getTime() + retentionWindowDays * 24 * 60 * 60 * 1000);\n}\n"]}

package/dist/esm/provider-registration-runtime.exports.d.ts

@@ -1,4 +1,5 @@
 export * from "./external-providers/provider-capability.shared.schemas";
 export * from "./external-providers/provider-metadata.shared.schemas";
 export * from './external-providers/provider-usage-pricing.shared.schemas';
+export * from './external-providers/provider-authentication-assurance.shared.schemas';
 //# sourceMappingURL=provider-registration-runtime.exports.d.ts.map

package/dist/esm/provider-registration-runtime.exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-registration-runtime.exports.d.ts","sourceRoot":"","sources":["../../src/provider-registration-runtime.exports.ts"],"names":[],"mappings":"AAAA,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC"}
+{"version":3,"file":"provider-registration-runtime.exports.d.ts","sourceRoot":"","sources":["../../../src/provider-registration-runtime.exports.ts"],"names":[],"mappings":"AAAA,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC;AAE3E,cAAc,uEAAuE,CAAC"}

package/dist/esm/provider-registration-runtime.exports.js

@@ -1,4 +1,5 @@
 export * from "./external-providers/provider-capability.shared.schemas.js";
 export * from "./external-providers/provider-metadata.shared.schemas.js";
 export * from './external-providers/provider-usage-pricing.shared.schemas.js';
+export * from './external-providers/provider-authentication-assurance.shared.schemas.js';
 //# sourceMappingURL=provider-registration-runtime.exports.js.map

package/dist/esm/provider-registration-runtime.exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-registration-runtime.exports.js","sourceRoot":"","sources":["../../../src/provider-registration-runtime.exports.ts"],"names":[],"mappings":"AAAA,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC","sourcesContent":["export * from \"./external-providers/provider-capability.shared.schemas\";\nexport * from \"./external-providers/provider-metadata.shared.schemas\";\nexport * from './external-providers/provider-usage-pricing.shared.schemas';\n"]}
+{"version":3,"file":"provider-registration-runtime.exports.js","sourceRoot":"","sources":["../../../src/provider-registration-runtime.exports.ts"],"names":[],"mappings":"AAAA,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC;AAE3E,cAAc,uEAAuE,CAAC","sourcesContent":["export * from \"./external-providers/provider-capability.shared.schemas\";\nexport * from \"./external-providers/provider-metadata.shared.schemas\";\nexport * from './external-providers/provider-usage-pricing.shared.schemas';\n\nexport * from './external-providers/provider-authentication-assurance.shared.schemas';\n"]}

package/dist/esm/public-runtime/index.d.ts

@@ -110,6 +110,13 @@ export { WildoHeaderKeys } from '../requests/header-keys.shared';
  * nothing to the decorator-free bundle budget.
  */
 export { MAIN_API_BASE_PATH } from '../requests/manual-controllers-routes-urls';
+/**
+ * A caught value as one readable line, for a bundle-isolated package (`saas-website`). The root's
+ * `describeCaughtError` also recognises the engine's own error type and so imports the error schemas;
+ * this atom imports nothing, and `describeCaughtError` delegates to it for every other value — one
+ * rendering, two doors (#1518's "[object Object]" fix, reachable from the browser-safe seam).
+ */
+export { describeThrownValue } from '../errors/thrown-value-description.shared.utils';
 export { AppFrontendType } from '../config/app-frontend-type.shared.schemas';
 /**
  * Canonical Zod-issue rendering. Browser-bound runtimes validate untrusted
@@ -145,6 +152,13 @@ export { buildProviderDisplayNameLabelKey, defineProviderMetadata, ENGINE_PROVID
  * side effects, which is the same bar the tier rule below is exported under.
  */
 export { ProviderDeploymentModel, ProviderComplianceProfileSchema, type ProviderComplianceProfile, } from '../external-providers/provider-compliance-profile.shared.schemas';
+/**
+ * Consent purposes (#534) — the set a person grants, read by the visitor-tier `WebsiteConsentGate` in
+ * the browser bundle and stored by the application. Carved into an import-free atom
+ * (`consent-purposes.shared.ts`) so the website and the engine share ONE vocabulary: a website that
+ * mirrored the string literals would be a second copy that drifts the day a purpose is added.
+ */
+export { ANONYMOUS_CONSENT_RECORD_METHOD, ANONYMOUS_CONSENT_RECORD_PATH, applicationAskedConsentPurposes, CONSENT_PURPOSES, ConsentPurpose, hasGrantedConsentPurposes, missingConsentPurposes, normalizeConsentPurposes, WEBSITE_VISITOR_CONSENT_STORAGE_KEY, } from '../compliance/privacy/consent-purposes.shared';
 /**
  * The tier rule (#328) is enforced by every facet's `compose*Providers`,
  * three of which are browser-bound and reach this package only here. It
@@ -160,15 +174,7 @@ export { assertProviderTierCoherence, engineSlotsBoundByCapabilities, findProvid
  * `AppConfiguration_FrontendBootstrapResponse` contract stays on the root-barrel
  * side.
  */
-export { FrontendProviderEntrySchema, FrontendProvidersBlockSchema, type FrontendProviderEntry, type FrontendProvidersBlock, } from '../external-providers/frontend-provider-entry.shared.schemas';
-/**
- * The z_file storage vocabulary, re-exported so a browser-bound provider module
- * can declare `fileStorage: FileStorageAccepted.GOOGLE_DRIVE` by NAME (#394 P5).
- * The enum is owned by `@wildo-ai/zod-decorators` — the package that owns
- * `z_file({ storageAccepted })` — and the facets' bundle-isolation allow-list
- * admits only this door into the models, so the value has to be reachable here.
- */
-export { FileStorageAccepted } from '@wildo-ai/zod-decorators';
+export { FileStorageAccepted, FrontendProviderEntrySchema, FrontendProvidersBlockSchema, type FrontendProviderEntry, type FrontendProvidersBlock, } from '../external-providers/frontend-provider-entry.shared.schemas';
 /**
  * Frontend-surface atoms a provider declares (#332, slice S4a): its CSP
  * footprint, the vendor SDK package it loads, and any third-party `<script>` it
@@ -200,7 +206,7 @@ export { defineFrontendPublicConfigSchema, FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY,
  * rather than conventional: the keys were previously read by hand at each use
  * site, where a renamed one produced `undefined` and a silently wrong surface.
  */
-export { FrontendFilePickerPublicConfigSchema, type FrontendFilePickerPublicConfig, } from '../external-providers/frontend-capability-public-config.shared.schemas';
+export { admissibleFrontendPublicConfigKeys, FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS, FrontendFilePickerPublicConfigSchema, frontendCapabilityPublicConfigKeys, layerProviderFilePickerConstraints, partitionFrontendCapabilityPublicConfig, type FrontendFilePickerPublicConfig, } from '../external-providers/frontend-capability-public-config.shared.schemas';
 /**
  * The RUNTIME half of the same idea (#437): what a built-in frontend capability
  * calls on the provider that fills it. `FRONTEND_ERROR_MONITORING` is the first —
@@ -229,5 +235,28 @@ export { BUILTIN_PROVIDER_PROTOCOL, type BuiltinProviderProtocol, type ProviderP
  * above, so the closure stays decorator-free.
  */
 export { composeProviderRegistry, ProviderCompositionConflictError, type ProviderRegistryFragment, type ComposedProviderRegistry, type ProviderCompositionConflict, } from '../external-providers/compose-provider-registry.shared';
+/**
+ * Portable lexical primitives — a sha256-digest grammar, a namespaced/opaque ref grammar, a
+ * positive version, a lowercase UUIDv4, an ISO datetime, and two array-canonicality predicates.
+ *
+ * ## Why they are HERE and not only behind `@wildo-ai/saas-models/meta-workflows`
+ *
+ * They are shared by two domains, and only one of them is meta-workflows. Measured 2026-09-19: of
+ * 41 import sites of the meta-workflows subpath, **7 take nothing but these primitives**, and all
+ * seven are `saas-specifications/src/technical-documentation/*.schemas.ts` — a browser-bound tier
+ * whose bundle-isolation allow-list had to admit an entire authoring domain to obtain seven
+ * regexes.
+ *
+ * No K-2 extraction was needed: `portable-primitives.meta-workflows.shared.schemas` imports `zod`
+ * and nothing else, so it is already the zero-dependency atom K-2 asks for — the
+ * `WildoHeaderKeys` case, re-exported whole. The meta-workflows door keeps publishing it for its
+ * 34 mixed consumers; that is two SUBPATHS onto one atom, which `check:package-entrypoints` rule 1
+ * does not refuse (it is root-vs-subpath), and it is what a curated bundle-safe subset IS.
+ *
+ * The `MetaWorkflow_` prefix is kept deliberately: renaming a symbol that 34 other sites import is
+ * a separate change from making it reachable on the bundle-safe seam, and doing both at once would
+ * hide one in the other.
+ */
+export { MetaWorkflow_Sha256DigestSchema, MetaWorkflow_NamespacedRefSchema, MetaWorkflow_OpaqueRefSchema, MetaWorkflow_PositiveVersionSchema, MetaWorkflow_PositiveOrdinalSchema, MetaWorkflow_NonNegativeRevisionSchema, MetaWorkflow_LowercaseUuidV4Schema, MetaWorkflow_IsoDateTimeSchema, MetaWorkflow_NonNegativeFiniteNumberSchema, metaWorkflowValuesAreUnique, metaWorkflowValuesAreLexicallySorted, compareMetaWorkflowCanonicalStrings, } from '../meta-workflows/portable-primitives.meta-workflows.shared.schemas';
 /** @wildo_source:part:end saas.public-runtime.contract */
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/public-runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/public-runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EACH,6BAA6B,EAC7B,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC7B,MAAM,uEAAuE,CAAC;AAE/E;;;;;;;;GAQG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAExG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAE7E;;;;;;GAMG;AACH,OAAO,EACH,cAAc,EACd,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,GACjC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EACH,iBAAiB,EACjB,aAAa,GAChB,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;;;GASG;AACH,OAAO,EACH,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACtB,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,OAAO,EACH,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,yBAAyB,GACjC,MAAM,kEAAkE,CAAC;AAE1E;;;;;GAKG;AACH,OAAO,EACH,2BAA2B,EAC3B,8BAA8B,EAC9B,0BAA0B,EAC1B,KAAK,uBAAuB,GAC/B,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;GAOG;AACH,OAAO,EACH,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC9B,MAAM,8DAA8D,CAAC;AAEtE;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,OAAO,EACH,qCAAqC,EACrC,yCAAyC,EACzC,0CAA0C,EAC1C,sCAAsC,EACtC,kCAAkC,EAClC,+BAA+B,EAC/B,iCAAiC,EACjC,uCAAuC,EACvC,mCAAmC,EACnC,iCAAiC,EACjC,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EACjC,KAAK,uCAAuC,EAC5C,KAAK,iCAAiC,EACtC,KAAK,6BAA6B,GACrC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,YAAY,EACR,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,GACxB,MAAM,yEAAyE,CAAC;AAEjF;;;;GAIG;AACH,OAAO,EACH,gCAAgC,EAChC,mCAAmC,EACnC,iCAAiC,EACjC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,EAC5B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,wCAAwC,GAChD,MAAM,8DAA8D,CAAC;AAEtE;;;;GAIG;AACH,OAAO,EACH,oCAAoC,EACpC,KAAK,8BAA8B,GACtC,MAAM,wEAAwE,CAAC;AAEhF;;;;;;GAMG;AACH,OAAO,EACH,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,GACnC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,OAAO,EACH,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GAC1B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACxB,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;GASG;AACH,OAAO,EACH,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,GACnC,MAAM,wDAAwD,CAAC;AAEhE,0DAA0D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/public-runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EACH,6BAA6B,EAC7B,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC7B,MAAM,uEAAuE,CAAC;AAE/E;;;;;;;;GAQG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAExG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAE7E;;;;;;GAMG;AACH,OAAO,EACH,cAAc,EACd,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,GACjC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EACH,iBAAiB,EACjB,aAAa,GAChB,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;;;GASG;AACH,OAAO,EACH,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACtB,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,OAAO,EACH,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,yBAAyB,GACjC,MAAM,kEAAkE,CAAC;AAE1E;;;;;GAKG;AACH,OAAO,EACH,+BAA+B,EAC/B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,mCAAmC,GACtC,MAAM,+CAA+C,CAAC;AAEvD;;;;;GAKG;AACH,OAAO,EACH,2BAA2B,EAC3B,8BAA8B,EAC9B,0BAA0B,EAC1B,KAAK,uBAAuB,GAC/B,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;GAOG;AACH,OAAO,EACH,mBAAmB,EACnB,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC9B,MAAM,8DAA8D,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,OAAO,EACH,qCAAqC,EACrC,yCAAyC,EACzC,0CAA0C,EAC1C,sCAAsC,EACtC,kCAAkC,EAClC,+BAA+B,EAC/B,iCAAiC,EACjC,uCAAuC,EACvC,mCAAmC,EACnC,iCAAiC,EACjC,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EACjC,KAAK,uCAAuC,EAC5C,KAAK,iCAAiC,EACtC,KAAK,6BAA6B,GACrC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,YAAY,EACR,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,GACxB,MAAM,yEAAyE,CAAC;AAEjF;;;;GAIG;AACH,OAAO,EACH,gCAAgC,EAChC,mCAAmC,EACnC,iCAAiC,EACjC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,EAC5B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,wCAAwC,GAChD,MAAM,8DAA8D,CAAC;AAEtE;;;;GAIG;AACH,OAAO,EACH,kCAAkC,EAClC,yCAAyC,EACzC,oCAAoC,EACpC,kCAAkC,EAClC,kCAAkC,EAClC,uCAAuC,EACvC,KAAK,8BAA8B,GACtC,MAAM,wEAAwE,CAAC;AAEhF;;;;;;GAMG;AACH,OAAO,EACH,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,GACnC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,OAAO,EACH,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GAC1B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACxB,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;GASG;AACH,OAAO,EACH,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,GACnC,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACH,+BAA+B,EAC/B,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,kCAAkC,EAClC,sCAAsC,EACtC,kCAAkC,EAClC,8BAA8B,EAC9B,0CAA0C,EAC1C,2BAA2B,EAC3B,oCAAoC,EACpC,mCAAmC,GACtC,MAAM,qEAAqE,CAAC;AAE7E,0DAA0D"}

package/dist/esm/public-runtime/index.js

@@ -110,6 +110,13 @@ export { WildoHeaderKeys } from '../requests/header-keys.shared.js';
  * nothing to the decorator-free bundle budget.
  */
 export { MAIN_API_BASE_PATH } from '../requests/manual-controllers-routes-urls.js';
+/**
+ * A caught value as one readable line, for a bundle-isolated package (`saas-website`). The root's
+ * `describeCaughtError` also recognises the engine's own error type and so imports the error schemas;
+ * this atom imports nothing, and `describeCaughtError` delegates to it for every other value — one
+ * rendering, two doors (#1518's "[object Object]" fix, reachable from the browser-safe seam).
+ */
+export { describeThrownValue } from '../errors/thrown-value-description.shared.utils.js';
 export { AppFrontendType } from '../config/app-frontend-type.shared.schemas.js';
 /**
  * Canonical Zod-issue rendering. Browser-bound runtimes validate untrusted
@@ -145,6 +152,13 @@ export { buildProviderDisplayNameLabelKey, defineProviderMetadata, ENGINE_PROVID
  * side effects, which is the same bar the tier rule below is exported under.
  */
 export { ProviderDeploymentModel, ProviderComplianceProfileSchema, } from '../external-providers/provider-compliance-profile.shared.schemas.js';
+/**
+ * Consent purposes (#534) — the set a person grants, read by the visitor-tier `WebsiteConsentGate` in
+ * the browser bundle and stored by the application. Carved into an import-free atom
+ * (`consent-purposes.shared.ts`) so the website and the engine share ONE vocabulary: a website that
+ * mirrored the string literals would be a second copy that drifts the day a purpose is added.
+ */
+export { ANONYMOUS_CONSENT_RECORD_METHOD, ANONYMOUS_CONSENT_RECORD_PATH, applicationAskedConsentPurposes, CONSENT_PURPOSES, ConsentPurpose, hasGrantedConsentPurposes, missingConsentPurposes, normalizeConsentPurposes, WEBSITE_VISITOR_CONSENT_STORAGE_KEY, } from '../compliance/privacy/consent-purposes.shared.js';
 /**
  * The tier rule (#328) is enforced by every facet's `compose*Providers`,
  * three of which are browser-bound and reach this package only here. It
@@ -160,15 +174,7 @@ export { assertProviderTierCoherence, engineSlotsBoundByCapabilities, findProvid
  * `AppConfiguration_FrontendBootstrapResponse` contract stays on the root-barrel
  * side.
  */
-export { FrontendProviderEntrySchema, FrontendProvidersBlockSchema, } from '../external-providers/frontend-provider-entry.shared.schemas.js';
-/**
- * The z_file storage vocabulary, re-exported so a browser-bound provider module
- * can declare `fileStorage: FileStorageAccepted.GOOGLE_DRIVE` by NAME (#394 P5).
- * The enum is owned by `@wildo-ai/zod-decorators` — the package that owns
- * `z_file({ storageAccepted })` — and the facets' bundle-isolation allow-list
- * admits only this door into the models, so the value has to be reachable here.
- */
-export { FileStorageAccepted } from '@wildo-ai/zod-decorators';
+export { FileStorageAccepted, FrontendProviderEntrySchema, FrontendProvidersBlockSchema, } from '../external-providers/frontend-provider-entry.shared.schemas.js';
 /**
  * Frontend-surface atoms a provider declares (#332, slice S4a): its CSP
  * footprint, the vendor SDK package it loads, and any third-party `<script>` it
@@ -192,7 +198,7 @@ export { defineFrontendPublicConfigSchema, FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY,
  * rather than conventional: the keys were previously read by hand at each use
  * site, where a renamed one produced `undefined` and a silently wrong surface.
  */
-export { FrontendFilePickerPublicConfigSchema, } from '../external-providers/frontend-capability-public-config.shared.schemas.js';
+export { admissibleFrontendPublicConfigKeys, FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS, FrontendFilePickerPublicConfigSchema, frontendCapabilityPublicConfigKeys, layerProviderFilePickerConstraints, partitionFrontendCapabilityPublicConfig, } from '../external-providers/frontend-capability-public-config.shared.schemas.js';
 /**
  * The RUNTIME half of the same idea (#437): what a built-in frontend capability
  * calls on the provider that fills it. `FRONTEND_ERROR_MONITORING` is the first —
@@ -221,5 +227,28 @@ export { BUILTIN_PROVIDER_PROTOCOL, } from '../external-providers/provider-proto
  * above, so the closure stays decorator-free.
  */
 export { composeProviderRegistry, ProviderCompositionConflictError, } from '../external-providers/compose-provider-registry.shared.js';
+/**
+ * Portable lexical primitives — a sha256-digest grammar, a namespaced/opaque ref grammar, a
+ * positive version, a lowercase UUIDv4, an ISO datetime, and two array-canonicality predicates.
+ *
+ * ## Why they are HERE and not only behind `@wildo-ai/saas-models/meta-workflows`
+ *
+ * They are shared by two domains, and only one of them is meta-workflows. Measured 2026-09-19: of
+ * 41 import sites of the meta-workflows subpath, **7 take nothing but these primitives**, and all
+ * seven are `saas-specifications/src/technical-documentation/*.schemas.ts` — a browser-bound tier
+ * whose bundle-isolation allow-list had to admit an entire authoring domain to obtain seven
+ * regexes.
+ *
+ * No K-2 extraction was needed: `portable-primitives.meta-workflows.shared.schemas` imports `zod`
+ * and nothing else, so it is already the zero-dependency atom K-2 asks for — the
+ * `WildoHeaderKeys` case, re-exported whole. The meta-workflows door keeps publishing it for its
+ * 34 mixed consumers; that is two SUBPATHS onto one atom, which `check:package-entrypoints` rule 1
+ * does not refuse (it is root-vs-subpath), and it is what a curated bundle-safe subset IS.
+ *
+ * The `MetaWorkflow_` prefix is kept deliberately: renaming a symbol that 34 other sites import is
+ * a separate change from making it reachable on the bundle-safe seam, and doing both at once would
+ * hide one in the other.
+ */
+export { MetaWorkflow_Sha256DigestSchema, MetaWorkflow_NamespacedRefSchema, MetaWorkflow_OpaqueRefSchema, MetaWorkflow_PositiveVersionSchema, MetaWorkflow_PositiveOrdinalSchema, MetaWorkflow_NonNegativeRevisionSchema, MetaWorkflow_LowercaseUuidV4Schema, MetaWorkflow_IsoDateTimeSchema, MetaWorkflow_NonNegativeFiniteNumberSchema, metaWorkflowValuesAreUnique, metaWorkflowValuesAreLexicallySorted, compareMetaWorkflowCanonicalStrings, } from '../meta-workflows/portable-primitives.meta-workflows.shared.schemas.js';
 /** @wildo_source:part:end saas.public-runtime.contract */
 //# sourceMappingURL=index.js.map

package/dist/esm/public-runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/public-runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EACH,6BAA6B,EAC7B,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,2BAA2B,GAK9B,MAAM,uEAAuE,CAAC;AAE/E;;;;;;;;GAQG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAExG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAE7E;;;;;;GAMG;AACH,OAAO,EACH,cAAc,EACd,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,kBAAkB,GAGrB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EACH,iBAAiB,EACjB,aAAa,GAChB,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;;;GASG;AACH,OAAO,EACH,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,GAMf,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,OAAO,EACH,uBAAuB,EACvB,+BAA+B,GAElC,MAAM,kEAAkE,CAAC;AAE1E;;;;;GAKG;AACH,OAAO,EACH,2BAA2B,EAC3B,8BAA8B,EAC9B,0BAA0B,GAE7B,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;GAOG;AACH,OAAO,EACH,2BAA2B,EAC3B,4BAA4B,GAG/B,MAAM,8DAA8D,CAAC;AAEtE;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,OAAO,EACH,qCAAqC,EACrC,yCAAyC,EACzC,0CAA0C,EAC1C,sCAAsC,EACtC,kCAAkC,EAClC,+BAA+B,EAC/B,iCAAiC,EACjC,uCAAuC,EACvC,mCAAmC,EACnC,iCAAiC,GAQpC,MAAM,gEAAgE,CAAC;AAexE;;;;GAIG;AACH,OAAO,EACH,gCAAgC,EAChC,mCAAmC,EACnC,iCAAiC,EACjC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,GAI/B,MAAM,8DAA8D,CAAC;AAEtE;;;;GAIG;AACH,OAAO,EACH,oCAAoC,GAEvC,MAAM,wEAAwE,CAAC;AAEhF;;;;;;GAMG;AACH,OAAO,EACH,6BAA6B,GAGhC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,OAAO,EACH,2BAA2B,GAG9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACH,yBAAyB,GAG5B,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;GASG;AACH,OAAO,EACH,uBAAuB,EACvB,gCAAgC,GAInC,MAAM,wDAAwD,CAAC;AAEhE,0DAA0D","sourcesContent":["/**\n * @wildo_source:part:start saas.public-runtime.contract facet:layer:shared facet:family:bundle-boundary\n *\n * @wildo-package-subpath @wildo-ai/saas-models/public-runtime\n *\n * Browser-safe, decorator-framework-free atom subset of\n * `@wildo-ai/saas-models`.\n *\n * Why this subpath exists:\n *   The package's root barrel (`./index.ts`) calls `initZodDecorators()` at\n *   module load (line 3) and re-exports the entire decorator-framework-bound\n *   schema graph (~150 schemas, transitively pulls\n *   `@wildo-ai/external-connectors-models` + `@wildo-ai/zod-decorators` +\n *   `reflect-metadata`). Browser bundles that need only a handful of stable\n *   atoms (cross-frontend handoff DTOs, canonical HTTP header keys, locale\n *   enums) should NOT pay that cost.\n *\n *   This subpath exposes that minimal stable surface, sourced from\n *   side-effect-free atom files (saas-models-public-runtime.md K-1 / K-2 /\n *   K-4):\n *\n *     - Cross-Frontend Handoff + Token Exchange DTO atoms\n *       (`../security/authentications/cross-frontend-handoff.shared.dto.schemas`):\n *       `CrossFrontendHandoffErrorCode`, `CrossFrontendHandoffRequestSchema`,\n *       `CrossFrontendHandoffResponseSchema`, `TokenExchangeRequestSchema`,\n *       `TokenExchangeResponseSchema`,\n *       `CrossFrontendHandoffRequest`, `CrossFrontendHandoffResponse`,\n *       `TokenExchangeRequest`, `TokenExchangeResponse`. The token-exchange\n *       schemas were added\n *       in cross-app-jwt-propagation.md Step 5 — every receiver of an\n *       AUTH_CODE_EXCHANGE token (SaaS app, docs site) is by construction\n *       a client-bundle target, so the response shape MUST live here too\n *       (not just in the heavy backend schemas barrel).\n *     - Frontend-kind enum\n *       (`../config/app-frontend-type.shared.schemas`): `AppFrontendType`\n *       — the SAAS_APP / STATIC_WEBSITE / TECH_DOC runtime taxonomy.\n *       Consumed by website discovery, scaffolding, CSP config, and\n *       companion services that need to introspect a service's runtime\n *       kind without booting the full schema graph. The atom file's\n *       file-level JSDoc is the canonical home for the kind-by-kind\n *       rationale AND the locked \"no native variants\" design decision\n *       — read that file before authoring any AppFrontendType-driven\n *       conditional.\n *     - Canonical HTTP header keys (`../requests/header-keys.shared`):\n *       `WildoHeaderKeys` (already a zero-dep `as const` atom — re-exported\n *       whole; per K-2 splitting it would itself violate DRY).\n *     - Locale enums (re-exported transparently from\n *       `@wildo-ai/presets-components-models/public-runtime`):\n *       `AvailableLanguage`, `TextDirection`. Consumers see ONE import path\n *       (`@wildo-ai/saas-models/public-runtime`) — the\n *       `presets-components-models/public-runtime` subpath is an internal\n *       seam (saas-models-public-runtime.md K-6).\n *\n * @wildo-boundary  (saas-models-public-runtime.md K-3)\n *   - This file and every file it transitively imports MUST NOT import from:\n *     `@wildo-ai/zod-decorators`, `@wildo-ai/external-connectors-models`,\n *     the `@wildo-ai/presets-components-models` ROOT barrel (only the\n *     `/public-runtime` subpath of that package is allowed), `inversify`,\n *     `reflect-metadata`, `mongoose`, `axios`, `express`, `socket.io`,\n *     `pino`, `helmet`, `argon2`, `bcrypt`, `jsonwebtoken`.\n *   - DO NOT import from this package's ROOT barrel (`../index`) — that\n *     barrel runs `initZodDecorators()` and pulls the full schema tree.\n *   - Allowed imports: `zod` (peer dep, browser-safe), files inside\n *     `./public-runtime/`, the atom files extracted by Steps 1 + 2 of the\n *     plan, and the\n *     `@wildo-ai/presets-components-models/public-runtime` subpath.\n *\n * @wildo-bundle-budget\n *   The output of this barrel + transitive imports MUST stay free of:\n *   `initZodDecorators()` invocation, `reflect-metadata`, the full\n *   `authentication.shared.dto.schemas.ts` web of types\n *   (`UserContextSchema`, `SessionType`, `AuthMethod`, `AuthFactorLevel`,\n *   `AuthSessionPurpose`, `AuthUtils`). The Step 5 vitest boundary test\n *   snapshots `Object.getOwnPropertyNames(z.ZodType.prototype)` before and\n *   after importing this module and asserts the prototype is unchanged\n *   (proof that `initZodDecorators` did NOT run).\n *\n * @wildo-dry-contract\n *   Every atom exposed here lives in EXACTLY one source file. The original\n *   home (e.g. `authentication.shared.dto.schemas.ts`,\n *   `localization/language.shared.schemas.ts`) re-exports from the same atom\n *   so existing root-barrel consumers keep working unchanged. Adding a new\n *   atom: split it out of its current heavy file FIRST (matching K-2\n *   protocol), add a re-export at the original home, then add the import\n *   here. NEVER duplicate a declaration into a `_public-runtime/` folder.\n */\n\nexport {\n    CrossFrontendHandoffErrorCode,\n    CrossFrontendHandoffRequestSchema,\n    CrossFrontendHandoffResponseSchema,\n    TokenExchangeRequestSchema,\n    TokenExchangeResponseSchema,\n    type CrossFrontendHandoffRequest,\n    type CrossFrontendHandoffResponse,\n    type TokenExchangeRequest,\n    type TokenExchangeResponse,\n} from '../security/authentications/cross-frontend-handoff.shared.dto.schemas';\n\n/**\n * The single same-origin redirect predicate.\n *\n * On the bundle-safe seam because the two BROWSER receivers of a post-authentication redirect — the\n * SaaS app (`saas-frontend-lib`) and the docs site (`saas-technical-doc`) — are client-bundle targets\n * by construction, while the ISSUER-side schema in this package validates the same value on the\n * server. All three must reach one predicate or they drift; they already had, in the same direction,\n * across four hand-written copies. The source atom is import-free, so it adds nothing to the budget.\n */\nexport { isSameOriginRedirectPath } from '../security/authentications/same-origin-redirect-path.shared';\n\nexport { WildoHeaderKeys } from '../requests/header-keys.shared';\n\n/**\n * Main API mount prefix (`/api/v1`) — the SINGLE SOURCE OF TRUTH for the path\n * under which the entire main controllers registry is served. Exposed on the\n * bundle-safe seam because browser-bound runtimes that call the SaaS backend\n * (e.g. the docs auth client's token-exchange / cross-frontend-handoff\n * requests) must prefix their request URLs with the SAME value the backend\n * mounts and the SaaS-app HTTP client uses. Deriving every consumer from one\n * symbol is what prevents the prefix-drift class — a mismatched prefix\n * silently breaks auth (see the refresh-cookie `Path` regression that\n * motivated the shared symbol). The source atom\n * (`../requests/manual-controllers-routes-urls`) is import-free, so it adds\n * nothing to the decorator-free bundle budget.\n */\nexport { MAIN_API_BASE_PATH } from '../requests/manual-controllers-routes-urls';\n\nexport { AppFrontendType } from '../config/app-frontend-type.shared.schemas';\n\n/**\n * Canonical Zod-issue rendering. Browser-bound runtimes validate untrusted\n * input too — MDX frontmatter at build time, API responses at runtime — and\n * each one previously re-derived its own `path: message` formatter, drifting on\n * root labels and truncation. The source atom is import-free (the issue shape is\n * structural, not a `zod` type import), so it adds nothing to the bundle budget.\n */\nexport {\n    ALL_ZOD_ISSUES,\n    DEFAULT_ZOD_ISSUE_RENDER_LIMIT,\n    ZOD_ROOT_ISSUE_PATH_LABEL,\n    formatZodIssue,\n    formatZodIssues,\n    summarizeZodIssues,\n    type FormattableZodIssue,\n    type ZodIssueFormattingOptions,\n} from '../errors/zod-issue-formatting.shared.utils';\n\nexport {\n    AvailableLanguage,\n    TextDirection,\n} from '@wildo-ai/presets-components-models/public-runtime';\n\n/**\n * Provider metadata atom (provider-registration-refactor §Phase 0.1 +\n * §Phase 1.g). The schema is built with plain Zod (no decorator\n * framework) and the type is `z.infer<…>`. Re-exported here so the\n * browser-bound `@wildo-ai/external-connectors-public/app`,\n * `@wildo-ai/external-connectors-public/techdoc`, and\n * `@wildo-ai/external-connectors-public/website` can consume it WITHOUT\n * pulling the saas-models\n * root barrel (which would boot `initZodDecorators()`).\n */\nexport {\n    buildProviderDisplayNameLabelKey,\n    defineProviderMetadata,\n    ENGINE_PROVIDER_ORIGIN,\n    ProviderCatalogueProvenanceSchema,\n    ProviderCatalogueSource,\n    ProviderIdentitySchema,\n    ProviderMetadataSchema,\n    ProviderOriginKind,\n    ProviderOriginSchema,\n    ProviderTier,\n    type DefineProviderMetadataInput,\n    type ProviderCatalogueProvenance,\n    type ProviderIdentity,\n    type ProviderMetadata,\n    type ProviderOrigin,\n} from '../external-providers/provider-metadata.shared.schemas';\n\n/**\n * A provider's compliance primitives, reachable from the FRONTEND facets.\n *\n * `ProviderComplianceProfile` was reachable only from the backend provider contract until\n * 2026-09-07 (#345), which left the half of the provider population that executes in the DATA\n * SUBJECT'S BROWSER unable to state a deployment model, a processing region or a legal entity —\n * exactly the recipients a processor register and a transfer statement must name.\n *\n * `ProviderDeploymentModel` is exported as a VALUE, not merely a type: a provider module writes\n * `ProviderDeploymentModel.VENDOR_HOSTED` in its own declaration, so the enum enters the frontend\n * facets' module graph. It is a closed enum over two string members with no Zod decorators and no\n * side effects, which is the same bar the tier rule below is exported under.\n */\nexport {\n    ProviderDeploymentModel,\n    ProviderComplianceProfileSchema,\n    type ProviderComplianceProfile,\n} from '../external-providers/provider-compliance-profile.shared.schemas';\n\n/**\n * The tier rule (#328) is enforced by every facet's `compose*Providers`,\n * three of which are browser-bound and reach this package only here. It\n * depends on the closed capability→slot map and the metadata enums only —\n * no Zod decorators, no side effects.\n */\nexport {\n    assertProviderTierCoherence,\n    engineSlotsBoundByCapabilities,\n    findProviderTierViolations,\n    type ProviderTierRuleSubject,\n} from '../external-providers/provider-tier-rule.shared.utils';\n\n/**\n * Frontend-provider bootstrap atoms shared by browser-bound runtimes.\n *\n * Safe for `/public-runtime` because the entry/block schemas depend only on\n * plain Zod plus `ProviderMetadataSchema`; the heavier\n * `AppConfiguration_FrontendBootstrapResponse` contract stays on the root-barrel\n * side.\n */\nexport {\n    FrontendProviderEntrySchema,\n    FrontendProvidersBlockSchema,\n    type FrontendProviderEntry,\n    type FrontendProvidersBlock,\n} from '../external-providers/frontend-provider-entry.shared.schemas';\n\n/**\n * The z_file storage vocabulary, re-exported so a browser-bound provider module\n * can declare `fileStorage: FileStorageAccepted.GOOGLE_DRIVE` by NAME (#394 P5).\n * The enum is owned by `@wildo-ai/zod-decorators` — the package that owns\n * `z_file({ storageAccepted })` — and the facets' bundle-isolation allow-list\n * admits only this door into the models, so the value has to be reachable here.\n */\nexport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\n\n/**\n * Frontend-surface atoms a provider declares (#332, slice S4a): its CSP\n * footprint, the vendor SDK package it loads, and any third-party `<script>` it\n * asks the surface to add.\n *\n * These are the DATA half of the frontend provider surface and they ride inside\n * `FrontendProviderEntry`, so they must reach the same browser-bound consumers\n * through the same door. Plain Zod, no decorators, no side effects. The\n * executable half lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this seam.\n */\nexport {\n    normalizeProviderFrontendCspFootprint,\n    ProviderFrontendComponentDescriptorSchema,\n    ProviderFrontendComponentDescriptorsSchema,\n    ProviderFrontendCspDerivedOriginSchema,\n    ProviderFrontendCspFootprintSchema,\n    ProviderFrontendCspOriginBucket,\n    ProviderFrontendScriptCrossOrigin,\n    ProviderFrontendScriptDeclarationSchema,\n    ProviderFrontendSdkDescriptorSchema,\n    ProviderFrontendSelectionDelivery,\n    type ProviderFrontendComponentDescriptor,\n    type ProviderFrontendComponentDescriptors,\n    type ProviderFrontendCspDerivedOrigin,\n    type ProviderFrontendCspFootprint,\n    type ProviderFrontendCspFootprintDeclaration,\n    type ProviderFrontendScriptDeclaration,\n    type ProviderFrontendSdkDescriptor,\n} from '../external-providers/provider-frontend-surface.shared.schemas';\n\n/**\n * The contract between a provider's frontend COMPONENT and the surface that\n * mounts it (#394). Types only — no schema, no runtime value — and it lives in\n * this package rather than beside the module types it serves because a component\n * ships in its OWN package and that package would otherwise close a dependency\n * cycle through emitted declarations. Its own file says why in full.\n */\nexport type {\n    ProviderFilePickerConstraints,\n    ProviderFilePickerProps,\n    ProviderFileSelection,\n} from '../external-providers/provider-frontend-component-contract.shared.types';\n\n/**\n * How an application supplies a frontend provider's public keys, and the\n * dependency-free schema helper the engine's own provider modules declare their\n * keys with (#394 P3). Browser-safe: pure functions and one enum, no Zod.\n */\nexport {\n    defineFrontendPublicConfigSchema,\n    FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY,\n    FrontendProviderPublicConfigError,\n    FrontendProviderPublicConfigRefusal,\n    FrontendPublicConfigValueKind,\n    overlayFrontendProviderPublicConfig,\n    readDeclaredPublicConfigKeys,\n    type FrontendPublicConfigKeySpec,\n    type FrontendPublicConfigSchema,\n    type OverlayFrontendProviderPublicConfigInput,\n} from '../external-providers/frontend-provider-public-config.shared';\n\n/**\n * The public-config shape a built-in frontend capability expects (#380). Named\n * rather than conventional: the keys were previously read by hand at each use\n * site, where a renamed one produced `undefined` and a silently wrong surface.\n */\nexport {\n    FrontendFilePickerPublicConfigSchema,\n    type FrontendFilePickerPublicConfig,\n} from '../external-providers/frontend-capability-public-config.shared.schemas';\n\n/**\n * The RUNTIME half of the same idea (#437): what a built-in frontend capability\n * calls on the provider that fills it. `FRONTEND_ERROR_MONITORING` is the first —\n * the framework reports a caught crash without knowing which vendor is listening,\n * so the capability declares the method and the provider adapts to it. Pure types\n * plus one guard; no Zod, no decorators.\n */\nexport {\n    isFrontendErrorMonitoringSink,\n    type FrontendCrashReport,\n    type FrontendErrorMonitoringSink,\n} from '../external-providers/frontend-capability-runtime.shared.types';\n\n/**\n * Provider capability atoms (provider-registration-refactor §Phase 0.2\n * + §Phase 1.g). Closed built-in enum + open declaration-merging seam\n * + computed union type. Pure types and `as const` — no Zod, no\n * decorators, no side effects. Required by every facet's provider\n * module shape, so it MUST live on the bundle-safe seam.\n */\nexport {\n    BUILTIN_PROVIDER_CAPABILITY,\n    type BuiltinProviderCapability,\n    type ProviderCapability,\n} from '../external-providers/provider-capability.shared.schemas';\nexport {\n    BUILTIN_PROVIDER_PROTOCOL,\n    type BuiltinProviderProtocol,\n    type ProviderProtocol,\n} from '../external-providers/provider-protocol.shared.schemas';\n\n/**\n * Generic registry composition core (provider-registration-refactor\n * §Phase 1.e + §Phase 1.g). Used by every facet's `compose<Facet>Providers`\n * wrapper (backend, frontend-app, frontend-techdoc, frontend-website).\n * The browser-bound facets need this on the bundle-safe seam; the backend\n * facet inherits via the same import path for DRY.\n *\n * Pure runtime — only TYPE-imports `ProviderCapability` from the atom\n * above, so the closure stays decorator-free.\n */\nexport {\n    composeProviderRegistry,\n    ProviderCompositionConflictError,\n    type ProviderRegistryFragment,\n    type ComposedProviderRegistry,\n    type ProviderCompositionConflict,\n} from '../external-providers/compose-provider-registry.shared';\n\n/** @wildo_source:part:end saas.public-runtime.contract */\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/public-runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EACH,6BAA6B,EAC7B,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,2BAA2B,GAK9B,MAAM,uEAAuE,CAAC;AAE/E;;;;;;;;GAQG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAExG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAE7E;;;;;;GAMG;AACH,OAAO,EACH,cAAc,EACd,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,kBAAkB,GAGrB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EACH,iBAAiB,EACjB,aAAa,GAChB,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;;;GASG;AACH,OAAO,EACH,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,GAMf,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,OAAO,EACH,uBAAuB,EACvB,+BAA+B,GAElC,MAAM,kEAAkE,CAAC;AAE1E;;;;;GAKG;AACH,OAAO,EACH,+BAA+B,EAC/B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,mCAAmC,GACtC,MAAM,+CAA+C,CAAC;AAEvD;;;;;GAKG;AACH,OAAO,EACH,2BAA2B,EAC3B,8BAA8B,EAC9B,0BAA0B,GAE7B,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;GAOG;AACH,OAAO,EACH,mBAAmB,EACnB,2BAA2B,EAC3B,4BAA4B,GAG/B,MAAM,8DAA8D,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,OAAO,EACH,qCAAqC,EACrC,yCAAyC,EACzC,0CAA0C,EAC1C,sCAAsC,EACtC,kCAAkC,EAClC,+BAA+B,EAC/B,iCAAiC,EACjC,uCAAuC,EACvC,mCAAmC,EACnC,iCAAiC,GAQpC,MAAM,gEAAgE,CAAC;AAexE;;;;GAIG;AACH,OAAO,EACH,gCAAgC,EAChC,mCAAmC,EACnC,iCAAiC,EACjC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,GAI/B,MAAM,8DAA8D,CAAC;AAEtE;;;;GAIG;AACH,OAAO,EACH,kCAAkC,EAClC,yCAAyC,EACzC,oCAAoC,EACpC,kCAAkC,EAClC,kCAAkC,EAClC,uCAAuC,GAE1C,MAAM,wEAAwE,CAAC;AAEhF;;;;;;GAMG;AACH,OAAO,EACH,6BAA6B,GAGhC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,OAAO,EACH,2BAA2B,GAG9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACH,yBAAyB,GAG5B,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;GASG;AACH,OAAO,EACH,uBAAuB,EACvB,gCAAgC,GAInC,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACH,+BAA+B,EAC/B,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,kCAAkC,EAClC,sCAAsC,EACtC,kCAAkC,EAClC,8BAA8B,EAC9B,0CAA0C,EAC1C,2BAA2B,EAC3B,oCAAoC,EACpC,mCAAmC,GACtC,MAAM,qEAAqE,CAAC;AAE7E,0DAA0D","sourcesContent":["/**\n * @wildo_source:part:start saas.public-runtime.contract facet:layer:shared facet:family:bundle-boundary\n *\n * @wildo-package-subpath @wildo-ai/saas-models/public-runtime\n *\n * Browser-safe, decorator-framework-free atom subset of\n * `@wildo-ai/saas-models`.\n *\n * Why this subpath exists:\n *   The package's root barrel (`./index.ts`) calls `initZodDecorators()` at\n *   module load (line 3) and re-exports the entire decorator-framework-bound\n *   schema graph (~150 schemas, transitively pulls\n *   `@wildo-ai/external-connectors-models` + `@wildo-ai/zod-decorators` +\n *   `reflect-metadata`). Browser bundles that need only a handful of stable\n *   atoms (cross-frontend handoff DTOs, canonical HTTP header keys, locale\n *   enums) should NOT pay that cost.\n *\n *   This subpath exposes that minimal stable surface, sourced from\n *   side-effect-free atom files (saas-models-public-runtime.md K-1 / K-2 /\n *   K-4):\n *\n *     - Cross-Frontend Handoff + Token Exchange DTO atoms\n *       (`../security/authentications/cross-frontend-handoff.shared.dto.schemas`):\n *       `CrossFrontendHandoffErrorCode`, `CrossFrontendHandoffRequestSchema`,\n *       `CrossFrontendHandoffResponseSchema`, `TokenExchangeRequestSchema`,\n *       `TokenExchangeResponseSchema`,\n *       `CrossFrontendHandoffRequest`, `CrossFrontendHandoffResponse`,\n *       `TokenExchangeRequest`, `TokenExchangeResponse`. The token-exchange\n *       schemas were added\n *       in cross-app-jwt-propagation.md Step 5 — every receiver of an\n *       AUTH_CODE_EXCHANGE token (SaaS app, docs site) is by construction\n *       a client-bundle target, so the response shape MUST live here too\n *       (not just in the heavy backend schemas barrel).\n *     - Frontend-kind enum\n *       (`../config/app-frontend-type.shared.schemas`): `AppFrontendType`\n *       — the SAAS_APP / STATIC_WEBSITE / TECH_DOC runtime taxonomy.\n *       Consumed by website discovery, scaffolding, CSP config, and\n *       companion services that need to introspect a service's runtime\n *       kind without booting the full schema graph. The atom file's\n *       file-level JSDoc is the canonical home for the kind-by-kind\n *       rationale AND the locked \"no native variants\" design decision\n *       — read that file before authoring any AppFrontendType-driven\n *       conditional.\n *     - Canonical HTTP header keys (`../requests/header-keys.shared`):\n *       `WildoHeaderKeys` (already a zero-dep `as const` atom — re-exported\n *       whole; per K-2 splitting it would itself violate DRY).\n *     - Locale enums (re-exported transparently from\n *       `@wildo-ai/presets-components-models/public-runtime`):\n *       `AvailableLanguage`, `TextDirection`. Consumers see ONE import path\n *       (`@wildo-ai/saas-models/public-runtime`) — the\n *       `presets-components-models/public-runtime` subpath is an internal\n *       seam (saas-models-public-runtime.md K-6).\n *\n * @wildo-boundary  (saas-models-public-runtime.md K-3)\n *   - This file and every file it transitively imports MUST NOT import from:\n *     `@wildo-ai/zod-decorators`, `@wildo-ai/external-connectors-models`,\n *     the `@wildo-ai/presets-components-models` ROOT barrel (only the\n *     `/public-runtime` subpath of that package is allowed), `inversify`,\n *     `reflect-metadata`, `mongoose`, `axios`, `express`, `socket.io`,\n *     `pino`, `helmet`, `argon2`, `bcrypt`, `jsonwebtoken`.\n *   - DO NOT import from this package's ROOT barrel (`../index`) — that\n *     barrel runs `initZodDecorators()` and pulls the full schema tree.\n *   - Allowed imports: `zod` (peer dep, browser-safe), files inside\n *     `./public-runtime/`, the atom files extracted by Steps 1 + 2 of the\n *     plan, and the\n *     `@wildo-ai/presets-components-models/public-runtime` subpath.\n *\n * @wildo-bundle-budget\n *   The output of this barrel + transitive imports MUST stay free of:\n *   `initZodDecorators()` invocation, `reflect-metadata`, the full\n *   `authentication.shared.dto.schemas.ts` web of types\n *   (`UserContextSchema`, `SessionType`, `AuthMethod`, `AuthFactorLevel`,\n *   `AuthSessionPurpose`, `AuthUtils`). The Step 5 vitest boundary test\n *   snapshots `Object.getOwnPropertyNames(z.ZodType.prototype)` before and\n *   after importing this module and asserts the prototype is unchanged\n *   (proof that `initZodDecorators` did NOT run).\n *\n * @wildo-dry-contract\n *   Every atom exposed here lives in EXACTLY one source file. The original\n *   home (e.g. `authentication.shared.dto.schemas.ts`,\n *   `localization/language.shared.schemas.ts`) re-exports from the same atom\n *   so existing root-barrel consumers keep working unchanged. Adding a new\n *   atom: split it out of its current heavy file FIRST (matching K-2\n *   protocol), add a re-export at the original home, then add the import\n *   here. NEVER duplicate a declaration into a `_public-runtime/` folder.\n */\n\nexport {\n    CrossFrontendHandoffErrorCode,\n    CrossFrontendHandoffRequestSchema,\n    CrossFrontendHandoffResponseSchema,\n    TokenExchangeRequestSchema,\n    TokenExchangeResponseSchema,\n    type CrossFrontendHandoffRequest,\n    type CrossFrontendHandoffResponse,\n    type TokenExchangeRequest,\n    type TokenExchangeResponse,\n} from '../security/authentications/cross-frontend-handoff.shared.dto.schemas';\n\n/**\n * The single same-origin redirect predicate.\n *\n * On the bundle-safe seam because the two BROWSER receivers of a post-authentication redirect — the\n * SaaS app (`saas-frontend-lib`) and the docs site (`saas-technical-doc`) — are client-bundle targets\n * by construction, while the ISSUER-side schema in this package validates the same value on the\n * server. All three must reach one predicate or they drift; they already had, in the same direction,\n * across four hand-written copies. The source atom is import-free, so it adds nothing to the budget.\n */\nexport { isSameOriginRedirectPath } from '../security/authentications/same-origin-redirect-path.shared';\n\nexport { WildoHeaderKeys } from '../requests/header-keys.shared';\n\n/**\n * Main API mount prefix (`/api/v1`) — the SINGLE SOURCE OF TRUTH for the path\n * under which the entire main controllers registry is served. Exposed on the\n * bundle-safe seam because browser-bound runtimes that call the SaaS backend\n * (e.g. the docs auth client's token-exchange / cross-frontend-handoff\n * requests) must prefix their request URLs with the SAME value the backend\n * mounts and the SaaS-app HTTP client uses. Deriving every consumer from one\n * symbol is what prevents the prefix-drift class — a mismatched prefix\n * silently breaks auth (see the refresh-cookie `Path` regression that\n * motivated the shared symbol). The source atom\n * (`../requests/manual-controllers-routes-urls`) is import-free, so it adds\n * nothing to the decorator-free bundle budget.\n */\nexport { MAIN_API_BASE_PATH } from '../requests/manual-controllers-routes-urls';\n\n/**\n * A caught value as one readable line, for a bundle-isolated package (`saas-website`). The root's\n * `describeCaughtError` also recognises the engine's own error type and so imports the error schemas;\n * this atom imports nothing, and `describeCaughtError` delegates to it for every other value — one\n * rendering, two doors (#1518's \"[object Object]\" fix, reachable from the browser-safe seam).\n */\nexport { describeThrownValue } from '../errors/thrown-value-description.shared.utils';\n\nexport { AppFrontendType } from '../config/app-frontend-type.shared.schemas';\n\n/**\n * Canonical Zod-issue rendering. Browser-bound runtimes validate untrusted\n * input too — MDX frontmatter at build time, API responses at runtime — and\n * each one previously re-derived its own `path: message` formatter, drifting on\n * root labels and truncation. The source atom is import-free (the issue shape is\n * structural, not a `zod` type import), so it adds nothing to the bundle budget.\n */\nexport {\n    ALL_ZOD_ISSUES,\n    DEFAULT_ZOD_ISSUE_RENDER_LIMIT,\n    ZOD_ROOT_ISSUE_PATH_LABEL,\n    formatZodIssue,\n    formatZodIssues,\n    summarizeZodIssues,\n    type FormattableZodIssue,\n    type ZodIssueFormattingOptions,\n} from '../errors/zod-issue-formatting.shared.utils';\n\nexport {\n    AvailableLanguage,\n    TextDirection,\n} from '@wildo-ai/presets-components-models/public-runtime';\n\n/**\n * Provider metadata atom (provider-registration-refactor §Phase 0.1 +\n * §Phase 1.g). The schema is built with plain Zod (no decorator\n * framework) and the type is `z.infer<…>`. Re-exported here so the\n * browser-bound `@wildo-ai/external-connectors-public/app`,\n * `@wildo-ai/external-connectors-public/techdoc`, and\n * `@wildo-ai/external-connectors-public/website` can consume it WITHOUT\n * pulling the saas-models\n * root barrel (which would boot `initZodDecorators()`).\n */\nexport {\n    buildProviderDisplayNameLabelKey,\n    defineProviderMetadata,\n    ENGINE_PROVIDER_ORIGIN,\n    ProviderCatalogueProvenanceSchema,\n    ProviderCatalogueSource,\n    ProviderIdentitySchema,\n    ProviderMetadataSchema,\n    ProviderOriginKind,\n    ProviderOriginSchema,\n    ProviderTier,\n    type DefineProviderMetadataInput,\n    type ProviderCatalogueProvenance,\n    type ProviderIdentity,\n    type ProviderMetadata,\n    type ProviderOrigin,\n} from '../external-providers/provider-metadata.shared.schemas';\n\n/**\n * A provider's compliance primitives, reachable from the FRONTEND facets.\n *\n * `ProviderComplianceProfile` was reachable only from the backend provider contract until\n * 2026-09-07 (#345), which left the half of the provider population that executes in the DATA\n * SUBJECT'S BROWSER unable to state a deployment model, a processing region or a legal entity —\n * exactly the recipients a processor register and a transfer statement must name.\n *\n * `ProviderDeploymentModel` is exported as a VALUE, not merely a type: a provider module writes\n * `ProviderDeploymentModel.VENDOR_HOSTED` in its own declaration, so the enum enters the frontend\n * facets' module graph. It is a closed enum over two string members with no Zod decorators and no\n * side effects, which is the same bar the tier rule below is exported under.\n */\nexport {\n    ProviderDeploymentModel,\n    ProviderComplianceProfileSchema,\n    type ProviderComplianceProfile,\n} from '../external-providers/provider-compliance-profile.shared.schemas';\n\n/**\n * Consent purposes (#534) — the set a person grants, read by the visitor-tier `WebsiteConsentGate` in\n * the browser bundle and stored by the application. Carved into an import-free atom\n * (`consent-purposes.shared.ts`) so the website and the engine share ONE vocabulary: a website that\n * mirrored the string literals would be a second copy that drifts the day a purpose is added.\n */\nexport {\n    ANONYMOUS_CONSENT_RECORD_METHOD,\n    ANONYMOUS_CONSENT_RECORD_PATH,\n    applicationAskedConsentPurposes,\n    CONSENT_PURPOSES,\n    ConsentPurpose,\n    hasGrantedConsentPurposes,\n    missingConsentPurposes,\n    normalizeConsentPurposes,\n    WEBSITE_VISITOR_CONSENT_STORAGE_KEY,\n} from '../compliance/privacy/consent-purposes.shared';\n\n/**\n * The tier rule (#328) is enforced by every facet's `compose*Providers`,\n * three of which are browser-bound and reach this package only here. It\n * depends on the closed capability→slot map and the metadata enums only —\n * no Zod decorators, no side effects.\n */\nexport {\n    assertProviderTierCoherence,\n    engineSlotsBoundByCapabilities,\n    findProviderTierViolations,\n    type ProviderTierRuleSubject,\n} from '../external-providers/provider-tier-rule.shared.utils';\n\n/**\n * Frontend-provider bootstrap atoms shared by browser-bound runtimes.\n *\n * Safe for `/public-runtime` because the entry/block schemas depend only on\n * plain Zod plus `ProviderMetadataSchema`; the heavier\n * `AppConfiguration_FrontendBootstrapResponse` contract stays on the root-barrel\n * side.\n */\nexport {\n    FileStorageAccepted,\n    FrontendProviderEntrySchema,\n    FrontendProvidersBlockSchema,\n    type FrontendProviderEntry,\n    type FrontendProvidersBlock,\n} from '../external-providers/frontend-provider-entry.shared.schemas';\n\n/**\n * Frontend-surface atoms a provider declares (#332, slice S4a): its CSP\n * footprint, the vendor SDK package it loads, and any third-party `<script>` it\n * asks the surface to add.\n *\n * These are the DATA half of the frontend provider surface and they ride inside\n * `FrontendProviderEntry`, so they must reach the same browser-bound consumers\n * through the same door. Plain Zod, no decorators, no side effects. The\n * executable half lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this seam.\n */\nexport {\n    normalizeProviderFrontendCspFootprint,\n    ProviderFrontendComponentDescriptorSchema,\n    ProviderFrontendComponentDescriptorsSchema,\n    ProviderFrontendCspDerivedOriginSchema,\n    ProviderFrontendCspFootprintSchema,\n    ProviderFrontendCspOriginBucket,\n    ProviderFrontendScriptCrossOrigin,\n    ProviderFrontendScriptDeclarationSchema,\n    ProviderFrontendSdkDescriptorSchema,\n    ProviderFrontendSelectionDelivery,\n    type ProviderFrontendComponentDescriptor,\n    type ProviderFrontendComponentDescriptors,\n    type ProviderFrontendCspDerivedOrigin,\n    type ProviderFrontendCspFootprint,\n    type ProviderFrontendCspFootprintDeclaration,\n    type ProviderFrontendScriptDeclaration,\n    type ProviderFrontendSdkDescriptor,\n} from '../external-providers/provider-frontend-surface.shared.schemas';\n\n/**\n * The contract between a provider's frontend COMPONENT and the surface that\n * mounts it (#394). Types only — no schema, no runtime value — and it lives in\n * this package rather than beside the module types it serves because a component\n * ships in its OWN package and that package would otherwise close a dependency\n * cycle through emitted declarations. Its own file says why in full.\n */\nexport type {\n    ProviderFilePickerConstraints,\n    ProviderFilePickerProps,\n    ProviderFileSelection,\n} from '../external-providers/provider-frontend-component-contract.shared.types';\n\n/**\n * How an application supplies a frontend provider's public keys, and the\n * dependency-free schema helper the engine's own provider modules declare their\n * keys with (#394 P3). Browser-safe: pure functions and one enum, no Zod.\n */\nexport {\n    defineFrontendPublicConfigSchema,\n    FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY,\n    FrontendProviderPublicConfigError,\n    FrontendProviderPublicConfigRefusal,\n    FrontendPublicConfigValueKind,\n    overlayFrontendProviderPublicConfig,\n    readDeclaredPublicConfigKeys,\n    type FrontendPublicConfigKeySpec,\n    type FrontendPublicConfigSchema,\n    type OverlayFrontendProviderPublicConfigInput,\n} from '../external-providers/frontend-provider-public-config.shared';\n\n/**\n * The public-config shape a built-in frontend capability expects (#380). Named\n * rather than conventional: the keys were previously read by hand at each use\n * site, where a renamed one produced `undefined` and a silently wrong surface.\n */\nexport {\n    admissibleFrontendPublicConfigKeys,\n    FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS,\n    FrontendFilePickerPublicConfigSchema,\n    frontendCapabilityPublicConfigKeys,\n    layerProviderFilePickerConstraints,\n    partitionFrontendCapabilityPublicConfig,\n    type FrontendFilePickerPublicConfig,\n} from '../external-providers/frontend-capability-public-config.shared.schemas';\n\n/**\n * The RUNTIME half of the same idea (#437): what a built-in frontend capability\n * calls on the provider that fills it. `FRONTEND_ERROR_MONITORING` is the first —\n * the framework reports a caught crash without knowing which vendor is listening,\n * so the capability declares the method and the provider adapts to it. Pure types\n * plus one guard; no Zod, no decorators.\n */\nexport {\n    isFrontendErrorMonitoringSink,\n    type FrontendCrashReport,\n    type FrontendErrorMonitoringSink,\n} from '../external-providers/frontend-capability-runtime.shared.types';\n\n/**\n * Provider capability atoms (provider-registration-refactor §Phase 0.2\n * + §Phase 1.g). Closed built-in enum + open declaration-merging seam\n * + computed union type. Pure types and `as const` — no Zod, no\n * decorators, no side effects. Required by every facet's provider\n * module shape, so it MUST live on the bundle-safe seam.\n */\nexport {\n    BUILTIN_PROVIDER_CAPABILITY,\n    type BuiltinProviderCapability,\n    type ProviderCapability,\n} from '../external-providers/provider-capability.shared.schemas';\nexport {\n    BUILTIN_PROVIDER_PROTOCOL,\n    type BuiltinProviderProtocol,\n    type ProviderProtocol,\n} from '../external-providers/provider-protocol.shared.schemas';\n\n/**\n * Generic registry composition core (provider-registration-refactor\n * §Phase 1.e + §Phase 1.g). Used by every facet's `compose<Facet>Providers`\n * wrapper (backend, frontend-app, frontend-techdoc, frontend-website).\n * The browser-bound facets need this on the bundle-safe seam; the backend\n * facet inherits via the same import path for DRY.\n *\n * Pure runtime — only TYPE-imports `ProviderCapability` from the atom\n * above, so the closure stays decorator-free.\n */\nexport {\n    composeProviderRegistry,\n    ProviderCompositionConflictError,\n    type ProviderRegistryFragment,\n    type ComposedProviderRegistry,\n    type ProviderCompositionConflict,\n} from '../external-providers/compose-provider-registry.shared';\n\n/**\n * Portable lexical primitives — a sha256-digest grammar, a namespaced/opaque ref grammar, a\n * positive version, a lowercase UUIDv4, an ISO datetime, and two array-canonicality predicates.\n *\n * ## Why they are HERE and not only behind `@wildo-ai/saas-models/meta-workflows`\n *\n * They are shared by two domains, and only one of them is meta-workflows. Measured 2026-09-19: of\n * 41 import sites of the meta-workflows subpath, **7 take nothing but these primitives**, and all\n * seven are `saas-specifications/src/technical-documentation/*.schemas.ts` — a browser-bound tier\n * whose bundle-isolation allow-list had to admit an entire authoring domain to obtain seven\n * regexes.\n *\n * No K-2 extraction was needed: `portable-primitives.meta-workflows.shared.schemas` imports `zod`\n * and nothing else, so it is already the zero-dependency atom K-2 asks for — the\n * `WildoHeaderKeys` case, re-exported whole. The meta-workflows door keeps publishing it for its\n * 34 mixed consumers; that is two SUBPATHS onto one atom, which `check:package-entrypoints` rule 1\n * does not refuse (it is root-vs-subpath), and it is what a curated bundle-safe subset IS.\n *\n * The `MetaWorkflow_` prefix is kept deliberately: renaming a symbol that 34 other sites import is\n * a separate change from making it reachable on the bundle-safe seam, and doing both at once would\n * hide one in the other.\n */\nexport {\n    MetaWorkflow_Sha256DigestSchema,\n    MetaWorkflow_NamespacedRefSchema,\n    MetaWorkflow_OpaqueRefSchema,\n    MetaWorkflow_PositiveVersionSchema,\n    MetaWorkflow_PositiveOrdinalSchema,\n    MetaWorkflow_NonNegativeRevisionSchema,\n    MetaWorkflow_LowercaseUuidV4Schema,\n    MetaWorkflow_IsoDateTimeSchema,\n    MetaWorkflow_NonNegativeFiniteNumberSchema,\n    metaWorkflowValuesAreUnique,\n    metaWorkflowValuesAreLexicallySorted,\n    compareMetaWorkflowCanonicalStrings,\n} from '../meta-workflows/portable-primitives.meta-workflows.shared.schemas';\n\n/** @wildo_source:part:end saas.public-runtime.contract */\n"]}

package/dist/esm/queue/jobs.shared.resources-config.schemas.d.ts

@@ -4,14 +4,13 @@
  * Defines resource configurations for JobExecution and JobPayloadStorage.
  *
  * Resource Design Principles:
- * - REPOSITORY_ONLY variants throughout: both resources are reached by the queue services and by
- *   nothing else, so neither declares an API variant and neither generates a route
+ * - REPOSITORY_ONLY variants throughout: both resources are reached by queue services and internal retention sweeps, so neither declares an API variant and neither generates a route
  * - Proper requestDto schemas for each variant
  * - isBackendOnly fields are automatically filtered in responses
  *
  * Key Resources:
- * - JobExecution: Tracks all job lifecycle events (30-day TTL)
- * - JobPayloadStorage: Stores large payloads >100KB (24-hour TTL)
+ * - JobExecution: Tracks job lifecycle; terminal history expires, unresolved scheduled work is retained
+ * - JobPayloadStorage: Stores operational payloads (24-hour default) and finite selected scheduled evidence
  */
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
 import type { ResourceConfiguration } from '../resources/resources-config.shared.schemas';
@@ -27,15 +26,15 @@ export declare enum JobExecutionVariantKey {
 /**
  * Core operations available for JobExecution.
  */
-type JobExecution_CoreOperations = CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH;
+type JobExecution_CoreOperations = CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.DELETE_MANY;
 /**
  * Factory function for JobExecution resource configuration.
  *
  * JobExecution tracks the lifecycle of all jobs processed by the queue system.
  * It provides visibility into job status, retries, timing, and error information.
  *
- * Variants: one per operation, all REPOSITORY_ONLY (CREATE, READ, UPDATE, LIST), for the queue
- * services. There is no API variant, so no route is generated and nothing here is reachable over
+ * Variants: one per operation, all REPOSITORY_ONLY (CREATE, READ, UPDATE, LIST, SEARCH, DELETE_MANY), for queue
+ * services and bounded retention maintenance. There is no API variant, so no route is generated and nothing here is reachable over
  * HTTP. In particular there is no admin cancel verb: cancelling a job is a queue-service call, not
  * an API call, and adding an operator-facing one means declaring an API variant here first.
  */
@@ -50,7 +49,7 @@ export declare enum JobPayloadStorageVariantKey {
 /**
  * Core operations available for JobPayloadStorage.
  */
-type JobPayloadStorage_CoreOperations = CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.DELETE | CoreResourceOperation.SEARCH;
+type JobPayloadStorage_CoreOperations = CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.DELETE | CoreResourceOperation.SEARCH | CoreResourceOperation.DELETE_MANY;
 /**
  * Factory function for JobPayloadStorage resource configuration.
  *

package/dist/esm/queue/jobs.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/queue/jobs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAO/B;;GAEG;AACH,oBAAY,sBAAsB;IAChC,kDAAkD;IAClD,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,KAAK,2BAA2B,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,CAAC;AAkBjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wDAAwD,GACnE,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,2BAA2B,EAAE,OAAO,kBAAkB,CA2KzF,CAAC;AAMF;;GAEG;AACH,oBAAY,2BAA2B;IACrC,gEAAgE;IAChE,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,KAAK,gCAAgC,GACjC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAWjC;;;;;;;;GAQG;AACH,eAAO,MAAM,6DAA6D,GACxE,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,gCAAgC,EAAE,OAAO,uBAAuB,CA2FnG,CAAC"}
+{"version":3,"file":"jobs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/queue/jobs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAO/B;;GAEG;AACH,oBAAY,sBAAsB;IAChC,kDAAkD;IAClD,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,KAAK,2BAA2B,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAkBtC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wDAAwD,GACnE,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,2BAA2B,EAAE,OAAO,kBAAkB,CAuLzF,CAAC;AAMF;;GAEG;AACH,oBAAY,2BAA2B;IACrC,gEAAgE;IAChE,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,KAAK,gCAAgC,GACjC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAWtC;;;;;;;;GAQG;AACH,eAAO,MAAM,6DAA6D,GACxE,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,gCAAgC,EAAE,OAAO,uBAAuB,CAwGnG,CAAC"}

package/dist/esm/queue/jobs.shared.resources-config.schemas.js

@@ -4,14 +4,13 @@
  * Defines resource configurations for JobExecution and JobPayloadStorage.
  *
  * Resource Design Principles:
- * - REPOSITORY_ONLY variants throughout: both resources are reached by the queue services and by
- *   nothing else, so neither declares an API variant and neither generates a route
+ * - REPOSITORY_ONLY variants throughout: both resources are reached by queue services and internal retention sweeps, so neither declares an API variant and neither generates a route
  * - Proper requestDto schemas for each variant
  * - isBackendOnly fields are automatically filtered in responses
  *
  * Key Resources:
- * - JobExecution: Tracks all job lifecycle events (30-day TTL)
- * - JobPayloadStorage: Stores large payloads >100KB (24-hour TTL)
+ * - JobExecution: Tracks job lifecycle; terminal history expires, unresolved scheduled work is retained
+ * - JobPayloadStorage: Stores operational payloads (24-hour default) and finite selected scheduled evidence
  */
 import { z } from 'zod';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
@@ -51,8 +50,8 @@ const JOB_EXECUTION_SORT_FIELDS = ['createdAt', 'completedAt', 'durationMs', 're
  * JobExecution tracks the lifecycle of all jobs processed by the queue system.
  * It provides visibility into job status, retries, timing, and error information.
  *
- * Variants: one per operation, all REPOSITORY_ONLY (CREATE, READ, UPDATE, LIST), for the queue
- * services. There is no API variant, so no route is generated and nothing here is reachable over
+ * Variants: one per operation, all REPOSITORY_ONLY (CREATE, READ, UPDATE, LIST, SEARCH, DELETE_MANY), for queue
+ * services and bounded retention maintenance. There is no API variant, so no route is generated and nothing here is reachable over
  * HTTP. In particular there is no admin cancel verb: cancelling a job is a queue-service call, not
  * an API call, and adding an operator-facing one means declaring an API variant here first.
  */
@@ -131,8 +130,20 @@ export const jobExecution_ResourceConfiguration_InitializationFactory = (resourc
             CoreResourceOperation.UPDATE,
             CoreResourceOperation.LIST,
             CoreResourceOperation.SEARCH,
+            CoreResourceOperation.DELETE_MANY,
         ],
         operationsConfiguration: {
+            // The built-in bounded retention sweep resolves this contract before deleting expired rows.
+            // Repository-only: supplying maintenance behavior must not create a public deletion route.
+            [CoreResourceOperation.DELETE_MANY]: {
+                variants: [{
+                        variantKey: JobExecutionVariantKey.INTERNAL,
+                        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                        isDefault: true,
+                        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                        riskLevel: ResourceOperationRiskLevel.HIGH,
+                    }],
+            },
             // === CREATE ===
             [CoreResourceOperation.CREATE]: {
                 variants: [
@@ -240,6 +251,7 @@ export const jobPayloadStorage_ResourceConfiguration_InitializationFactory = (re
     // Internal services provide all data except auto-generated fields
     const JobPayloadStorageCreateInternalSchema = JobPayloadStorageSchema.omit({
         _id: true,
+        createdAt: true, // Repository owns timestamps; input cleaning removes them before DTO validation.
         referenceCount: true, // Starts at 1 (default)
     });
     return createResourceConfiguration_Initialization({
@@ -253,8 +265,20 @@ export const jobPayloadStorage_ResourceConfiguration_InitializationFactory = (re
             CoreResourceOperation.READ,
             CoreResourceOperation.DELETE,
             CoreResourceOperation.SEARCH,
+            CoreResourceOperation.DELETE_MANY,
         ],
         operationsConfiguration: {
+            // The built-in bounded retention sweep resolves this contract before deleting expired rows.
+            // Repository-only: supplying maintenance behavior must not create a public deletion route.
+            [CoreResourceOperation.DELETE_MANY]: {
+                variants: [{
+                        variantKey: JobPayloadStorageVariantKey.INTERNAL,
+                        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                        isDefault: true,
+                        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                        riskLevel: ResourceOperationRiskLevel.HIGH,
+                    }],
+            },
             // === CREATE ===
             [CoreResourceOperation.CREATE]: {
                 variants: [