npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.6 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1399) hide show

package/dist/esm/applications/applications-context.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"applications-context.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/applications/applications-context.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
1	+ {"version":3,"file":"applications-context.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications-context.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/applications/applications.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -14,6 +14,7 @@ export declare const applicationResourceConfiguration_InitializationFactory: (re
     appDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     lastVersion: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     platformAppId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    ownerOrganizationSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
 }, z.core.$strip>>;
 export {};
 //# sourceMappingURL=applications.shared.resources-config.schemas.d.ts.map

package/dist/esm/applications/applications.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"applications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AA+E7E,KAAK,yBAAyB,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,sDAAsD,GAAI,wBAAwB,oBAAoB,EAAE~~;;;;;;kBAkNnH~~,CAAC"}
1	+ {"version":3,"file":"applications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsC,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AA+E7E,KAAK,yBAAyB,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,sDAAsD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;kBAmNnH,CAAC"}

package/dist/esm/applications/applications.shared.resources-config.schemas.js CHANGED Viewed

@@ -74,7 +74,7 @@ import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles
 //
 // Applications consequently declare NO custom operations (hence the `undefined` custom-operation
 // type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and
-// `.claude/plans/routed-unimplemented-operations-fail-closed.md`.
+// the 2026-08-01 routed-but-unimplemented operation sweep (#1275).
 const APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];
 const APPLICATION_FILTER_FIELDS = {
     appSlug: z.string(),
@@ -198,7 +198,8 @@ export const applicationResourceConfiguration_InitializationFactory = (resources
                     roles: [CORE_ORG_ROLES.ORG_MEMBER],
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     isSearchable: true,
-                    searchableFields: ['name', 'description'],
+                    // The application's own names (#1952): `name`/`description`/`slug` were never fields of an application.
+                    searchableFields: ['appDisplayName'],
                     searchableOptions: { caseSensitive: false, fullMatchOnly: false },
                     filterFields: APPLICATION_FILTER_FIELDS,
                     sortFields: APPLICATION_SORT_FIELDS,
@@ -211,7 +212,7 @@ export const applicationResourceConfiguration_InitializationFactory = (resources
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     isSearchable: true,
-                    searchableFields: ['name', 'description', 'slug'],
+                    searchableFields: ['appDisplayName', 'appSlug'],
                     searchableOptions: { caseSensitive: false, fullMatchOnly: false },
                     filterFields: APPLICATION_FILTER_FIELDS,
                     sortFields: APPLICATION_SORT_FIELDS,

package/dist/esm/applications/applications.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"applications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAE7I,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,2CAA2C;AAC3C,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,mFAAmF;AACnF,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,mFAAmF;AACnF,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sEAAsE;AACtE,wFAAwF;AACxF,uFAAuF;AACvF,2FAA2F;AAC3F,gGAAgG;AAChG,6DAA6D;AAC7D,qFAAqF;AACrF,yFAAyF;AACzF,6FAA6F;AAC7F,qBAAqB;AACrB,0FAA0F;AAC1F,+EAA+E;AAC/E,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iGAAiG;AACjG,8DAA8D;AAC9D,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,yEAAyE;AACzE,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AACzF,kEAAkE;AAElE,MAAM,uBAAuB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE9D,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAUF;;EAEE;AACF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIlK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,yEAAyE;oBACzE,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,oCAAoC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4GAA4G;oBAChJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;oBACjD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,wEAAwE;oBACxE,sFAAsF;oBACtF,qFAAqF;oBACrF,oFAAoF;oBACpF,qFAAqF;oBACrF,sFAAsF;oBACtF,oEAAoE;oBACpE,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0EAA0E;oBAC1E,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CAEF,CAAC,CAAC","sourcesContent":["/*\n Application Shared Resource Configuration\n \n Resource configuration for application management.\n * Supports both organization self-management and platform admin oversight.\n /\n\nimport { z } from 'zod';\nimport { ApplicationSchema } from './applications.shared.schemas';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for applications.\n//\n// CROSS-ORGANIZATION APPLICATION TRANSFER IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY.\n// `TRANSFER` was declared here in two variants (`ORG_ADMIN` default at `riskLevel: CRITICAL`, and\n// an `APP_ADMIN_SUPER_ADMIN` `admin` variant adding `bypassOwnerApproval`), taking\n// `{ targetOrganizationId, transferReason }`. Both were ROUTED but never implemented, so each\n// request fell through to the generic core UPDATE, which persists only fields the resource schema\n// declares. Neither `targetOrganizationId` nor `transferReason` is one, so every call answered\n// HTTP 200 having changed nothing* — an operator was told a CRITICAL cross-tenant move had\n// succeeded while the application stayed exactly where it was. Removed 2026-08-01.\n//\n// It was REMOVED rather than implemented on five independent grounds:\n//\n// 1. NO FIELD TO WRITE. `ApplicationSchema` carries no owning-organization field.\n// 2. NO RELATIONSHIP TO RE-POINT. The resources registry declares no\n// `ORGANIZATIONS → APPLICATION` edge; applications are not organization-owned here.\n// 3. THE OWNERSHIP DIRECTION IS INVERTED. `APPLICATION` is a top-level, self-anchored\n// `ResourcePrimaryScope`. The application IS the tenant container; organizations are a\n// sibling scope living inside its tenancy. \"Transferring\" the application to one of its own\n// organizations is incoherent, not merely unimplemented.\n// 4. WHERE ORGANIZATION OWNERSHIP DOES EXIST, IT IS ALREADY IMMUTABLE. The platform\n// app-factory's own application record binds `organizationId` at create and marks it\n// `excludeFromUpdate()` — a different resource, on a different service, already refusing\n// this mutation.\n// 5. FRAMEWORK PRECEDENT. Cross-organization MEMBER transfer is refused for exactly this\n// reason — a tenant-boundary crossing the framework does not sanction (see\n// `organization-members.shared.resources-config.schemas.ts`). An application is the tenant\n// container itself, so the argument applies with more force, not less.\n//\n// `bypassOwnerApproval` additionally named an approval flow that does not exist, and neither\n// variant emitted an audit event despite being cross-tenant and CRITICAL. Re-declaring an\n// application re-parenting verb would require, at minimum: a persisted ownership edge, an\n// approval flow for the flag to bypass, a custom implementation that writes the edge, and\n// audit/SIEM emission on both request and completion.\n//\n// APPLICATION STATUS LIFECYCLE IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY EITHER.\n// `ACTIVATE` and `SUSPEND` were declared here as `APP_ADMIN_SUPER_ADMIN` verbs (`MEDIUM` and\n// `CRITICAL` respectively, both with a generated bulk variant) taking `{ reason }` and\n// `{ suspensionReason, notifyOwners }`. Like TRANSFER they were ROUTED but never implemented, so\n// each fell through to the generic core UPDATE and answered HTTP 200 having changed nothing —\n// an operator was told a CRITICAL application suspension had taken effect while the application\n// kept serving. Removed 2026-08-01, on grounds that compound with TRANSFER's:\n//\n// 1. NO FIELD TO WRITE — and no plausible one. `ApplicationSchema` is\n// `{_id, appSlug, appDisplayName, lastVersion, platformAppId}`: an identity row, carrying no\n// lifecycle state at all. There is nothing to transition.\n// 2. THE LIFECYCLE IS OWNED ONE TIER UP. An application's real operational state lives at the\n// platform tier (`PLATFORM_APPLICATIONS` / `Wildo_Application_Config`), provisioned and\n// managed by the platform apps-manager. This row is the in-app registry entry an application\n// reads to know its own identity — halting an application is a platform-tier action, not a\n// self-service field flip on the application's own copy of its name.\n// 3. SAME INVERTED OWNERSHIP AS TRANSFER (ground 3 above). `APPLICATION` is a top-level\n// `ResourcePrimaryScope`; suspending the tenant container from inside its own tenancy is\n// incoherent, and the suspending super-admin's own session lives in that container.\n//\n// The resource specification's framing — \"Created per org, managed by admins, and may be\n// transferred or suspended under governance\", with 409s for destination-org slug collisions —\n// describes a per-organization application marketplace. The framework does not implement one, and\n// inventing an `ApplicationStatus` to satisfy two unimplemented buttons would have built that\n// model backwards from its UI. Re-declaring these verbs requires the ownership model first.\n//\n// Applications consequently declare NO custom operations (hence the `undefined` custom-operation\n// type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and\n// `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n\nconst APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];\n\nconst APPLICATION_FILTER_FIELDS = {\n appSlug: z.string(),\n appDisplayName: z.string(),\n};\n\ntype ApplicationCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE;\n\n/\nApplications Resource Configuration Factory\n/\nexport const applicationResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n undefined,\n ApplicationCoreOperations,\n typeof ApplicationSchema\n>({\n mainSchema: ApplicationSchema,\n resourceIdentifier: CoreResourceType.APPLICATION,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Applications are core system resources\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE\n ],\n\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can create applications\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // Use database definition so platformAppId and lastVersion are preserved\n // requestDto auto-derived from decorators\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can create applications for any org\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can view any application\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n /*\n ⚠️ NOTHING CONFINES THIS QUERY — and that is safe for a reason worth stating, because the\n * comment on the default variant used to imply a mechanism that does not exist.\n \n `applications` is its own scope ROOT, so both repositories blacklist the APPLICATIONS axis and\n * this LIST compiles to the EMPTY filter (measured 2026-08-12,\n * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep). The\n * old wording — \"Org members can list their applications\" — is exactly the shape of the claim\n * that was FALSE on `organizations` and cost a full tenant-isolation investigation, one role tier\n * higher.\n \n What makes it safe here is ARCHITECTURE, not a predicate: one database per application.\n * \"An application's organizations live in that application's own database\"\n * (`organizations.shared.schemas.ts`, on `slug` uniqueness), so this collection holds that\n * application's own row and a caller can only ever see the application they are already using.\n * Measured: an ordinary `ORG_MEMBER` receives 1 of 1 rows, projected to four summary fields.\n \n So the two variants below differ in ROLE, not in reach — `admin` exists for the fields and\n * operations it unlocks elsewhere, not because it sees more rows here.\n \n ⚠️ This rests on the one-database-per-application invariant. `CREATE` is super-admin gated, so\n * a second application row COULD be written into this database; if that ever becomes a real\n * deployment shape, this resource inherits the `organizations` defect at the `ORG_MEMBER` tier\n * and must be confined on `initiatorIds.applicationId`. Tracked as SEC-SCOPEROOT-3.\n */\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Unconfined by construction; safe because the collection holds this application only — see the block above\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can list all applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'slug'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ]\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update their applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n // requestDto auto-derived from decorators\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can update any application\n riskLevel: ResourceOperationRiskLevel.LOW,\n // requestDto auto-derived from decorators\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can delete their applications\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n // An APPLICATION is a top-level scope in this framework, not an org-owned artifact, so\n // deleting one destroys everything scoped beneath it. Same reasoning as\n // `ORGANIZATIONS \| DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`\n // policy is opt-in, off by default, and freshness-satisfied — neither challenges the\n // caller here. Re-authentication itself accepts PASSWORD, an enrolled second factor\n // (TOTP or a backup code) and PASSKEY, so a directory-managed user whose local first\n // factor the framework destroys can still clear the gate through their second factor;\n // see the note on `ORGANIZATIONS \| DELETE` for how that came about.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n requiresStepUpAuthentication: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can delete any application\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-VARIANT flag — nothing is inherited from the default variant above.\n requiresStepUpAuthentication: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n }\n },\n\n});\n"]}
1	+ {"version":3,"file":"applications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAE7I,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,2CAA2C;AAC3C,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,mFAAmF;AACnF,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,mFAAmF;AACnF,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sEAAsE;AACtE,wFAAwF;AACxF,uFAAuF;AACvF,2FAA2F;AAC3F,gGAAgG;AAChG,6DAA6D;AAC7D,qFAAqF;AACrF,yFAAyF;AACzF,6FAA6F;AAC7F,qBAAqB;AACrB,0FAA0F;AAC1F,+EAA+E;AAC/E,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iGAAiG;AACjG,8DAA8D;AAC9D,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,yEAAyE;AACzE,yFAAyF;AACzF,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AACzF,mEAAmE;AAEnE,MAAM,uBAAuB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE9D,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAUF;;EAEE;AACF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIlK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;IAChD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACzF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,yEAAyE;oBACzE,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,oCAAoC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4GAA4G;oBAChJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,wGAAwG;oBACxG,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;oBACpC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC;oBAC/C,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,2CAA2C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,wEAAwE;oBACxE,sFAAsF;oBACtF,qFAAqF;oBACrF,oFAAoF;oBACpF,qFAAqF;oBACrF,sFAAsF;oBACtF,oEAAoE;oBACpE,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,0CAA0C;oBACzF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0EAA0E;oBAC1E,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CAEF,CAAC,CAAC","sourcesContent":["/*\n Application Shared Resource Configuration\n \n Resource configuration for application management.\n * Supports both organization self-management and platform admin oversight.\n /\n\nimport { z } from 'zod';\nimport { ApplicationSchema } from './applications.shared.schemas';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for applications.\n//\n// CROSS-ORGANIZATION APPLICATION TRANSFER IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY.\n// `TRANSFER` was declared here in two variants (`ORG_ADMIN` default at `riskLevel: CRITICAL`, and\n// an `APP_ADMIN_SUPER_ADMIN` `admin` variant adding `bypassOwnerApproval`), taking\n// `{ targetOrganizationId, transferReason }`. Both were ROUTED but never implemented, so each\n// request fell through to the generic core UPDATE, which persists only fields the resource schema\n// declares. Neither `targetOrganizationId` nor `transferReason` is one, so every call answered\n// HTTP 200 having changed nothing* — an operator was told a CRITICAL cross-tenant move had\n// succeeded while the application stayed exactly where it was. Removed 2026-08-01.\n//\n// It was REMOVED rather than implemented on five independent grounds:\n//\n// 1. NO FIELD TO WRITE. `ApplicationSchema` carries no owning-organization field.\n// 2. NO RELATIONSHIP TO RE-POINT. The resources registry declares no\n// `ORGANIZATIONS → APPLICATION` edge; applications are not organization-owned here.\n// 3. THE OWNERSHIP DIRECTION IS INVERTED. `APPLICATION` is a top-level, self-anchored\n// `ResourcePrimaryScope`. The application IS the tenant container; organizations are a\n// sibling scope living inside its tenancy. \"Transferring\" the application to one of its own\n// organizations is incoherent, not merely unimplemented.\n// 4. WHERE ORGANIZATION OWNERSHIP DOES EXIST, IT IS ALREADY IMMUTABLE. The platform\n// app-factory's own application record binds `organizationId` at create and marks it\n// `excludeFromUpdate()` — a different resource, on a different service, already refusing\n// this mutation.\n// 5. FRAMEWORK PRECEDENT. Cross-organization MEMBER transfer is refused for exactly this\n// reason — a tenant-boundary crossing the framework does not sanction (see\n// `organization-members.shared.resources-config.schemas.ts`). An application is the tenant\n// container itself, so the argument applies with more force, not less.\n//\n// `bypassOwnerApproval` additionally named an approval flow that does not exist, and neither\n// variant emitted an audit event despite being cross-tenant and CRITICAL. Re-declaring an\n// application re-parenting verb would require, at minimum: a persisted ownership edge, an\n// approval flow for the flag to bypass, a custom implementation that writes the edge, and\n// audit/SIEM emission on both request and completion.\n//\n// APPLICATION STATUS LIFECYCLE IS INTENTIONALLY NOT A FRAMEWORK CAPABILITY EITHER.\n// `ACTIVATE` and `SUSPEND` were declared here as `APP_ADMIN_SUPER_ADMIN` verbs (`MEDIUM` and\n// `CRITICAL` respectively, both with a generated bulk variant) taking `{ reason }` and\n// `{ suspensionReason, notifyOwners }`. Like TRANSFER they were ROUTED but never implemented, so\n// each fell through to the generic core UPDATE and answered HTTP 200 having changed nothing —\n// an operator was told a CRITICAL application suspension had taken effect while the application\n// kept serving. Removed 2026-08-01, on grounds that compound with TRANSFER's:\n//\n// 1. NO FIELD TO WRITE — and no plausible one. `ApplicationSchema` is\n// `{_id, appSlug, appDisplayName, lastVersion, platformAppId}`: an identity row, carrying no\n// lifecycle state at all. There is nothing to transition.\n// 2. THE LIFECYCLE IS OWNED ONE TIER UP. An application's real operational state lives at the\n// platform tier (`PLATFORM_APPLICATIONS` / `Wildo_Application_Config`), provisioned and\n// managed by the platform apps-manager. This row is the in-app registry entry an application\n// reads to know its own identity — halting an application is a platform-tier action, not a\n// self-service field flip on the application's own copy of its name.\n// 3. SAME INVERTED OWNERSHIP AS TRANSFER (ground 3 above). `APPLICATION` is a top-level\n// `ResourcePrimaryScope`; suspending the tenant container from inside its own tenancy is\n// incoherent, and the suspending super-admin's own session lives in that container.\n//\n// The resource specification's framing — \"Created per org, managed by admins, and may be\n// transferred or suspended under governance\", with 409s for destination-org slug collisions —\n// describes a per-organization application marketplace. The framework does not implement one, and\n// inventing an `ApplicationStatus` to satisfy two unimplemented buttons would have built that\n// model backwards from its UI. Re-declaring these verbs requires the ownership model first.\n//\n// Applications consequently declare NO custom operations (hence the `undefined` custom-operation\n// type parameter below). See `.claude/plans/status-lifecycle-operations-analysis.md` and\n// the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n\nconst APPLICATION_SORT_FIELDS = ['appDisplayName', 'appSlug'];\n\nconst APPLICATION_FILTER_FIELDS = {\n appSlug: z.string(),\n appDisplayName: z.string(),\n};\n\ntype ApplicationCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE;\n\n/\nApplications Resource Configuration Factory\n/\nexport const applicationResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n undefined,\n ApplicationCoreOperations,\n typeof ApplicationSchema\n>({\n mainSchema: ApplicationSchema,\n resourceIdentifier: CoreResourceType.APPLICATION,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Applications are core system resources\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE\n ],\n\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can create applications\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // Use database definition so platformAppId and lastVersion are preserved\n // requestDto auto-derived from decorators\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can create applications for any org\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can view any application\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n /*\n ⚠️ NOTHING CONFINES THIS QUERY — and that is safe for a reason worth stating, because the\n * comment on the default variant used to imply a mechanism that does not exist.\n \n `applications` is its own scope ROOT, so both repositories blacklist the APPLICATIONS axis and\n * this LIST compiles to the EMPTY filter (measured 2026-08-12,\n * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep). The\n * old wording — \"Org members can list their applications\" — is exactly the shape of the claim\n * that was FALSE on `organizations` and cost a full tenant-isolation investigation, one role tier\n * higher.\n \n What makes it safe here is ARCHITECTURE, not a predicate: one database per application.\n * \"An application's organizations live in that application's own database\"\n * (`organizations.shared.schemas.ts`, on `slug` uniqueness), so this collection holds that\n * application's own row and a caller can only ever see the application they are already using.\n * Measured: an ordinary `ORG_MEMBER` receives 1 of 1 rows, projected to four summary fields.\n \n So the two variants below differ in ROLE, not in reach — `admin` exists for the fields and\n * operations it unlocks elsewhere, not because it sees more rows here.\n \n ⚠️ This rests on the one-database-per-application invariant. `CREATE` is super-admin gated, so\n * a second application row COULD be written into this database; if that ever becomes a real\n * deployment shape, this resource inherits the `organizations` defect at the `ORG_MEMBER` tier\n * and must be confined on `initiatorIds.applicationId`. Tracked as SEC-SCOPEROOT-3.\n */\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Unconfined by construction; safe because the collection holds this application only — see the block above\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can list all applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n // The application's own names (#1952): `name`/`description`/`slug` were never fields of an application.\n searchableFields: ['appDisplayName'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['appDisplayName', 'appSlug'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: APPLICATION_FILTER_FIELDS,\n sortFields: APPLICATION_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ]\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update their applications\n riskLevel: ResourceOperationRiskLevel.LOW,\n // requestDto auto-derived from decorators\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can update any application\n riskLevel: ResourceOperationRiskLevel.LOW,\n // requestDto auto-derived from decorators\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can delete their applications\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n // An APPLICATION is a top-level scope in this framework, not an org-owned artifact, so\n // deleting one destroys everything scoped beneath it. Same reasoning as\n // `ORGANIZATIONS \| DELETE`: `riskLevel` is UI-only and the per-user-type `stepUpAuth`\n // policy is opt-in, off by default, and freshness-satisfied — neither challenges the\n // caller here. Re-authentication itself accepts PASSWORD, an enrolled second factor\n // (TOTP or a backup code) and PASSKEY, so a directory-managed user whose local first\n // factor the framework destroys can still clear the gate through their second factor;\n // see the note on `ORGANIZATIONS \| DELETE` for how that came about.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n requiresStepUpAuthentication: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Super admins can delete any application\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-VARIANT flag — nothing is inherited from the default variant above.\n requiresStepUpAuthentication: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n }\n },\n\n});\n"]}

package/dist/esm/applications/applications.shared.schemas.d.ts CHANGED Viewed

@@ -3,12 +3,14 @@ export declare enum StaticFrontEndType {
     WEBSITE = "website",
     TECHNICAL_DOCUMENTATION = "technical_documentation"
 }
+/**
+ * The backend endpoints the runtime topology declares. One: the backend process binds exactly one port,
+ * and serves health, webhooks, the OAuth provider and MCP as routes on it. Four "sibling" members
+ * (health, webhook, OAuth, MCP at the API port minus 1..4) were removed with #1783 — nothing listened on
+ * any of them, so each was a URL that refused every connection.
+ */
 export declare enum BackendApiType {
-    MAIN_BACKEND_API = "main_backend_api",
-    HEALTH_CHECK_API = "health_check_api",
-    MAIN_WEBHOOK_API = "main_webhook_api",
-    OAUTH2_PROVIDER_API = "oauth2_provider_api",
-    MCP_API = "mcp_api"
+    MAIN_BACKEND_API = "main_backend_api"
 }
 /**
  * Background app-owned runtimes — kinds that an application owns but that
@@ -80,11 +82,12 @@ export declare const ApplicationSchema: z.ZodObject<{
     appDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     lastVersion: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     platformAppId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    ownerOrganizationSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
 }, z.core.$strip>;
 export type Application = z.infer<typeof ApplicationSchema>;
 export declare const ApplicationVersionSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    appId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     version: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     releaseDate: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
     releaseNotes: z.ZodString;
@@ -92,7 +95,7 @@ export declare const ApplicationVersionSchema: z.ZodObject<{
 export type ApplicationVersion = z.infer<typeof ApplicationVersionSchema>;
 export declare const ApplicationMetadataSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    appId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
     description: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodString>>>;
 }, z.core.$strip>;
 export type ApplicationMetadata = z.infer<typeof ApplicationMetadataSchema>;

package/dist/esm/applications/applications.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"applications.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;IACnB,uBAAuB,4BAA4B;CACpD;AAED,oBAAY,cAAc;IACxB,gBAAgB,qBAAqB;~~IACrC,gBAAgB,qBAAqB~~;~~IACrC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,OAAO,YAAY;CACpB;~~AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,4GAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,4KAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB~~;;;;;;iBAO5B~~,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,yBAAyB;;;;~~iBAwBpC~~,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
1	+ {"version":3,"file":"applications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;IACnB,uBAAuB,4BAA4B;CACpD;AAED;;;;;GAKG;AACH,oBAAY,cAAc;IACxB,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,4GAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,4KAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;iBAuC5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,yBAAyB;;;;iBA2BpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/applications/applications.shared.schemas.js CHANGED Viewed

@@ -4,13 +4,15 @@ export var StaticFrontEndType;
     StaticFrontEndType["WEBSITE"] = "website";
     StaticFrontEndType["TECHNICAL_DOCUMENTATION"] = "technical_documentation";
 })(StaticFrontEndType || (StaticFrontEndType = {}));
+/**
+ * The backend endpoints the runtime topology declares. One: the backend process binds exactly one port,
+ * and serves health, webhooks, the OAuth provider and MCP as routes on it. Four "sibling" members
+ * (health, webhook, OAuth, MCP at the API port minus 1..4) were removed with #1783 — nothing listened on
+ * any of them, so each was a URL that refused every connection.
+ */
 export var BackendApiType;
 (function (BackendApiType) {
     BackendApiType["MAIN_BACKEND_API"] = "main_backend_api";
-    BackendApiType["HEALTH_CHECK_API"] = "health_check_api";
-    BackendApiType["MAIN_WEBHOOK_API"] = "main_webhook_api";
-    BackendApiType["OAUTH2_PROVIDER_API"] = "oauth2_provider_api";
-    BackendApiType["MCP_API"] = "mcp_api";
 })(BackendApiType || (BackendApiType = {}));
 /**
  * Background app-owned runtimes — kinds that an application owns but that
@@ -89,10 +91,42 @@ export const ApplicationSchema = z.object({
     lastVersion: z.string().optional().excludeFromCreate().excludeFromUpdate(),
     // Backend-only field - stored in DB but never sent to frontend
     platformAppId: z.string().isDBIndexed().isBackendOnly(),
+    /**
+     * Serializes every decision about WHICH organization owns the application (#1054).
+     *
+     * ## The race it closes
+     *
+     * `organizations.promoteToOwnerOrganization` measures ("does an owner organization exist?") and
+     * then writes (`type`). Under snapshot isolation that is textbook WRITE SKEW: two operators
+     * promote two DIFFERENT organizations, each observes no owner, and both commit — producing the two
+     * owner organizations the whole design refuses, which neither was individually permitted to
+     * create. No amount of additional checking closes it: each transaction's view is internally
+     * consistent, and a re-measure after the write cannot see the other's uncommitted row.
+     *
+     * The remedy is to give the two transactions something to collide ON. The promotion bumps this
+     * token inside its transaction before measuring, so two of them touch the same document and the
+     * storage engine aborts the loser. Same mechanism, same reasoning, as
+     * `Organization.ownerFloorSerializationToken` — which is also where the trap is recorded: the
+     * write MUST carry `preserveServerInjectedFields` for this field, or the repository's strict
+     * re-parse silently strips it and the serialization protects nothing.
+     *
+     * ## Why the APPLICATION row and not an organization's
+     *
+     * The two racing promotions target DIFFERENT organizations, so neither organization's row is
+     * shared and colliding on one would serialize nothing. The APPLICATION row is the only row both
+     * transactions can be made to touch, and it is also the right subject semantically: the fact being
+     * protected is a property of the application ("it has one owner organization"), not of any tenant.
+     *
+     * The VALUE is irrelevant and nothing reads it, so a lost update here costs nothing; what matters
+     * is that the document is written at all. `.nullish()` because every existing application predates
+     * the field, and one that has never had a promotion legitimately has no token — absent and zero
+     * mean the same thing.
+     */
+    ownerOrganizationSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),
 });
 export const ApplicationVersionSchema = z.object({
     _id: z.string().isPrimaryKey().isSummaryField(),
-    appId: z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    applicationId: z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
     version: z.string().isDBIndexed().isSummaryField(),
     releaseDate: z.date().isDBIndexed().isSummaryField(),
     releaseNotes: z.string(),
@@ -113,11 +147,14 @@ export const ApplicationMetadataSchema = z.object({
      * a pure marker with no index, so two concurrent creates could otherwise leave
      * an application with two metadata rows, which no read path expects.
      *
-     * NB the field is named `appId`, not the canonical `applicationId` that every
-     * other APPLICATION-scoped resource uses. The relationship declares it, so the
-     * framework follows the declaration.
+     * The name is `applicationId`, matching the APPLICATION scope's registered field
+     * identifier and every other APPLICATION-scoped resource. It was `appId` until
+     * 2026-09-18, which silently excluded this resource — and its two siblings — from
+     * every mechanism keyed on that identifier, up to and including the settings panes
+     * that render it. See the APPLICATION_FEATURES edge in
+     * `resources-registry.shared.core.definitions.ts` for the measured consequences.
      */
-    appId: z.string().isDBIndexed().isForeignKey().isBusinessKey().isUnique().isSummaryField().excludeFromUpdate(),
+    applicationId: z.string().isDBIndexed().isForeignKey().isBusinessKey().isUnique().isSummaryField().excludeFromUpdate(),
     // `.default('')` so the row is eager-seedable via onParentCreate (placeholder;
     // the app sets a real description later) — root-cause fix for the blocking field.
     description: z.string().default('').isDBIndexed().isSummaryField(),

package/dist/esm/applications/applications.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"applications.shared.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,yEAAmD,CAAA;AACrD,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,uDAAqC,CAAA;IACrC,uDAAqC,CAAA;IACrC,uDAAqC,CAAA;IACrC,6DAA2C,CAAA;IAC3C,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;AACnB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1B,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,+BAA+B;IAC/B,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,OAAO,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,WAAW,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC3E,+DAA+D;IAC/D,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,KAAK,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACpF,OAAO,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnD,WAAW,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrD,YAAY,EAAG,CAAC,CAAC,MAAM,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC/G,+EAA+E;IAC/E,kFAAkF;IAClF,WAAW,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;CACtE,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nexport enum StaticFrontEndType {\n WEBSITE = 'website',\n TECHNICAL_DOCUMENTATION = 'technical_documentation',\n}\n\nexport enum BackendApiType {\n MAIN_BACKEND_API = 'main_backend_api',\n HEALTH_CHECK_API = 'health_check_api',\n MAIN_WEBHOOK_API = 'main_webhook_api',\n OAUTH2_PROVIDER_API = 'oauth2_provider_api',\n MCP_API = 'mcp_api',\n}\n\n/*\n Background app-owned runtimes — kinds that an application owns but that\n * do NOT serve user-facing requests directly (no public HTTP surface for\n * end-users, no rendered frontend).\n \n Introduced by the minions-and-workers plan\n * (`.claude/plans/minions-and-workers-implementation.md`, KD-9):\n \n - `MINION` — TS/Node single-instance process sharing the application\n * scope (Mongo / Redis / RabbitMQ); hosts the actor system; consumes\n * queue / cron ticks. Always-up or cron-triggered.\n * - `WORKER` — language-pluggable stateless HTTP subprocess (Rust / Node /\n * Java / …) called by the backend-api with a Wildo JWT. No backing\n * services; ClusterIP-only, no ingress.\n \n Deploy-time identity uses the `{kind, name}` vocabulary (`name` = the\n * `wildo.saas.config.ts` bucket key), surfaced in two forms — the\n * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` env pair and the\n * matching `wildo.ai/owned-service-{kind,name}` pod labels. WHICH forms a\n * kind carries, and how it consumes them, differs because their runtimes differ:\n \n - `WORKER` — language-pluggable, so a non-Node runtime (the reference Rust\n * worker) READS the `APP_OWNED_SERVICE_NAME` env var at boot and forwards\n * it as the apps-manager `worker-bootstrap` path segment\n * (`appConfig.workers[name]`). A Node worker instead hardcodes `workerName` in\n * `defineWorkerInit`; the env pair is still stamped on every worker deploy path\n * (k8s, docker-compose, CLI `.env`) for the language-agnostic case +\n * observability, alongside the matching pod labels.\n * - `MINION` — always Node, and sources its `minionName` from its compiled-in\n * `defineMinionInit({ minionName })` config (the minion package is\n * domain-specific by construction), cross-validated at boot against the\n * fetched `appConfig.minions[minionName]`. Because identity is a compile-time\n * fact, minions carry it ONLY as the `wildo.ai/owned-service-{kind,name}` pod\n * labels (operators, selectors, observability); the `APP_OWNED_SERVICE_`\n env pair is deliberately omitted on EVERY minion deploy path (k8s, CLI\n * `.env`, docker-compose), since an env identity would be a second,\n * drift-prone authority (see `env-configuration-generator.service.ts`).\n /\nexport enum BackgroundRuntimeType {\n MINION = 'minion',\n WORKER = 'worker',\n}\n\n/\n Schema for all shared (non-platform-private) application types.\n \n Interactive frontend surfaces are config-defined strings keyed by frontend\n * service identity via `frontendServices` in AppConfiguration, not an enum.\n * `z.string()` accepts those config-defined values alongside the known\n * static-frontend and backend-API enums.\n /\nexport const AllSharedApplicationTypesSchema = z.union([\n z.enum(StaticFrontEndType),\n z.enum(BackendApiType),\n z.string(),\n]);\nexport type AllSharedApplicationTypes = z.infer<typeof AllSharedApplicationTypesSchema>;\n\n/\n Full app-owned runtime identity surface: every primary application type\n * (`AllSharedApplicationTypesSchema` — backend kinds, static frontends,\n * dynamic-frontend keys) plus the background runtimes\n * (`BackgroundRuntimeType` — minions, workers).\n \n Use this where a process needs to declare what kind of app-owned\n * runtime it is without forcing every caller to switch on a coarse\n * vocabulary that overlaps the existing fine-grained enums.\n /\nexport const AllAppOwnedRuntimeTypesSchema = z.union([\n AllSharedApplicationTypesSchema,\n z.enum(BackgroundRuntimeType),\n]);\nexport type AllAppOwnedRuntimeTypes = z.infer<typeof AllAppOwnedRuntimeTypesSchema>;\n\nexport const ApplicationSchema = z.object({\n _id : z.string().isPrimaryKey().isSummaryField(),\n appSlug : z.string().isDBIndexed().isSummaryField().excludeFromUpdate(),\n appDisplayName : z.string().isDBIndexed().isSummaryField(),\n lastVersion : z.string().optional().excludeFromCreate().excludeFromUpdate(),\n // Backend-only field - stored in DB but never sent to frontend\n platformAppId : z.string().isDBIndexed().isBackendOnly(),\n});\nexport type Application = z.infer<typeof ApplicationSchema>;\n\nexport const ApplicationVersionSchema = z.object({\n _id : z.string().isPrimaryKey().isSummaryField(),\n appId : z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n version : z.string().isDBIndexed().isSummaryField(),\n releaseDate : z.date().isDBIndexed().isSummaryField(),\n releaseNotes : z.string(),\n});\nexport type ApplicationVersion = z.infer<typeof ApplicationVersionSchema>;\n\nexport const ApplicationMetadataSchema = z.object({\n _id : z.string().isPrimaryKey().isSummaryField(),\n /\n The owning application — and this row's BUSINESS IDENTITY.\n \n `APPLICATION → APPLICATION_METADATA` is 1:1, so \"the metadata of application X\"\n * identifies the row completely. Declaring that lets the framework's business-key\n * repository helpers address it: the app-init seed\n * (`engine-applications:application-metadata`) upserts through\n * `upsertByBusinessKey`, which refuses a schema that declares no identity —\n * \"Schema declares no business-key identity\" — rather than guessing one.\n \n `.isUnique()` carries the 1:1 down to the database. `.isBusinessKey()` alone is\n * a pure marker with no index, so two concurrent creates could otherwise leave\n * an application with two metadata rows, which no read path expects.\n \n NB the field is named `appId`, not the canonical `applicationId` that every\n * other APPLICATION-scoped resource uses. The relationship declares it, so the\n * framework follows the declaration.\n */\n appId : z.string().isDBIndexed().isForeignKey().isBusinessKey().isUnique().isSummaryField().excludeFromUpdate(),\n // `.default('')` so the row is eager-seedable via onParentCreate (placeholder;\n // the app sets a real description later) — root-cause fix for the blocking field.\n description : z.string().default('').isDBIndexed().isSummaryField(),\n});\nexport type ApplicationMetadata = z.infer<typeof ApplicationMetadataSchema>;\n"]}
1	+ {"version":3,"file":"applications.shared.schemas.js","sourceRoot":"","sources":["../../../../src/applications/applications.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,yEAAmD,CAAA;AACrD,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,cAEX;AAFD,WAAY,cAAc;IACxB,uDAAqC,CAAA;AACvC,CAAC,EAFW,cAAc,KAAd,cAAc,QAEzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;AACnB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1B,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,+BAA+B;IAC/B,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,OAAO,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,WAAW,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC3E,+DAA+D;IAC/D,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;IACxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,mCAAmC,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;CACtI,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5F,OAAO,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnD,WAAW,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrD,YAAY,EAAG,CAAC,CAAC,MAAM,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvH,+EAA+E;IAC/E,kFAAkF;IAClF,WAAW,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;CACtE,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nexport enum StaticFrontEndType {\n WEBSITE = 'website',\n TECHNICAL_DOCUMENTATION = 'technical_documentation',\n}\n\n/*\n The backend endpoints the runtime topology declares. One: the backend process binds exactly one port,\n * and serves health, webhooks, the OAuth provider and MCP as routes on it. Four \"sibling\" members\n * (health, webhook, OAuth, MCP at the API port minus 1..4) were removed with #1783 — nothing listened on\n * any of them, so each was a URL that refused every connection.\n /\nexport enum BackendApiType {\n MAIN_BACKEND_API = 'main_backend_api',\n}\n\n/\n Background app-owned runtimes — kinds that an application owns but that\n * do NOT serve user-facing requests directly (no public HTTP surface for\n * end-users, no rendered frontend).\n \n Introduced by the minions-and-workers plan\n * (`.claude/plans/minions-and-workers-implementation.md`, KD-9):\n \n - `MINION` — TS/Node single-instance process sharing the application\n * scope (Mongo / Redis / RabbitMQ); hosts the actor system; consumes\n * queue / cron ticks. Always-up or cron-triggered.\n * - `WORKER` — language-pluggable stateless HTTP subprocess (Rust / Node /\n * Java / …) called by the backend-api with a Wildo JWT. No backing\n * services; ClusterIP-only, no ingress.\n \n Deploy-time identity uses the `{kind, name}` vocabulary (`name` = the\n * `wildo.saas.config.ts` bucket key), surfaced in two forms — the\n * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` env pair and the\n * matching `wildo.ai/owned-service-{kind,name}` pod labels. WHICH forms a\n * kind carries, and how it consumes them, differs because their runtimes differ:\n \n - `WORKER` — language-pluggable, so a non-Node runtime (the reference Rust\n * worker) READS the `APP_OWNED_SERVICE_NAME` env var at boot and forwards\n * it as the apps-manager `worker-bootstrap` path segment\n * (`appConfig.workers[name]`). A Node worker instead hardcodes `workerName` in\n * `defineWorkerInit`; the env pair is still stamped on every worker deploy path\n * (k8s, docker-compose, CLI `.env`) for the language-agnostic case +\n * observability, alongside the matching pod labels.\n * - `MINION` — always Node, and sources its `minionName` from its compiled-in\n * `defineMinionInit({ minionName })` config (the minion package is\n * domain-specific by construction), cross-validated at boot against the\n * fetched `appConfig.minions[minionName]`. Because identity is a compile-time\n * fact, minions carry it ONLY as the `wildo.ai/owned-service-{kind,name}` pod\n * labels (operators, selectors, observability); the `APP_OWNED_SERVICE_`\n env pair is deliberately omitted on EVERY minion deploy path (k8s, CLI\n * `.env`, docker-compose), since an env identity would be a second,\n * drift-prone authority (see `env-configuration-generator.service.ts`).\n /\nexport enum BackgroundRuntimeType {\n MINION = 'minion',\n WORKER = 'worker',\n}\n\n/\n Schema for all shared (non-platform-private) application types.\n \n Interactive frontend surfaces are config-defined strings keyed by frontend\n * service identity via `frontendServices` in AppConfiguration, not an enum.\n * `z.string()` accepts those config-defined values alongside the known\n * static-frontend and backend-API enums.\n /\nexport const AllSharedApplicationTypesSchema = z.union([\n z.enum(StaticFrontEndType),\n z.enum(BackendApiType),\n z.string(),\n]);\nexport type AllSharedApplicationTypes = z.infer<typeof AllSharedApplicationTypesSchema>;\n\n/\n Full app-owned runtime identity surface: every primary application type\n * (`AllSharedApplicationTypesSchema` — backend kinds, static frontends,\n * dynamic-frontend keys) plus the background runtimes\n * (`BackgroundRuntimeType` — minions, workers).\n \n Use this where a process needs to declare what kind of app-owned\n * runtime it is without forcing every caller to switch on a coarse\n * vocabulary that overlaps the existing fine-grained enums.\n /\nexport const AllAppOwnedRuntimeTypesSchema = z.union([\n AllSharedApplicationTypesSchema,\n z.enum(BackgroundRuntimeType),\n]);\nexport type AllAppOwnedRuntimeTypes = z.infer<typeof AllAppOwnedRuntimeTypesSchema>;\n\nexport const ApplicationSchema = z.object({\n _id : z.string().isPrimaryKey().isSummaryField(),\n appSlug : z.string().isDBIndexed().isSummaryField().excludeFromUpdate(),\n appDisplayName : z.string().isDBIndexed().isSummaryField(),\n lastVersion : z.string().optional().excludeFromCreate().excludeFromUpdate(),\n // Backend-only field - stored in DB but never sent to frontend\n platformAppId : z.string().isDBIndexed().isBackendOnly(),\n /\n Serializes every decision about WHICH organization owns the application (#1054).\n \n ## The race it closes\n \n `organizations.promoteToOwnerOrganization` measures (\"does an owner organization exist?\") and\n * then writes (`type`). Under snapshot isolation that is textbook WRITE SKEW: two operators\n * promote two DIFFERENT organizations, each observes no owner, and both commit — producing the two\n * owner organizations the whole design refuses, which neither was individually permitted to\n * create. No amount of additional checking closes it: each transaction's view is internally\n * consistent, and a re-measure after the write cannot see the other's uncommitted row.\n \n The remedy is to give the two transactions something to collide ON. The promotion bumps this\n * token inside its transaction before measuring, so two of them touch the same document and the\n * storage engine aborts the loser. Same mechanism, same reasoning, as\n * `Organization.ownerFloorSerializationToken` — which is also where the trap is recorded: the\n * write MUST carry `preserveServerInjectedFields` for this field, or the repository's strict\n * re-parse silently strips it and the serialization protects nothing.\n \n ## Why the APPLICATION row and not an organization's\n \n The two racing promotions target DIFFERENT organizations, so neither organization's row is\n * shared and colliding on one would serialize nothing. The APPLICATION row is the only row both\n * transactions can be made to touch, and it is also the right subject semantically: the fact being\n * protected is a property of the application (\"it has one owner organization\"), not of any tenant.\n \n The VALUE is irrelevant and nothing reads it, so a lost update here costs nothing; what matters\n * is that the document is written at all. `.nullish()` because every existing application predates\n * the field, and one that has never had a promotion legitimately has no token — absent and zero\n * mean the same thing.\n /\n ownerOrganizationSerializationToken : z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n});\nexport type Application = z.infer<typeof ApplicationSchema>;\n\nexport const ApplicationVersionSchema = z.object({\n _id : z.string().isPrimaryKey().isSummaryField(),\n applicationId : z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n version : z.string().isDBIndexed().isSummaryField(),\n releaseDate : z.date().isDBIndexed().isSummaryField(),\n releaseNotes : z.string(),\n});\nexport type ApplicationVersion = z.infer<typeof ApplicationVersionSchema>;\n\nexport const ApplicationMetadataSchema = z.object({\n _id : z.string().isPrimaryKey().isSummaryField(),\n /\n The owning application — and this row's BUSINESS IDENTITY.\n \n `APPLICATION → APPLICATION_METADATA` is 1:1, so \"the metadata of application X\"\n * identifies the row completely. Declaring that lets the framework's business-key\n * repository helpers address it: the app-init seed\n * (`engine-applications:application-metadata`) upserts through\n * `upsertByBusinessKey`, which refuses a schema that declares no identity —\n * \"Schema declares no business-key identity\" — rather than guessing one.\n \n `.isUnique()` carries the 1:1 down to the database. `.isBusinessKey()` alone is\n * a pure marker with no index, so two concurrent creates could otherwise leave\n * an application with two metadata rows, which no read path expects.\n \n The name is `applicationId`, matching the APPLICATION scope's registered field\n * identifier and every other APPLICATION-scoped resource. It was `appId` until\n * 2026-09-18, which silently excluded this resource — and its two siblings — from\n * every mechanism keyed on that identifier, up to and including the settings panes\n * that render it. See the APPLICATION_FEATURES edge in\n * `resources-registry.shared.core.definitions.ts` for the measured consequences.\n */\n applicationId : z.string().isDBIndexed().isForeignKey().isBusinessKey().isUnique().isSummaryField().excludeFromUpdate(),\n // `.default('')` so the row is eager-seedable via onParentCreate (placeholder;\n // the app sets a real description later) — root-cause fix for the blocking field.\n description : z.string().default('').isDBIndexed().isSummaryField(),\n});\nexport type ApplicationMetadata = z.infer<typeof ApplicationMetadataSchema>;\n"]}

package/dist/esm/billing/billing-account.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -15,19 +15,27 @@ export declare enum BillingAccount_Operations {
     /** Open the Stripe Customer Portal for self-service management */
     OPEN_PORTAL = "open_portal",
     /** Fetch aggregated billing state (account, subscription, products, prices, credit pools) */
-    GET_STATE = "get_state"
+    GET_STATE = "get_state",
+    /**
+     * Redeem another account's referral code (#1802). Only a new customer may: an account that has never
+     * subscribed, is not already referred, and is not the referrer.
+     */
+    REDEEM_REFERRAL = "redeem_referral"
 }
-/** Request DTO for OPEN_CHECKOUT operation */
+/** Request DTO for OPEN_CHECKOUT. Trial duration is server-owned product/application policy, never a payer option. */
 export declare const BillingAccount_OpenCheckoutRequestDto: z.ZodObject<{
     productKey: z.ZodString;
     priceId: z.ZodString;
     successUrl: z.ZodURL;
     cancelUrl: z.ZodURL;
     quantity: z.ZodDefault<z.ZodNumber>;
-    trialDays: z.ZodOptional<z.ZodNumber>;
     promotionCode: z.ZodOptional<z.ZodString>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
+/** Request DTO for REDEEM_REFERRAL (#1802). */
+export declare const BillingAccount_RedeemReferralRequestDto: z.ZodObject<{
+    referralCode: z.ZodString;
+}, z.core.$strict>;
 /** Request DTO for OPEN_PORTAL operation */
 export declare const BillingAccount_OpenPortalRequestDto: z.ZodObject<{
     returnUrl: z.ZodURL;

package/dist/esm/billing/billing-account.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"billing-account.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;~~AAgBzG~~,oBAAY,yBAAyB;IACnC,wEAAwE;IACxE,aAAa,kBAAkB;IAC/B,kEAAkE;IAClE,WAAW,gBAAgB;IAC3B,6FAA6F;IAC7F,SAAS,cAAc;~~CACxB~~;AAID,~~8CAA8C~~;~~AAC9C~~,eAAO,MAAM,qCAAqC~~;;;;;;;;;iBAqChD~~,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,~~2SAiM~~/C,CAAC"}
1	+ {"version":3,"file":"billing-account.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-account.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAiBzG,oBAAY,yBAAyB;IACnC,wEAAwE;IACxE,aAAa,kBAAkB;IAC/B,kEAAkE;IAClE,WAAW,gBAAgB;IAC3B,6FAA6F;IAC7F,SAAS,cAAc;IACvB;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAID,sHAAsH;AACtH,eAAO,MAAM,qCAAqC;;;;;;;;iBAoChD,CAAC;AAEH,+CAA+C;AAC/C,eAAO,MAAM,uCAAuC;;kBAElD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAMH;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,2SAyN/C,CAAC"}

package/dist/esm/billing/billing-account.shared.resources-config.schemas.js CHANGED Viewed

@@ -13,7 +13,8 @@ import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../re
 import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
-import { BILLING_CHECKOUT_MAX_QUANTITY, BILLING_RESERVED_METADATA_KEY_PREFIX } from './billing-enums.shared.schemas.js';
+import { BILLING_CHECKOUT_MAX_QUANTITY, BILLING_RESERVED_METADATA_KEY_PREFIX, ReferralStatus } from './billing-enums.shared.schemas.js';
+import { ReferredRewardSchema } from './referral-reward.shared.schemas.js';
 import { billingAccountsPolymorphicDeclaration } from './billing-account.shared.schemas.js';
 import { BillingStateResponseSchema } from './billing-types.shared.schemas.js';
 import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
@@ -27,22 +28,26 @@ export var BillingAccount_Operations;
     BillingAccount_Operations["OPEN_PORTAL"] = "open_portal";
     /** Fetch aggregated billing state (account, subscription, products, prices, credit pools) */
     BillingAccount_Operations["GET_STATE"] = "get_state";
+    /**
+     * Redeem another account's referral code (#1802). Only a new customer may: an account that has never
+     * subscribed, is not already referred, and is not the referrer.
+     */
+    BillingAccount_Operations["REDEEM_REFERRAL"] = "redeem_referral";
 })(BillingAccount_Operations || (BillingAccount_Operations = {}));
 // ── Request DTOs ─────────────────────────────────────────────────────
-/** Request DTO for OPEN_CHECKOUT operation */
+/** Request DTO for OPEN_CHECKOUT. Trial duration is server-owned product/application policy, never a payer option. */
 export const BillingAccount_OpenCheckoutRequestDto = z.object({
-    productKey: z.string().min(1),
-    priceId: z.string().min(1),
-    successUrl: z.url(),
-    cancelUrl: z.url(),
+    productKey: z.string().min(1).describe("The key of the product to buy. It must be available for purchase and offered to this account's scope."),
+    priceId: z.string().min(1).describe("The id of the price to buy the product at. It must be a price of that product."),
+    successUrl: z.url().describe("Where the billing provider sends the customer after a completed checkout."),
+    cancelUrl: z.url().describe("Where the billing provider sends the customer if they leave checkout without paying."),
     /**
      * Bounded by the same constant the webhook consumer honours. An unbounded quantity here would be
      * billed by the provider and then refused on the way back in, charging the customer for credits
      * that never arrive.
      */
-    quantity: z.number().int().min(1).max(BILLING_CHECKOUT_MAX_QUANTITY).default(1),
-    trialDays: z.number().min(0).optional(),
-    promotionCode: z.string().optional(),
+    quantity: z.number().int().min(1).max(BILLING_CHECKOUT_MAX_QUANTITY).default(1).describe("How many units to buy, such as seats or credit packs. Defaults to 1."),
+    promotionCode: z.string().optional().describe("A promotion code to apply. It is checked before checkout opens, and refused when it is unknown, inactive, outside its validity dates, used up, not valid for this product, or not set up with the billing provider. The checkout page accepts no code of its own."),
     /**
      * Caller-supplied tags mirrored to the provider for the application's own analytics or
      * reconciliation. They carry NO authority.
@@ -62,9 +67,13 @@ export const BillingAccount_OpenCheckoutRequestDto = z.object({
         .record(z.string().refine((key) => !key.startsWith(BILLING_RESERVED_METADATA_KEY_PREFIX), `Metadata keys starting with "${BILLING_RESERVED_METADATA_KEY_PREFIX}" are reserved by the framework and cannot be supplied by the caller`), z.string())
         .optional(),
 });
+/** Request DTO for REDEEM_REFERRAL (#1802). */
+export const BillingAccount_RedeemReferralRequestDto = z.strictObject({
+    referralCode: z.string().trim().min(1).max(64).describe('The referral code to redeem, as the referrer shared it.'),
+});
 /** Request DTO for OPEN_PORTAL operation */
 export const BillingAccount_OpenPortalRequestDto = z.object({
-    returnUrl: z.url(),
+    returnUrl: z.url().describe('Absolute URL the billing portal sends the customer back to when they leave it.'),
 });
 // =============================================================================
 // POLYMORPHIC FACTORY — 2 variants (org, user)
@@ -170,8 +179,8 @@ export const billingAccountsPolymorphicFactories = createPolymorphicResourceConf
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],
+                        [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 }],
@@ -192,8 +201,8 @@ export const billingAccountsPolymorphicFactories = createPolymorphicResourceConf
                     variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],
+                        [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],
                     },
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                 }],
@@ -224,8 +233,32 @@ export const billingAccountsPolymorphicFactories = createPolymorphicResourceConf
                     // session, NOT the billing-account resource. Without this the DTO builder
                     // would validate the service output against the resource schema and 500.
                     customResponseDto: z.object({
-                        url: z.url(),
-                        sessionId: z.string(),
+                        url: z.url().describe("The billing provider's hosted checkout page. Send the customer there to pay."),
+                        sessionId: z.string().describe("The billing provider's id for this checkout session."),
+                    }),
+                }],
+        },
+        /*
+         * #1802 — the account that was referred redeems the code. Refusals are the ones a person can act on:
+         * an unusable code, and an account that cannot be referred. The rewards are the referrer's policy,
+         * copied when the code was issued, and are reported back so the purchase screen can show them.
+         */
+        [BillingAccount_Operations.REDEEM_REFERRAL]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: BillingAccount_RedeemReferralRequestDto,
+                    // Returns the redemption, not the billing account.
+                    customResponseDto: z.object({
+                        referralId: z.string().describe('The id of the referral that was redeemed.'),
+                        status: z.enum(ReferralStatus).systemEnum('ReferralStatus').describe('`accepted`: the account is now the referred side, and the rewards are granted when it pays its first invoice.'),
+                        referredReward: ReferredRewardSchema.optional().describe('What this account receives. Absent when the referral gives the referred side nothing.'),
                     }),
                 }],
         },
@@ -243,7 +276,7 @@ export const billingAccountsPolymorphicFactories = createPolymorphicResourceConf
                     // Borrows READ for its route/verb but returns the provider portal
                     // redirect URL, NOT the billing-account resource.
                     customResponseDto: z.object({
-                        url: z.url(),
+                        url: z.url().describe("The billing provider's customer portal, where the customer manages their billing. Send the customer there; the portal links back to `returnUrl`."),
                     }),
                 }],
         },