@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/inbound/inbound-delivery.shared.resources-config.schemas.js

@@ -0,0 +1,169 @@
+/**
+ * Inbound delivery resource configuration — polymorphic over ORGANIZATION and APPLICATION (#1596).
+ *
+ * Operation set:
+ *   - READ / LIST / SEARCH (API)      : an administrator of the scope browses deliveries, filters by status
+ *   - CREATE / UPDATE (REPOSITORY_ONLY): the inbound pipeline and its worker only — never an HTTP surface
+ *   - DELETE / DELETE_MANY (REPOSITORY_ONLY): the retention sweep's door (#1613); no API delete, so the
+ *                                        operator's log cannot be edited
+ *   - REPLAY (custom, API)             : move ONE `DEAD` delivery back to `RECEIVED`, with a written
+ *                                        justification that is stored on the row and on the audit trail
+ *
+ * Roles mirror the outbound delivery log: the organization's administrator for its own deliveries,
+ * the application's super-administrator for application-scope ones.
+ */
+import { z } from 'zod';
+import { CoreResourceOperation, CoreResourceType, } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../resources/resources.shared.schemas.js';
+import { createPaginationResponseMetadataSchema, DEFAULT_LIST_PAGE_CEILING, DEFAULT_SEARCH_PAGE_CEILING } from '../resources/resources-config.shared.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas.js';
+import { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory.js';
+import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { inboundDeliveryPolymorphicDeclaration, InboundDeliveryStatus, InboundSourceKind, } from './inbound-delivery.shared.schemas.js';
+export var InboundDelivery_Operations;
+(function (InboundDelivery_Operations) {
+    /**
+     * Put a `DEAD` delivery back to `RECEIVED` so the worker runs its handler again. Refused for any
+     * other status (a processed delivery must not run twice; an unroutable one has no scope to run in).
+     */
+    InboundDelivery_Operations["REPLAY"] = "replay";
+})(InboundDelivery_Operations || (InboundDelivery_Operations = {}));
+/**
+ * The only thing a replay needs from the operator is WHY. The row is addressed by the route, so the
+ * body cannot name a second one.
+ */
+export const InboundDelivery_ReplayRequestDto = z.strictObject({
+    justification: z
+        .string()
+        .trim()
+        .min(1)
+        .max(2000)
+        .describe('Why the delivery is being replayed — for example, the fix that makes the handler succeed now. Required, 1 to 2000 characters; stored on the delivery and on the audit trail.'),
+});
+/**
+ * What a COLLECTION read returns: every field of the variant but the raw payload. The payload can carry
+ * personal data and runs to 256 KB, so it is returned one delivery at a time (READ), never a page at a
+ * time. The list screens already use SUMMARY mode, which never included it; this closes the RAW-mode API
+ * read as well.
+ *
+ * Built from the VARIANT's schema, not the shared base, so each page keeps its scope foreign key
+ * (`organizationId` / `applicationId`). What this does NOT do: keep the column out of the query. The
+ * repository projection is not derived from a paginated envelope, so the payload is still read and then
+ * dropped by the response parse — the wire never carries it, the database round trip still does.
+ */
+function inboundDeliveryCollectionItemSchema(variantSchema) {
+    return variantSchema.omit({ rawBody: true });
+}
+/** LIST's page: each operation keeps its own page ceiling, so request, repository and response agree. */
+export function inboundDeliveryListResponseDto(variantSchema) {
+    return z.object({
+        data: z.array(inboundDeliveryCollectionItemSchema(variantSchema)),
+        pagination: createPaginationResponseMetadataSchema(DEFAULT_LIST_PAGE_CEILING),
+    });
+}
+/** SEARCH's page, at SEARCH's ceiling. */
+export function inboundDeliverySearchResponseDto(variantSchema) {
+    return z.object({
+        data: z.array(inboundDeliveryCollectionItemSchema(variantSchema)),
+        pagination: createPaginationResponseMetadataSchema(DEFAULT_SEARCH_PAGE_CEILING),
+    });
+}
+const ADMIN_ROLES = {
+    [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+    [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+};
+export const inboundDeliveryPolymorphicFactories = createPolymorphicResourceConfigurations(inboundDeliveryPolymorphicDeclaration, {
+    isSystemResource: true,
+    customOperation: InboundDelivery_Operations,
+    /*
+     * Kept for the application's declared OPERATIONAL_LOGS period, counted from the moment the delivery
+     * reached a terminal status (#1596, #1613). The row holds the sender's raw payload, which can carry
+     * personal data, so it must not outlive the period the privacy notice states. CLOSURE_EVENT on
+     * `terminalAt` rather than CREATED: a delivery still RECEIVED or waiting for a retry is live work, and
+     * a replay clears `terminalAt`, so a replayed delivery's clock restarts when it settles again.
+     */
+    retentionBinding: {
+        retentionClass: DataRetentionClass.OPERATIONAL_LOGS,
+        startPoint: RetentionStartPoint.CLOSURE_EVENT,
+        closureFieldName: 'terminalAt',
+    },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.SEARCH,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE,
+        CoreResourceOperation.DELETE,
+        CoreResourceOperation.DELETE_MANY,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.LOW, polymorphicCustomResponseDto: inboundDeliveryListResponseDto },
+            ],
+        },
+        [CoreResourceOperation.SEARCH]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: ADMIN_ROLES,
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    isSearchable: true,
+                    searchableFields: ['sourceKey', 'handlerRef', 'dedupKey'],
+                    filterFields: {
+                        status: z.enum(InboundDeliveryStatus).systemEnum('InboundDeliveryStatus'),
+                        sourceKind: z.enum(InboundSourceKind).systemEnum('InboundSourceKind'),
+                        handlerRef: z.string(),
+                        receivedAt: z.date(),
+                    },
+                    sortFields: ['receivedAt', 'status'],
+                    polymorphicCustomResponseDto: inboundDeliverySearchResponseDto,
+                },
+            ],
+        },
+        // The pipeline writes rows; the worker drives the status machine. Neither is an HTTP surface.
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+        // The retention sweep's door (#1613). INTERNAL_CALL, not REPOSITORY_ONLY: the sweep deletes through
+        // the service layer and only an internal-call variant resolves there. It is route-less, so no API can
+        // delete a delivery. HIGH because it removes evidence.
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.HIGH },
+            ],
+        },
+        [CoreResourceOperation.DELETE_MANY]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.HIGH },
+            ],
+        },
+        [InboundDelivery_Operations.REPLAY]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: ADMIN_ROLES,
+                    // A replay runs application code again on a stored message, with the handler's authority.
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: InboundDelivery_ReplayRequestDto,
+                },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=inbound-delivery.shared.resources-config.schemas.js.map

package/dist/esm/inbound/inbound-delivery.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-delivery.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/inbound/inbound-delivery.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,sCAAsC,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC9J,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAClH,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EACL,qCAAqC,EACrC,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,CAAN,IAAY,0BAMX;AAND,WAAY,0BAA0B;IACpC;;;OAGG;IACH,+CAAiB,CAAA;AACnB,CAAC,EANW,0BAA0B,KAA1B,0BAA0B,QAMrC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,CAAC,8KAA8K,CAAC;CAC5L,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,SAAS,mCAAmC,CAAC,aAA2B;IACtE,OAAQ,aAA4C,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,8BAA8B,CAAC,aAA2B;IACxE,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;QACjE,UAAU,EAAE,sCAAsC,CAAC,yBAAyB,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,gCAAgC,CAAC,aAA2B;IAC1E,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;QACjE,UAAU,EAAE,sCAAsC,CAAC,2BAA2B,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,0BAA0B;IAC3C;;;;;;OAMG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,gBAAgB;QACnD,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,YAAY;KAC/B;IACD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACjJ;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,4BAA4B,EAAE,8BAA8B,EAAE;aAC/M;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,WAAW;oBAC5B,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;oBACzD,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;wBACzE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;wBACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;wBACtB,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;qBACrB;oBACD,UAAU,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAU;oBAC7C,4BAA4B,EAAE,gCAAgC;iBAC/D;aACF;SACF;QACD,8FAA8F;QAC9F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACxJ;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACxJ;SACF;QACD,oGAAoG;QACpG,sGAAsG;QACtG,uDAAuD;QACvD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;aACvJ;SACF;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;aACvJ;SACF;QACD,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,WAAW;oBAC5B,0FAA0F;oBAC1F,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;iBAC7C;aACF;SACF;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Inbound delivery resource configuration — polymorphic over ORGANIZATION and APPLICATION (#1596).\n *\n * Operation set:\n *   - READ / LIST / SEARCH (API)      : an administrator of the scope browses deliveries, filters by status\n *   - CREATE / UPDATE (REPOSITORY_ONLY): the inbound pipeline and its worker only — never an HTTP surface\n *   - DELETE / DELETE_MANY (REPOSITORY_ONLY): the retention sweep's door (#1613); no API delete, so the\n *                                        operator's log cannot be edited\n *   - REPLAY (custom, API)             : move ONE `DEAD` delivery back to `RECEIVED`, with a written\n *                                        justification that is stored on the row and on the audit trail\n *\n * Roles mirror the outbound delivery log: the organization's administrator for its own deliveries,\n * the application's super-administrator for application-scope ones.\n */\nimport { z } from 'zod';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPaginationResponseMetadataSchema, DEFAULT_LIST_PAGE_CEILING, DEFAULT_SEARCH_PAGE_CEILING } from '../resources/resources-config.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport {\n  inboundDeliveryPolymorphicDeclaration,\n  InboundDeliveryStatus,\n  InboundSourceKind,\n} from './inbound-delivery.shared.schemas';\n\nexport enum InboundDelivery_Operations {\n  /**\n   * Put a `DEAD` delivery back to `RECEIVED` so the worker runs its handler again. Refused for any\n   * other status (a processed delivery must not run twice; an unroutable one has no scope to run in).\n   */\n  REPLAY = 'replay',\n}\n\n/**\n * The only thing a replay needs from the operator is WHY. The row is addressed by the route, so the\n * body cannot name a second one.\n */\nexport const InboundDelivery_ReplayRequestDto = z.strictObject({\n  justification: z\n    .string()\n    .trim()\n    .min(1)\n    .max(2000)\n    .describe('Why the delivery is being replayed — for example, the fix that makes the handler succeed now. Required, 1 to 2000 characters; stored on the delivery and on the audit trail.'),\n});\n\n/**\n * What a COLLECTION read returns: every field of the variant but the raw payload. The payload can carry\n * personal data and runs to 256 KB, so it is returned one delivery at a time (READ), never a page at a\n * time. The list screens already use SUMMARY mode, which never included it; this closes the RAW-mode API\n * read as well.\n *\n * Built from the VARIANT's schema, not the shared base, so each page keeps its scope foreign key\n * (`organizationId` / `applicationId`). What this does NOT do: keep the column out of the query. The\n * repository projection is not derived from a paginated envelope, so the payload is still read and then\n * dropped by the response parse — the wire never carries it, the database round trip still does.\n */\nfunction inboundDeliveryCollectionItemSchema(variantSchema: z.ZodTypeAny): z.ZodTypeAny {\n  return (variantSchema as z.ZodObject<z.ZodRawShape>).omit({ rawBody: true });\n}\n\n/** LIST's page: each operation keeps its own page ceiling, so request, repository and response agree. */\nexport function inboundDeliveryListResponseDto(variantSchema: z.ZodTypeAny): z.ZodTypeAny {\n  return z.object({\n    data: z.array(inboundDeliveryCollectionItemSchema(variantSchema)),\n    pagination: createPaginationResponseMetadataSchema(DEFAULT_LIST_PAGE_CEILING),\n  });\n}\n\n/** SEARCH's page, at SEARCH's ceiling. */\nexport function inboundDeliverySearchResponseDto(variantSchema: z.ZodTypeAny): z.ZodTypeAny {\n  return z.object({\n    data: z.array(inboundDeliveryCollectionItemSchema(variantSchema)),\n    pagination: createPaginationResponseMetadataSchema(DEFAULT_SEARCH_PAGE_CEILING),\n  });\n}\n\nconst ADMIN_ROLES = {\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\nexport const inboundDeliveryPolymorphicFactories = createPolymorphicResourceConfigurations(\n  inboundDeliveryPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: InboundDelivery_Operations,\n    /*\n     * Kept for the application's declared OPERATIONAL_LOGS period, counted from the moment the delivery\n     * reached a terminal status (#1596, #1613). The row holds the sender's raw payload, which can carry\n     * personal data, so it must not outlive the period the privacy notice states. CLOSURE_EVENT on\n     * `terminalAt` rather than CREATED: a delivery still RECEIVED or waiting for a retry is live work, and\n     * a replay clears `terminalAt`, so a replayed delivery's clock restarts when it settles again.\n     */\n    retentionBinding: {\n      retentionClass: DataRetentionClass.OPERATIONAL_LOGS,\n      startPoint: RetentionStartPoint.CLOSURE_EVENT,\n      closureFieldName: 'terminalAt',\n    },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.LOW, polymorphicCustomResponseDto: inboundDeliveryListResponseDto },\n        ],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            polymorphicRole: ADMIN_ROLES,\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            isSearchable: true,\n            searchableFields: ['sourceKey', 'handlerRef', 'dedupKey'],\n            filterFields: {\n              status: z.enum(InboundDeliveryStatus).systemEnum('InboundDeliveryStatus'),\n              sourceKind: z.enum(InboundSourceKind).systemEnum('InboundSourceKind'),\n              handlerRef: z.string(),\n              receivedAt: z.date(),\n            },\n            sortFields: ['receivedAt', 'status'] as const,\n            polymorphicCustomResponseDto: inboundDeliverySearchResponseDto,\n          },\n        ],\n      },\n      // The pipeline writes rows; the worker drives the status machine. Neither is an HTTP surface.\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.REPOSITORY_ONLY, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      // The retention sweep's door (#1613). INTERNAL_CALL, not REPOSITORY_ONLY: the sweep deletes through\n      // the service layer and only an internal-call variant resolves there. It is route-less, so no API can\n      // delete a delivery. HIGH because it removes evidence.\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.HIGH },\n        ],\n      },\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, polymorphicRole: ADMIN_ROLES, riskLevel: ResourceOperationRiskLevel.HIGH },\n        ],\n      },\n      [InboundDelivery_Operations.REPLAY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            polymorphicRole: ADMIN_ROLES,\n            // A replay runs application code again on a stored message, with the handler's authority.\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: InboundDelivery_ReplayRequestDto,\n          },\n        ],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/inbound/inbound-delivery.shared.schemas.d.ts

@@ -0,0 +1,404 @@
+/**
+ * Inbound deliveries — the durable record of every verified message an application RECEIVED from
+ * another system, and the named vocabularies the inbound pipeline speaks (#1596).
+ *
+ * ## What an inbound delivery is
+ *
+ * A webhook POST (or, later, another inbound channel) that arrived at the application, passed
+ * signature verification, and was written here BEFORE anything acted on it. The row is three things
+ * at once, like its outbound twin `m2mWebhookDeliveryLog`:
+ *
+ *  1. the DEDUPLICATION LEDGER — `(sourceKey, dedupKey)` is unique, so one provider event causes at
+ *     most one handler run however many times the provider retries it (a Redis claim cannot promise
+ *     that: its TTL is shorter than a provider's retry window — Stripe retries for three days);
+ *  2. the WORK QUEUE the dispatch worker drains — `status` + `nextAttemptAt`;
+ *  3. the OPERATOR'S LOG — an administrator lists deliveries, sees why one is `DEAD`, and replays it.
+ *
+ * ## Why it is polymorphic over ORGANIZATION and APPLICATION
+ *
+ * A delivery's payload usually carries a client organization's personal data. Storing the row in its
+ * resolved organization's variant means it is erased with that organization (COMPOSITION,
+ * `onParentDelete: IMMEDIATE`) and is visible to that organization's administrator — the same
+ * tenant-segregation argument as the outbound delivery log. A delivery that resolves to no
+ * organization (an APPLICATION-scope handler, or an `UNROUTABLE` delivery) lives in the application
+ * variant.
+ *
+ * The consequence, stated rather than hidden: the two variants are two tables, so the unique index is
+ * per variant. The pipeline therefore resolves scope BEFORE inserting, and checks the other variant
+ * for the same key first. See `inbound-delivery-store.backend.service.ts` for the residual that
+ * leaves (two concurrent copies of one event resolving to different scopes in the same instant).
+ *
+ * @see engine/saas-models/src/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts — the
+ *   outbound twin this is modelled on.
+ */
+import { z } from 'zod';
+import { InboundChannelKind, InboundSenderAssurance } from './inbound-channels.shared.schemas';
+/**
+ * Where an inbound delivery came from — decides which route receives it and who owns its
+ * verification.
+ */
+export declare enum InboundSourceKind {
+    /**
+     * A PROVIDER declared the endpoint (`Hook_Endpoint` under `WEBHOOK_ORIGINATOR`) and owns its
+     * verification — Stripe's SDK `constructEvent`, for one. Route: `POST /webhooks/{providerRef}/{endpointKey}`.
+     */
+    PROVIDER_ENDPOINT = "provider_endpoint",
+    /**
+     * The APPLICATION declared the endpoint on a handler and chose an engine-owned verification
+     * scheme. Route: `POST /webhooks/app/{endpointKey}` — the provider ref `app` is reserved so the
+     * two route families can never collide.
+     */
+    APPLICATION_ENDPOINT = "application_endpoint",
+    /**
+     * A message received on an inbound CHANNEL (#1630) — email today — routed to an organization and
+     * handed to the channel handler selected for it. The handler names the channel, never the provider
+     * that received the message: that is the application's `EMAIL_INBOUND` selection.
+     */
+    CHANNEL = "channel"
+}
+/**
+ * Which scope a handler's deliveries run in. Declared by the handler, enforced by the pipeline: a
+ * delivery never runs in a scope its handler did not declare, and nothing ever FALLS BACK to the
+ * application scope.
+ */
+export declare enum InboundHandlerScopeMode {
+    /**
+     * Every delivery must resolve to one organization. One that does not is `UNROUTABLE` — recorded,
+     * audited, acknowledged with 200 and never run. It is NOT run at application scope, because the
+     * handler was written for a tenant and application scope would give it every tenant.
+     */
+    ORGANIZATION_REQUIRED = "organization_required",
+    /** Deliveries run at application scope; no organization is resolved. */
+    APPLICATION = "application",
+    /**
+     * The handler's `resolveScope` decides per delivery, because the source's events genuinely belong to
+     * different scopes (billing: a subscription event belongs to an organization's billing account, or to one
+     * person's). `resolveScope` must answer one of {@link InboundResolvedScopeKind}; there is no default.
+     *
+     * The handler is admitted to exactly the scopes it declares `actingRoles` for, and must declare at least
+     * one (#1629). A resolver answering a scope the handler holds no roles in makes the delivery `UNROUTABLE`
+     * (`SCOPE_NOT_ADMITTED_BY_HANDLER`). The `USER` scope is reachable only through this mode.
+     */
+    RESOLVED_PER_DELIVERY = "resolved_per_delivery"
+}
+/** What scope resolution concluded for one delivery. */
+export declare enum InboundResolvedScopeKind {
+    ORGANIZATION = "organization",
+    APPLICATION = "application",
+    /**
+     * The delivery belongs to ONE person — their personal (`USER_SELF`) data, such as a personal billing
+     * account (#1629). The handler acts with its declared `actingRoles.user` (application roles, since
+     * personal resources gate on them), confined to that person's rows. The person is the delivery's SCOPE:
+     * nobody authenticated as them. Stored in the application variant, where the application's operators
+     * see it.
+     */
+    USER = "user",
+    /** No admissible scope — the delivery is recorded and acknowledged, never run. */
+    UNROUTABLE = "unroutable"
+}
+/**
+ * The engine-owned signature schemes an APPLICATION endpoint may declare. Each is implemented by the
+ * engine; an application picks one and supplies a secret. A scheme is added with its first user.
+ */
+export declare enum InboundVerificationScheme {
+    /**
+     * Svix (also used by Resend and the Standard Webhooks convention): HMAC-SHA256 over
+     * `{id}.{timestamp}.{body}` with a base64 `whsec_` secret, a versioned space-delimited signature
+     * header, and a five-minute timestamp window.
+     */
+    SVIX_V1 = "svix_v1",
+    /**
+     * HMAC-SHA256 of the raw body (or of `{timestamp}.{body}` when a timestamp header is declared)
+     * carried in one declared header.
+     */
+    HMAC_SHA256_HEADER = "hmac_sha256_header"
+}
+/** How an {@link InboundVerificationScheme.HMAC_SHA256_HEADER} signature is encoded in its header. */
+export declare enum HmacSignatureEncoding {
+    HEX = "hex",
+    BASE64 = "base64"
+}
+/**
+ * The lifecycle of one stored delivery.
+ *
+ * ```
+ * RECEIVED → PROCESSING → PROCESSED
+ *                       → RETRY_SCHEDULED → PROCESSING → …
+ *                       → DEAD            (attempts or window exhausted)
+ * DEAD → RECEIVED                         (operator replay, justified and audited)
+ * UNROUTABLE                              (terminal: no admissible scope, never run)
+ * ```
+ */
+export declare enum InboundDeliveryStatus {
+    /** Verified and stored; waiting for the dispatch worker. */
+    RECEIVED = "received",
+    /** A worker holds it and is running the handler. */
+    PROCESSING = "processing",
+    /** The last attempt failed; `nextAttemptAt` says when the next one runs. */
+    RETRY_SCHEDULED = "retry_scheduled",
+    /** The handler completed. Terminal. */
+    PROCESSED = "processed",
+    /** Every attempt the handler's retry policy allows has failed. Terminal until an operator replays it. */
+    DEAD = "dead",
+    /** No admissible scope was resolved, so the handler never ran. Terminal. */
+    UNROUTABLE = "unroutable"
+}
+/** Statuses a row never leaves on its own — the retention clock starts at the instant a row reaches one. */
+export declare const INBOUND_DELIVERY_TERMINAL_STATUSES: readonly InboundDeliveryStatus[];
+/** Why an inbound request was refused BEFORE it became a delivery. Carried on `INBOUND_DELIVERY_REJECTED`. */
+export declare enum InboundDeliveryRejectionReason {
+    /** The signature did not verify under the configured secret, or was absent. */
+    SIGNATURE_INVALID = "signature_invalid",
+    /** The signed timestamp is outside the scheme's window — a stale or replayed message. */
+    TIMESTAMP_OUT_OF_WINDOW = "timestamp_out_of_window",
+    /** No verification secret is configured, so nothing can be verified. */
+    SECRET_NOT_CONFIGURED = "secret_not_configured",
+    /** The body exceeds the endpoint's `maxBodyBytes`. */
+    BODY_TOO_LARGE = "body_too_large",
+    /** The endpoint accepts `application/json` only. */
+    UNSUPPORTED_MEDIA_TYPE = "unsupported_media_type",
+    /** The body verified but is not what the handler declared (not JSON, or its payload schema refused it). */
+    MALFORMED = "malformed"
+}
+/** Why a verified delivery was never run. Carried on the row and on `INBOUND_DELIVERY_UNROUTABLE`. */
+export declare enum InboundDeliveryUnroutableReason {
+    /** An `ORGANIZATION_REQUIRED` handler's resolver found no organization. */
+    NO_ORGANIZATION_RESOLVED = "no_organization_resolved",
+    /** The handler's `resolveScope` itself answered `UNROUTABLE`. */
+    RESOLVER_DECLARED_UNROUTABLE = "resolver_declared_unroutable",
+    /** A resolver answered a scope the handler's scope mode does not admit. */
+    SCOPE_NOT_ADMITTED_BY_HANDLER = "scope_not_admitted_by_handler",
+    /** The resolver named an organization that does not exist. */
+    ORGANIZATION_NOT_FOUND = "organization_not_found",
+    /**
+     * The resolver named an organization whose status confers no authority (suspended, marked for
+     * deletion). Its own members could not act there either, so a handler must not.
+     */
+    ORGANIZATION_WITHOUT_AUTHORITY = "organization_without_authority",
+    /**
+     * A channel message arrived on a reply token that belongs to ANOTHER organization than the one its
+     * address routed to (#1630, I12). Either a misconfiguration or an attempt to reach across tenants; in
+     * both cases it must not run in either.
+     */
+    REPLY_TOKEN_OF_ANOTHER_ORGANIZATION = "reply_token_of_another_organization",
+    /** The resolver named a person who does not exist (#1629). */
+    USER_NOT_FOUND = "user_not_found",
+    /**
+     * The resolver named a person whose status confers no authority (anything but active). They could not
+     * act on their own data either, so a handler must not act on it for them (#1629).
+     */
+    USER_WITHOUT_AUTHORITY = "user_without_authority",
+    /** An email recipient no route reaches: no reply token, client mailbox, verified organization domain or shared-domain slug matched it (#1600). */
+    EMAIL_ADDRESS_NOT_ROUTED = "email_address_not_routed",
+    /** An email recipient on a claimed organization domain that is not VERIFIED — pending, failed or suspended (#1600, E3). */
+    EMAIL_DOMAIN_NOT_VERIFIED = "email_domain_not_verified",
+    /**
+     * An email recipient on a client mailbox whose authority does not hold right now: the relationship is not ACTIVE,
+     * or the domain is not VERIFIED, or it is not the firm's (#1600, E4).
+     */
+    CLIENT_MAILBOX_NOT_AUTHORIZED = "client_mailbox_not_authorized",
+    /** An email recipient on the shared domain whose slug belonged to a DELETED organization (#1600, L3). */
+    SHARED_DOMAIN_SLUG_TOMBSTONED = "shared_domain_slug_tombstoned"
+}
+/** How the wait between a handler's failed attempts grows. */
+export declare enum InboundRetryBackoffKind {
+    /** `baseSeconds × 2^(attempt−1)`, capped at `maxSeconds`. The default: a failing dependency gets room to recover. */
+    EXPONENTIAL = "exponential",
+    /** `baseSeconds` every time. */
+    FIXED = "fixed"
+}
+/** The outcome of one handler attempt, recorded on the row. */
+export declare enum InboundDeliveryAttemptOutcome {
+    PROCESSED = "processed",
+    FAILED = "failed"
+}
+export declare const InboundSvixVerificationConfigSchema: z.ZodObject<{
+    scheme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundVerificationScheme.SVIX_V1>>;
+}, z.core.$strict>;
+export declare const InboundHmacSha256HeaderVerificationConfigSchema: z.ZodObject<{
+    scheme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundVerificationScheme.HMAC_SHA256_HEADER>>;
+    /** Header carrying the signature, e.g. `x-hub-signature-256`. Matched case-insensitively. */
+    signatureHeader: z.ZodString;
+    encoding: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof HmacSignatureEncoding>>;
+    /**
+     * A literal the sender puts in front of the signature, e.g. `sha256=`. Stripped before comparison;
+     * a header that does not start with it is refused.
+     */
+    signaturePrefix: z.ZodOptional<z.ZodString>;
+    /**
+     * Header carrying the send time in seconds since the epoch. When declared, the SIGNED content is
+     * `{timestamp}.{rawBody}` and the timestamp must fall within `toleranceSeconds` of now.
+     *
+     * A timestamp that is checked but not signed would be a control that does nothing: whoever
+     * replays a captured message rewrites the header too. So declaring one changes what is signed.
+     */
+    timestampHeader: z.ZodOptional<z.ZodString>;
+    /** Window for `timestampHeader`, in seconds. Defaults to 300 (five minutes). */
+    toleranceSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+/** The verification an APPLICATION endpoint declares. Discriminated on `scheme`. */
+export declare const InboundVerificationConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    scheme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundVerificationScheme.SVIX_V1>>;
+}, z.core.$strict>, z.ZodObject<{
+    scheme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundVerificationScheme.HMAC_SHA256_HEADER>>;
+    /** Header carrying the signature, e.g. `x-hub-signature-256`. Matched case-insensitively. */
+    signatureHeader: z.ZodString;
+    encoding: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof HmacSignatureEncoding>>;
+    /**
+     * A literal the sender puts in front of the signature, e.g. `sha256=`. Stripped before comparison;
+     * a header that does not start with it is refused.
+     */
+    signaturePrefix: z.ZodOptional<z.ZodString>;
+    /**
+     * Header carrying the send time in seconds since the epoch. When declared, the SIGNED content is
+     * `{timestamp}.{rawBody}` and the timestamp must fall within `toleranceSeconds` of now.
+     *
+     * A timestamp that is checked but not signed would be a control that does nothing: whoever
+     * replays a captured message rewrites the header too. So declaring one changes what is signed.
+     */
+    timestampHeader: z.ZodOptional<z.ZodString>;
+    /** Window for `timestampHeader`, in seconds. Defaults to 300 (five minutes). */
+    toleranceSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>], "scheme">;
+export type InboundVerificationConfig = z.infer<typeof InboundVerificationConfigSchema>;
+/** Engine default for an application endpoint's body cap: 256 KB. Per endpoint, never per route prefix. */
+export declare const INBOUND_APPLICATION_ENDPOINT_DEFAULT_MAX_BODY_BYTES: number;
+/** The provider ref reserved for application endpoints: `/webhooks/app/{endpointKey}`. */
+export declare const INBOUND_APPLICATION_ENDPOINT_PROVIDER_REF = "app";
+/** The scope a stored delivery resolved to. Discriminated on `kind`; never absent. */
+export declare const InboundDeliveryResolvedScopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.ORGANIZATION>>;
+    organizationId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.APPLICATION>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.USER>>;
+    userId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.UNROUTABLE>>;
+    reason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundDeliveryUnroutableReason>>;
+}, z.core.$strict>], "kind">;
+export type InboundDeliveryResolvedScope = z.infer<typeof InboundDeliveryResolvedScopeSchema>;
+export declare const InboundDeliveryAttemptSchema: z.ZodObject<{
+    at: z.ZodDate;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundDeliveryAttemptOutcome>>;
+    /** A classified code, never the error message: a message can quote the payload. */
+    errorCode: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type InboundDeliveryAttempt = z.infer<typeof InboundDeliveryAttemptSchema>;
+export declare const InboundDeliveryReplaySchema: z.ZodObject<{
+    /** The user who replayed the delivery. */
+    by: z.ZodString;
+    at: z.ZodDate;
+    justification: z.ZodString;
+}, z.core.$strict>;
+export type InboundDeliveryReplay = z.infer<typeof InboundDeliveryReplaySchema>;
+/**
+ * One stored delivery. Written by the pipeline only (CREATE and UPDATE are REPOSITORY_ONLY); an
+ * administrator reads it and may REPLAY a `DEAD` one.
+ */
+export declare const InboundDeliveryBaseSchema: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    sourceKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundSourceKind>>>;
+    sourceKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    handlerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    dedupKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    orderingKey: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    providerDeliveryId: z.ZodOptional<z.ZodString>;
+    signedAt: z.ZodOptional<z.ZodDate>;
+    receivedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    rawBody: z.ZodString;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    resolvedScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.ORGANIZATION>>;
+        organizationId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.APPLICATION>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.USER>>;
+        userId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.UNROUTABLE>>;
+        reason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundDeliveryUnroutableReason>>;
+    }, z.core.$strict>], "kind">;
+    channel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundChannelKind>>>>;
+    senderAssurance: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundSenderAssurance>>>;
+    threadId: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundDeliveryStatus>>>>>;
+    attemptCount: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
+    attempts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        at: z.ZodDate;
+        outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundDeliveryAttemptOutcome>>;
+        /** A classified code, never the error message: a message can quote the payload. */
+        errorCode: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    nextAttemptAt: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    leaseExpiresAt: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    budgetStartedAt: z.ZodDate;
+    budgetBaseAttemptCount: z.ZodDefault<z.ZodNumber>;
+    terminalAt: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    replays: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** The user who replayed the delivery. */
+        by: z.ZodString;
+        at: z.ZodDate;
+        justification: z.ZodString;
+    }, z.core.$strict>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip>>;
+export type InboundDeliveryBase = z.infer<typeof InboundDeliveryBaseSchema>;
+/**
+ * Yields `organizationInboundDeliveries` (FK `organizationId`) and `applicationInboundDeliveries`
+ * (FK `applicationId`). Many rows per scope, so the singleton business-key default is opted out of;
+ * the row's identity is the `(sourceKey, dedupKey)` set above.
+ */
+export declare const inboundDeliveryPolymorphicDeclaration: import("..").PolymorphicSchemaDeclaration<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    sourceKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundSourceKind>>>;
+    sourceKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    handlerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    dedupKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    orderingKey: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    providerDeliveryId: z.ZodOptional<z.ZodString>;
+    signedAt: z.ZodOptional<z.ZodDate>;
+    receivedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    rawBody: z.ZodString;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    resolvedScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.ORGANIZATION>>;
+        organizationId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.APPLICATION>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.USER>>;
+        userId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<InboundResolvedScopeKind.UNROUTABLE>>;
+        reason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundDeliveryUnroutableReason>>;
+    }, z.core.$strict>], "kind">;
+    channel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundChannelKind>>>>;
+    senderAssurance: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundSenderAssurance>>>;
+    threadId: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundDeliveryStatus>>>>>;
+    attemptCount: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
+    attempts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        at: z.ZodDate;
+        outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof InboundDeliveryAttemptOutcome>>;
+        /** A classified code, never the error message: a message can quote the payload. */
+        errorCode: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    nextAttemptAt: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    leaseExpiresAt: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    budgetStartedAt: z.ZodDate;
+    budgetBaseAttemptCount: z.ZodDefault<z.ZodNumber>;
+    terminalAt: z.ZodDefault<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    replays: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** The user who replayed the delivery. */
+        by: z.ZodString;
+        at: z.ZodDate;
+        justification: z.ZodString;
+    }, z.core.$strict>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip>>>;
+//# sourceMappingURL=inbound-delivery.shared.schemas.d.ts.map

package/dist/esm/inbound/inbound-delivery.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-delivery.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/inbound/inbound-delivery.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAM/F;;;GAGG;AACH,oBAAY,iBAAiB;IAC3B;;;OAGG;IACH,iBAAiB,sBAAsB;IACvC;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C;;;;OAIG;IACH,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,oBAAY,uBAAuB;IACjC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C,wEAAwE;IACxE,WAAW,gBAAgB;IAC3B;;;;;;;;OAQG;IACH,qBAAqB,0BAA0B;CAChD;AAED,wDAAwD;AACxD,oBAAY,wBAAwB;IAClC,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B;;;;;;OAMG;IACH,IAAI,SAAS;IACb,kFAAkF;IAClF,UAAU,eAAe;CAC1B;AAED;;;GAGG;AACH,oBAAY,yBAAyB;IACnC;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;OAGG;IACH,kBAAkB,uBAAuB;CAC1C;AAED,sGAAsG;AACtG,oBAAY,qBAAqB;IAC/B,GAAG,QAAQ;IACX,MAAM,WAAW;CAClB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,qBAAqB;IAC/B,4DAA4D;IAC5D,QAAQ,aAAa;IACrB,oDAAoD;IACpD,UAAU,eAAe;IACzB,4EAA4E;IAC5E,eAAe,oBAAoB;IACnC,uCAAuC;IACvC,SAAS,cAAc;IACvB,yGAAyG;IACzG,IAAI,SAAS;IACb,4EAA4E;IAC5E,UAAU,eAAe;CAC1B;AAED,4GAA4G;AAC5G,eAAO,MAAM,kCAAkC,EAAE,SAAS,qBAAqB,EAI7E,CAAC;AAEH,8GAA8G;AAC9G,oBAAY,8BAA8B;IACxC,+EAA+E;IAC/E,iBAAiB,sBAAsB;IACvC,yFAAyF;IACzF,uBAAuB,4BAA4B;IACnD,wEAAwE;IACxE,qBAAqB,0BAA0B;IAC/C,sDAAsD;IACtD,cAAc,mBAAmB;IACjC,oDAAoD;IACpD,sBAAsB,2BAA2B;IACjD,2GAA2G;IAC3G,SAAS,cAAc;CACxB;AAED,sGAAsG;AACtG,oBAAY,+BAA+B;IACzC,2EAA2E;IAC3E,wBAAwB,6BAA6B;IACrD,iEAAiE;IACjE,4BAA4B,iCAAiC;IAC7D,2EAA2E;IAC3E,6BAA6B,kCAAkC;IAC/D,8DAA8D;IAC9D,sBAAsB,2BAA2B;IACjD;;;OAGG;IACH,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,mCAAmC,wCAAwC;IAC3E,8DAA8D;IAC9D,cAAc,mBAAmB;IACjC;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD,kJAAkJ;IAClJ,wBAAwB,6BAA6B;IACrD,2HAA2H;IAC3H,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,6BAA6B,kCAAkC;IAC/D,yGAAyG;IACzG,6BAA6B,kCAAkC;CAChE;AAED,8DAA8D;AAC9D,oBAAY,uBAAuB;IACjC,qHAAqH;IACrH,WAAW,gBAAgB;IAC3B,gCAAgC;IAChC,KAAK,UAAU;CAChB;AAED,+DAA+D;AAC/D,oBAAY,6BAA6B;IACvC,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAMD,eAAO,MAAM,mCAAmC;;kBAE9C,CAAC;AAEH,eAAO,MAAM,+CAA+C;;IAE1D,6FAA6F;;;IAG7F;;;OAGG;;IAEH;;;;;;OAMG;;IAEH,gFAAgF;;kBAEhF,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,+BAA+B;;;;IArB1C,6FAA6F;;;IAG7F;;;OAGG;;IAEH;;;;;;OAMG;;IAEH,gFAAgF;;8BAQhF,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,2GAA2G;AAC3G,eAAO,MAAM,mDAAmD,QAAa,CAAC;AAE9E,0FAA0F;AAC1F,eAAO,MAAM,yCAAyC,QAAQ,CAAC;AAM/D,sFAAsF;AACtF,eAAO,MAAM,kCAAkC;;;;;;;;;;;4BA+B7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,4BAA4B;;;IAMvC,mFAAmF;;kBAQnF,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,2BAA2B;IACtC,0CAA0C;;;;kBAI1C,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAehF;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAtCpC,mFAAmF;;;;;;;;;QAanF,0CAA0C;;;;;;;kBA4HA,CAAC;AAE7C,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAlJhD,mFAAmF;;;;;;;;;QAanF,0CAA0C;;;;;;;mBA2I1C,CAAC"}