@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/resources/resources.shared.core.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources.shared.core.definitions.js","sourceRoot":"","sources":["../../../src/resources/resources.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,qBAWX;AAXD,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,sCAAa,CAAA;IACb,0CAAiB,CAAA;IACjB,wCAAe,CAAA;AACjB,CAAC,EAXW,qBAAqB,KAArB,qBAAqB,QAWhC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4B;IACxE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA4B;IACpE,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,GAAG,iCAAiC;IACpC,GAAG,6BAA6B;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA4B;IACtE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AACF,iEAAiE;AAEjE,MAAM,CAAN,IAAY,gBA+OX;AA/OD,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;IACvB,mCAAe,CAAA;IACf,wDAAoC,CAAA;IACpC,kDAA8B,CAAA;IAC9B,wDAAoC,CAAA;IACpC,2DAAuC,CAAA;IACvC,iEAA6C,CAAA;IAC7C,mDAA+B,CAAA;IAC/B,4DAAwC,CAAA;IACxC,kEAA8C,CAAA;IAC9C,wEAAoD,CAAA;IACpD,mEAA+C,CAAA;IAE/C;;;;;;;;;;;;;;;OAeG;IACH,yEAAqD,CAAA;IACrD,4EAAwD,CAAA;IACxD,kEAA8C,CAAA;IAC9C,kDAA8B,CAAA;IAC9B,gEAA4C,CAAA;IAC5C,sGAAsG;IACtG,yEAAqD,CAAA;IAGrD,wDAAoC,CAAA;IACpC,2EAAuD,CAAA;IACvD;;;;;OAKG;IACH,gFAA4D,CAAA;IAC5D,yEAAqD,CAAA;IACrD,uEAAmD,CAAA;IACnD,gGAA4E,CAAA;IAE5E,8BAA8B;IAC9B,+EAA2D,CAAA;IAC3D,qEAAiD,CAAA;IAEjD,6CAA6C;IAC7C,oFAAgE,CAAA;IAChE,kFAA8D,CAAA;IAE9D,gDAA4B,CAAA;IAC5B,mEAA+C,CAAA;IAC/C,6EAAyD,CAAA;IACzD,kFAA8D,CAAA;IAC9D,gFAA4D,CAAA;IAC5D,8FAA0E,CAAA;IAC1E,+DAA2C,CAAA;IAC3C,yEAAqD,CAAA;IACrD,gEAA4C,CAAA;IAC5C,gEAA4C,CAAA;IAC5C,gEAA4C,CAAA;IAE5C,kEAAkE;IAClE,iFAA6D,CAAA;IAC7D,iEAA6C,CAAA;IAE7C,+DAA+D;IAC/D,4EAAwD,CAAA;IACxD,4DAAwC,CAAA;IAExC,8DAA8D;IAC9D,yEAAqD,CAAA;IACrD,yDAAqC,CAAA;IAErC,+DAA+D;IAC/D,2EAAuD,CAAA;IACvD,2DAAuC,CAAA;IAEvC,8DAA8D;IAC9D,yEAAqD,CAAA;IACrD,yDAAqC,CAAA;IAErC,uDAAuD;IACvD,yCAAqB,CAAA;IACrB,qCAAiB,CAAA;IACjB,6CAAyB,CAAA;IACzB,2CAAuB,CAAA;IAEvB,iCAAiC;IACjC,4CAAwB,CAAA;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mEAA+C,CAAA;IAE/C,uEAAuE;IACvE,yEAAyE;IACzE,gFAAgF;IAChF,uEAAuE;IACvE,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAC9E,uEAAmD,CAAA;IACnD,uFAAmE,CAAA;IAEnE,uEAAuE;IACvE,+DAA+D;IAC/D,kEAAkE;IAClE,6EAAyD,CAAA;IACzD,2EAAuD,CAAA;IACvD,+FAA2E,CAAA;IAC3E,6FAAyE,CAAA;IACzE,6FAA6F;IAC7F,gGAAgG;IAChG,iGAAiG;IACjG,yFAAyF;IACzF,oFAAoF;IACpF,EAAE;IACF,wFAAwF;IACxF,8FAA8F;IAC9F,iGAAiG;IACjG,gGAAgG;IAChG,kDAAkD;IAElD,4BAA4B;IAC5B,mCAAe,CAAA;IAEf,kDAAkD;IAClD,oDAAgC,CAAA;IAChC,6DAAyC,CAAA;IAEzC,2BAA2B;IAC3B,6DAAyC,CAAA;IAEzC,0FAA0F;IAC1F,+DAA2C,CAAA;IAE3C,8BAA8B;IAC9B,uDAAmC,CAAA;IAEnC,wEAAwE;IACxE,wEAAwE;IACxE,wCAAwC;IACxC,wDAAoC,CAAA;IAEpC,8DAA8D;IAC9D,6DAAyC,CAAA;IACzC,6EAAyD,CAAA;IAEzD,iEAAiE;IACjE,mEAA+C,CAAA;IAC/C,mFAA+D,CAAA;IAE/D,+DAA+D;IAC/D,+DAA2C,CAAA;IAC3C,+EAA2D,CAAA;IAE3D,4EAA4E;IAC5E,+EAA+E;IAC/E,kFAAkF;IAClF,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,+DAA+D;IAC/D,0EAAsD,CAAA;IACtD,0FAAsE,CAAA;IACtE,wFAAoE,CAAA;IAEpE,0EAA0E;IAC1E,iFAAiF;IACjF,gFAAgF;IAChF,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,6FAA6F;IAC7F,sFAAsF;IACtF,iFAAiF;IACjF,+EAA+E;IAC/E,+CAA+C;IAC/C,gEAA4C,CAAA;IAC5C,gFAA4D,CAAA;IAC5D,8EAA0D,CAAA;IAE1D,0EAA0E;IAC1E,uFAAuF;IACvF,yFAAyF;IACzF,yFAAyF;IACzF,wEAAwE;IACxE,8CAA8C;IAC9C,yEAAqD,CAAA;IACrD,yFAAqE,CAAA;IACrE,uFAAmE,CAAA;IAEnE,kFAAkF;IAClF,oFAAoF;IACpF,wFAAwF;IACxF,8EAA8E;IAC9E,0FAA0F;IAC1F,2EAAuD,CAAA;IACvD,2FAAuE,CAAA;IACvE,yFAAqE,CAAA;AACvE,CAAC,EA/OW,gBAAgB,KAAhB,gBAAgB,QA+O3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAwB,IAAI,GAAG,CAAS;IACzF,gBAAgB,CAAC,SAAS;CAC3B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAkC,IAAI,GAAG,CAAC;IAC3E,uCAAuC;IACvC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,qBAAqB;IACtC,oCAAoC;IACpC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,kBAAkB;IACnC,mCAAmC;IACnC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,iBAAiB;IAClC,oCAAoC;IACpC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,kBAAkB;IACnC,mCAAmC;IACnC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,iBAAiB;IAClC,oCAAoC;IACpC,gBAAgB,CAAC,QAAQ;IACzB,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,SAAS;CAC3B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACxB,CAAC,CAAC,MAAM,EAAE,CAAC,wBAAwB;CACpC,CAAC,CAAC;AAGH,uDAAuD;AAEvD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAqC;IACxF,MAAM,EAAE,gBAAgB,CAAC,KAAK;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAA0C;IACrF,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAClD,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ;IAClC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IACxD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,sCAAsC;IAC9E,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,eAAe;IACjD,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IACxD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,mBAAmB;IAC1D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,eAAe;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;IACnE,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B;IAC5E,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAClF,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,EAAE,qCAAqC;IAC9F,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAChE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAEhE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC3D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IACxE,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB;IAClE,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAC5E,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAClE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAClD,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAExE,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,aAAa;IAC9C,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,kBAAkB;IACjE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,EAAE,sCAAsC;IAChG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,aAAa;IACtD,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,kBAAkB;IAChE,gBAAgB;IAChB,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,6BAA6B;IAC9E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,yBAAyB;IACrE,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,EAAE,gCAAgC;IACpF,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAElF,0CAA0C;IAC1C,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,sBAAsB;IAChE,uCAAuC;IACvC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B;IAC3E,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC3D,sCAAsC;IACtC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;IACxD,uCAAuC;IACvC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IAC1E,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,mBAAmB;IAC1D,sCAAsC;IACtC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;IACxD,oCAAoC;IACpC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW;IACxC,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS;IACpC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,aAAa;IAC5C,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,YAAY;IAC1C,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,YAAY;IAC3C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB;IAClE,wDAAwD;IACxD,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,iCAAiC;IACtF,0DAA0D;IAC1D,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,6BAA6B;IAC7E,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B;IAC3E,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,EAAE,qCAAqC;IAC/F,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,EAAE,oCAAoC;IAC7F,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ;IAClC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,gBAAgB;IACnD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,oBAAoB;IAC5D,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,qBAAqB;IAC9D,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACrD,qCAAqC;IACrC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACvD,2BAA2B;IAC3B,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,6BAA6B;IAC7E,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;IACnE,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,gCAAgC;IACnF,4BAA4B;IAC5B,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B;IAC/E,uEAAuE;IACvE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B;IACzE,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,kEAAkE;IAClE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,qBAAqB;IAC/D,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,6BAA6B;IAC/E,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B;IAC7E,yEAAyE;IACzE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B;IACzE,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,iFAAiF;IACjF,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,2BAA2B;IAC3E,CAAC,gBAAgB,CAAC,mCAAmC,CAAC,EAAE,mCAAmC;IAC3F,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;CAC5F,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC9F,OAAO,EAAE,gDAAgD;KAC1D,CAAC;IACF,CAAC,CAAC,MAAM,EAAE,CAAC,oCAAoC;CAChD,CAAC,CAAC;AAGH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,6DAA6D;IAC7D,uCAAmB,CAAA;IACnB,0DAA0D;IAC1D,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B","sourcesContent":["import { z } from 'zod';\nimport { EnumLikeType }from '@wildo-ai/zod-decorators';\n\n\n\n\n/**\n * @wildo_source:part:start saas.models.core-resource-operation facet:layer:shared facet:family:resource-config\n *\n * Core CRUD and collection operations every resource may expose.\n *\n * @remarks Import from `@wildo-ai/saas-models`. App `resources-config` picks a\n * subset via `coreOperations` and adds `customOperation` identifiers.\n */\nexport enum CoreResourceOperation {\n  READ = 'read',        // View/retrieve existing resource\n  UPDATE = 'update',      // Update existing resource\n  UPDATE_MANY = 'update_many',   // Update multiple resources\n  DELETE = 'delete',    // Remove resource\n  DELETE_MANY = 'delete_many',   // Delete multiple resources\n  CREATE = 'create',    // Create new resource\n  CREATE_MANY = 'create_many',   // Create multiple resources\n  LIST = 'list',        // List/search multiple resources\n  SEARCH = 'search',    // Search resources with advanced filtering\n  COUNT = 'count',      // Count resources matching criteria\n}\n\nexport const ALL_CORE_OPERATIONS = Object.values(CoreResourceOperation);\n\n/**\n * Collection operations that operate on collections rather than specific resources.\n * These operations don't require a resource ID and authorization is based on roles + parent scope.\n */\nexport const COLLECTION_OPERATIONS_WITHOUT_IDS: CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.CREATE_MANY,\n  CoreResourceOperation.SEARCH,\n  CoreResourceOperation.COUNT,\n];\n\n/**\n * Collection operations that may require resource IDs in the request body or query parameters.\n * These operations operate on collections but may filter/update/delete specific resources by ID.\n */\nexport const COLLECTION_OPERATIONS_WITH_ID: CoreResourceOperation[] = [\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE_MANY,\n];\n\n/**\n * All collection operations (both with and without IDs).\n * These operations operate on collections rather than specific resources.\n * Used for URL building to determine if an operation needs an entity ID in the URL path.\n */\nexport const ALL_COLLECTION_OPERATIONS: CoreResourceOperation[] = [\n  ...COLLECTION_OPERATIONS_WITHOUT_IDS,\n  ...COLLECTION_OPERATIONS_WITH_ID,\n];\n\n/**\n * Operations that return array responses (multiple resources).\n * Used for validation and transformation logic that needs to handle arrays.\n */\nexport const ARRAY_RESPONSE_OPERATIONS: CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.DELETE_MANY,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.CREATE_MANY,\n];\n\n/**\n * Operations that don't require request body validation.\n * These operations use IDs from execution context or query parameters, not from request body.\n */\nexport const OPERATIONS_WITHOUT_REQUEST_BODY: CoreResourceOperation[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.DELETE,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.SEARCH,\n];\n/** @wildo_source:part:end saas.models.core-resource-operation */\n\nexport enum CoreResourceType {\n\n  USER_SELF = 'user_self',\n  USERS = 'users',\n  USER_CREDENTIALS = 'userCredentials',\n  USER_PROFILES = 'userProfiles',\n  USER_PREFERENCES = 'userPreferences',\n  USER_SELF_PROFILES = 'userSelfProfiles',\n  USER_SELF_PREFERENCES = 'userSelfPreferences',\n  ORGANIZATIONS = 'organizations',\n  ORGANIZATION_UNITS = 'organizationUnits',\n  ORGANIZATION_PROFILES = 'organizationProfiles',\n  ORGANIZATION_PREFERENCES = 'organizationPreferences',\n  PLATFORM_ACCESS_GRANTS = 'platformAccessGrants',\n\n  /**\n   * The APPLICATION-WIDE sibling of {@link CoreResourceType.PLATFORM_ACCESS_GRANTS}.\n   *\n   * Same lifecycle, same vocabulary, same expiry control — a DIFFERENT scope, and the scope is the\n   * whole reason it is a second resource rather than a field on the first. A platform access grant\n   * is an ORGANIZATIONS-scoped row addressed at `/organizations/{organizationId}/…`, because the\n   * tenant it names is the party that sees, approves and revokes it. An application-wide elevation\n   * names NO tenant, so there is nothing for that route to carry and nobody for the Lockbox posture\n   * to ask.\n   *\n   * Its approval is therefore the TWO-PERSON RULE: a second platform administrator, never the\n   * requester. `.claude/rules/administrative-continuity-floors.md` — \"a second factor authenticates\n   * a session; only a second signature constrains an authenticated operator\". Customer approval is\n   * the industry ceiling (Lockbox, Access Approval) and is structurally unavailable here, so a\n   * second signature is the strongest control that exists for this act.\n   */\n  APPLICATION_ACCESS_GRANTS = 'applicationAccessGrants',\n  ORGANIZATION_NOTIFICATIONS = 'organizationNotifications',\n  ORGANIZATION_FEATURES = 'organizationFeatures',\n  USER_FEATURES = 'userFeatures',\n  ORGANIZATION_MEMBERS = 'organizationMembers',\n  /** Junction: a membership's role inside one organization unit (replaced an embedded array — D-B5). */\n  ORGANIZATION_UNIT_MEMBERS = 'organizationUnitMembers',\n\n\n  ORG_API_KEYS = 'organizationApiKeys',\n  OAUTH_CLIENTS_ORGANIZATION = 'organizationOAuthClients',\n  /**\n   * An organization's OWN credential toward a third-party provider — its Slack workspace token,\n   * its CRM API key. Distinct from the deployment's `process.env` secret, which is one value for\n   * every tenant in the application, and distinct from a user's delegated OAuth grant (#333),\n   * which has a different owner and a different revocation.\n   */\n  ORG_PROVIDER_CREDENTIALS = 'organizationProviderCredentials',\n  USER_PROVIDER_CREDENTIALS = 'userProviderCredentials',\n  ORGANIZATION_SCIM_TOKENS = 'organizationScimTokens',\n  ORGANIZATION_SCIM_PROVISIONING_CONFIG = 'organizationScimProvisioningConfig',\n\n  // SSO Resources (Phase H-SSO)\n  ORGANIZATION_SSO_CONNECTIONS = 'organizationSsoConnections',\n  ORGANIZATION_SSO_CONFIG = 'organizationSsoConfig',\n\n  // SIEM / Compliance Resources (Phase H-SIEM)\n  ORGANIZATION_SIEM_EXPORT_CONFIG = 'organizationSiemExportConfig',\n  ORGANIZATION_SIEM_DELIVERY_DLQ = 'organizationSiemDeliveryDlq',\n\n  APPLICATION = 'applications',\n  APPLICATION_SSO_CONFIG = 'applicationSsoConfig',\n  APPLICATION_SSO_CONNECTIONS = 'applicationSsoConnections',\n  APPLICATION_SIEM_EXPORT_CONFIG = 'applicationSiemExportConfig',\n  APPLICATION_SIEM_DELIVERY_DLQ = 'applicationSiemDeliveryDlq',\n  APPLICATION_SCIM_PROVISIONING_CONFIG = 'applicationScimProvisioningConfig',\n  APPLICATION_API_KEYS = 'applicationApiKeys',\n  OAUTH_CLIENTS_APPLICATION = 'applicationOAuthClients',\n  APPLICATION_METADATA = 'applicationMetadata',\n  APPLICATION_VERSIONS = 'applicationVersions',\n  APPLICATION_FEATURES = 'applicationFeatures',\n\n  // Billing Accounts — polymorphic variants (one per primary scope)\n  ORGANIZATION_BILLING_ACCOUNTS = 'organizationBillingAccounts',\n  USER_BILLING_ACCOUNTS = 'userBillingAccounts',\n\n  // Subscriptions — polymorphic variants (one per primary scope)\n  ORGANIZATION_SUBSCRIPTIONS = 'organizationSubscriptions',\n  USER_SUBSCRIPTIONS = 'userSubscriptions',\n\n  // Invoice Refs — polymorphic variants (one per primary scope)\n  ORGANIZATION_INVOICE_REFS = 'organizationInvoiceRefs',\n  USER_INVOICE_REFS = 'userInvoiceRefs',\n\n  // Usage Records — polymorphic variants (one per primary scope)\n  ORGANIZATION_USAGE_RECORDS = 'organizationUsageRecords',\n  USER_USAGE_RECORDS = 'userUsageRecords',\n\n  // Credit Pools — polymorphic variants (one per primary scope)\n  ORGANIZATION_CREDIT_POOLS = 'organizationCreditPools',\n  USER_CREDIT_POOLS = 'userCreditPools',\n\n  // Billing Resources — non-polymorphic (shared catalog)\n  PRODUCTS = 'products',\n  PRICES = 'prices',\n  PROMOTIONS = 'promotions',\n  REFERRALS = 'referrals',\n\n  // Audit and Compliance Resources\n  AUDIT_LOGS = 'auditLogs',\n  /**\n   * The APPLICATION-scoped door onto the SAME audit rows `AUDIT_LOGS` serves.\n   *\n   * `AUDIT_LOGS` is organization-scoped: its only route is\n   * `/organizations/{organizationId}/audit-logs`, so it can only ever return rows carrying that\n   * tenant. But a security event is frequently application-scoped BY NATURE — `logUserLogin` takes\n   * `organizationId` as OPTIONAL because at login no organization is selected, and the same holds\n   * for session eviction, token refresh and application-wide authentication-policy changes.\n   * Measured on a dogfood application (#317): 94 of 127 rows carried no organization and were\n   * therefore reachable through no API at all.\n   *\n   * This type is that missing door, and it is a SEPARATE type rather than a second route on\n   * `AUDIT_LOGS` because the URL combinator forbids the alternative: `generateParentCombinations`\n   * puts every `isPrimaryScope` and every `REQUIRES_CONTEXT` parent into EVERY combination, so\n   * routing `AUDIT_LOGS`' application edge would rewrite its organization route to\n   * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` and break every\n   * existing consumer. A sibling type with a single application parent takes the route it needs and\n   * leaves the organization door untouched.\n   *\n   * Both types address ONE row set through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES` — the\n   * mechanism `USER_SELF` already uses to address `USERS`' rows. Two doors, one record set: the\n   * organization door stays tenant-filtered, this one is `APP_ADMIN_SUPER_ADMIN`-only, and a read\n   * here that touches a tenant-attributed row emits `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, once per\n   * tenant reached. That emission is NOT inherited: `authorizeOrganizations`, where the event is\n   * otherwise raised, runs only for ORGANIZATIONS-scoped resources. Each read variant here declares\n   * `admitsCrossTenantPlatformAdministration`, and that declaration is what enrols the read in the\n   * trail (`security/authorizations/cross-tenant-read-observation.backend.ts`).\n   */\n  APPLICATION_AUDIT_LOGS = 'applicationAuditLogs',\n\n  // Notification Badges Resources — polymorphic dual-scope (USER + ORG).\n  // Each scope owns its own collection and its own access-control surface:\n  //   - USER variant: the user themselves reads/lists their badges; CREATE/UPDATE\n  //     are system-internal (driven by the dispatcher / batch services).\n  //   - ORG variant: org admins read/list their org's badges; CREATE/UPDATE are\n  //     system-internal.\n  // See `notifications/notification-badges.shared.resources-config.schemas.ts`.\n  USER_NOTIFICATION_BADGES = 'userNotificationBadges',\n  ORGANIZATION_NOTIFICATION_BADGES = 'organizationNotificationBadges',\n\n  // M2M Outbound Webhook Resources — polymorphic dual-scope (ORG + APP).\n  // See `notifications/m2m/webhook-config.shared.schemas.ts` and\n  // `notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts`.\n  ORGANIZATION_WEBHOOK_CONFIG = 'organizationWebhookConfig',\n  APPLICATION_WEBHOOK_CONFIG = 'applicationWebhookConfig',\n  ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG = 'organizationM2mWebhookDeliveryLog',\n  APPLICATION_M2M_WEBHOOK_DELIVERY_LOG = 'applicationM2mWebhookDeliveryLog',\n  // There is NO email equivalent of these two, and that is a DECISION rather than an oversight\n  // (#412, 2026-09-08). A sent email leaves log lines and nothing else — no resource, no delivery\n  // record — so \"did this customer receive it?\" is answered with the email provider's own tooling,\n  // never with Wildo. The asymmetry with these webhook logs is what makes the absence look\n  // accidental, which is why it is written down HERE as well as at the email service.\n  //\n  // The cost is not the table. A persisted email record carries retention policy, privacy\n  // classification, subject-export and erasure obligations FOR MESSAGE CONTENT — a new per-user\n  // personal-data store, for an answer a vendor already gives. A metadata-only variant (recipient,\n  // template, timestamp, provider id; no body) was available and also declined, because it is the\n  // same set of obligations over a smaller payload.\n\n  // File Management Resources\n  FILES = 'files',\n\n  // Queue/Job Resources (internal, repository-only)\n  JOB_EXECUTIONS = 'jobExecutions',\n  JOB_PAYLOAD_STORAGE = 'jobPayloadStorage',\n\n  // Authentication Resources\n  USER_IDENTITY_LINKS = 'userIdentityLinks',\n\n  // OIDC persistent consent grants (\"remember this app\") — USER_SELF-scoped, provider-side.\n  OAUTH_CONSENT_GRANTS = 'oauthConsentGrants',\n\n  // Anonymous Session Resources\n  ANONYMOUS_USERS = 'anonymous_users',\n\n  // Marketing / Lead Capture Resources (Phase 0.5 — public marketing site\n  // forms write here; APPLICATION-scoped, no isAnonymizable, see Q-E=B in\n  // .cursor/plans/saas-website-slice.md).\n  INBOUND_CONTACTS = 'inboundContacts',\n\n  // Guidance State Resources — dual-scope (USER / ORGANIZATION)\n  USER_GUIDANCE_STATE = 'userGuidanceState',\n  ORGANIZATION_GUIDANCE_STATE = 'organizationGuidanceState',\n\n  // Progression State Resources — dual-scope (USER / ORGANIZATION)\n  USER_PROGRESSION_STATE = 'userProgressionState',\n  ORGANIZATION_PROGRESSION_STATE = 'organizationProgressionState',\n\n  // Lifecycle State Resources — dual-scope (USER / ORGANIZATION)\n  USER_LIFECYCLE_STATE = 'userLifecycleState',\n  ORGANIZATION_LIFECYCLE_STATE = 'organizationLifecycleState',\n\n  // Flows-Actors Execution Resources — persisted flow/actor system executions\n  // (conversational message log + kind-discriminated runtime state). POLYMORPHIC\n  // across owner scope: one variant per scope, each owned by the injected owner FK.\n  // The user variant is WS chat + user-delegated A2A; the org/app variants are\n  // machine-owned (API-key / OIDC-client A2A). Written by the conversational\n  // runtime; read as chat history by the owner. Values MUST match the polymorphic\n  // derivation from `flowActorExecutionsPolymorphicDeclaration`.\n  USER_FLOW_ACTOR_EXECUTIONS = 'userFlowActorExecutions',\n  ORGANIZATION_FLOW_ACTOR_EXECUTIONS = 'organizationFlowActorExecutions',\n  APPLICATION_FLOW_ACTOR_EXECUTIONS = 'applicationFlowActorExecutions',\n\n  // Flows-Actors Task Resources — the persisted WORK record, deliberately a\n  // SEPARATE plane from the conversational execution above: executions own session\n  // history, tasks own an addressable/pollable/cancelable work lifecycle with its\n  // own status and artifacts. A task links back to an execution through a SOFT INDEXED\n  // FIELD (`flowActorExecutionId`), NOT a declared relationship of any kind — executions are\n  // polymorphic, so one foreign key would match no variant, and a declared edge would imply a\n  // cascade path that must not exist: a task has to OUTLIVE the conversation that produced it.\n  // (An earlier revision of this comment said \"REFERENCE, never COMPOSITION\", which read as a\n  // declared edge; no such relationship exists. The schema and the spec both describe the soft\n  // link correctly.) Derived from the canonical `Actors_Task_Schema`, mirroring how the\n  // platform persists `wildoApplicationActorTasks`. Surfaces the A2A `Task` object\n  // (`tasks/get` / `tasks/cancel`). Values MUST match the polymorphic derivation\n  // from `flowActorTasksPolymorphicDeclaration`.\n  USER_FLOW_ACTOR_TASKS = 'userFlowActorTasks',\n  ORGANIZATION_FLOW_ACTOR_TASKS = 'organizationFlowActorTasks',\n  APPLICATION_FLOW_ACTOR_TASKS = 'applicationFlowActorTasks',\n\n  // A2A Push Notification Delivery Log (polymorphic — one per owner scope).\n  // One row per (task state change × registered webhook), written BEFORE the delivery is\n  // attempted so an unreachable queue still leaves a trace. Scope set MUST mirror the task\n  // resources above: an owner with no delivery-log variant is an owner whose notifications\n  // cannot be recorded. Values MUST match the polymorphic derivation from\n  // `a2aPushDeliveryLogPolymorphicDeclaration`.\n  USER_A2A_PUSH_DELIVERY_LOG = 'userA2aPushDeliveryLog',\n  ORGANIZATION_A2A_PUSH_DELIVERY_LOG = 'organizationA2aPushDeliveryLog',\n  APPLICATION_A2A_PUSH_DELIVERY_LOG = 'applicationA2aPushDeliveryLog',\n\n  // A2A Token Budget State Resources (polymorphic SINGLETON — one per owner scope).\n  // Per-tenant, per-period LLM token-budget accumulator enforced on inbound A2A agent\n  // turns; written + read ONLY by the A2A runtime (via *AsSystem). Enum VALUES MUST match\n  // the polymorphic derivation from `a2aTokenBudgetStatePolymorphicDeclaration`\n  // (`toPascalCase('a2aTokenBudgetState')` = `A2aTokenBudgetState`, so the value is `A2a`).\n  USER_A2A_TOKEN_BUDGET_STATE = 'userA2aTokenBudgetState',\n  ORGANIZATION_A2A_TOKEN_BUDGET_STATE = 'organizationA2aTokenBudgetState',\n  APPLICATION_A2A_TOKEN_BUDGET_STATE = 'applicationA2aTokenBudgetState',\n}\n\n/**\n * The core resources the ENGINE'S OWN runtime reads, which an application may never exclude.\n *\n * `excludedResourceTypes` exists so an application can drop core vocabulary it does not use — the\n * billing-conditional resources it was built for, or, for a purpose-built console, most of the core\n * catalog. That freedom has one floor: a resource the engine itself reads to function.\n *\n * It is declared HERE, in the shared tier, because the floor has TWO enforcement sites in different\n * layers and they must never disagree: the frontend registry must REGISTER the resource, and the\n * backend serving that frontend must MOUNT its controller. A floor honoured on one side only fails\n * exactly as loudly as no floor at all — the workbench proved both halves in turn, first a registry\n * with no `user_self` entry, then a 404 on `/api/v1/user-self/:id/context`.\n *\n * `USER_SELF` is that floor today. `UserOrgsContext.restoreUserSession` reads it to build the\n * authenticated context after every login and every reload, and returns `false` when the registry\n * has no entry for it — on which the caller logs out \"to avoid a half-restored state\". So excluding\n * it does not degrade a feature; it makes authentication IMPOSSIBLE, in the most misleading way\n * available: `POST /auth/authenticate` answers 200 with a valid token, the very next request goes out\n * with no `Authorization` header, the 401 that follows is read as an expired session, and the user\n * lands back on the login form. The only trace is one `warn`.\n *\n * That is why this is a floor the engine ENFORCES rather than a line in an application's\n * documentation. An application cannot see this dependency — `restoreUserSession` is engine-internal\n * — so an exclusion set derived from the application's own vocabulary (which is the correct way to\n * write one) has no way to know it must carve this out. Measured on the application-creation\n * workbench, whose exclusion is derived exactly that way: login succeeded and bounced, every time.\n *\n * `ORGANIZATIONS` is deliberately NOT here. `loadOrganizations` also reads the registry, but it warns\n * and returns an empty list, so excluding it degrades the organization switcher and nothing else —\n * a legitimate choice for a console with no tenant vocabulary. The floor is what BREAKS when absent,\n * not everything the engine happens to read; a floor that grows past that would quietly re-impose the\n * whole core catalog on every application.\n */\nexport const ENGINE_RUNTIME_REQUIRED_RESOURCE_TYPES: ReadonlySet<string> = new Set<string>([\n  CoreResourceType.USER_SELF,\n]);\n\n\n/**\n * Set of all billing resource types.\n * Used by the resource exclusion mechanism to conditionally exclude\n * all billing resources when billing is disabled in app config.\n */\nexport const BILLING_RESOURCE_TYPES: ReadonlySet<CoreResourceType> = new Set([\n  // Polymorphic billing account variants\n  CoreResourceType.ORGANIZATION_BILLING_ACCOUNTS,\n  CoreResourceType.USER_BILLING_ACCOUNTS,\n  // Polymorphic subscription variants\n  CoreResourceType.ORGANIZATION_SUBSCRIPTIONS,\n  CoreResourceType.USER_SUBSCRIPTIONS,\n  // Polymorphic invoice ref variants\n  CoreResourceType.ORGANIZATION_INVOICE_REFS,\n  CoreResourceType.USER_INVOICE_REFS,\n  // Polymorphic usage record variants\n  CoreResourceType.ORGANIZATION_USAGE_RECORDS,\n  CoreResourceType.USER_USAGE_RECORDS,\n  // Polymorphic credit pool variants\n  CoreResourceType.ORGANIZATION_CREDIT_POOLS,\n  CoreResourceType.USER_CREDIT_POOLS,\n  // Non-polymorphic billing resources\n  CoreResourceType.PRODUCTS,\n  CoreResourceType.PRICES,\n  CoreResourceType.PROMOTIONS,\n  CoreResourceType.REFERRALS,\n]);\n\n/**\n * @wildo_source:part:start saas.models.resource-type facet:layer:shared facet:family:resource-config\n *\n * Resource Type Schema (Core + Custom)\n *\n * @remarks Import from `@wildo-ai/saas-models`. Custom app resources use\n * string literals beyond `CoreResourceType`.\n */\nexport const ResourceTypeSchema = z.union([\n  z.enum(CoreResourceType),\n  z.string() // Custom resource types\n]);\n\nexport type ResourceType = z.infer<typeof ResourceTypeSchema>;\n/** @wildo_source:part:end saas.models.resource-type */\n\n/**\n * When multiple resource types share the same field identifier (e.g., USERS and\n * USER_SELF both use \"userId\"), this map declares which resource type is the\n * canonical FK resolution target. Without this, the winner would depend on\n * relationship declaration order — a latent fragility.\n *\n * Used by both frontend and backend registry builds as a post-enrichment fixup.\n */\nexport const coreResourceShared_FieldIdentifierPriority: Record<string, CoreResourceType> = {\n    userId: CoreResourceType.USERS,\n};\n\nexport const coreResourceShared_FieldIdentifier: { [key in CoreResourceType]: string } = {\n    [CoreResourceType.ORGANIZATIONS]: 'organizationId',\n    [CoreResourceType.USERS]: 'userId',\n    [CoreResourceType.USER_CREDENTIALS]: 'userCredentialsId',\n    [CoreResourceType.USER_SELF]: 'userId', // Same as USERS but different context\n    [CoreResourceType.USER_PROFILES]: 'userProfileId',\n    [CoreResourceType.USER_PREFERENCES]: 'userPreferencesId',\n    [CoreResourceType.USER_SELF_PROFILES]: 'userSelfProfileId',\n    [CoreResourceType.USER_SELF_PREFERENCES]: 'userSelfPreferencesId',\n    [CoreResourceType.APPLICATION]: 'applicationId',\n    [CoreResourceType.APPLICATION_SSO_CONFIG]: 'applicationSsoConfigId',\n    [CoreResourceType.APPLICATION_SSO_CONNECTIONS]: 'applicationSsoConnectionId',\n    [CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG]: 'applicationSiemExportConfigId',\n    [CoreResourceType.APPLICATION_SIEM_DELIVERY_DLQ]: 'applicationSiemDeliveryDlqId',\n    [CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG]: 'applicationScimProvisioningConfigId',\n    [CoreResourceType.APPLICATION_METADATA]: 'applicationMetadataId',\n    [CoreResourceType.APPLICATION_VERSIONS]: 'applicationVersionId',\n    [CoreResourceType.APPLICATION_FEATURES]: 'applicationFeaturesId',\n\n    [CoreResourceType.ORGANIZATION_UNITS]: 'organizationUnitId',\n    [CoreResourceType.ORGANIZATION_PROFILES]: 'organizationProfileId',\n    [CoreResourceType.ORGANIZATION_PREFERENCES]: 'organizationPreferencesId',\n    [CoreResourceType.PLATFORM_ACCESS_GRANTS]: 'platformAccessGrantId',\n    [CoreResourceType.APPLICATION_ACCESS_GRANTS]: 'applicationAccessGrantId',\n    [CoreResourceType.ORGANIZATION_NOTIFICATIONS]: 'organizationNotificationsId',\n    [CoreResourceType.ORGANIZATION_FEATURES]: 'organizationFeaturesId',\n    [CoreResourceType.USER_FEATURES]: 'userFeaturesId',\n    [CoreResourceType.ORGANIZATION_MEMBERS]: 'organizationMemberId',\n    [CoreResourceType.ORGANIZATION_UNIT_MEMBERS]: 'organizationUnitMemberId',\n\n    [CoreResourceType.ORG_API_KEYS]: 'orgApiKeyId',\n    [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: 'orgOAuthClientId',\n    [CoreResourceType.ORG_PROVIDER_CREDENTIALS]: 'orgProviderCredentialId',\n    [CoreResourceType.USER_PROVIDER_CREDENTIALS]: 'userProviderCredentialId',\n    [CoreResourceType.ORGANIZATION_SCIM_TOKENS]: 'organizationScimTokenId',\n    [CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG]: 'organizationScimProvisioningConfigId',\n    [CoreResourceType.APPLICATION_API_KEYS]: 'appApiKeyId',\n    [CoreResourceType.OAUTH_CLIENTS_APPLICATION]: 'appOAuthClientId',\n    // SSO Resources\n    [CoreResourceType.ORGANIZATION_SSO_CONNECTIONS]: 'organizationSsoConnectionId',\n    [CoreResourceType.ORGANIZATION_SSO_CONFIG]: 'organizationSsoConfigId',\n    // SIEM / Compliance Resources\n    [CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG]: 'organizationSiemExportConfigId',\n    [CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ]: 'organizationSiemDeliveryDlqId',\n\n    // Billing Accounts — polymorphic variants\n    [CoreResourceType.ORGANIZATION_BILLING_ACCOUNTS]: 'organizationBillingAccountId',\n    [CoreResourceType.USER_BILLING_ACCOUNTS]: 'userBillingAccountId',\n    // Subscriptions — polymorphic variants\n    [CoreResourceType.ORGANIZATION_SUBSCRIPTIONS]: 'organizationSubscriptionId',\n    [CoreResourceType.USER_SUBSCRIPTIONS]: 'userSubscriptionId',\n    // Invoice Refs — polymorphic variants\n    [CoreResourceType.ORGANIZATION_INVOICE_REFS]: 'organizationInvoiceRefId',\n    [CoreResourceType.USER_INVOICE_REFS]: 'userInvoiceRefId',\n    // Usage Records — polymorphic variants\n    [CoreResourceType.ORGANIZATION_USAGE_RECORDS]: 'organizationUsageRecordId',\n    [CoreResourceType.USER_USAGE_RECORDS]: 'userUsageRecordId',\n    // Credit Pools — polymorphic variants\n    [CoreResourceType.ORGANIZATION_CREDIT_POOLS]: 'organizationCreditPoolId',\n    [CoreResourceType.USER_CREDIT_POOLS]: 'userCreditPoolId',\n    // Non-polymorphic billing resources\n    [CoreResourceType.PRODUCTS]: 'productId',\n    [CoreResourceType.PRICES]: 'priceId',\n    [CoreResourceType.PROMOTIONS]: 'promotionId',\n    [CoreResourceType.REFERRALS]: 'referralId',\n    [CoreResourceType.AUDIT_LOGS]: 'auditLogId',\n    [CoreResourceType.APPLICATION_AUDIT_LOGS]: 'applicationAuditLogId',\n    // Notification Badges — polymorphic dual-scope variants\n    [CoreResourceType.USER_NOTIFICATION_BADGES]: 'userNotificationBadgeId',\n    [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: 'organizationNotificationBadgeId',\n    // M2M Outbound Webhook Resources — polymorphic dual-scope\n    [CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG]: 'organizationWebhookConfigId',\n    [CoreResourceType.APPLICATION_WEBHOOK_CONFIG]: 'applicationWebhookConfigId',\n    [CoreResourceType.ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG]: 'organizationM2mWebhookDeliveryLogId',\n    [CoreResourceType.APPLICATION_M2M_WEBHOOK_DELIVERY_LOG]: 'applicationM2mWebhookDeliveryLogId',\n    [CoreResourceType.FILES]: 'fileId',\n    [CoreResourceType.JOB_EXECUTIONS]: 'jobExecutionId',\n    [CoreResourceType.JOB_PAYLOAD_STORAGE]: 'jobPayloadStorageId',\n    [CoreResourceType.USER_IDENTITY_LINKS]: 'userIdentityLinkId',\n    [CoreResourceType.OAUTH_CONSENT_GRANTS]: 'oauthConsentGrantId',\n    // Anonymous Session Resources\n    [CoreResourceType.ANONYMOUS_USERS]: 'anonymousUserId',\n    // Marketing / Lead Capture Resources\n    [CoreResourceType.INBOUND_CONTACTS]: 'inboundContactId',\n    // Guidance State Resources\n    [CoreResourceType.USER_GUIDANCE_STATE]: 'userGuidanceStateId',\n    [CoreResourceType.ORGANIZATION_GUIDANCE_STATE]: 'organizationGuidanceStateId',\n    // Progression State Resources\n    [CoreResourceType.USER_PROGRESSION_STATE]: 'userProgressionStateId',\n    [CoreResourceType.ORGANIZATION_PROGRESSION_STATE]: 'organizationProgressionStateId',\n    // Lifecycle State Resources\n    [CoreResourceType.USER_LIFECYCLE_STATE]: 'userLifecycleStateId',\n    [CoreResourceType.ORGANIZATION_LIFECYCLE_STATE]: 'organizationLifecycleStateId',\n    // Flows-Actors Execution Resources (polymorphic — one per owner scope)\n    [CoreResourceType.USER_FLOW_ACTOR_EXECUTIONS]: 'userFlowActorExecutionId',\n    [CoreResourceType.ORGANIZATION_FLOW_ACTOR_EXECUTIONS]: 'organizationFlowActorExecutionId',\n    [CoreResourceType.APPLICATION_FLOW_ACTOR_EXECUTIONS]: 'applicationFlowActorExecutionId',\n    // Flows-Actors Task Resources (polymorphic — one per owner scope)\n    [CoreResourceType.USER_FLOW_ACTOR_TASKS]: 'userFlowActorTaskId',\n    [CoreResourceType.ORGANIZATION_FLOW_ACTOR_TASKS]: 'organizationFlowActorTaskId',\n    [CoreResourceType.APPLICATION_FLOW_ACTOR_TASKS]: 'applicationFlowActorTaskId',\n    // A2A Push Notification Delivery Log (polymorphic — one per owner scope)\n    [CoreResourceType.USER_A2A_PUSH_DELIVERY_LOG]: 'userA2aPushDeliveryLogId',\n    [CoreResourceType.ORGANIZATION_A2A_PUSH_DELIVERY_LOG]: 'organizationA2aPushDeliveryLogId',\n    [CoreResourceType.APPLICATION_A2A_PUSH_DELIVERY_LOG]: 'applicationA2aPushDeliveryLogId',\n    // A2A Token Budget State Resources (polymorphic singleton — one per owner scope)\n    [CoreResourceType.USER_A2A_TOKEN_BUDGET_STATE]: 'userA2aTokenBudgetStateId',\n    [CoreResourceType.ORGANIZATION_A2A_TOKEN_BUDGET_STATE]: 'organizationA2aTokenBudgetStateId',\n    [CoreResourceType.APPLICATION_A2A_TOKEN_BUDGET_STATE]: 'applicationA2aTokenBudgetStateId',\n};\n\n/**\n * @wildo_source:part:start saas.models.resource-field-identifier facet:layer:shared facet:family:resource-config\n *\n * FK / primary-key field identifier string for a resource (core or custom).\n *\n * @remarks Import from `@wildo-ai/saas-models`.\n */\nexport const ResourceFieldIdentifierSchema = z.union([\n  z.string().refine((value) => Object.values(coreResourceShared_FieldIdentifier).includes(value), {\n    message: \"Must be a valid core resource field identifier\"\n  }),\n  z.string() // Custom resource field identifiers\n]);\n\nexport type ResourceFieldIdentifier = z.infer<typeof ResourceFieldIdentifierSchema>;\n/** @wildo_source:part:end saas.models.resource-field-identifier */\n\n/**\n * Cascade direction for self-referencing relationships.\n * Used when resourceType1 === resourceType2 to disambiguate parent vs child.\n */\nexport enum CascadeDirection {\n  /** Standard parent→child — declaring resource is ancestor */\n  FORWARD = 'forward',\n  /** Reverse child→parent — related resource is ancestor */\n  BACKWARD = 'backward',\n}\n"]}
+{"version":3,"file":"resources.shared.core.definitions.js","sourceRoot":"","sources":["../../../../src/resources/resources.shared.core.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,qBAWX;AAXD,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;IAC3B,sCAAa,CAAA;IACb,0CAAiB,CAAA;IACjB,wCAAe,CAAA;AACjB,CAAC,EAXW,qBAAqB,KAArB,qBAAqB,QAWhC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4B;IACxE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA4B;IACpE,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,GAAG,iCAAiC;IACpC,GAAG,6BAA6B;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA4B;IACtE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AACF,iEAAiE;AAEjE,MAAM,CAAN,IAAY,gBA0UX;AA1UD,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;IACvB,mCAAe,CAAA;IACf,wDAAoC,CAAA;IACpC,kDAA8B,CAAA;IAC9B,wDAAoC,CAAA;IACpC,2DAAuC,CAAA;IACvC,iEAA6C,CAAA;IAC7C,mDAA+B,CAAA;IAC/B,4DAAwC,CAAA;IACxC,kEAA8C,CAAA;IAC9C,wEAAoD,CAAA;IACpD,mEAA+C,CAAA;IAC/C;;;OAGG;IACH,8CAA0B,CAAA;IAC1B;;;;OAIG;IACH,mFAA+D,CAAA;IAC/D,kHAAkH;IAClH,8DAA0C,CAAA;IAC1C,4FAA4F;IAC5F,mFAA+D,CAAA;IAC/D,mJAAmJ;IACnJ,mGAA+E,CAAA;IAC/E,oIAAoI;IACpI,kFAA8D,CAAA;IAC9D;;;OAGG;IACH,0FAAsE,CAAA;IAEtE;;;;;;;;;;;;;;;OAeG;IACH,yEAAqD,CAAA;IACrD;;;;;;;;;;;;;OAaG;IACH,iGAA6E,CAAA;IAC7E,4EAAwD,CAAA;IACxD,kEAA8C,CAAA;IAC9C,kDAA8B,CAAA;IAC9B,gEAA4C,CAAA;IAC5C,sGAAsG;IACtG,yEAAqD,CAAA;IAGrD,wDAAoC,CAAA;IACpC,2EAAuD,CAAA;IACvD;;;;;OAKG;IACH,gFAA4D,CAAA;IAC5D,yEAAqD,CAAA;IACrD,uEAAmD,CAAA;IACnD,gGAA4E,CAAA;IAE5E,8BAA8B;IAC9B,+EAA2D,CAAA;IAC3D,qEAAiD,CAAA;IAEjD,6CAA6C;IAC7C,oFAAgE,CAAA;IAChE,kFAA8D,CAAA;IAC9D,wFAAoE,CAAA;IAEpE,gDAA4B,CAAA;IAC5B,mEAA+C,CAAA;IAC/C,6EAAyD,CAAA;IACzD,kFAA8D,CAAA;IAC9D,gFAA4D,CAAA;IAC5D,sFAAkE,CAAA;IAClE,8FAA0E,CAAA;IAC1E,+DAA2C,CAAA;IAC3C,yEAAqD,CAAA;IACrD,gEAA4C,CAAA;IAC5C,gEAA4C,CAAA;IAC5C,gEAA4C,CAAA;IAE5C,kEAAkE;IAClE,iFAA6D,CAAA;IAC7D,iEAA6C,CAAA;IAE7C,+DAA+D;IAC/D,4EAAwD,CAAA;IACxD,4DAAwC,CAAA;IAExC,8DAA8D;IAC9D,yEAAqD,CAAA;IACrD,yDAAqC,CAAA;IAErC,+DAA+D;IAC/D,2EAAuD,CAAA;IACvD,2DAAuC,CAAA;IAEvC,8DAA8D;IAC9D,yEAAqD,CAAA;IACrD,yDAAqC,CAAA;IAErC,uDAAuD;IACvD,yCAAqB,CAAA;IACrB,qCAAiB,CAAA;IACjB,6CAAyB,CAAA;IACzB,2CAAuB,CAAA;IAEvB,iCAAiC;IACjC,4CAAwB,CAAA;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mEAA+C,CAAA;IAE/C,uEAAuE;IACvE,yEAAyE;IACzE,gFAAgF;IAChF,uEAAuE;IACvE,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAC9E,uEAAmD,CAAA;IACnD,uFAAmE,CAAA;IAEnE,uEAAuE;IACvE,+DAA+D;IAC/D,kEAAkE;IAClE,6EAAyD,CAAA;IACzD,2EAAuD,CAAA;IACvD,+FAA2E,CAAA;IAC3E,6FAAyE,CAAA;IACzE,uGAAuG;IACvG,qFAAqF;IACrF,qFAAiE,CAAA;IACjE,mFAA+D,CAAA;IAC/D,uGAAuG;IACvG,gHAAgH;IAChH,gEAA4C,CAAA;IAC5C,kEAA8C,CAAA;IAC9C,yEAAqD,CAAA;IACrD,0GAA0G;IAC1G,4GAA4G;IAC5G,2GAA2G;IAC3G,oDAAgC,CAAA;IAChC,2EAAuD,CAAA;IACvD,wDAAoC,CAAA;IACpC,2EAAuD,CAAA;IACvD,6FAA6F;IAC7F,gGAAgG;IAChG,iGAAiG;IACjG,yFAAyF;IACzF,oFAAoF;IACpF,EAAE;IACF,wFAAwF;IACxF,8FAA8F;IAC9F,iGAAiG;IACjG,gGAAgG;IAChG,kDAAkD;IAElD,4BAA4B;IAC5B,mCAAe,CAAA;IAEf,kDAAkD;IAClD,oDAAgC,CAAA;IAChC,6DAAyC,CAAA;IAEzC,8FAA8F;IAC9F,0FAA0F;IAC1F,iEAA6C,CAAA;IAC7C,sGAAsG;IACtG,6DAA6D;IAC7D,qEAAiD,CAAA;IACjD,yGAAyG;IACzG,8EAA0D,CAAA;IAE1D,gHAAgH;IAChH,wFAAwF;IACxF,kGAAkG;IAClG,wEAAoD,CAAA;IACpD,wFAAoE,CAAA;IACpE,sFAAkE,CAAA;IAClE,yEAAyE;IACzE,uFAAmE,CAAA;IACnE,uGAAmF,CAAA;IACnF,qGAAiF,CAAA;IACjF,8EAA8E;IAC9E,4EAAwD,CAAA;IACxD,gHAAgH;IAChH,uFAAmE,CAAA;IACnE,+BAA+B;IAC/B,2EAAuD,CAAA;IAEvD,0GAA0G;IAC1G,6FAA6F;IAC7F,iFAA6D,CAAA;IAE7D,2BAA2B;IAC3B,6DAAyC,CAAA;IAEzC,0FAA0F;IAC1F,+DAA2C,CAAA;IAE3C,mGAAmG;IACnG,wFAAwF;IACxF,0FAAsE,CAAA;IAEtE,8BAA8B;IAC9B,uDAAmC,CAAA;IAEnC,wEAAwE;IACxE,wEAAwE;IACxE,wCAAwC;IACxC,wDAAoC,CAAA;IAEpC,8DAA8D;IAC9D,6DAAyC,CAAA;IACzC,6EAAyD,CAAA;IAEzD,iEAAiE;IACjE,mEAA+C,CAAA;IAC/C,mFAA+D,CAAA;IAE/D,+DAA+D;IAC/D,+DAA2C,CAAA;IAC3C,+EAA2D,CAAA;IAE3D,4EAA4E;IAC5E,+EAA+E;IAC/E,kFAAkF;IAClF,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,+DAA+D;IAC/D,0EAAsD,CAAA;IACtD,0FAAsE,CAAA;IACtE,wFAAoE,CAAA;IAEpE,0EAA0E;IAC1E,iFAAiF;IACjF,gFAAgF;IAChF,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,6FAA6F;IAC7F,sFAAsF;IACtF,iFAAiF;IACjF,+EAA+E;IAC/E,+CAA+C;IAC/C,gEAA4C,CAAA;IAC5C,gFAA4D,CAAA;IAC5D,8EAA0D,CAAA;IAE1D,0EAA0E;IAC1E,uFAAuF;IACvF,yFAAyF;IACzF,yFAAyF;IACzF,wEAAwE;IACxE,8CAA8C;IAC9C,yEAAqD,CAAA;IACrD,yFAAqE,CAAA;IACrE,uFAAmE,CAAA;IAEnE,kFAAkF;IAClF,oFAAoF;IACpF,wFAAwF;IACxF,8EAA8E;IAC9E,0FAA0F;IAC1F,2EAAuD,CAAA;IACvD,2FAAuE,CAAA;IACvE,yFAAqE,CAAA;AACvE,CAAC,EA1UW,gBAAgB,KAAhB,gBAAgB,QA0U3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAwB,IAAI,GAAG,CAAS;IACzF,gBAAgB,CAAC,SAAS;CAC3B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAkC,IAAI,GAAG,CAAC;IAC3E,uCAAuC;IACvC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,qBAAqB;IACtC,oCAAoC;IACpC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,kBAAkB;IACnC,mCAAmC;IACnC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,iBAAiB;IAClC,oCAAoC;IACpC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,kBAAkB;IACnC,mCAAmC;IACnC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,iBAAiB;IAClC,oCAAoC;IACpC,gBAAgB,CAAC,QAAQ;IACzB,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,SAAS;CAC3B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACxB,CAAC,CAAC,MAAM,EAAE,CAAC,wBAAwB;CACpC,CAAC,CAAC;AAGH,uDAAuD;AAEvD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAqC;IACxF,MAAM,EAAE,gBAAgB,CAAC,KAAK;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAA0C;IACrF,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAClD,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ;IAClC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IACxD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,sCAAsC;IAC9E,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,eAAe;IACjD,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IACxD,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,mBAAmB;IAC1D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,eAAe;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;IACnE,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B;IAC5E,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAClF,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,iCAAiC;IACtF,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,EAAE,qCAAqC;IAC9F,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAChE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAEhE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC3D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IACxE,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB;IAClE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,aAAa;IAC7C,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAClF,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAClF,CAAC,gBAAgB,CAAC,uCAAuC,CAAC,EAAE,uCAAuC;IACnG,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,oCAAoC;IACvF,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,EAAE,qCAAqC;IAChG,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAC5E,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAClE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAClD,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAExE,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,aAAa;IAC9C,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,kBAAkB;IACjE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,EAAE,sCAAsC;IAChG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,aAAa;IACtD,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,kBAAkB;IAChE,gBAAgB;IAChB,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,6BAA6B;IAC9E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,yBAAyB;IACrE,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,EAAE,gCAAgC;IACpF,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,+BAA+B;IAClF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,kCAAkC;IAExF,0CAA0C;IAC1C,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,sBAAsB;IAChE,uCAAuC;IACvC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B;IAC3E,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC3D,sCAAsC;IACtC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;IACxD,uCAAuC;IACvC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IAC1E,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,mBAAmB;IAC1D,sCAAsC;IACtC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;IACxD,oCAAoC;IACpC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW;IACxC,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS;IACpC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,aAAa;IAC5C,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,YAAY;IAC1C,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,YAAY;IAC3C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB;IAClE,wDAAwD;IACxD,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB;IACtE,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,iCAAiC;IACtF,0DAA0D;IAC1D,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,6BAA6B;IAC7E,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B;IAC3E,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,EAAE,qCAAqC;IAC/F,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,EAAE,oCAAoC;IAC7F,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,EAAE,+BAA+B;IACnF,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,8BAA8B;IACjF,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;IACjE,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IACxE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,gBAAgB;IACnD,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IAC1E,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,iBAAiB;IACtD,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IAC1E,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ;IAClC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,gBAAgB;IACnD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,sBAAsB;IAChE,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,wBAAwB;IACpE,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,yBAAyB;IACvE,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,gCAAgC;IACrF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,gCAAgC;IACtF,CAAC,gBAAgB,CAAC,yCAAyC,CAAC,EAAE,wCAAwC;IACtG,CAAC,gBAAgB,CAAC,wCAAwC,CAAC,EAAE,uCAAuC;IACpG,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B;IAC5E,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,iCAAiC;IACtF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IAC1E,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B;IAChF,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,oBAAoB;IAC5D,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,qBAAqB;IAC9D,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACrD,qCAAqC;IACrC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACvD,2BAA2B;IAC3B,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IAC7D,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,6BAA6B;IAC7E,8BAA8B;IAC9B,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;IACnE,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,gCAAgC;IACnF,4BAA4B;IAC5B,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IAC/D,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B;IAC/E,uEAAuE;IACvE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B;IACzE,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,kEAAkE;IAClE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,qBAAqB;IAC/D,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,6BAA6B;IAC/E,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B;IAC7E,yEAAyE;IACzE,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B;IACzE,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;IACzF,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAAE,iCAAiC;IACvF,iFAAiF;IACjF,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,2BAA2B;IAC3E,CAAC,gBAAgB,CAAC,mCAAmC,CAAC,EAAE,mCAAmC;IAC3F,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,EAAE,kCAAkC;CAC5F,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC9F,OAAO,EAAE,gDAAgD;KAC1D,CAAC;IACF,CAAC,CAAC,MAAM,EAAE,CAAC,oCAAoC;CAChD,CAAC,CAAC;AAGH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,6DAA6D;IAC7D,uCAAmB,CAAA;IACnB,0DAA0D;IAC1D,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B","sourcesContent":["import { z } from 'zod';\nimport { EnumLikeType }from '@wildo-ai/zod-decorators';\n\n\n\n\n/**\n * @wildo_source:part:start saas.models.core-resource-operation facet:layer:shared facet:family:resource-config\n *\n * Core CRUD and collection operations every resource may expose.\n *\n * @remarks Import from `@wildo-ai/saas-models`. App `resources-config` picks a\n * subset via `coreOperations` and adds `customOperation` identifiers.\n */\nexport enum CoreResourceOperation {\n  READ = 'read',        // View/retrieve existing resource\n  UPDATE = 'update',      // Update existing resource\n  UPDATE_MANY = 'update_many',   // Update multiple resources\n  DELETE = 'delete',    // Remove resource\n  DELETE_MANY = 'delete_many',   // Delete multiple resources\n  CREATE = 'create',    // Create new resource\n  CREATE_MANY = 'create_many',   // Create multiple resources\n  LIST = 'list',        // List/search multiple resources\n  SEARCH = 'search',    // Search resources with advanced filtering\n  COUNT = 'count',      // Count resources matching criteria\n}\n\nexport const ALL_CORE_OPERATIONS = Object.values(CoreResourceOperation);\n\n/**\n * Collection operations that operate on collections rather than specific resources.\n * These operations don't require a resource ID and authorization is based on roles + parent scope.\n */\nexport const COLLECTION_OPERATIONS_WITHOUT_IDS: CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.CREATE_MANY,\n  CoreResourceOperation.SEARCH,\n  CoreResourceOperation.COUNT,\n];\n\n/**\n * Collection operations that may require resource IDs in the request body or query parameters.\n * These operations operate on collections but may filter/update/delete specific resources by ID.\n */\nexport const COLLECTION_OPERATIONS_WITH_ID: CoreResourceOperation[] = [\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE_MANY,\n];\n\n/**\n * All collection operations (both with and without IDs).\n * These operations operate on collections rather than specific resources.\n * Used for URL building to determine if an operation needs an entity ID in the URL path.\n */\nexport const ALL_COLLECTION_OPERATIONS: CoreResourceOperation[] = [\n  ...COLLECTION_OPERATIONS_WITHOUT_IDS,\n  ...COLLECTION_OPERATIONS_WITH_ID,\n];\n\n/**\n * Operations that return array responses (multiple resources).\n * Used for validation and transformation logic that needs to handle arrays.\n */\nexport const ARRAY_RESPONSE_OPERATIONS: CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.DELETE_MANY,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.CREATE_MANY,\n];\n\n/**\n * Operations that don't require request body validation.\n * These operations use IDs from execution context or query parameters, not from request body.\n */\nexport const OPERATIONS_WITHOUT_REQUEST_BODY: CoreResourceOperation[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.DELETE,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.SEARCH,\n];\n/** @wildo_source:part:end saas.models.core-resource-operation */\n\nexport enum CoreResourceType {\n\n  USER_SELF = 'user_self',\n  USERS = 'users',\n  USER_CREDENTIALS = 'userCredentials',\n  USER_PROFILES = 'userProfiles',\n  USER_PREFERENCES = 'userPreferences',\n  USER_SELF_PROFILES = 'userSelfProfiles',\n  USER_SELF_PREFERENCES = 'userSelfPreferences',\n  ORGANIZATIONS = 'organizations',\n  ORGANIZATION_UNITS = 'organizationUnits',\n  ORGANIZATION_PROFILES = 'organizationProfiles',\n  ORGANIZATION_PREFERENCES = 'organizationPreferences',\n  PLATFORM_ACCESS_GRANTS = 'platformAccessGrants',\n  /**\n   * A recorded decision that suspends DELETION of a scope of a tenant's data until it is released (#1634) —\n   * the whole tenant, rows of one resource, or one person's data. Every deletion path consults it.\n   */\n  LEGAL_HOLDS = 'legalHolds',\n  /**\n   * A service FIRM's relationship with a CLIENT organization, stored in the client — the party that\n   * declares, scopes and ends it (#1597). Its firm-side mirror is {@link SERVICE_ENGAGEMENTS}; which of\n   * the firm's experts serve it is {@link SERVICE_ENGAGEMENT_ASSIGNMENTS}.\n   */\n  SERVICE_PROVIDER_RELATIONSHIPS = 'serviceProviderRelationships',\n  /** The firm's system-written mirror of one service-provider relationship, stored in the PROVIDER organization. */\n  SERVICE_ENGAGEMENTS = 'serviceEngagements',\n  /** Which of the firm's members serve an engagement, stored in the PROVIDER organization. */\n  SERVICE_ENGAGEMENT_ASSIGNMENTS = 'serviceEngagementAssignments',\n  /** The firm's decision whether it collects activity metadata about its own experts' work in clients (#1632). One row per PROVIDER organization. */\n  SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS = 'serviceProviderActivityFeedSettings',\n  /** Metadata-only entries, in the PROVIDER organization, of what its experts did in client organizations (#1632). Engine-written. */\n  SERVICE_PROVIDER_ACTIVITY_FEED = 'serviceProviderActivityFeed',\n  /**\n   * An administrative capability a CLIENT organization lends one service firm's experts, narrow and time-bound (#1631).\n   * Stored in the client; conferred per request by the live filter only while ACTIVE and within its term.\n   */\n  SERVICE_PROVIDER_CAPABILITY_GRANTS = 'serviceProviderCapabilityGrants',\n\n  /**\n   * The APPLICATION-WIDE sibling of {@link CoreResourceType.PLATFORM_ACCESS_GRANTS}.\n   *\n   * Same lifecycle, same vocabulary, same expiry control — a DIFFERENT scope, and the scope is the\n   * whole reason it is a second resource rather than a field on the first. A platform access grant\n   * is an ORGANIZATIONS-scoped row addressed at `/organizations/{organizationId}/…`, because the\n   * tenant it names is the party that sees, approves and revokes it. An application-wide elevation\n   * names NO tenant, so there is nothing for that route to carry and nobody for the Lockbox posture\n   * to ask.\n   *\n   * Its approval is therefore the TWO-PERSON RULE: a second platform administrator, never the\n   * requester. `.claude/rules/administrative-continuity-floors.md` — \"a second factor authenticates\n   * a session; only a second signature constrains an authenticated operator\". Customer approval is\n   * the industry ceiling (Lockbox, Access Approval) and is structurally unavailable here, so a\n   * second signature is the strongest control that exists for this act.\n   */\n  APPLICATION_ACCESS_GRANTS = 'applicationAccessGrants',\n  /**\n   * Which ORGANIZATION UNIT a remote partition of a system of record belongs to.\n   *\n   * The edge that makes unit narrowing reach a read-through resource. A system of record holds\n   * several partitions inside one corporate — Odoo companies, SAP company codes, NetSuite\n   * subsidiaries — and every row read out of one is stamped with the application's OWNER\n   * organization, so without this every member of that organization sees every partition.\n   *\n   * APPLICATION-scoped rather than ORGANIZATIONS-scoped even though every row names a unit of the\n   * owner organization: assigning a partition is an OPERATOR act on the deployment's own\n   * configuration, and an operator door on a tenant-scoped resource would need a cross-tenant\n   * declaration and a platform access grant per crossing — the ceremony for reaching into a\n   * CUSTOMER's data, not for editing one's own wiring.\n   */\n  SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS = 'systemOfRecordPartitionAssignments',\n  ORGANIZATION_NOTIFICATIONS = 'organizationNotifications',\n  ORGANIZATION_FEATURES = 'organizationFeatures',\n  USER_FEATURES = 'userFeatures',\n  ORGANIZATION_MEMBERS = 'organizationMembers',\n  /** Junction: a membership's role inside one organization unit (replaced an embedded array — D-B5). */\n  ORGANIZATION_UNIT_MEMBERS = 'organizationUnitMembers',\n\n\n  ORG_API_KEYS = 'organizationApiKeys',\n  OAUTH_CLIENTS_ORGANIZATION = 'organizationOAuthClients',\n  /**\n   * An organization's OWN credential toward a third-party provider — its Slack workspace token,\n   * its CRM API key. Distinct from the deployment's `process.env` secret, which is one value for\n   * every tenant in the application, and distinct from a user's delegated OAuth grant (#333),\n   * which has a different owner and a different revocation.\n   */\n  ORG_PROVIDER_CREDENTIALS = 'organizationProviderCredentials',\n  USER_PROVIDER_CREDENTIALS = 'userProviderCredentials',\n  ORGANIZATION_SCIM_TOKENS = 'organizationScimTokens',\n  ORGANIZATION_SCIM_PROVISIONING_CONFIG = 'organizationScimProvisioningConfig',\n\n  // SSO Resources (Phase H-SSO)\n  ORGANIZATION_SSO_CONNECTIONS = 'organizationSsoConnections',\n  ORGANIZATION_SSO_CONFIG = 'organizationSsoConfig',\n\n  // SIEM / Compliance Resources (Phase H-SIEM)\n  ORGANIZATION_SIEM_EXPORT_CONFIG = 'organizationSiemExportConfig',\n  ORGANIZATION_SIEM_DELIVERY_DLQ = 'organizationSiemDeliveryDlq',\n  ORGANIZATION_SIEM_DELIVERY_OUTBOX = 'organizationSiemDeliveryOutbox',\n\n  APPLICATION = 'applications',\n  APPLICATION_SSO_CONFIG = 'applicationSsoConfig',\n  APPLICATION_SSO_CONNECTIONS = 'applicationSsoConnections',\n  APPLICATION_SIEM_EXPORT_CONFIG = 'applicationSiemExportConfig',\n  APPLICATION_SIEM_DELIVERY_DLQ = 'applicationSiemDeliveryDlq',\n  APPLICATION_SIEM_DELIVERY_OUTBOX = 'applicationSiemDeliveryOutbox',\n  APPLICATION_SCIM_PROVISIONING_CONFIG = 'applicationScimProvisioningConfig',\n  APPLICATION_API_KEYS = 'applicationApiKeys',\n  OAUTH_CLIENTS_APPLICATION = 'applicationOAuthClients',\n  APPLICATION_METADATA = 'applicationMetadata',\n  APPLICATION_VERSIONS = 'applicationVersions',\n  APPLICATION_FEATURES = 'applicationFeatures',\n\n  // Billing Accounts — polymorphic variants (one per primary scope)\n  ORGANIZATION_BILLING_ACCOUNTS = 'organizationBillingAccounts',\n  USER_BILLING_ACCOUNTS = 'userBillingAccounts',\n\n  // Subscriptions — polymorphic variants (one per primary scope)\n  ORGANIZATION_SUBSCRIPTIONS = 'organizationSubscriptions',\n  USER_SUBSCRIPTIONS = 'userSubscriptions',\n\n  // Invoice Refs — polymorphic variants (one per primary scope)\n  ORGANIZATION_INVOICE_REFS = 'organizationInvoiceRefs',\n  USER_INVOICE_REFS = 'userInvoiceRefs',\n\n  // Usage Records — polymorphic variants (one per primary scope)\n  ORGANIZATION_USAGE_RECORDS = 'organizationUsageRecords',\n  USER_USAGE_RECORDS = 'userUsageRecords',\n\n  // Credit Pools — polymorphic variants (one per primary scope)\n  ORGANIZATION_CREDIT_POOLS = 'organizationCreditPools',\n  USER_CREDIT_POOLS = 'userCreditPools',\n\n  // Billing Resources — non-polymorphic (shared catalog)\n  PRODUCTS = 'products',\n  PRICES = 'prices',\n  PROMOTIONS = 'promotions',\n  REFERRALS = 'referrals',\n\n  // Audit and Compliance Resources\n  AUDIT_LOGS = 'auditLogs',\n  /**\n   * The APPLICATION-scoped door onto the SAME audit rows `AUDIT_LOGS` serves.\n   *\n   * `AUDIT_LOGS` is organization-scoped: its only route is\n   * `/organizations/{organizationId}/audit-logs`, so it can only ever return rows carrying that\n   * tenant. But a security event is frequently application-scoped BY NATURE — `logUserLogin` takes\n   * `organizationId` as OPTIONAL because at login no organization is selected, and the same holds\n   * for session eviction, token refresh and application-wide authentication-policy changes.\n   * Measured on a dogfood application (#317): 94 of 127 rows carried no organization and were\n   * therefore reachable through no API at all.\n   *\n   * This type is that missing door, and it is a SEPARATE type rather than a second route on\n   * `AUDIT_LOGS` because the URL combinator forbids the alternative: `generateParentCombinations`\n   * puts every `isPrimaryScope` and every `REQUIRES_CONTEXT` parent into EVERY combination, so\n   * routing `AUDIT_LOGS`' application edge would rewrite its organization route to\n   * `/applications/{applicationId}/organizations/{organizationId}/audit-logs` and break every\n   * existing consumer. A sibling type with a single application parent takes the route it needs and\n   * leaves the organization door untouched.\n   *\n   * Both types address ONE row set through `RESOURCE_SHARED_PERSISTENCE_COLLECTION_ALIASES` — the\n   * mechanism `USER_SELF` already uses to address `USERS`' rows. Two doors, one record set: the\n   * organization door stays tenant-filtered, this one is `APP_ADMIN_SUPER_ADMIN`-only, and a read\n   * here that touches a tenant-attributed row emits `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, once per\n   * tenant reached. That emission is NOT inherited: `authorizeOrganizations`, where the event is\n   * otherwise raised, runs only for ORGANIZATIONS-scoped resources. Each read variant here declares\n   * `admitsCrossTenantPlatformAdministration`, and that declaration is what enrols the read in the\n   * trail (`security/authorizations/cross-tenant-read-observation.backend.ts`).\n   */\n  APPLICATION_AUDIT_LOGS = 'applicationAuditLogs',\n\n  // Notification Badges Resources — polymorphic dual-scope (USER + ORG).\n  // Each scope owns its own collection and its own access-control surface:\n  //   - USER variant: the user themselves reads/lists their badges; CREATE/UPDATE\n  //     are system-internal (driven by the dispatcher / batch services).\n  //   - ORG variant: org admins read/list their org's badges; CREATE/UPDATE are\n  //     system-internal.\n  // See `notifications/notification-badges.shared.resources-config.schemas.ts`.\n  USER_NOTIFICATION_BADGES = 'userNotificationBadges',\n  ORGANIZATION_NOTIFICATION_BADGES = 'organizationNotificationBadges',\n\n  // M2M Outbound Webhook Resources — polymorphic dual-scope (ORG + APP).\n  // See `notifications/m2m/webhook-config.shared.schemas.ts` and\n  // `notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts`.\n  ORGANIZATION_WEBHOOK_CONFIG = 'organizationWebhookConfig',\n  APPLICATION_WEBHOOK_CONFIG = 'applicationWebhookConfig',\n  ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG = 'organizationM2mWebhookDeliveryLog',\n  APPLICATION_M2M_WEBHOOK_DELIVERY_LOG = 'applicationM2mWebhookDeliveryLog',\n  // Inbound deliveries (#1596) — the durable dedup ledger, work queue and operator log of every verified\n  // message an application received. See `inbound/inbound-delivery.shared.schemas.ts`.\n  ORGANIZATION_INBOUND_DELIVERIES = 'organizationInboundDeliveries',\n  APPLICATION_INBOUND_DELIVERIES = 'applicationInboundDeliveries',\n  // Conversation threads (#1630) — the shared thread model inbound channels correlate into, its messages\n  // in both directions, and the per-recipient reply tokens. See `inbound/conversation-threads.shared.schemas.ts`.\n  CONVERSATION_THREADS = 'conversationThreads',\n  CONVERSATION_MESSAGES = 'conversationMessages',\n  CONVERSATION_REPLY_TOKENS = 'conversationReplyTokens',\n  // Receiving email (#1600) — the email channel's record of a received message, the domains an organization\n  // receives and sends on, the mailboxes a firm keeps for its clients, and the slugs of deleted organizations\n  // the shared domain never routes again. See `notifications/inbound-email/inbound-email.shared.schemas.ts`.\n  INBOUND_EMAILS = 'inboundEmails',\n  ORGANIZATION_EMAIL_DOMAINS = 'organizationEmailDomains',\n  CLIENT_MAILBOXES = 'clientMailboxes',\n  INBOUND_ADDRESS_TOMBSTONES = 'inboundAddressTombstones',\n  // There is NO email equivalent of these two, and that is a DECISION rather than an oversight\n  // (#412, 2026-09-08). A sent email leaves log lines and nothing else — no resource, no delivery\n  // record — so \"did this customer receive it?\" is answered with the email provider's own tooling,\n  // never with Wildo. The asymmetry with these webhook logs is what makes the absence look\n  // accidental, which is why it is written down HERE as well as at the email service.\n  //\n  // The cost is not the table. A persisted email record carries retention policy, privacy\n  // classification, subject-export and erasure obligations FOR MESSAGE CONTENT — a new per-user\n  // personal-data store, for an answer a vendor already gives. A metadata-only variant (recipient,\n  // template, timestamp, provider id; no body) was available and also declined, because it is the\n  // same set of obligations over a smaller payload.\n\n  // File Management Resources\n  FILES = 'files',\n\n  // Queue/Job Resources (internal, repository-only)\n  JOB_EXECUTIONS = 'jobExecutions',\n  JOB_PAYLOAD_STORAGE = 'jobPayloadStorage',\n\n  // One row per physical model-provider call: provider, model, usage, outcome. Engine-internal,\n  // repository-only, metadata only; the queryable record `outbound-call-record` C2 demands.\n  PROVIDER_CALL_RECORDS = 'providerCallRecords',\n  // One row per (provider call × unit of work): tenant, case, execution, tokens and exact cost (#1598).\n  // Engine-internal, repository-only; deleted with the tenant.\n  MODEL_CALL_ATTRIBUTIONS = 'modelCallAttributions',\n  // One row per (organization × calendar month × currency): the invoice-backing model-cost record (#1598).\n  MODEL_COST_PERIOD_AGGREGATES = 'modelCostPeriodAggregates',\n\n  // Agent-work decisions (#1599): what an expert did with an agent's proposal. POLYMORPHIC across the owner scope\n  // of the paused work, like `flowActorExecutions`. Values MUST match the derivation from\n  // `agentWorkDecisionsPolymorphicDeclaration` / `agentWorkDecisionContentsPolymorphicDeclaration`.\n  USER_AGENT_WORK_DECISIONS = 'userAgentWorkDecisions',\n  ORGANIZATION_AGENT_WORK_DECISIONS = 'organizationAgentWorkDecisions',\n  APPLICATION_AGENT_WORK_DECISIONS = 'applicationAgentWorkDecisions',\n  // The opt-in content of those decisions (proposal, final, diff, reason).\n  USER_AGENT_WORK_DECISION_CONTENTS = 'userAgentWorkDecisionContents',\n  ORGANIZATION_AGENT_WORK_DECISION_CONTENTS = 'organizationAgentWorkDecisionContents',\n  APPLICATION_AGENT_WORK_DECISION_CONTENTS = 'applicationAgentWorkDecisionContents',\n  // An organization's choice to keep that content (singleton per organization).\n  AGENT_WORK_CAPTURE_SETTINGS = 'agentWorkCaptureSettings',\n  // An organization's recorded basis for exporting its decisions as evaluation data (singleton per organization).\n  EVALUATION_EXPORT_AUTHORIZATIONS = 'evaluationExportAuthorizations',\n  // The ledger of those exports.\n  EVALUATION_DATASET_EXPORTS = 'evaluationDatasetExports',\n\n  // One row per (retention-class sweep run × class-bound resource): counts, the period applied, the deleted\n  // window and the outcome (#1636). Counts and instants only; the storage-limitation evidence.\n  RETENTION_ENFORCEMENT_RECORDS = 'retentionEnforcementRecords',\n\n  // Authentication Resources\n  USER_IDENTITY_LINKS = 'userIdentityLinks',\n\n  // OIDC persistent consent grants (\"remember this app\") — USER_SELF-scoped, provider-side.\n  OAUTH_CONSENT_GRANTS = 'oauthConsentGrants',\n\n  // Which governed-document releases a person accepted — the queryable twin of the audit interaction\n  // (#1258). Append-only, INTERNAL_CALL-only, kept across erasure as evidence of the act.\n  USER_GOVERNED_DOCUMENT_ACCEPTANCES = 'userGovernedDocumentAcceptances',\n\n  // Anonymous Session Resources\n  ANONYMOUS_USERS = 'anonymous_users',\n\n  // Marketing / Lead Capture Resources (Phase 0.5 — public marketing site\n  // forms write here; APPLICATION-scoped, no isAnonymizable, see Q-E=B in\n  // .cursor/plans/saas-website-slice.md).\n  INBOUND_CONTACTS = 'inboundContacts',\n\n  // Guidance State Resources — dual-scope (USER / ORGANIZATION)\n  USER_GUIDANCE_STATE = 'userGuidanceState',\n  ORGANIZATION_GUIDANCE_STATE = 'organizationGuidanceState',\n\n  // Progression State Resources — dual-scope (USER / ORGANIZATION)\n  USER_PROGRESSION_STATE = 'userProgressionState',\n  ORGANIZATION_PROGRESSION_STATE = 'organizationProgressionState',\n\n  // Lifecycle State Resources — dual-scope (USER / ORGANIZATION)\n  USER_LIFECYCLE_STATE = 'userLifecycleState',\n  ORGANIZATION_LIFECYCLE_STATE = 'organizationLifecycleState',\n\n  // Flows-Actors Execution Resources — persisted flow/actor system executions\n  // (conversational message log + kind-discriminated runtime state). POLYMORPHIC\n  // across owner scope: one variant per scope, each owned by the injected owner FK.\n  // The user variant is WS chat + user-delegated A2A; the org/app variants are\n  // machine-owned (API-key / OIDC-client A2A). Written by the conversational\n  // runtime; read as chat history by the owner. Values MUST match the polymorphic\n  // derivation from `flowActorExecutionsPolymorphicDeclaration`.\n  USER_FLOW_ACTOR_EXECUTIONS = 'userFlowActorExecutions',\n  ORGANIZATION_FLOW_ACTOR_EXECUTIONS = 'organizationFlowActorExecutions',\n  APPLICATION_FLOW_ACTOR_EXECUTIONS = 'applicationFlowActorExecutions',\n\n  // Flows-Actors Task Resources — the persisted WORK record, deliberately a\n  // SEPARATE plane from the conversational execution above: executions own session\n  // history, tasks own an addressable/pollable/cancelable work lifecycle with its\n  // own status and artifacts. A task links back to an execution through a SOFT INDEXED\n  // FIELD (`flowActorExecutionId`), NOT a declared relationship of any kind — executions are\n  // polymorphic, so one foreign key would match no variant, and a declared edge would imply a\n  // cascade path that must not exist: a task has to OUTLIVE the conversation that produced it.\n  // (An earlier revision of this comment said \"REFERENCE, never COMPOSITION\", which read as a\n  // declared edge; no such relationship exists. The schema and the spec both describe the soft\n  // link correctly.) Derived from the canonical `Actors_Task_Schema`, mirroring how the\n  // platform persists `wildoApplicationActorTasks`. Surfaces the A2A `Task` object\n  // (`tasks/get` / `tasks/cancel`). Values MUST match the polymorphic derivation\n  // from `flowActorTasksPolymorphicDeclaration`.\n  USER_FLOW_ACTOR_TASKS = 'userFlowActorTasks',\n  ORGANIZATION_FLOW_ACTOR_TASKS = 'organizationFlowActorTasks',\n  APPLICATION_FLOW_ACTOR_TASKS = 'applicationFlowActorTasks',\n\n  // A2A Push Notification Delivery Log (polymorphic — one per owner scope).\n  // One row per (task state change × registered webhook), written BEFORE the delivery is\n  // attempted so an unreachable queue still leaves a trace. Scope set MUST mirror the task\n  // resources above: an owner with no delivery-log variant is an owner whose notifications\n  // cannot be recorded. Values MUST match the polymorphic derivation from\n  // `a2aPushDeliveryLogPolymorphicDeclaration`.\n  USER_A2A_PUSH_DELIVERY_LOG = 'userA2aPushDeliveryLog',\n  ORGANIZATION_A2A_PUSH_DELIVERY_LOG = 'organizationA2aPushDeliveryLog',\n  APPLICATION_A2A_PUSH_DELIVERY_LOG = 'applicationA2aPushDeliveryLog',\n\n  // A2A Token Budget State Resources (polymorphic SINGLETON — one per owner scope).\n  // Per-tenant, per-period LLM token-budget accumulator enforced on inbound A2A agent\n  // turns; written + read ONLY by the A2A runtime (via *AsSystem). Enum VALUES MUST match\n  // the polymorphic derivation from `a2aTokenBudgetStatePolymorphicDeclaration`\n  // (`toPascalCase('a2aTokenBudgetState')` = `A2aTokenBudgetState`, so the value is `A2a`).\n  USER_A2A_TOKEN_BUDGET_STATE = 'userA2aTokenBudgetState',\n  ORGANIZATION_A2A_TOKEN_BUDGET_STATE = 'organizationA2aTokenBudgetState',\n  APPLICATION_A2A_TOKEN_BUDGET_STATE = 'applicationA2aTokenBudgetState',\n}\n\n/**\n * The core resources the ENGINE'S OWN runtime reads, which an application may never exclude.\n *\n * `excludedResourceTypes` exists so an application can drop core vocabulary it does not use — the\n * billing-conditional resources it was built for, or, for a purpose-built console, most of the core\n * catalog. That freedom has one floor: a resource the engine itself reads to function.\n *\n * It is declared HERE, in the shared tier, because the floor has TWO enforcement sites in different\n * layers and they must never disagree: the frontend registry must REGISTER the resource, and the\n * backend serving that frontend must MOUNT its controller. A floor honoured on one side only fails\n * exactly as loudly as no floor at all — the workbench proved both halves in turn, first a registry\n * with no `user_self` entry, then a 404 on `/api/v1/user-self/:id/context`.\n *\n * `USER_SELF` is that floor today. `UserOrgsContext.restoreUserSession` reads it to build the\n * authenticated context after every login and every reload, and returns `false` when the registry\n * has no entry for it — on which the caller logs out \"to avoid a half-restored state\". So excluding\n * it does not degrade a feature; it makes authentication IMPOSSIBLE, in the most misleading way\n * available: `POST /auth/authenticate` answers 200 with a valid token, the very next request goes out\n * with no `Authorization` header, the 401 that follows is read as an expired session, and the user\n * lands back on the login form. The only trace is one `warn`.\n *\n * That is why this is a floor the engine ENFORCES rather than a line in an application's\n * documentation. An application cannot see this dependency — `restoreUserSession` is engine-internal\n * — so an exclusion set derived from the application's own vocabulary (which is the correct way to\n * write one) has no way to know it must carve this out. Measured on the application-creation\n * workbench, whose exclusion is derived exactly that way: login succeeded and bounced, every time.\n *\n * `ORGANIZATIONS` is deliberately NOT here. `loadOrganizations` also reads the registry, but it warns\n * and returns an empty list, so excluding it degrades the organization switcher and nothing else —\n * a legitimate choice for a console with no tenant vocabulary. The floor is what BREAKS when absent,\n * not everything the engine happens to read; a floor that grows past that would quietly re-impose the\n * whole core catalog on every application.\n */\nexport const ENGINE_RUNTIME_REQUIRED_RESOURCE_TYPES: ReadonlySet<string> = new Set<string>([\n  CoreResourceType.USER_SELF,\n]);\n\n\n/**\n * Set of all billing resource types.\n * Used by the resource exclusion mechanism to conditionally exclude\n * all billing resources when billing is disabled in app config.\n */\nexport const BILLING_RESOURCE_TYPES: ReadonlySet<CoreResourceType> = new Set([\n  // Polymorphic billing account variants\n  CoreResourceType.ORGANIZATION_BILLING_ACCOUNTS,\n  CoreResourceType.USER_BILLING_ACCOUNTS,\n  // Polymorphic subscription variants\n  CoreResourceType.ORGANIZATION_SUBSCRIPTIONS,\n  CoreResourceType.USER_SUBSCRIPTIONS,\n  // Polymorphic invoice ref variants\n  CoreResourceType.ORGANIZATION_INVOICE_REFS,\n  CoreResourceType.USER_INVOICE_REFS,\n  // Polymorphic usage record variants\n  CoreResourceType.ORGANIZATION_USAGE_RECORDS,\n  CoreResourceType.USER_USAGE_RECORDS,\n  // Polymorphic credit pool variants\n  CoreResourceType.ORGANIZATION_CREDIT_POOLS,\n  CoreResourceType.USER_CREDIT_POOLS,\n  // Non-polymorphic billing resources\n  CoreResourceType.PRODUCTS,\n  CoreResourceType.PRICES,\n  CoreResourceType.PROMOTIONS,\n  CoreResourceType.REFERRALS,\n]);\n\n/**\n * @wildo_source:part:start saas.models.resource-type facet:layer:shared facet:family:resource-config\n *\n * Resource Type Schema (Core + Custom)\n *\n * @remarks Import from `@wildo-ai/saas-models`. Custom app resources use\n * string literals beyond `CoreResourceType`.\n */\nexport const ResourceTypeSchema = z.union([\n  z.enum(CoreResourceType),\n  z.string() // Custom resource types\n]);\n\nexport type ResourceType = z.infer<typeof ResourceTypeSchema>;\n/** @wildo_source:part:end saas.models.resource-type */\n\n/**\n * When multiple resource types share the same field identifier (e.g., USERS and\n * USER_SELF both use \"userId\"), this map declares which resource type is the\n * canonical FK resolution target. Without this, the winner would depend on\n * relationship declaration order — a latent fragility.\n *\n * Used by both frontend and backend registry builds as a post-enrichment fixup.\n */\nexport const coreResourceShared_FieldIdentifierPriority: Record<string, CoreResourceType> = {\n    userId: CoreResourceType.USERS,\n};\n\nexport const coreResourceShared_FieldIdentifier: { [key in CoreResourceType]: string } = {\n    [CoreResourceType.ORGANIZATIONS]: 'organizationId',\n    [CoreResourceType.USERS]: 'userId',\n    [CoreResourceType.USER_CREDENTIALS]: 'userCredentialsId',\n    [CoreResourceType.USER_SELF]: 'userId', // Same as USERS but different context\n    [CoreResourceType.USER_PROFILES]: 'userProfileId',\n    [CoreResourceType.USER_PREFERENCES]: 'userPreferencesId',\n    [CoreResourceType.USER_SELF_PROFILES]: 'userSelfProfileId',\n    [CoreResourceType.USER_SELF_PREFERENCES]: 'userSelfPreferencesId',\n    [CoreResourceType.APPLICATION]: 'applicationId',\n    [CoreResourceType.APPLICATION_SSO_CONFIG]: 'applicationSsoConfigId',\n    [CoreResourceType.APPLICATION_SSO_CONNECTIONS]: 'applicationSsoConnectionId',\n    [CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG]: 'applicationSiemExportConfigId',\n    [CoreResourceType.APPLICATION_SIEM_DELIVERY_DLQ]: 'applicationSiemDeliveryDlqId',\n    [CoreResourceType.APPLICATION_SIEM_DELIVERY_OUTBOX]: 'applicationSiemDeliveryOutboxId',\n    [CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG]: 'applicationScimProvisioningConfigId',\n    [CoreResourceType.APPLICATION_METADATA]: 'applicationMetadataId',\n    [CoreResourceType.APPLICATION_VERSIONS]: 'applicationVersionId',\n    [CoreResourceType.APPLICATION_FEATURES]: 'applicationFeaturesId',\n\n    [CoreResourceType.ORGANIZATION_UNITS]: 'organizationUnitId',\n    [CoreResourceType.ORGANIZATION_PROFILES]: 'organizationProfileId',\n    [CoreResourceType.ORGANIZATION_PREFERENCES]: 'organizationPreferencesId',\n    [CoreResourceType.PLATFORM_ACCESS_GRANTS]: 'platformAccessGrantId',\n    [CoreResourceType.LEGAL_HOLDS]: 'legalHoldId',\n    [CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS]: 'serviceProviderRelationshipId',\n    [CoreResourceType.SERVICE_ENGAGEMENTS]: 'serviceEngagementId',\n    [CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS]: 'serviceEngagementAssignmentId',\n    [CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS]: 'serviceProviderActivityFeedSettingsId',\n    [CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED]: 'serviceProviderActivityFeedEntryId',\n    [CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS]: 'serviceProviderCapabilityGrantId',\n    [CoreResourceType.APPLICATION_ACCESS_GRANTS]: 'applicationAccessGrantId',\n    [CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS]: 'systemOfRecordPartitionAssignmentId',\n    [CoreResourceType.ORGANIZATION_NOTIFICATIONS]: 'organizationNotificationsId',\n    [CoreResourceType.ORGANIZATION_FEATURES]: 'organizationFeaturesId',\n    [CoreResourceType.USER_FEATURES]: 'userFeaturesId',\n    [CoreResourceType.ORGANIZATION_MEMBERS]: 'organizationMemberId',\n    [CoreResourceType.ORGANIZATION_UNIT_MEMBERS]: 'organizationUnitMemberId',\n\n    [CoreResourceType.ORG_API_KEYS]: 'orgApiKeyId',\n    [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: 'orgOAuthClientId',\n    [CoreResourceType.ORG_PROVIDER_CREDENTIALS]: 'orgProviderCredentialId',\n    [CoreResourceType.USER_PROVIDER_CREDENTIALS]: 'userProviderCredentialId',\n    [CoreResourceType.ORGANIZATION_SCIM_TOKENS]: 'organizationScimTokenId',\n    [CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG]: 'organizationScimProvisioningConfigId',\n    [CoreResourceType.APPLICATION_API_KEYS]: 'appApiKeyId',\n    [CoreResourceType.OAUTH_CLIENTS_APPLICATION]: 'appOAuthClientId',\n    // SSO Resources\n    [CoreResourceType.ORGANIZATION_SSO_CONNECTIONS]: 'organizationSsoConnectionId',\n    [CoreResourceType.ORGANIZATION_SSO_CONFIG]: 'organizationSsoConfigId',\n    // SIEM / Compliance Resources\n    [CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG]: 'organizationSiemExportConfigId',\n    [CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ]: 'organizationSiemDeliveryDlqId',\n    [CoreResourceType.ORGANIZATION_SIEM_DELIVERY_OUTBOX]: 'organizationSiemDeliveryOutboxId',\n\n    // Billing Accounts — polymorphic variants\n    [CoreResourceType.ORGANIZATION_BILLING_ACCOUNTS]: 'organizationBillingAccountId',\n    [CoreResourceType.USER_BILLING_ACCOUNTS]: 'userBillingAccountId',\n    // Subscriptions — polymorphic variants\n    [CoreResourceType.ORGANIZATION_SUBSCRIPTIONS]: 'organizationSubscriptionId',\n    [CoreResourceType.USER_SUBSCRIPTIONS]: 'userSubscriptionId',\n    // Invoice Refs — polymorphic variants\n    [CoreResourceType.ORGANIZATION_INVOICE_REFS]: 'organizationInvoiceRefId',\n    [CoreResourceType.USER_INVOICE_REFS]: 'userInvoiceRefId',\n    // Usage Records — polymorphic variants\n    [CoreResourceType.ORGANIZATION_USAGE_RECORDS]: 'organizationUsageRecordId',\n    [CoreResourceType.USER_USAGE_RECORDS]: 'userUsageRecordId',\n    // Credit Pools — polymorphic variants\n    [CoreResourceType.ORGANIZATION_CREDIT_POOLS]: 'organizationCreditPoolId',\n    [CoreResourceType.USER_CREDIT_POOLS]: 'userCreditPoolId',\n    // Non-polymorphic billing resources\n    [CoreResourceType.PRODUCTS]: 'productId',\n    [CoreResourceType.PRICES]: 'priceId',\n    [CoreResourceType.PROMOTIONS]: 'promotionId',\n    [CoreResourceType.REFERRALS]: 'referralId',\n    [CoreResourceType.AUDIT_LOGS]: 'auditLogId',\n    [CoreResourceType.APPLICATION_AUDIT_LOGS]: 'applicationAuditLogId',\n    // Notification Badges — polymorphic dual-scope variants\n    [CoreResourceType.USER_NOTIFICATION_BADGES]: 'userNotificationBadgeId',\n    [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: 'organizationNotificationBadgeId',\n    // M2M Outbound Webhook Resources — polymorphic dual-scope\n    [CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG]: 'organizationWebhookConfigId',\n    [CoreResourceType.APPLICATION_WEBHOOK_CONFIG]: 'applicationWebhookConfigId',\n    [CoreResourceType.ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG]: 'organizationM2mWebhookDeliveryLogId',\n    [CoreResourceType.APPLICATION_M2M_WEBHOOK_DELIVERY_LOG]: 'applicationM2mWebhookDeliveryLogId',\n    [CoreResourceType.ORGANIZATION_INBOUND_DELIVERIES]: 'organizationInboundDeliveryId',\n    [CoreResourceType.APPLICATION_INBOUND_DELIVERIES]: 'applicationInboundDeliveryId',\n    [CoreResourceType.CONVERSATION_THREADS]: 'conversationThreadId',\n    [CoreResourceType.CONVERSATION_MESSAGES]: 'conversationMessageId',\n    [CoreResourceType.CONVERSATION_REPLY_TOKENS]: 'conversationReplyTokenId',\n    [CoreResourceType.INBOUND_EMAILS]: 'inboundEmailId',\n    [CoreResourceType.ORGANIZATION_EMAIL_DOMAINS]: 'organizationEmailDomainId',\n    [CoreResourceType.CLIENT_MAILBOXES]: 'clientMailboxId',\n    [CoreResourceType.INBOUND_ADDRESS_TOMBSTONES]: 'inboundAddressTombstoneId',\n    [CoreResourceType.FILES]: 'fileId',\n    [CoreResourceType.JOB_EXECUTIONS]: 'jobExecutionId',\n    [CoreResourceType.JOB_PAYLOAD_STORAGE]: 'jobPayloadStorageId',\n    [CoreResourceType.PROVIDER_CALL_RECORDS]: 'providerCallRecordId',\n    [CoreResourceType.MODEL_CALL_ATTRIBUTIONS]: 'modelCallAttributionId',\n    [CoreResourceType.MODEL_COST_PERIOD_AGGREGATES]: 'modelCostPeriodAggregateId',\n    [CoreResourceType.USER_AGENT_WORK_DECISIONS]: 'userAgentWorkDecisionId',\n    [CoreResourceType.ORGANIZATION_AGENT_WORK_DECISIONS]: 'organizationAgentWorkDecisionId',\n    [CoreResourceType.APPLICATION_AGENT_WORK_DECISIONS]: 'applicationAgentWorkDecisionId',\n    [CoreResourceType.USER_AGENT_WORK_DECISION_CONTENTS]: 'userAgentWorkDecisionContentId',\n    [CoreResourceType.ORGANIZATION_AGENT_WORK_DECISION_CONTENTS]: 'organizationAgentWorkDecisionContentId',\n    [CoreResourceType.APPLICATION_AGENT_WORK_DECISION_CONTENTS]: 'applicationAgentWorkDecisionContentId',\n    [CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS]: 'agentWorkCaptureSettingsId',\n    [CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS]: 'evaluationExportAuthorizationId',\n    [CoreResourceType.EVALUATION_DATASET_EXPORTS]: 'evaluationDatasetExportId',\n    [CoreResourceType.RETENTION_ENFORCEMENT_RECORDS]: 'retentionEnforcementRecordId',\n    [CoreResourceType.USER_IDENTITY_LINKS]: 'userIdentityLinkId',\n    [CoreResourceType.OAUTH_CONSENT_GRANTS]: 'oauthConsentGrantId',\n    [CoreResourceType.USER_GOVERNED_DOCUMENT_ACCEPTANCES]: 'userGovernedDocumentAcceptanceId',\n    // Anonymous Session Resources\n    [CoreResourceType.ANONYMOUS_USERS]: 'anonymousUserId',\n    // Marketing / Lead Capture Resources\n    [CoreResourceType.INBOUND_CONTACTS]: 'inboundContactId',\n    // Guidance State Resources\n    [CoreResourceType.USER_GUIDANCE_STATE]: 'userGuidanceStateId',\n    [CoreResourceType.ORGANIZATION_GUIDANCE_STATE]: 'organizationGuidanceStateId',\n    // Progression State Resources\n    [CoreResourceType.USER_PROGRESSION_STATE]: 'userProgressionStateId',\n    [CoreResourceType.ORGANIZATION_PROGRESSION_STATE]: 'organizationProgressionStateId',\n    // Lifecycle State Resources\n    [CoreResourceType.USER_LIFECYCLE_STATE]: 'userLifecycleStateId',\n    [CoreResourceType.ORGANIZATION_LIFECYCLE_STATE]: 'organizationLifecycleStateId',\n    // Flows-Actors Execution Resources (polymorphic — one per owner scope)\n    [CoreResourceType.USER_FLOW_ACTOR_EXECUTIONS]: 'userFlowActorExecutionId',\n    [CoreResourceType.ORGANIZATION_FLOW_ACTOR_EXECUTIONS]: 'organizationFlowActorExecutionId',\n    [CoreResourceType.APPLICATION_FLOW_ACTOR_EXECUTIONS]: 'applicationFlowActorExecutionId',\n    // Flows-Actors Task Resources (polymorphic — one per owner scope)\n    [CoreResourceType.USER_FLOW_ACTOR_TASKS]: 'userFlowActorTaskId',\n    [CoreResourceType.ORGANIZATION_FLOW_ACTOR_TASKS]: 'organizationFlowActorTaskId',\n    [CoreResourceType.APPLICATION_FLOW_ACTOR_TASKS]: 'applicationFlowActorTaskId',\n    // A2A Push Notification Delivery Log (polymorphic — one per owner scope)\n    [CoreResourceType.USER_A2A_PUSH_DELIVERY_LOG]: 'userA2aPushDeliveryLogId',\n    [CoreResourceType.ORGANIZATION_A2A_PUSH_DELIVERY_LOG]: 'organizationA2aPushDeliveryLogId',\n    [CoreResourceType.APPLICATION_A2A_PUSH_DELIVERY_LOG]: 'applicationA2aPushDeliveryLogId',\n    // A2A Token Budget State Resources (polymorphic singleton — one per owner scope)\n    [CoreResourceType.USER_A2A_TOKEN_BUDGET_STATE]: 'userA2aTokenBudgetStateId',\n    [CoreResourceType.ORGANIZATION_A2A_TOKEN_BUDGET_STATE]: 'organizationA2aTokenBudgetStateId',\n    [CoreResourceType.APPLICATION_A2A_TOKEN_BUDGET_STATE]: 'applicationA2aTokenBudgetStateId',\n};\n\n/**\n * @wildo_source:part:start saas.models.resource-field-identifier facet:layer:shared facet:family:resource-config\n *\n * FK / primary-key field identifier string for a resource (core or custom).\n *\n * @remarks Import from `@wildo-ai/saas-models`.\n */\nexport const ResourceFieldIdentifierSchema = z.union([\n  z.string().refine((value) => Object.values(coreResourceShared_FieldIdentifier).includes(value), {\n    message: \"Must be a valid core resource field identifier\"\n  }),\n  z.string() // Custom resource field identifiers\n]);\n\nexport type ResourceFieldIdentifier = z.infer<typeof ResourceFieldIdentifierSchema>;\n/** @wildo_source:part:end saas.models.resource-field-identifier */\n\n/**\n * Cascade direction for self-referencing relationships.\n * Used when resourceType1 === resourceType2 to disambiguate parent vs child.\n */\nexport enum CascadeDirection {\n  /** Standard parent→child — declaring resource is ancestor */\n  FORWARD = 'forward',\n  /** Reverse child→parent — related resource is ancestor */\n  BACKWARD = 'backward',\n}\n"]}

package/dist/esm/resources/resources.shared.schemas.d.ts

@@ -7,7 +7,6 @@ import { z } from 'zod';
 import type { DecoratedPrimitiveZodType } from '@wildo-ai/zod-decorators';
 import { CoreResourceOperation, ResourceType } from './resources.shared.core.definitions';
 import { ChildLifecycleMode, ChildLifecycleStrategy, type ChildOperationsConfig_Parsed } from './child-operations.shared.schemas';
-import { SchemaInfer } from './utils/schema-type-inference.utils';
 export type { ResourceType } from './resources.shared.core.definitions';
 /**
  * @wildo_source:part:start saas.models.resource-operation-display-risk facet:layer:shared facet:family:resource-config
@@ -20,6 +19,52 @@ export declare enum ResourceOperationRiskLevel {
     HIGH = "high",
     CRITICAL = "critical"
 }
+/**
+ * Can this operation's effect be UNDONE by a later operation?
+ *
+ * ## Why this is not `riskLevel`, and what the conflation cost
+ *
+ * Risk answers *how much does this matter*. Reversibility answers *can I take it back*. They are
+ * independent, and the framework had only the first — so the danger zone, which is the one surface
+ * that exists to mark the point of no return, derived its membership from risk alone:
+ * `isRiskyOperation(riskLevel) ? DANGER_ZONE : PRIMARY`.
+ *
+ * Measured 2026-09-19 over the framework's own resource definitions: 150 operation variants declare HIGH or CRITICAL,
+ * and the owning verbs are **48 DELETE — and then 29 UPDATE_MANY, 14 CREATE, 9 UPDATE**, plus
+ * `RESTORE`, `APPROVE`, `GRANT_OWNERSHIP`, `VERIFY_DOMAIN`, `CLAIM_DOMAIN` and `GENERATE_TOKEN`.
+ * So a CREATE sat under a red button in a section headed "Danger Zone", and so did `RESTORE` —
+ * an operation whose entire purpose is to UNDO a deletion.
+ *
+ * What a reader met on Administration → Entitlements was the pane's primary verb, **Edit**, rendered
+ * as a red destructive button beneath "This action may cause significant disruption and be difficult
+ * to reverse" — a sentence two of the three buttons beside it also carried, so it described none of
+ * them. When everything is red, nothing is.
+ *
+ * ## The default is DERIVED, so almost nothing has to be authored
+ *
+ * `resolveOperationReversibility` reads this declaration when present and otherwise derives it from
+ * `resourceOperationLike`: a DELETE-like operation is irreversible, everything else is reversible.
+ * That covers the 53 DELETE / DELETE_MANY variants without touching them, and leaves an explicit
+ * declaration for the handful of custom verbs whose name does not carry the answer — rotating a
+ * secret, purging a queue, resetting a ledger.
+ *
+ * Declaring it is cheap and REVERSIBLE is never wrong to omit: the danger zone is now conjunctive
+ * (risky AND irreversible), so an un-annotated custom verb keeps its red *variant* from its risk
+ * level and simply stops being filed under a heading that promises permanence.
+ */
+export declare enum ResourceOperationReversibility {
+    /**
+     * A later operation can restore the prior state — update it back, re-enable it, restore it from
+     * the deletion window. The act may still be serious; serious is what `riskLevel` is for.
+     */
+    REVERSIBLE = "reversible",
+    /**
+     * Nothing in the product can undo it: the row is purged, the secret is replaced and the old one is
+     * gone, the ledger is reset with no backup. This is what a danger zone exists to mark, and the
+     * only thing that belongs in one.
+     */
+    IRREVERSIBLE = "irreversible"
+}
 /**
  * The **frontend surface** of a resource operation — whether (and how) the
  * operation is presented in the UI. This is a per-app, per-operation DISPLAY
@@ -249,12 +294,51 @@ export declare enum ResourceOperation_ServiceRuntimeMode {
 }
 export declare enum ResourceOperation_CustomServiceImplementationMode {
     OVERRIDE_ALL = "override_all",
+    /**
+     * Runs OUTSIDE any database transaction, after preflight and before the transactional core (#535).
+     *
+     * The one phase that may perform an external effect whose outcome must feed the core write — a payment provider
+     * call, for example — because the transactional core's callback can be retried by the database driver and must
+     * never repeat such an effect. Single-owner; requires `transactionalCore: true`; refused inside a caller-owned
+     * transaction. It returns either a patch merged into the core input plus a continuation the core phases read, or
+     * `ALREADY_COMPLETED`, which skips core persistence, managed post-commit effects and token consumption, applies the
+     * synchronous terminal result transforms, and answers the stored state.
+     */
+    BEFORE_TRANSACTIONAL_CORE = "before_transactional_core",
     PREFIX_CORE_OPERARTIONS = "prefix_core_operations",
     POSTFIX_CORE_OPERARTIONS = "postfix_core_operations",
     REPLACE_CORE_OPERARTIONS = "between_core_operations",
     AFTER_USER_NOTIFICATIONS = "after_user_notifications",
     AT_THE_END = "at_the_end"
 }
+/** @wildo_source:part:start saas.backend.custom-operation.transactional-core facet:layer:shared facet:family:resource-operation */
+/**
+ * Who delivers an operation occurrence's post-commit effects: its resource-operation audit row and its notifications
+ * (resource-room broadcast and configured notifications).
+ *
+ * The framework delivers them after commit on a best-effort basis: a crash between the commit and the effects loses
+ * them. An operation whose effects must survive that crash declares `IMPLEMENTATION_OUTBOX` on its custom
+ * implementation. The implementation then writes the effects to its own outbox inside the operation's transaction, and
+ * the framework does not deliver them itself, so each is delivered once, by the outbox (#535).
+ *
+ * Reserved for engine-owned writers whose outbox an engine relay delivers. There is no application-facing delivery
+ * surface: an application declaring `IMPLEMENTATION_OUTBOX` would suppress its own audit rows and notifications with
+ * nothing to deliver them.
+ */
+export declare enum ResourceOperation_PostCommitEffectOwnership {
+    /** The framework emits the audit row and dispatches notifications after commit. The default. */
+    FRAMEWORK = "framework",
+    /**
+     * The custom implementation owns them: it captures their inputs inside the transactional core and enqueues them in
+     * that same transaction. The framework suppresses its own emission for the occurrence. Resource post-operation hooks
+     * still run and are told the ownership, so a hook whose work the outbox owns can stand down.
+     *
+     * Requires `transactionalCore: true`, because the enqueue must commit with the change. Refused for an operation that
+     * generates a consumable token, because a replayed notification would need the token's secret persisted.
+     */
+    IMPLEMENTATION_OUTBOX = "implementation_outbox"
+}
+/** @wildo_source:part:end saas.backend.custom-operation.transactional-core */
 export declare enum ResourceParentResourceRequirement {
     MANDATORY = "mandatory",
     OPTIONAL = "optional"
@@ -715,10 +799,9 @@ export type ScopeMembership = z.infer<typeof ScopeMembershipSchema>;
  * Absent for a foreign key ⇒ the relationship's baseline membership applies unchanged. `false` ⇒
  * enforcement is DISABLED for that foreign key on that variant.
  *
- * Note on rigor: the baseline membership check is TENANT ISOLATION and is enforced strictly. The
- * refinements below are ACCESS MANAGEMENT — `requiredRoles` reuses the shared hierarchy matcher
- * (`userRolesSatisfyRequiredRoles`), which is deliberately permissive about app-custom roles it cannot
- * expand rather than fail-closed on them.
+ * Both membership and role refinements are enforced by the backend. `requiredRoles` resolves
+ * against the live application role definitions in the declared scope; unknown held roles do not
+ * confer authority. Frontend visibility decisions are not an authorization substitute.
  */
 export declare const ReferenceScopeConstraintSchema: z.ZodObject<{
     qualifyingStatuses: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -777,11 +860,13 @@ export declare const ResourceRelationshipSchema: z.ZodObject<{
         depth: z.ZodOptional<z.ZodNumber>;
         objectMode: z.ZodOptional<z.ZodEnum<typeof import("./context-policy.shared.schemas").ContextPolicy_ObjectMode>>;
         accessRightsMode: z.ZodOptional<z.ZodEnum<typeof import("./context-policy.shared.schemas").ContextPolicy_AccessRightsMode>>;
+        limit: z.ZodOptional<z.ZodNumber>;
         operationOverrides: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof CoreResourceOperation> & z.core.$partial, z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
             depth: z.ZodOptional<z.ZodNumber>;
             objectMode: z.ZodOptional<z.ZodEnum<typeof import("./context-policy.shared.schemas").ContextPolicy_ObjectMode>>;
             accessRightsMode: z.ZodOptional<z.ZodEnum<typeof import("./context-policy.shared.schemas").ContextPolicy_AccessRightsMode>>;
+            limit: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>>;
     }, z.core.$strip>>;
     nature: z.ZodEnum<typeof RelationshipNature>;
@@ -793,7 +878,7 @@ export declare const ResourceRelationshipSchema: z.ZodObject<{
             onParentDelete: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodDefault<z.ZodBoolean>;
                 mode: z.ZodDefault<z.ZodEnum<typeof ChildLifecycleMode>>;
-                strategy: z.ZodDefault<z.ZodEnum<typeof ChildLifecycleStrategy>>;
+                strategy: z.ZodOptional<z.ZodEnum<typeof ChildLifecycleStrategy>>;
                 maxDepth: z.ZodDefault<z.ZodNumber>;
             }, z.core.$strip>>;
             onParentCreate: z.ZodOptional<z.ZodObject<{
@@ -976,31 +1061,17 @@ export type ResourceRelationship = ResourceRelationshipDeclaration & {
  */
 export declare const DefaultDeleteResponseSchema: z.ZodObject<{
     id: z.ZodString;
-    deletedAt: z.ZodOptional<z.ZodDate>;
 }, z.core.$strip>;
 export type DefaultDeleteResponse = z.infer<typeof DefaultDeleteResponseSchema>;
 export declare const DefaultBulkDeleteResponseSchema: z.ZodObject<{
     deletedIds: z.ZodArray<z.ZodString>;
     deletedCount: z.ZodNumber;
-    deletedAt: z.ZodOptional<z.ZodDate>;
 }, z.core.$strip>;
 export type DefaultBulkDeleteResponse = z.infer<typeof DefaultBulkDeleteResponseSchema>;
-export declare const DefaultUpdateManyResponseSchema: z.ZodObject<{
-    updatedCount: z.ZodNumber;
-    updatedIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    updatedAt: z.ZodOptional<z.ZodDate>;
-}, z.core.$strip>;
-export type DefaultUpdateManyResponse = z.infer<typeof DefaultUpdateManyResponseSchema>;
 export declare const DefaultCountResponseSchema: z.ZodObject<{
     count: z.ZodNumber;
 }, z.core.$strip>;
 export type DefaultCountResponse = z.infer<typeof DefaultCountResponseSchema>;
-export interface DefaultCreateManyResponse<T> {
-    items: T[];
-    createdCount: number;
-    createdAt?: Date;
-}
-export declare const DefaultCreateManyResponseSchema: <T extends z.ZodTypeAny>(itemSchema: T) => z.ZodType<DefaultCreateManyResponse<SchemaInfer<T>>>;
 /**
  * Generic success envelope for explicit custom action-style operations.
  *
@@ -1060,6 +1131,26 @@ export declare const OUTPUT_ENVELOPE_OPERATIONS: readonly string[];
  * Pass the operation's OWN `operationIdentifier`, never `resourceOperationLike`/`effectiveOperation`
  * (a custom op borrowing the verb has a custom identifier and returns its own shape). */
 export declare function isOutputEnvelopeOperation(operationIdentifier: string): boolean;
+/**
+ * Does this operation answer with an ARRAY OF ROWS, each validated against the row schema?
+ *
+ * The literal bulk verbs (`CREATE_MANY`, `UPDATE_MANY`) do, and so does a BULK VARIANT of `CREATE`
+ * or `UPDATE` — `haveBulkOperation: true` mints the bulk route as a variant of the single verb, so
+ * its effective verb reads `UPDATE` and only `isBulkOperation` separates it (the same axis issue
+ * #404 added for DELETE). The response DTO builder already declares exactly this — a bulk
+ * create/update's `responseDto` is the per-item row schema — but the three places that VALIDATE
+ * the response each re-derived the rule from the verb alone: the service's output parse, the
+ * controller serializer, and the frontend client. So a bulk "Unassign" of two todos wrote both rows
+ * and then answered a degraded body, which the client refused. They all ask this now.
+ *
+ * Only an array is read per item: a one-row bulk selection travels the single-row path and answers
+ * one row, which the same row schema accepts as it stands.
+ */
+export declare function respondsWithPerItemRowArray(operation: {
+    operationIdentifier?: unknown;
+    resourceOperationLike?: unknown;
+    isBulkOperation?: boolean;
+}): boolean;
 /**
  * Value-level twin of {@link getDefaultResponseSchemaForOperation}: composes an operation's
  * DECLARED default response value from the raw service/repository output, so the value that flows
@@ -1090,7 +1181,88 @@ export declare function isOutputEnvelopeOperation(operationIdentifier: string):
  * Keep this switch in lockstep with {@link getDefaultResponseSchemaForOperation} and
  * {@link OUTPUT_ENVELOPE_OPERATIONS}.
  */
-export declare function composeDefaultOperationResponse(operationIdentifier: string, serviceOutput: unknown): unknown;
+export declare function composeDefaultOperationResponse(operationIdentifier: string, serviceOutput: unknown, isBulkOperation?: boolean): unknown;
+/**
+ * Marker key identifying a DEGRADED operation response.
+ *
+ * Deliberately a fixed, namespaced key rather than a class or a symbol: this value crosses the
+ * service → controller → serializer boundary and is JSON-encoded on the way to a webhook delivery
+ * log, so it has to survive `JSON.parse(JSON.stringify(...))` and a structural type guard.
+ */
+export declare const DEGRADED_OPERATION_RESPONSE_MARKER: "__wildoDegradedResponse";
+/**
+ * A write that COMMITTED and could not be described.
+ *
+ * ## Why this exists (issue #577)
+ *
+ * `transformOutput` validates a write's result against the operation's `internalDto`. When that
+ * parse fails the write may already be durable — and the engine's answer was `INTERNAL` / HTTP 500.
+ * Measured on the MCP plane: `todoLists__create` created the row, answered `-32603`, and the agent
+ * did what an agent does with a failure — retried, and created another one.
+ *
+ * **Reporting failure for a write that persisted is the one available answer that is false**, and it
+ * is the answer that manufactures duplicates. The industry position is consistent on this: a `5xx`
+ * means *the outcome is unknown*, which is precisely why callers retry it, so emitting one for a
+ * known success guarantees the duplicate it is trying to avoid.
+ * spec-cite: N/A — that is this repository's reading of the retry literature, not a quotation.
+ *
+ * ## Why a reduced body is CONFORMANT, not a fudge
+ *
+ * A `201 Created` response body representing the new resource is explicitly OPTIONAL; what the
+ * specification asks for is a `Location` header identifying the created resource. So answering
+ * "it worked, here is its identity" without the full representation is the standard's own shape.
+ * spec-cite: RFC 9110 §15.3.2 (201 Created) — https://www.rfc-editor.org/rfc/rfc9110#section-15.3.2
+ *
+ * The neighbouring status exists for the same reason: a successful request need not carry a
+ * representation at all.
+ * spec-cite: RFC 9110 §15.3.5 (204 No Content) — https://www.rfc-editor.org/rfc/rfc9110#section-15.3.5
+ *
+ * ## The rule this encodes, which is ONE rule applied at two sites
+ *
+ * **A response must tell the truth about whether the write persisted.** The two `transformOutput`
+ * call sites differ in the world, not in plumbing, so the same rule produces different answers:
+ *
+ * | site | state | truthful answer |
+ * |---|---|---|
+ * | inside the transactional core | the transaction is still open — a throw ROLLS BACK | throw: "failed" is TRUE |
+ * | after a non-transactional write | the row is durable and nothing can undo it | degrade: "failed" would be FALSE |
+ *
+ * Forcing both to the same OBSERVABLE outcome was considered and rejected: it would either discard a
+ * genuinely successful write, or report success for one that was rolled back.
+ *
+ * ## What this is NOT
+ *
+ * It is not the fix for retry-duplication in general. **Any** error after commit — a crashed process,
+ * a dropped connection, a timeout — produces the same duplicate, and the mechanism the industry uses
+ * for that is an IDEMPOTENCY KEY on the request, so a retry replays the first outcome instead of
+ * performing a second write. This type narrows the window; it does not close the class.
+ * spec-cite: N/A — describes Stripe's documented idempotency-key behaviour in this repository's own
+ * words rather than quoting it (https://docs.stripe.com/api/idempotent_requests).
+ *
+ * ## Safety property
+ *
+ * The degraded body carries the resource IDENTITY and nothing else. That matters because the
+ * response-DTO parse is what strips `.isBackendOnly()` fields and masks write-only secrets — a
+ * degraded body BYPASSES that parse, so it must be constructed from a closed set of safe values
+ * rather than from the row. Never widen it to carry row content.
+ */
+export interface DegradedOperationResponse {
+    readonly [DEGRADED_OPERATION_RESPONSE_MARKER]: true;
+    /** The created/updated row's identity, when one could be recovered. Never any other row content. */
+    readonly resourceId?: string;
+    /** Stable, client-branchable reason. Not a message: the human text is server-side, in the log. */
+    readonly reason: 'response_description_failed';
+}
+/** Structural guard — see {@link DEGRADED_OPERATION_RESPONSE_MARKER} for why it is not a class. */
+export declare function isDegradedOperationResponse(value: unknown): value is DegradedOperationResponse;
+/**
+ * Build the degraded response for a committed write whose description failed.
+ *
+ * `resourceId` is recovered best-effort from the raw row: absent it, the caller still learns the
+ * write succeeded, which is the load-bearing half. Only `_id`/`id` are read — see the safety
+ * property on {@link DegradedOperationResponse}.
+ */
+export declare function composeDegradedOperationResponse(serviceOutput: unknown): DegradedOperationResponse;
 export declare function operationShouldHaveRequestDto(operation: string): boolean;
 /**
  * Database-agnostic Resource ID utilities
@@ -1126,8 +1298,8 @@ export declare enum ResourceIdFormat {
      * The synthesized id of an `INTROSPECTION`-backed resource: the key of a row DERIVED from the
      * application's own structure, never minted and never stored.
      *
-     * A distinct member from {@link HTTP_API_SYNTHESIZED} even though both admit the same charset,
-     * because they answer different questions and will diverge: an HTTP-API id encodes a REMOTE
+     * A distinct member from {@link HTTP_API_SYNTHESIZED}, because they answer different questions and have
+     * diverged: this one also admits the element-ref separators `:` `/` `[` `]` (#2048). An HTTP-API id encodes a REMOTE
      * entity's key through a codec that can round-trip it, while an introspected id is whatever the
      * companion behavior's projection already calls the row — a module name, a composed structural
      * key. Merging them would put one name on two origins, and the next reader could not tell which
@@ -1192,10 +1364,11 @@ export type ManyToManyScopeJunctionMap = ReadonlyMap<string, ManyToManyScopeJunc
  * relies on, mirrored for reads. The viewer therefore needs no read access to the
  * related row itself (e.g. another member's `user_profile`).
  *
- * @remarks Resolution requires the related resource to be MongoDB-backed. If the
- * related resource is PostgreSQL-backed the read is skipped and the label degrades
- * to `fallback` — parity is a future enhancement, mirroring the same adapter gap
- * on `SearchableRelationDescriptor`. Import from `@wildo-ai/saas-models`.
+ * @remarks Both persistence adapters resolve it: the MongoDB and PostgreSQL resource
+ * repositories each implement `findFieldValuesByJoinField` with the same contract
+ * (the PostgreSQL half landed with #1100; until then a PostgreSQL-backed related
+ * resource silently degraded every label to `fallback`). Import from
+ * `@wildo-ai/saas-models`.
  *
  * @example
  * // organizationMembers labels itself by the linked user's name. firstName/
@@ -1288,4 +1461,62 @@ export declare function renderForwardedLabel(relatedRow: Record<string, unknown>
  * a summary field too.)
  */
 export declare function forwardedLabel(descriptor: LabelRelationDescriptor): DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+/**
+ * Can a later operation undo this one? The declaration first, then a derivation from the verb.
+ *
+ * ## The derivation, and why it is total rather than a list
+ *
+ * A DELETE-like operation is irreversible; everything else is reversible until it says otherwise.
+ * That reads the operation's OWN statement of which core verb it resembles
+ * (`resourceOperationLike`), so it covers every DELETE variant in the catalogue — 53 at the time of
+ * writing — with no annotation, and covers one added tomorrow the same way. A hand-kept list of
+ * irreversible operation names is the shape `.claude/rules/invariant-call-site-enumeration.md`
+ * exists to refuse: correct on the day it is written, silently incomplete afterwards.
+ *
+ * ## Why the fallback is REVERSIBLE rather than fail-closed
+ *
+ * Fail-closed would mean "assume irreversible when unsure", which sounds safer and is not: it puts
+ * every unannotated custom verb straight back into the danger zone, which is the state this
+ * replaces — a section so full that a reader stops reading it. The costs are asymmetric in the
+ * other direction. An irreversible act mis-filed as reversible keeps its destructive COLOUR (that
+ * comes from `riskLevel`) and its confirmation, and is merely not grouped under a heading promising
+ * permanence. A reversible act mis-filed as irreversible devalues the heading for everything
+ * genuinely in it.
+ *
+ * The residual is real: a genuinely irreversible CUSTOM verb nobody annotates is under-marked.
+ * Eleven were declared when this landed — `ROTATE` ×4, `RESET_FEATURES` ×2, `ROTATE_TOKEN`,
+ * `REVOKE_TOKEN`, `PURGE_ALL`, `PURGE_OLD`, `RESET_TO_DEFAULTS` — each carrying its reason at the
+ * site.
+ *
+ * ## Why it lives HERE and not beside the operation-variant type
+ *
+ * It was written in `resources-config.shared.schemas.ts` first, next to the field it resolves, and
+ * that broke thirteen test files with `z.enum(undefined)`. Every prior use of `CoreResourceOperation`
+ * in that module is a TYPE position, so its import was elided at emit; one runtime comparison made
+ * the import real, added a module edge and closed a cycle. This module already imports
+ * `CoreResourceOperation` at runtime, so the resolver adds no edge at all.
+ *
+ * The parameter is STRUCTURAL rather than `Pick<ResourceConfiguration_OperationVariant_Base, …>`
+ * for the same reason — naming that type would import the module this one is imported BY.
+ */
+export interface ResourceOperation_ReversibilityInput {
+    reversibility?: ResourceOperationReversibility;
+    resourceOperationLike?: CoreResourceOperation;
+    /** A literal core operation carries its verb HERE and no `resourceOperationLike`. */
+    operationIdentifier?: unknown;
+}
+/**
+ * The default is derived from the EFFECTIVE verb — `resourceOperationLike`, else the operation's own
+ * identifier — and a delete of one row or of many is irreversible.
+ *
+ * It read `resourceOperationLike === DELETE` alone, while this file said the default "covers the 53
+ * DELETE / DELETE_MANY variants". A literal core DELETE carries no `resourceOperationLike` (the
+ * factory copies it from the variant, where a core operation has none), so the plain Delete of every
+ * resource derived REVERSIBLE — and the danger zone, which admits what is risky AND irreversible,
+ * never received it. A delete-many-like custom verb (a purge) was missed the same way, and a
+ * confirmation told a purge nothing about permanence.
+ */
+export declare function resolveOperationReversibility(variant: ResourceOperation_ReversibilityInput): ResourceOperationReversibility;
+/** True when nothing in the product can undo this operation. See {@link resolveOperationReversibility}. */
+export declare function isIrreversibleOperation(variant: ResourceOperation_ReversibilityInput): boolean;
 //# sourceMappingURL=resources.shared.schemas.d.ts.map