@wildo-ai/saas-models 1.1.7 → 1.1.8

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-partition-assignments.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAY/C,KAAK,gDAAgD,GACjD,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,6EAA6E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;mBA+NxI,CAAC"}
+{"version":3,"file":"system-of-record-partition-assignments.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAY/C,KAAK,gDAAgD,GACjD,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,6EAA6E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;mBA+NxI,CAAC"}

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-partition-assignments.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,uCAAuC,EACvC,6CAA6C,GAC9C,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,MAAM,mDAAmD,GAAG;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC/B,CAAC;AAWF,MAAM,CAAC,MAAM,6EAA6E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC9I,0CAA0C,CAIxC;IACA,UAAU,EAAE,uCAAuC;IACnD,kBAAkB,EAAE,gBAAgB,CAAC,sCAAsC;IAC3E,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sCAAsC,CAAC;IACpH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED,sGAAsG;IACtG,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;;;;;;;;;;;WAiBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,mDAAmD;iBAClE;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,CAAC,6CAA6C,CAAC,QAAQ,CAAC,EAAE;YACxD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,iGAAiG;wBACjG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,0FAA0F;wBAC1F,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;6BACjD,QAAQ,CAAC,wOAAwO,CAAC;wBACrP,uGAAuG;wBACvG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;qBAC3C,CAAC;iBACH;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,uGAAuG;CACxG,CAAC,CAAC","sourcesContent":["/**\n * `systemOfRecordPartitionAssignments` — resource configuration.\n *\n * Every verb is `APP_ADMIN_SUPER_ADMIN` at APPLICATION scope and none is reachable with a tenant\n * role, which is decision D11 of the slice: only an OPERATOR decides which part of the operator's own\n * ERP a unit of the org chart corresponds to. A tenant administrator who could assign partitions\n * could assign their own unit to a company they were never meant to see — the confinement would be\n * configurable by the party it confines.\n *\n * See `system-of-record-partition-assignments.shared.schemas.ts` for what the row means and why it is\n * APPLICATION-scoped rather than ORGANIZATIONS-scoped.\n */\n\nimport { z } from 'zod';\n\nimport {\n  SystemOfRecordPartitionAssignmentSchema,\n  SystemOfRecordPartitionAssignments_Operations,\n} from './system-of-record-partition-assignments.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nconst SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_FILTER_FIELDS = {\n  system: z.string(),\n  remoteKey: z.string(),\n  organizationUnitId: z.string(),\n};\n\ntype SystemOfRecordPartitionAssignmentsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const systemOfRecordPartitionAssignmentsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof SystemOfRecordPartitionAssignments_Operations,\n    SystemOfRecordPartitionAssignmentsCoreOperations,\n    typeof SystemOfRecordPartitionAssignmentSchema\n  >({\n    mainSchema: SystemOfRecordPartitionAssignmentSchema,\n    resourceIdentifier: CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `list` ALLOWED, and it is the load-bearing entry rather than a convenience.\n     *\n     * The read confinement resolves a caller's unit set into remote partition keys on EVERY read of\n     * every resource bound to a partitioned instance — and that caller is an ordinary tenant member\n     * with no application role at all. They can no more LIST these rows in their own right than they\n     * can read the deployment's configuration, so the lookup runs on a SYSTEM context. This is the\n     * same shape, and the same argument, as the access-grant resources: the authorization layer\n     * consults the row before the caller's own authority is established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that checks\n     * the unit against the owner organization and records the lifecycle event. A system door around\n     * those would be a second way to grant a set of members access to a company's data.\n     *\n     * `exportSubject: FORBIDDEN`. `assignedByUserId` is a foreign key back to USERS, so these rows sit\n     * on that operator's Art. 15 graph — and an included resource carrying NO declaration REFUSES the\n     * whole export, so the field cannot simply be omitted. FORBIDDEN because the row is not about the\n     * subject: it is the operator's corporate structure (which remote company corresponds to which\n     * unit), and disclosing the deployment's partition map to a data subject discloses a third party's\n     * business organization rather than the subject's personal data.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS the row and scrubs its free text.\n     *\n     * Erasing the assignment itself would be a configuration change dressed as a privacy act: the\n     * partition would become unreachable to every member of its unit, which is an availability\n     * incident for the operator's business and does nothing for the data subject. What the subject's\n     * erasure does reach is the prose THEY wrote — `justification` — which is masked.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /** The row is about a remote partition, not a person. The operator's session ends through `USERS`. */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * Assigning a partition to a unit — the verb that GRANTS a set of members access to a remote\n       * company's rows.\n       *\n       * HIGH rather than MEDIUM, and the threshold is the reason: HIGH is inside\n       * `AUTOMATIC_AUDIT_RISK_FLOOR`, so the generic `RESOURCE_OPERATION_PERFORMED` row fires without\n       * any declaration here. The dedicated lifecycle event carries what that row cannot — which unit,\n       * and on a reassignment, which unit it was before.\n       *\n       * No `requestDto`: the create contract is the schema's own, which is exactly right here. All\n       * four authored fields (`system`, `remoteKey`, `organizationUnitId`, `justification`) are\n       * required and creatable; `assignedByUserId` is `.excludeFromCreate()` and is server-authored\n       * from the session, so a caller cannot attribute an assignment to somebody else.\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a remote partition reaches only the unit an\n       * operator deliberately assigned it to.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n\n      /**\n       * Unassigning — and it is not the mild verb it looks like.\n       *\n       * Removing the edge makes the partition unreachable to EVERY caller: the read pushes down the\n       * set of assigned keys, so a key with no assignment is in nobody's predicate. An operator\n       * unassigning by mistake does not narrow access, they remove a company from the product. HIGH\n       * for that reason, and the lifecycle event names the unit that was lost.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The partition map an operator works from.\n       *\n       * `APP_ADMIN_SUPER_ADMIN`, and whether the owner organization's `ORG_ADMIN` may also read it is\n       * a deliberate LATER widening rather than an oversight: the rows describe the operator's own\n       * corporate structure, and an APPLICATION-scoped resource carries application roles, so opening\n       * it to a tenant role is a scope decision and not a role edit.\n       */\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            filterFields: SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_FILTER_FIELDS,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * MOVING a partition between units, under a compare-and-swap on the unit it is leaving.\n       *\n       * ## Why this is not an UPDATE\n       *\n       * `organizationUnitId` is `.excludeFromUpdate()`, so a plain UPDATE naming it SUCCEEDS and\n       * persists nothing — the repository's strict re-parse drops the field and the caller is told the\n       * write worked. That failure mode is silent by construction, which is why the field is excluded\n       * and this door exists: one writer, one contract, one audit event.\n       *\n       * ## Why the compare-and-swap\n       *\n       * `expectedCurrentOrganizationUnitId` is REQUIRED, not optional. Two administrators moving the\n       * same partition in opposite directions during one incident is not a hypothetical — it is the\n       * ordinary shape of an incident — and a last-write-wins result would leave a company assigned to\n       * a unit neither operator chose, with two plausible audit rows explaining it. Naming the unit\n       * you believe you are moving away from makes the second write REFUSE instead.\n       *\n       * No `enabledCondition`, and that is stated rather than omitted. The precedent resources\n       * duplicate their guard into `enabledCondition` so a console cannot render an affordance the\n       * implementation will refuse — but that guard is a question about the ROW's state, and this row\n       * has no state to be in. The only thing that can refuse a reassignment is the relationship\n       * between the request and the current unit, which `enabledCondition` cannot see: it receives\n       * `currentObject` and `initiatorIds`, never the request DTO. A condition that ignored the DTO\n       * would be an affordance guard that hides nothing while reading as defence in depth — #19 of\n       * `invariant-call-site-enumeration.md`. The CAS in the implementation is the whole guard.\n       *\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a move records both units and its reason.\n       */\n      [SystemOfRecordPartitionAssignments_Operations.REASSIGN]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              /** The unit the partition moves TO. Checked against the owner organization and ACTIVE status. */\n              organizationUnitId: z.string().min(1),\n              /** The unit the caller believes it is moving FROM. The row is refused if it disagrees. */\n              expectedCurrentOrganizationUnitId: z.string().min(1)\n                .describe('The unit you believe the partition is assigned to now, the one it moves away from. If it has already moved elsewhere, for instance because another administrator reassigned it, the request is refused with a 409 and nothing changes.'),\n              /** Replaces the stored justification: the reason the partition is HERE, not the reason it once was. */\n              justification: z.string().min(1).max(1000),\n            }),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS).\n  });\n"]}
+{"version":3,"file":"system-of-record-partition-assignments.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,uCAAuC,EACvC,6CAA6C,GAC9C,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,MAAM,mDAAmD,GAAG;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC/B,CAAC;AAWF,MAAM,CAAC,MAAM,6EAA6E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC9I,0CAA0C,CAIxC;IACA,UAAU,EAAE,uCAAuC;IACnD,kBAAkB,EAAE,gBAAgB,CAAC,sCAAsC;IAC3E,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sCAAsC,CAAC;IACpH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED,sGAAsG;IACtG,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;;;;;;;;;;;WAiBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,mDAAmD;iBAClE;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,CAAC,6CAA6C,CAAC,QAAQ,CAAC,EAAE;YACxD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,iGAAiG;wBACjG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,0FAA0F;wBAC1F,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;6BACjD,QAAQ,CAAC,wOAAwO,CAAC;wBACrP,uGAAuG;wBACvG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;qBAC3C,CAAC;iBACH;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,uGAAuG;CACxG,CAAC,CAAC","sourcesContent":["/**\n * `systemOfRecordPartitionAssignments` — resource configuration.\n *\n * Every verb is `APP_ADMIN_SUPER_ADMIN` at APPLICATION scope and none is reachable with a tenant\n * role, which is decision D11 of the slice: only an OPERATOR decides which part of the operator's own\n * ERP a unit of the org chart corresponds to. A tenant administrator who could assign partitions\n * could assign their own unit to a company they were never meant to see — the confinement would be\n * configurable by the party it confines.\n *\n * See `system-of-record-partition-assignments.shared.schemas.ts` for what the row means and why it is\n * APPLICATION-scoped rather than ORGANIZATIONS-scoped.\n */\n\nimport { z } from 'zod';\n\nimport {\n  SystemOfRecordPartitionAssignmentSchema,\n  SystemOfRecordPartitionAssignments_Operations,\n} from './system-of-record-partition-assignments.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nconst SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_FILTER_FIELDS = {\n  system: z.string(),\n  remoteKey: z.string(),\n  organizationUnitId: z.string(),\n};\n\ntype SystemOfRecordPartitionAssignmentsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const systemOfRecordPartitionAssignmentsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof SystemOfRecordPartitionAssignments_Operations,\n    SystemOfRecordPartitionAssignmentsCoreOperations,\n    typeof SystemOfRecordPartitionAssignmentSchema\n  >({\n    mainSchema: SystemOfRecordPartitionAssignmentSchema,\n    resourceIdentifier: CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `list` ALLOWED, and it is the load-bearing entry rather than a convenience.\n     *\n     * The read confinement resolves a caller's unit set into remote partition keys on EVERY read of\n     * every resource bound to a partitioned instance — and that caller is an ordinary tenant member\n     * with no application role at all. They can no more LIST these rows in their own right than they\n     * can read the deployment's configuration, so the lookup runs on a SYSTEM context. This is the\n     * same shape, and the same argument, as the access-grant resources: the authorization layer\n     * consults the row before the caller's own authority is established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that checks\n     * the unit against the owner organization and records the lifecycle event. A system door around\n     * those would be a second way to grant a set of members access to a company's data.\n     *\n     * `exportSubject: FORBIDDEN`. `assignedByUserId` is a foreign key back to USERS, so these rows sit\n     * on that operator's Art. 15 graph — and an included resource carrying NO declaration REFUSES the\n     * whole export, so the field cannot simply be omitted. FORBIDDEN because the row is not about the\n     * subject: it is the operator's corporate structure (which remote company corresponds to which\n     * unit), and disclosing the deployment's partition map to a data subject discloses a third party's\n     * business organization rather than the subject's personal data.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS the row and scrubs its free text.\n     *\n     * Erasing the assignment itself would be a configuration change dressed as a privacy act: the\n     * partition would become unreachable to every member of its unit, which is an availability\n     * incident for the operator's business and does nothing for the data subject. What the subject's\n     * erasure does reach is the prose THEY wrote — `justification` — which is masked.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /** The row is about a remote partition, not a person. The operator's session ends through `USERS`. */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * Assigning a partition to a unit — the verb that GRANTS a set of members access to a remote\n       * company's rows.\n       *\n       * HIGH rather than MEDIUM, and the threshold is the reason: HIGH is inside\n       * `AUTOMATIC_AUDIT_RISK_FLOOR`, so the generic `RESOURCE_OPERATION_PERFORMED` row fires without\n       * any declaration here. The dedicated lifecycle event carries what that row cannot — which unit,\n       * and on a reassignment, which unit it was before.\n       *\n       * No `requestDto`: the create contract is the schema's own, which is exactly right here. All\n       * four authored fields (`system`, `remoteKey`, `organizationUnitId`, `justification`) are\n       * required and creatable; `assignedByUserId` is `.excludeFromCreate()` and is server-authored\n       * from the session, so a caller cannot attribute an assignment to somebody else.\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a remote partition reaches only the unit an\n       * operator deliberately assigned it to.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n\n      /**\n       * Unassigning — and it is not the mild verb it looks like.\n       *\n       * Removing the edge makes the partition unreachable to EVERY caller: the read pushes down the\n       * set of assigned keys, so a key with no assignment is in nobody's predicate. An operator\n       * unassigning by mistake does not narrow access, they remove a company from the product. HIGH\n       * for that reason, and the lifecycle event names the unit that was lost.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The partition map an operator works from.\n       *\n       * `APP_ADMIN_SUPER_ADMIN`, and whether the owner organization's `ORG_ADMIN` may also read it is\n       * a deliberate LATER widening rather than an oversight: the rows describe the operator's own\n       * corporate structure, and an APPLICATION-scoped resource carries application roles, so opening\n       * it to a tenant role is a scope decision and not a role edit.\n       */\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            filterFields: SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_FILTER_FIELDS,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * MOVING a partition between units, under a compare-and-swap on the unit it is leaving.\n       *\n       * ## Why this is not an UPDATE\n       *\n       * `organizationUnitId` is `.excludeFromUpdate()`, so a plain UPDATE naming it SUCCEEDS and\n       * persists nothing — the repository's strict re-parse drops the field and the caller is told the\n       * write worked. That failure mode is silent by construction, which is why the field is excluded\n       * and this door exists: one writer, one contract, one audit event.\n       *\n       * ## Why the compare-and-swap\n       *\n       * `expectedCurrentOrganizationUnitId` is REQUIRED, not optional. Two administrators moving the\n       * same partition in opposite directions during one incident is not a hypothetical — it is the\n       * ordinary shape of an incident — and a last-write-wins result would leave a company assigned to\n       * a unit neither operator chose, with two plausible audit rows explaining it. Naming the unit\n       * you believe you are moving away from makes the second write REFUSE instead.\n       *\n       * No `enabledCondition`, and that is stated rather than omitted. The precedent resources\n       * duplicate their guard into `enabledCondition` so a console cannot render an affordance the\n       * implementation will refuse — but that guard is a question about the ROW's state, and this row\n       * has no state to be in. The only thing that can refuse a reassignment is the relationship\n       * between the request and the current unit, which `enabledCondition` cannot see: it receives\n       * `currentObject` and `initiatorIds`, never the request DTO. A condition that ignored the DTO\n       * would be an affordance guard that hides nothing while reading as defence in depth — #19 of\n       * `invariant-call-site-enumeration.md`. The CAS in the implementation is the whole guard.\n       *\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a move records both units and its reason.\n       */\n      [SystemOfRecordPartitionAssignments_Operations.REASSIGN]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              /** The unit the partition moves TO. Checked against the owner organization and ACTIVE status. */\n              organizationUnitId: z.string().min(1),\n              /** The unit the caller believes it is moving FROM. The row is refused if it disagrees. */\n              expectedCurrentOrganizationUnitId: z.string().min(1)\n                .describe('The unit you believe the partition is assigned to now, the one it moves away from. If it has already moved elsewhere, for instance because another administrator reassigned it, the request is refused with a 409 and nothing changes.'),\n              /** Replaces the stored justification: the reason the partition is HERE, not the reason it once was. */\n              justification: z.string().min(1).max(1000),\n            }),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS).\n  });\n"]}

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-partition-assignments.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-partition-assignments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;;;;GAOG;AACH,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,4DAA4D;AAC5D,oBAAY,2CAA2C;IACrD,wDAAwD;IACxD,QAAQ,aAAa;IACrB,4EAA4E;IAC5E,UAAU,eAAe;IACzB,+EAA+E;IAC/E,UAAU,eAAe;CAC1B;AAED,kEAAkE;AAClE,eAAO,MAAM,6CAA6C;IACxD;;;;;;OAMG;;CAEK,CAAC;AAEX,eAAO,MAAM,uCAAuC;;;;;;;;;;kBAoFlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,IAAI,CAAC,iCAAiC,EAAE,oBAAoB,GAAG,WAAW,CAAC,EAAE,EACnG,mBAAmB,EAAE,SAAS,MAAM,EAAE,GACrC,MAAM,EAAE,CAOV"}
+{"version":3,"file":"system-of-record-partition-assignments.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-partition-assignments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;;;;GAOG;AACH,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,4DAA4D;AAC5D,oBAAY,2CAA2C;IACrD,wDAAwD;IACxD,QAAQ,aAAa;IACrB,4EAA4E;IAC5E,UAAU,eAAe;IACzB,+EAA+E;IAC/E,UAAU,eAAe;CAC1B;AAED,kEAAkE;AAClE,eAAO,MAAM,6CAA6C;IACxD;;;;;;OAMG;;CAEK,CAAC;AAEX,eAAO,MAAM,uCAAuC;;;;;;;;;;kBAoFlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,IAAI,CAAC,iCAAiC,EAAE,oBAAoB,GAAG,WAAW,CAAC,EAAE,EACnG,mBAAmB,EAAE,SAAS,MAAM,EAAE,GACrC,MAAM,EAAE,CAOV"}

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-partition-assignments.shared.schemas.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-partition-assignments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAEhI,6FAA6F;AAC7F,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,4DAA4D;AAC5D,MAAM,CAAN,IAAY,2CAOX;AAPD,WAAY,2CAA2C;IACrD,wDAAwD;IACxD,oEAAqB,CAAA;IACrB,4EAA4E;IAC5E,wEAAyB,CAAA;IACzB,+EAA+E;IAC/E,wEAAyB,CAAA;AAC3B,CAAC,EAPW,2CAA2C,KAA3C,2CAA2C,QAOtD;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D;;;;;;OAMG;IACH,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SACf,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;SAC5G,GAAG,CAAC,gCAAgC,CAAC;SACrC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEvE;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;SACrE,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEvE;;;;;;;;;OASG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzH;;;;;;;OAOG;IACH,mGAAmG;IACnG,iGAAiG;IACjG,yDAAyD;IACzD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;SAC3C,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,sBAAsB,EAAE,CACtC;IAED,gGAAgG;IAChG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAExI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAIH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmG,EACnG,mBAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC","sourcesContent":["/**\n * `systemOfRecordPartitionAssignments` — which ORGANIZATION UNIT a remote partition belongs to.\n *\n * ## The gap this closes\n *\n * A system of record holds several partitions inside one corporate: Odoo companies (`company_id`),\n * SAP company codes, Dynamics business units, NetSuite subsidiaries. Every row read out of one is\n * stamped with the application's OWNER organization (#1055 §6) — so before this resource existed,\n * every member of that organization saw every partition, and the Spanish subsidiary's accountant\n * read the German company's invoices.\n *\n * The mechanism that confines WITHIN one organization already exists and is pinned: organization\n * unit narrowing. What it lacked was the edge from a remote partition key to a Wildo unit. This\n * resource IS that edge, and it is deliberately the only thing that carries it:\n *\n * ```\n *   Odoo company_id = 10  ──(this row)──▶  unit \"Acme Deutschland\"  ──(unit narrowing)──▶  members\n * ```\n *\n * ## Why the edge points THIS way\n *\n * The remote has never heard of Wildo. Pushing a Wildo unit id into Odoo was rejected in the slice's\n * own alternatives table for that reason — there is nothing on the far side to receive it. So the\n * mapping lives here, and the read path walks it in REVERSE: a caller's effective unit set becomes a\n * set of remote keys, which is what a remote predicate can actually be written in.\n *\n * ## APPLICATION-scoped, not ORGANIZATIONS-scoped (slice E10)\n *\n * Every row here names a unit of the owner organization, so the tenant-scoped shape is the intuitive\n * one and it is wrong. Assigning a remote partition is an OPERATOR act (D11) — the deployment's own\n * administrator deciding which part of the operator's ERP a unit of their customer-facing org chart\n * corresponds to. An operator door on an ORGANIZATIONS-scoped resource would need\n * `admitsCrossTenantPlatformAdministration` on every verb plus a platform access grant per crossing\n * (`.claude/rules/administrative-continuity-floors.md`), which is the ceremony for reaching into a\n * CUSTOMER's data — not for editing the deployment's own configuration.\n *\n * The precedent is `applicationAccessGrants` beside `platformAccessGrants`: a sibling resource type\n * at the scope the act actually has, rather than a nullable tenant field weakening the resource whose\n * tenant field IS its control.\n *\n * ## What identifies an assignment, and what an edit may change\n *\n * `[system, remoteKey]` is the business key: one remote partition maps to at most one unit, and that\n * uniqueness is persisted rather than conventional. All three of `system`, `remoteKey` and\n * `organizationUnitId` are `.excludeFromUpdate()`, which leaves an ordinary UPDATE with nothing to\n * write — deliberately. A reassignment is a MOVE-shaped custom operation carrying a compare-and-swap\n * on the CURRENT unit (slice E11), because \"move partition 10 from Deutschland to Österreich\" is a\n * decision about two units and a plain field write can neither name the unit it expected to replace\n * nor refuse when another operator got there first.\n *\n * ⚠️ An excluded-field write SUCCEEDS and persists nothing — the repository's strict re-parse drops\n * it. So the reassign door must write through a path that re-attaches the field\n * (`preserveServerInjectedFields` / an authoritative write), never a plain UPDATE that looks like it\n * worked. `.claude/rules/invariant-call-site-enumeration.md` #8 is this exact shape.\n *\n * ## `remoteKey` is a STRING, and the codec is what makes that safe\n *\n * Odoo's `company_id` is an integer; Dataverse's is a GUID; NetSuite's subsidiary is an integer. One\n * stored shape across every vendor would either lose type information or need a column per vendor, so\n * the row carries the key's CANONICAL TEXT and the facet's partition declaration carries the codec\n * that decodes it before a predicate is compiled. Storing `10` as `'10'` and comparing it against\n * Odoo's integer `10` without decoding is the defect that codec exists to prevent.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a remote partition reaches only the unit an\n * operator assigned it to, and a member reaches only the partitions their unit grants.\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every assignment change is justified and\n * recorded with its before/after unit.\n */\n\nimport { z } from 'zod';\n\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { SYSTEM_OF_RECORD_NAME_MAX_LENGTH, SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Fixed replacement for assignment free-text that cannot be cleared (a `.min(1)` field). */\nconst ERASED_ASSIGNMENT_TEXT = '[erased]';\n\n/**\n * The longest canonical text a remote partition key may have.\n *\n * 128 is a GUID (36) with room for a vendor that composes one — NetSuite's internal ids, an SAP\n * company code, a Dataverse business-unit id. Bounded rather than open because the value is compiled\n * into a remote predicate: an OData `or`-chain of keys is a URL, and a URL has a length the vendor\n * enforces long before we would.\n */\nexport const SYSTEM_OF_RECORD_REMOTE_KEY_MAX_LENGTH = 128;\n\n/** One transition in the life of a partition assignment. */\nexport enum SystemOfRecordPartitionAssignmentTransition {\n  /** A remote partition gained a unit it did not have. */\n  ASSIGNED = 'assigned',\n  /** An assigned partition MOVED to a different unit — carries both units. */\n  REASSIGNED = 'reassigned',\n  /** The edge was removed. The partition becomes unreachable to every caller. */\n  UNASSIGNED = 'unassigned',\n}\n\n/** The custom doors this resource opens beyond the core verbs. */\nexport const SystemOfRecordPartitionAssignments_Operations = {\n  /**\n   * Move an assigned partition to a different unit, under a compare-and-swap on the current one.\n   *\n   * Not an UPDATE: `organizationUnitId` is `.excludeFromUpdate()` precisely so this is the only door,\n   * and the CAS is what makes concurrent operators safe — two administrators reassigning the same\n   * partition in opposite directions must not silently produce whichever write landed second.\n   */\n  REASSIGN: 'reassign',\n} as const;\n\nexport const SystemOfRecordPartitionAssignmentSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The primary-scope parent — the deployment this assignment configures.\n   *\n   * OPTIONAL, copying `applicationAccessGrants` and `applicationAuditLogs` rather than loosening\n   * anything: declared MANDATORY the resource does not load at all on a Mongo-persisted deployment\n   * (the ZodToMongoose convertor refuses it and INIT dies on\n   * `zod_converter_schema_conversion_failed`). Addressing is carried by `isPrimaryScope` +\n   * `REQUIRES_CONTEXT` on the relationship, which is what the URL builder reads, so the route is\n   * identical either way.\n   */\n  applicationId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * WHICH declared instance this partition lives in — a `systemsOfRecord.<name>` key.\n   *\n   * Instance-scoped rather than vendor-scoped, and that is load-bearing: two Odoo deployments\n   * (`odoo-fr`, `odoo-de`) share one vendor facet and have entirely unrelated company ids. A key\n   * scoped to the vendor would let one deployment's company 10 resolve through the other's map.\n   *\n   * ⚠️ Built from the exported PATTERN and MAX_LENGTH rather than from `SystemOfRecordNameSchema`,\n   * and that is not a style choice. A zod decorator MUTATES the schema object it is called on —\n   * measured 2026-09-18: `shared.isDBIndexed() === shared` is `true`, and the metadata lands on the\n   * shared object. Chaining off the exported instance-name schema would therefore stamp\n   * `isDBIndexed`/`isSummaryField`/`excludeFromUpdate`/`isAuditEvidence` onto the schema that\n   * validates `systemsOfRecord.<name>` keys in `wildo.saas.config.ts`, which is a configuration key\n   * and not a resource field. The two constants ARE the single source — they are exported precisely\n   * because the environment-variable derivation depends on them — so nothing is duplicated here\n   * except the act of building a fresh schema out of them.\n   */\n  system: z.string()\n    .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n    .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH)\n    .isDBIndexed().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The partition's key AS THE REMOTE SPELLS IT, in canonical text.\n   *\n   * Decoded through the facet's partition codec before it reaches a compiler — see the class doc on\n   * why one stored shape plus a codec beats a column per vendor.\n   */\n  remoteKey: z.string().min(1).max(SYSTEM_OF_RECORD_REMOTE_KEY_MAX_LENGTH)\n    .isDBIndexed().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The unit of the OWNER organization this partition belongs to.\n   *\n   * `.excludeFromUpdate()` so the only writer is the `reassign` door and its compare-and-swap.\n   *\n   * The foreign key buys EXISTENCE and nothing more. An APPLICATION-scoped row written by a\n   * super-administrator resolves `writeTenantId === ''` in the write-integrity check, so the FK\n   * cannot also assert that the unit belongs to the owner organization or that it is ACTIVE — both\n   * are checked in the custom implementation through the system door, and pinned there (slice R10).\n   */\n  organizationUnitId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * Why this partition belongs to this unit. REQUIRED, on the `applicationAccessGrants` precedent.\n   *\n   * It carries real weight here rather than being ceremony: an assignment is an access decision with\n   * no expiry — unlike a grant, it stands until someone changes it — and the next operator looking at\n   * \"company 10 → Deutschland\" has no other way to learn whether that reflects the corporate\n   * structure or somebody's guess during an incident.\n   */\n  // USER_CONTENT — free prose an OPERATOR typed. MASK rather than REMOVE on erasure: `.min(1)` makes\n  // it non-clearable, so a null would be rejected by the strict update-DTO parse the impersonalize\n  // writer runs, and a fixed non-empty string is accepted.\n  justification: addImpersonalizeWith(\n    z.string().min(1).max(1000).isSummaryField()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.MASK,\n    { maskValue: ERASED_ASSIGNMENT_TEXT },\n  ),\n\n  /** The operator who last assigned or moved this partition. Server-authored from the session. */\n  assignedByUserId: z.string().min(1).optional().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'system',\n  'remoteKey',\n]);\n\nexport type SystemOfRecordPartitionAssignment = z.infer<typeof SystemOfRecordPartitionAssignmentSchema>;\n\n/**\n * The inverse map a read uses: unit ids → the remote keys confined to them.\n *\n * Built per request from the rows this caller's units reach. Deliberately NOT cached — measured\n * 2026-09-18, the indexed lookup is 0.078–0.177 ms at 20× the realistic row count, against a 1.02 ms\n * p50 floor for the remote read it precedes (a loopback socket with a handler that does nothing but\n * serialize). A real system of record is 50–500 ms, so the cache would save ~0.1 ms on a path about\n * to spend three orders of magnitude more.\n *\n * The correctness half is what settles it: the cached value is a SECURITY CONFINEMENT, so a stale\n * entry means a member still reads a partition they were unassigned from — the defect this resource\n * exists to close, re-entering through the cache. `ApplicationOwnerOrganizationResolverBackendService`\n * caches for the process lifetime and is right to, because its invalidating event is an owner\n * PROMOTION — once per application lifetime. Reassigning a partition is ordinary administration.\n */\nexport function buildRemoteKeysForUnits(\n  assignments: readonly Pick<SystemOfRecordPartitionAssignment, 'organizationUnitId' | 'remoteKey'>[],\n  organizationUnitIds: readonly string[],\n): string[] {\n  const wanted = new Set(organizationUnitIds);\n  const keys = new Set<string>();\n  for (const assignment of assignments) {\n    if (wanted.has(assignment.organizationUnitId)) keys.add(assignment.remoteKey);\n  }\n  return [...keys];\n}\n"]}
+{"version":3,"file":"system-of-record-partition-assignments.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-partition-assignments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAEhI,6FAA6F;AAC7F,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,4DAA4D;AAC5D,MAAM,CAAN,IAAY,2CAOX;AAPD,WAAY,2CAA2C;IACrD,wDAAwD;IACxD,oEAAqB,CAAA;IACrB,4EAA4E;IAC5E,wEAAyB,CAAA;IACzB,+EAA+E;IAC/E,wEAAyB,CAAA;AAC3B,CAAC,EAPW,2CAA2C,KAA3C,2CAA2C,QAOtD;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D;;;;;;OAMG;IACH,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SACf,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;SAC5G,GAAG,CAAC,gCAAgC,CAAC;SACrC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEvE;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;SACrE,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEvE;;;;;;;;;OASG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzH;;;;;;;OAOG;IACH,mGAAmG;IACnG,iGAAiG;IACjG,yDAAyD;IACzD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;SAC3C,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,sBAAsB,EAAE,CACtC;IAED,gGAAgG;IAChG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAExI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAIH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmG,EACnG,mBAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC","sourcesContent":["/**\n * `systemOfRecordPartitionAssignments` — which ORGANIZATION UNIT a remote partition belongs to.\n *\n * ## The gap this closes\n *\n * A system of record holds several partitions inside one corporate: Odoo companies (`company_id`),\n * SAP company codes, Dynamics business units, NetSuite subsidiaries. Every row read out of one is\n * stamped with the application's OWNER organization (#1055 §6) — so before this resource existed,\n * every member of that organization saw every partition, and the Spanish subsidiary's accountant\n * read the German company's invoices.\n *\n * The mechanism that confines WITHIN one organization already exists and is pinned: organization\n * unit narrowing. What it lacked was the edge from a remote partition key to a Wildo unit. This\n * resource IS that edge, and it is deliberately the only thing that carries it:\n *\n * ```\n *   Odoo company_id = 10  ──(this row)──▶  unit \"Acme Deutschland\"  ──(unit narrowing)──▶  members\n * ```\n *\n * ## Why the edge points THIS way\n *\n * The remote has never heard of Wildo. Pushing a Wildo unit id into Odoo was rejected in the slice's\n * own alternatives table for that reason — there is nothing on the far side to receive it. So the\n * mapping lives here, and the read path walks it in REVERSE: a caller's effective unit set becomes a\n * set of remote keys, which is what a remote predicate can actually be written in.\n *\n * ## APPLICATION-scoped, not ORGANIZATIONS-scoped (slice E10)\n *\n * Every row here names a unit of the owner organization, so the tenant-scoped shape is the intuitive\n * one and it is wrong. Assigning a remote partition is an OPERATOR act (D11) — the deployment's own\n * administrator deciding which part of the operator's ERP a unit of their customer-facing org chart\n * corresponds to. An operator door on an ORGANIZATIONS-scoped resource would need\n * `admitsCrossTenantPlatformAdministration` on every verb plus a platform access grant per crossing\n * (`.claude/rules/administrative-continuity-floors.md`), which is the ceremony for reaching into a\n * CUSTOMER's data — not for editing the deployment's own configuration.\n *\n * The precedent is `applicationAccessGrants` beside `platformAccessGrants`: a sibling resource type\n * at the scope the act actually has, rather than a nullable tenant field weakening the resource whose\n * tenant field IS its control.\n *\n * ## What identifies an assignment, and what an edit may change\n *\n * `[system, remoteKey]` is the business key: one remote partition maps to at most one unit, and that\n * uniqueness is persisted rather than conventional. All three of `system`, `remoteKey` and\n * `organizationUnitId` are `.excludeFromUpdate()`, which leaves an ordinary UPDATE with nothing to\n * write — deliberately. A reassignment is a MOVE-shaped custom operation carrying a compare-and-swap\n * on the CURRENT unit (slice E11), because \"move partition 10 from Deutschland to Österreich\" is a\n * decision about two units and a plain field write can neither name the unit it expected to replace\n * nor refuse when another operator got there first.\n *\n * ⚠️ An excluded-field write SUCCEEDS and persists nothing — the repository's strict re-parse drops\n * it. So the reassign door must write through a path that re-attaches the field\n * (`preserveServerInjectedFields` / an authoritative write), never a plain UPDATE that looks like it\n * worked. `.claude/rules/invariant-call-site-enumeration.md` #8 is this exact shape.\n *\n * ## `remoteKey` is a STRING, and the codec is what makes that safe\n *\n * Odoo's `company_id` is an integer; Dataverse's is a GUID; NetSuite's subsidiary is an integer. One\n * stored shape across every vendor would either lose type information or need a column per vendor, so\n * the row carries the key's CANONICAL TEXT and the facet's partition declaration carries the codec\n * that decodes it before a predicate is compiled. Storing `10` as `'10'` and comparing it against\n * Odoo's integer `10` without decoding is the defect that codec exists to prevent.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a remote partition reaches only the unit an\n * operator assigned it to, and a member reaches only the partitions their unit grants.\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every assignment change is justified and\n * recorded with its before/after unit.\n */\n\nimport { z } from 'zod';\n\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { SYSTEM_OF_RECORD_NAME_MAX_LENGTH, SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Fixed replacement for assignment free-text that cannot be cleared (a `.min(1)` field). */\nconst ERASED_ASSIGNMENT_TEXT = '[erased]';\n\n/**\n * The longest canonical text a remote partition key may have.\n *\n * 128 is a GUID (36) with room for a vendor that composes one — NetSuite's internal ids, an SAP\n * company code, a Dataverse business-unit id. Bounded rather than open because the value is compiled\n * into a remote predicate: an OData `or`-chain of keys is a URL, and a URL has a length the vendor\n * enforces long before we would.\n */\nexport const SYSTEM_OF_RECORD_REMOTE_KEY_MAX_LENGTH = 128;\n\n/** One transition in the life of a partition assignment. */\nexport enum SystemOfRecordPartitionAssignmentTransition {\n  /** A remote partition gained a unit it did not have. */\n  ASSIGNED = 'assigned',\n  /** An assigned partition MOVED to a different unit — carries both units. */\n  REASSIGNED = 'reassigned',\n  /** The edge was removed. The partition becomes unreachable to every caller. */\n  UNASSIGNED = 'unassigned',\n}\n\n/** The custom doors this resource opens beyond the core verbs. */\nexport const SystemOfRecordPartitionAssignments_Operations = {\n  /**\n   * Move an assigned partition to a different unit, under a compare-and-swap on the current one.\n   *\n   * Not an UPDATE: `organizationUnitId` is `.excludeFromUpdate()` precisely so this is the only door,\n   * and the CAS is what makes concurrent operators safe — two administrators reassigning the same\n   * partition in opposite directions must not silently produce whichever write landed second.\n   */\n  REASSIGN: 'reassign',\n} as const;\n\nexport const SystemOfRecordPartitionAssignmentSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The primary-scope parent — the deployment this assignment configures.\n   *\n   * OPTIONAL, copying `applicationAccessGrants` and `applicationAuditLogs` rather than loosening\n   * anything: declared MANDATORY the resource does not load at all on a Mongo-persisted deployment\n   * (the ZodToMongoose convertor refuses it and INIT dies on\n   * `zod_converter_schema_conversion_failed`). Addressing is carried by `isPrimaryScope` +\n   * `REQUIRES_CONTEXT` on the relationship, which is what the URL builder reads, so the route is\n   * identical either way.\n   */\n  applicationId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * WHICH declared instance this partition lives in — a `systemsOfRecord.<name>` key.\n   *\n   * Instance-scoped rather than vendor-scoped, and that is load-bearing: two Odoo deployments\n   * (`odoo-fr`, `odoo-de`) share one vendor facet and have entirely unrelated company ids. A key\n   * scoped to the vendor would let one deployment's company 10 resolve through the other's map.\n   *\n   * ⚠️ Built from the exported PATTERN and MAX_LENGTH rather than from `SystemOfRecordNameSchema`,\n   * and that is not a style choice. A zod decorator MUTATES the schema object it is called on —\n   * measured 2026-09-18: `shared.isDBIndexed() === shared` is `true`, and the metadata lands on the\n   * shared object. Chaining off the exported instance-name schema would therefore stamp\n   * `isDBIndexed`/`isSummaryField`/`excludeFromUpdate`/`isAuditEvidence` onto the schema that\n   * validates `systemsOfRecord.<name>` keys in `wildo.saas.config.ts`, which is a configuration key\n   * and not a resource field. The two constants ARE the single source — they are exported precisely\n   * because the environment-variable derivation depends on them — so nothing is duplicated here\n   * except the act of building a fresh schema out of them.\n   */\n  system: z.string()\n    .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n    .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH)\n    .isDBIndexed().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The partition's key AS THE REMOTE SPELLS IT, in canonical text.\n   *\n   * Decoded through the facet's partition codec before it reaches a compiler — see the class doc on\n   * why one stored shape plus a codec beats a column per vendor.\n   */\n  remoteKey: z.string().min(1).max(SYSTEM_OF_RECORD_REMOTE_KEY_MAX_LENGTH)\n    .isDBIndexed().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The unit of the OWNER organization this partition belongs to.\n   *\n   * `.excludeFromUpdate()` so the only writer is the `reassign` door and its compare-and-swap.\n   *\n   * The foreign key buys EXISTENCE and nothing more. An APPLICATION-scoped row written by a\n   * super-administrator resolves `writeTenantId === ''` in the write-integrity check, so the FK\n   * cannot also assert that the unit belongs to the owner organization or that it is ACTIVE — both\n   * are checked in the custom implementation through the system door, and pinned there (slice R10).\n   */\n  organizationUnitId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * Why this partition belongs to this unit. REQUIRED, on the `applicationAccessGrants` precedent.\n   *\n   * It carries real weight here rather than being ceremony: an assignment is an access decision with\n   * no expiry — unlike a grant, it stands until someone changes it — and the next operator looking at\n   * \"company 10 → Deutschland\" has no other way to learn whether that reflects the corporate\n   * structure or somebody's guess during an incident.\n   */\n  // USER_CONTENT — free prose an OPERATOR typed. MASK rather than REMOVE on erasure: `.min(1)` makes\n  // it non-clearable, so a null would be rejected by the strict update-DTO parse the impersonalize\n  // writer runs, and a fixed non-empty string is accepted.\n  justification: addImpersonalizeWith(\n    z.string().min(1).max(1000).isSummaryField()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.MASK,\n    { maskValue: ERASED_ASSIGNMENT_TEXT },\n  ),\n\n  /** The operator who last assigned or moved this partition. Server-authored from the session. */\n  assignedByUserId: z.string().min(1).optional().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'system',\n  'remoteKey',\n]);\n\nexport type SystemOfRecordPartitionAssignment = z.infer<typeof SystemOfRecordPartitionAssignmentSchema>;\n\n/**\n * The inverse map a read uses: unit ids → the remote keys confined to them.\n *\n * Built per request from the rows this caller's units reach. Deliberately NOT cached — measured\n * 2026-09-18, the indexed lookup is 0.078–0.177 ms at 20× the realistic row count, against a 1.02 ms\n * p50 floor for the remote read it precedes (a loopback socket with a handler that does nothing but\n * serialize). A real system of record is 50–500 ms, so the cache would save ~0.1 ms on a path about\n * to spend three orders of magnitude more.\n *\n * The correctness half is what settles it: the cached value is a SECURITY CONFINEMENT, so a stale\n * entry means a member still reads a partition they were unassigned from — the defect this resource\n * exists to close, re-entering through the cache. `ApplicationOwnerOrganizationResolverBackendService`\n * caches for the process lifetime and is right to, because its invalidating event is an owner\n * PROMOTION — once per application lifetime. Reassigning a partition is ordinary administration.\n */\nexport function buildRemoteKeysForUnits(\n  assignments: readonly Pick<SystemOfRecordPartitionAssignment, 'organizationUnitId' | 'remoteKey'>[],\n  organizationUnitIds: readonly string[],\n): string[] {\n  const wanted = new Set(organizationUnitIds);\n  const keys = new Set<string>();\n  for (const assignment of assignments) {\n    if (wanted.has(assignment.organizationUnitId)) keys.add(assignment.remoteKey);\n  }\n  return [...keys];\n}\n"]}

package/dist/esm/testing/resource-config-builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-config-builders.d.ts","sourceRoot":"","sources":["../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2CAA2C,EAC5C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAKL,oBAAoB,EAKrB,MAAM,uCAAuC,CAAC;AAG/C,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CA6C5F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,mBAAmB,GAAE,qBAAkD,GACtE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAsChD;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,UAAU,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAC3D,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CA0BtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,2CAA2C,CAuI7C;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,oBAAoB,EAAE,CAQxB"}
+{"version":3,"file":"resource-config-builders.d.ts","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2CAA2C,EAC5C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAKL,oBAAoB,EAKrB,MAAM,uCAAuC,CAAC;AAG/C,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CA6C5F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,mBAAmB,GAAE,qBAAkD,GACtE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAsChD;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,UAAU,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAC3D,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CA0BtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,2CAA2C,CAuI7C;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,oBAAoB,EAAE,CAQxB"}

package/dist/esm/testing/resource-config-builders.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-config-builders.js","sourceRoot":"","sources":["../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EACL,qBAAqB,GAGtB,MAAM,gDAAgD,CAAC;AAMxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,UAAU,gBAAgB,CAAC,SAAuC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;QAClF,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,oBAAoB,EAAE,SAAS;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrC,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD;;;;;WAKG;QACH,cAAc,EAAE;YACd,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,KAAK;YACvB,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,EAAE;QAC1B,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,IAAI;SACpC;QACD,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAwB,EACxB,sBAA6C,qBAAqB,CAAC,IAAI;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,gBAAgB,EAAE,KAAK;QACvB,mBAAmB;QACnB,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,QAAe;QACnC,2BAA2B,EAAE,EAAE;QAC/B,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,qBAAqB,EAAE,SAAS;QAChC,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,0BAA0B,CAAC,GAAG;QACzC,KAAK,EAAE,EAAE;QACT,gCAAgC,EAAE,EAAE;QACpC,oBAAoB,EAAE,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,sBAAsB,EAAE,KAAK;QAC7B,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,SAAS;KAC4B,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAwB,EACxB,UAA4D;IAE5D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,SAAS;QAC1B,UAAU;QACV,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,2BAA2B,EAAE,SAAS;QACtC,gBAAgB,EAAE,KAAK;QACvB,iGAAiG;QACjG,cAAc,EAAE,KAAK;QACrB,4FAA4F;QAC5F,mBAAmB,EAAE,2BAA2B,CAAC,GAAG;QACpD,UAAU;KACoC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,kBAA0B,EAC1B,qBAA6C;IAE7C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;IAEF,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACxB,CAAC;IAEF,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAE7F,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE7E,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,kBAA0B,EAC1B,qBAA6C;IAE7C,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,EAAE,kBAAkB;QACrC,GAAG,CAAC,aAAa,CAAC,MAAM;QACxB,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CAAC,CACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared helpers for saas-models tests: minimal resource configs, auth fixtures,\n * and relationship processing that mirrors `createResourceConfiguration_Initialization`.\n *\n * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.\n */\nimport type { z } from 'zod';\nimport {\n  EmailVerificationMode,\n  RegistrationMode,\n  type UserTypeAuthPolicy,\n} from '../config/entity-identity-config.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport {\n  CoreResourceOperation,\n  ResourceFieldIdentifier,\n  ResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport type {\n  ResourceConfiguration,\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_ResourceRelationships,\n} from '../resources/resources-config.shared.schemas';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceTranspositionPolicy,\n} from '../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../resources/resources.shared.utils';\n\nexport function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy {\n  return {\n    authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.MAGIC_LINK]: true },\n    mfaPolicy: {\n      requireMFA: false,\n      requireStrongMFA: false,\n      acceptableMFAMethods: undefined,\n      enrollmentGracePeriodDays: 14,\n      passkeyExemptFromMFA: true,\n    },\n    registration: {\n      mode: RegistrationMode.OPEN,\n      allowedMethods: [AuthMethod.PASSWORD],\n      emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n      blockForSSODomains: false,\n    },\n    /*\n     * Mirrors the production default (#1249). It did not: this builder said `requireNumbers: false`\n     * while all five production declarations said `true`, so every test written against it validated a\n     * policy no application had. That is worth more than the fix — a test double that drifts from the\n     * thing it doubles reports on a product that does not exist.\n     */\n    passwordPolicy: {\n      minLength: 15,\n      maxLength: 128,\n      requireUppercase: false,\n      requireLowercase: false,\n      requireNumbers: false,\n      requireSpecialChars: false,\n      expiryDays: 0,\n    },\n    sessionDurationMinutes: 30,\n    lockoutPolicy: {\n      maxLoginAttempts: 5,\n      lockoutDurationMinutes: 30,\n      progressiveLockout: false,\n      maxProgressiveLockoutHours: 24,\n    },\n    autoLinkByEmail: true,\n    methodManagement: {\n      allowUserMethodRemoval: true,\n      requireReauthForMethodChanges: true,\n    },\n    ...overrides,\n  } as UserTypeAuthPolicy;\n}\n\n/**\n * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.\n *\n * **Not** the same symbol as `createTestOperation` in `@wildo-ai/saas-backend-lib/testing`\n * (`feature-test-utils.ts`), which builds operation stubs for **feature-gate** tests.\n */\nexport function createTestOperation(\n  mainSchema: z.ZodTypeAny,\n  operationIdentifier: CoreResourceOperation = CoreResourceOperation.READ\n): ResourceConfiguration_Operation<any, any, any> {\n  return {\n    isDisabled: false,\n    mainSchema,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    isSystemResource: false,\n    operationIdentifier,\n    isOperationDefault: true,\n    serviceRuntimeMode: 'INLINE' as any,\n    notificationBadgeOperations: [],\n    userNotifications: [],\n    m2mNotifications: [],\n    variantType: ResourceOperationVariantType.API_CALL,\n    resourceOperationLike: undefined,\n    requiredFeatures: undefined,\n    riskLevel: ResourceOperationRiskLevel.LOW,\n    roles: [],\n    customServiceImplementationModes: [],\n    basicPrefixOperation: undefined,\n    httpVerb: HttpMethod.GET,\n    isApiKeyAccessDisabled: false,\n    isBulkOperation: false,\n    consumableToken: undefined,\n    enabledCondition: undefined,\n    isDefault: true,\n    variantKey: undefined,\n  } as ResourceConfiguration_Operation<any, any, any>;\n}\n\nexport function createTestResourceConfig(\n  mainSchema: z.ZodTypeAny,\n  operations: ResourceConfiguration_Operation<any, any, any>[]\n): ResourceConfiguration<any, any, any> {\n  return {\n    isDisabled: false,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    coreOperations: [],\n    customOperation: undefined,\n    mainSchema,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    inheritenceSchemaDefinition: undefined,\n    isSystemResource: false,\n    /** W7.3a: test fixtures default to non-anonymizable unless overrides replace the full config. */\n    isAnonymizable: false,\n    /** Required by type; only applied when `isAnonymizable` is true (engine default is ADD). */\n    transpositionPolicy: ResourceTranspositionPolicy.ADD,\n    operations,\n  } satisfies ResourceConfiguration<any, any, any>;\n}\n\n/**\n * Process relationships for a resource — mirrors the logic in createResourceConfiguration_Initialization.\n * M:N relationships are transformed into 1:N relationships for the junction table.\n *\n * The helper expects compiled runtime relationships, matching the production\n * factory output from `createResourcesRelationship()` / registry initialization.\n */\nexport function processResourceRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceConfiguration_ResourceRelationships {\n  const compileSyntheticRelationship = (\n    relationshipDeclaration: ResourceRelationshipDeclaration\n  ): ResourceRelationship =>\n    Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n  const activeRelationships = resourceRelationships.filter((rel) => !rel.isDisabled);\n\n  const isManyToMany = (rel: ResourceRelationship) =>\n    rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n    rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n    rel.jointResourceType;\n\n  const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n    parentRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType2 === resourceIdentifier &&\n        rel.resourceType1 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    childRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    selfRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 === resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n  };\n\n  const manyToManyRelationships = activeRelationships.filter(\n    (rel) =>\n      rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n      rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n      rel.jointResourceType\n  );\n\n  manyToManyRelationships.forEach((m2mRel) => {\n    Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n    const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType } = m2mRel;\n\n    if (resourceIdentifier === jointResourceType) {\n      const relationFromEntity1 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity1Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity1);\n\n      const relationFromEntity2 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity2Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity2);\n    } else if (resourceIdentifier === entity1Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    } else if (resourceIdentifier === entity2Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    }\n  });\n\n  return processedResourceRelationships;\n}\n\n/**\n * Conditional relationships — active only for specific discriminator variants.\n */\nexport function getConditionalRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceRelationship[] {\n  return resourceRelationships.filter(\n    (rel) =>\n      rel.discriminator?.discriminatorField &&\n      rel.discriminator.values &&\n      rel.discriminator.values.length > 0 &&\n      (rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier)\n  );\n}\n"]}
+{"version":3,"file":"resource-config-builders.js","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EACL,qBAAqB,GAGtB,MAAM,gDAAgD,CAAC;AAMxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,UAAU,gBAAgB,CAAC,SAAuC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;QAClF,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,oBAAoB,EAAE,SAAS;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrC,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD;;;;;WAKG;QACH,cAAc,EAAE;YACd,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,KAAK;YACvB,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,EAAE;QAC1B,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,IAAI;SACpC;QACD,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAwB,EACxB,sBAA6C,qBAAqB,CAAC,IAAI;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,gBAAgB,EAAE,KAAK;QACvB,mBAAmB;QACnB,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,QAAe;QACnC,2BAA2B,EAAE,EAAE;QAC/B,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,qBAAqB,EAAE,SAAS;QAChC,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,0BAA0B,CAAC,GAAG;QACzC,KAAK,EAAE,EAAE;QACT,gCAAgC,EAAE,EAAE;QACpC,oBAAoB,EAAE,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,sBAAsB,EAAE,KAAK;QAC7B,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,SAAS;KAC4B,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAwB,EACxB,UAA4D;IAE5D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,SAAS;QAC1B,UAAU;QACV,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,2BAA2B,EAAE,SAAS;QACtC,gBAAgB,EAAE,KAAK;QACvB,iGAAiG;QACjG,cAAc,EAAE,KAAK;QACrB,4FAA4F;QAC5F,mBAAmB,EAAE,2BAA2B,CAAC,GAAG;QACpD,UAAU;KACoC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,kBAA0B,EAC1B,qBAA6C;IAE7C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;IAEF,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACxB,CAAC;IAEF,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAE7F,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE7E,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,kBAA0B,EAC1B,qBAA6C;IAE7C,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,EAAE,kBAAkB;QACrC,GAAG,CAAC,aAAa,CAAC,MAAM;QACxB,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CAAC,CACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared helpers for saas-models tests: minimal resource configs, auth fixtures,\n * and relationship processing that mirrors `createResourceConfiguration_Initialization`.\n *\n * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.\n */\nimport type { z } from 'zod';\nimport {\n  EmailVerificationMode,\n  RegistrationMode,\n  type UserTypeAuthPolicy,\n} from '../config/entity-identity-config.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport {\n  CoreResourceOperation,\n  ResourceFieldIdentifier,\n  ResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport type {\n  ResourceConfiguration,\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_ResourceRelationships,\n} from '../resources/resources-config.shared.schemas';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceTranspositionPolicy,\n} from '../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../resources/resources.shared.utils';\n\nexport function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy {\n  return {\n    authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.MAGIC_LINK]: true },\n    mfaPolicy: {\n      requireMFA: false,\n      requireStrongMFA: false,\n      acceptableMFAMethods: undefined,\n      enrollmentGracePeriodDays: 14,\n      passkeyExemptFromMFA: true,\n    },\n    registration: {\n      mode: RegistrationMode.OPEN,\n      allowedMethods: [AuthMethod.PASSWORD],\n      emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n      blockForSSODomains: false,\n    },\n    /*\n     * Mirrors the production default (#1249). It did not: this builder said `requireNumbers: false`\n     * while all five production declarations said `true`, so every test written against it validated a\n     * policy no application had. That is worth more than the fix — a test double that drifts from the\n     * thing it doubles reports on a product that does not exist.\n     */\n    passwordPolicy: {\n      minLength: 15,\n      maxLength: 128,\n      requireUppercase: false,\n      requireLowercase: false,\n      requireNumbers: false,\n      requireSpecialChars: false,\n      expiryDays: 0,\n    },\n    sessionDurationMinutes: 30,\n    lockoutPolicy: {\n      maxLoginAttempts: 5,\n      lockoutDurationMinutes: 30,\n      progressiveLockout: false,\n      maxProgressiveLockoutHours: 24,\n    },\n    autoLinkByEmail: true,\n    methodManagement: {\n      allowUserMethodRemoval: true,\n      requireReauthForMethodChanges: true,\n    },\n    ...overrides,\n  } as UserTypeAuthPolicy;\n}\n\n/**\n * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.\n *\n * **Not** the same symbol as `createTestOperation` in `@wildo-ai/saas-backend-lib/testing`\n * (`feature-test-utils.ts`), which builds operation stubs for **feature-gate** tests.\n */\nexport function createTestOperation(\n  mainSchema: z.ZodTypeAny,\n  operationIdentifier: CoreResourceOperation = CoreResourceOperation.READ\n): ResourceConfiguration_Operation<any, any, any> {\n  return {\n    isDisabled: false,\n    mainSchema,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    isSystemResource: false,\n    operationIdentifier,\n    isOperationDefault: true,\n    serviceRuntimeMode: 'INLINE' as any,\n    notificationBadgeOperations: [],\n    userNotifications: [],\n    m2mNotifications: [],\n    variantType: ResourceOperationVariantType.API_CALL,\n    resourceOperationLike: undefined,\n    requiredFeatures: undefined,\n    riskLevel: ResourceOperationRiskLevel.LOW,\n    roles: [],\n    customServiceImplementationModes: [],\n    basicPrefixOperation: undefined,\n    httpVerb: HttpMethod.GET,\n    isApiKeyAccessDisabled: false,\n    isBulkOperation: false,\n    consumableToken: undefined,\n    enabledCondition: undefined,\n    isDefault: true,\n    variantKey: undefined,\n  } as ResourceConfiguration_Operation<any, any, any>;\n}\n\nexport function createTestResourceConfig(\n  mainSchema: z.ZodTypeAny,\n  operations: ResourceConfiguration_Operation<any, any, any>[]\n): ResourceConfiguration<any, any, any> {\n  return {\n    isDisabled: false,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    coreOperations: [],\n    customOperation: undefined,\n    mainSchema,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    inheritenceSchemaDefinition: undefined,\n    isSystemResource: false,\n    /** W7.3a: test fixtures default to non-anonymizable unless overrides replace the full config. */\n    isAnonymizable: false,\n    /** Required by type; only applied when `isAnonymizable` is true (engine default is ADD). */\n    transpositionPolicy: ResourceTranspositionPolicy.ADD,\n    operations,\n  } satisfies ResourceConfiguration<any, any, any>;\n}\n\n/**\n * Process relationships for a resource — mirrors the logic in createResourceConfiguration_Initialization.\n * M:N relationships are transformed into 1:N relationships for the junction table.\n *\n * The helper expects compiled runtime relationships, matching the production\n * factory output from `createResourcesRelationship()` / registry initialization.\n */\nexport function processResourceRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceConfiguration_ResourceRelationships {\n  const compileSyntheticRelationship = (\n    relationshipDeclaration: ResourceRelationshipDeclaration\n  ): ResourceRelationship =>\n    Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n  const activeRelationships = resourceRelationships.filter((rel) => !rel.isDisabled);\n\n  const isManyToMany = (rel: ResourceRelationship) =>\n    rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n    rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n    rel.jointResourceType;\n\n  const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n    parentRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType2 === resourceIdentifier &&\n        rel.resourceType1 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    childRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    selfRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 === resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n  };\n\n  const manyToManyRelationships = activeRelationships.filter(\n    (rel) =>\n      rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n      rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n      rel.jointResourceType\n  );\n\n  manyToManyRelationships.forEach((m2mRel) => {\n    Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n    const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType } = m2mRel;\n\n    if (resourceIdentifier === jointResourceType) {\n      const relationFromEntity1 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity1Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity1);\n\n      const relationFromEntity2 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity2Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity2);\n    } else if (resourceIdentifier === entity1Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    } else if (resourceIdentifier === entity2Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    }\n  });\n\n  return processedResourceRelationships;\n}\n\n/**\n * Conditional relationships — active only for specific discriminator variants.\n */\nexport function getConditionalRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceRelationship[] {\n  return resourceRelationships.filter(\n    (rel) =>\n      rel.discriminator?.discriminatorField &&\n      rel.discriminator.values &&\n      rel.discriminator.values.length > 0 &&\n      (rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier)\n  );\n}\n"]}

package/dist/esm/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC"}

package/dist/esm/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC","sourcesContent":["/**\n * Public testing surface for @wildo-ai/saas-models.\n * Import from `@wildo-ai/saas-models/testing` — not from the main package entry.\n */\nexport * from './testing/resource-config-builders';\n"]}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC","sourcesContent":["/**\n * Public testing surface for @wildo-ai/saas-models.\n * Import from `@wildo-ai/saas-models/testing` — not from the main package entry.\n */\nexport * from './testing/resource-config-builders';\n"]}

package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;iBAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oCAAoC;;;;;;;;;;;iBAK/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}
+{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;iBAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oCAAoC;;;;;;;;;;;iBAK/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAO,0CAA0C;AAClF,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,OAAO,EAAI,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAc,mBAAmB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAC/D,WAAW,EAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACnE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser First-Touch Marketing Attribution (Phase 0.5, Q-D=β)\n *\n * Captured ONCE at session-init time on `AnonymousUser.marketingMetadata`\n * and never overwritten on subsequent requests (first-touch semantics).\n * Attribution lives on the session, not the conversion row — so a single\n * `AnonymousUser` is the canonical source whether the visitor:\n *   - converts via an `InboundContact` form submission,\n *   - signs up directly,\n *   - or never converts at all (cleaned up by the anonymous-session-cleanup\n *     batch at session TTL).\n *\n * Marketing analytics joins `InboundContact → AnonymousUser →\n * marketingMetadata` via the `anonymousUserId` FK declared in\n * `inbound-contacts.shared.schemas.ts`.\n *\n * Field-by-field rationale:\n *\n * - `utm.*`            — Standard UTM parameters extracted from `req.query`\n *                        on the marketing site landing request. All optional\n *                        because organic / direct traffic has none.\n * - `referrer`         — `Referer` HTTP header (note the historical\n *                        misspelling — kept as `referrer` here to match\n *                        the analytics-industry convention rather than\n *                        the HTTP-header spec spelling).\n * - `landingPath`      — Path of the FIRST page the visitor landed on\n *                        (e.g. `/pricing`, `/blog/post-slug`). Sourced\n *                        from a marketing-site-only `x-landing-path` HTTP\n *                        header (registered in `WildoHeaderKeys`) that\n *                        the marketing-site bootstrap injects on the\n *                        very first request to the anonymous-session-init\n *                        endpoint. We do NOT use `req.path` because the\n *                        anonymous-session-init endpoint URL is itself\n *                        not a marketing landing page.\n * - `acceptLanguage`   — Raw `Accept-Language` header (full string, not\n *                        parsed). Useful for analytics segmentation and\n *                        for inferring locale preference when the visitor\n *                        eventually creates an account.\n *\n * NOT modeled here (already on parent `AnonymousUserSchema`):\n * - `userAgent`         — `AnonymousUser.userAgent` (line 14).\n * - consent            — `AnonymousUserPrivacy.consentedPurposes` (what was granted) and\n *                        `consentDecidedAt` (when the visitor decided — a decision, not necessarily a grant).\n * - `ipHash`            — `AnonymousUser.ipHash` (line 15).\n *\n * Length caps mirror the existing `AnonymousUser.userAgent` truncation\n * pattern (`.substring(0, 256)` in `createAnonymousUser`) — applied at\n * the schema level here so the boundary is explicit and re-used at every\n * write site.\n */\n\nimport { z } from 'zod';\n\nconst MAX_UTM_FIELD_LENGTH = 256;\nconst MAX_REFERRER_LENGTH = 2048;       // URLs can be long (oauth callbacks etc.)\nconst MAX_LANDING_PATH_LENGTH = 2048;\nconst MAX_ACCEPT_LANGUAGE_LENGTH = 256;\n\n/**\n * Standard UTM parameter subobject. Every field optional because\n * organic / direct traffic carries no UTM params at all.\n */\nexport const UtmParametersSchema = z.object({\n  source   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  medium   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  campaign : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  term     : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  content  : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n});\n\nexport type UtmParameters = z.infer<typeof UtmParametersSchema>;\n\nexport const AnonymousUserMarketingMetadataSchema = z.object({\n  utm            : UtmParametersSchema.optional(),\n  referrer       : z.string().max(MAX_REFERRER_LENGTH).optional(),\n  landingPath    : z.string().max(MAX_LANDING_PATH_LENGTH).optional(),\n  acceptLanguage : z.string().max(MAX_ACCEPT_LANGUAGE_LENGTH).optional(),\n});\n\nexport type AnonymousUserMarketingMetadata = z.infer<typeof AnonymousUserMarketingMetadataSchema>;\n"]}
+{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAO,0CAA0C;AAClF,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,OAAO,EAAI,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAc,mBAAmB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAC/D,WAAW,EAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACnE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser First-Touch Marketing Attribution (Phase 0.5, Q-D=β)\n *\n * Captured ONCE at session-init time on `AnonymousUser.marketingMetadata`\n * and never overwritten on subsequent requests (first-touch semantics).\n * Attribution lives on the session, not the conversion row — so a single\n * `AnonymousUser` is the canonical source whether the visitor:\n *   - converts via an `InboundContact` form submission,\n *   - signs up directly,\n *   - or never converts at all (cleaned up by the anonymous-session-cleanup\n *     batch at session TTL).\n *\n * Marketing analytics joins `InboundContact → AnonymousUser →\n * marketingMetadata` via the `anonymousUserId` FK declared in\n * `inbound-contacts.shared.schemas.ts`.\n *\n * Field-by-field rationale:\n *\n * - `utm.*`            — Standard UTM parameters extracted from `req.query`\n *                        on the marketing site landing request. All optional\n *                        because organic / direct traffic has none.\n * - `referrer`         — `Referer` HTTP header (note the historical\n *                        misspelling — kept as `referrer` here to match\n *                        the analytics-industry convention rather than\n *                        the HTTP-header spec spelling).\n * - `landingPath`      — Path of the FIRST page the visitor landed on\n *                        (e.g. `/pricing`, `/blog/post-slug`). Sourced\n *                        from a marketing-site-only `x-landing-path` HTTP\n *                        header (registered in `WildoHeaderKeys`) that\n *                        the marketing-site bootstrap injects on the\n *                        very first request to the anonymous-session-init\n *                        endpoint. We do NOT use `req.path` because the\n *                        anonymous-session-init endpoint URL is itself\n *                        not a marketing landing page.\n * - `acceptLanguage`   — Raw `Accept-Language` header (full string, not\n *                        parsed). Useful for analytics segmentation and\n *                        for inferring locale preference when the visitor\n *                        eventually creates an account.\n *\n * NOT modeled here (already on parent `AnonymousUserSchema`):\n * - `userAgent`         — `AnonymousUser.userAgent` (line 14).\n * - consent            — `AnonymousUserPrivacy.consentedPurposes` (what was granted) and\n *                        `consentDecidedAt` (when the visitor decided — a decision, not necessarily a grant).\n * - `ipHash`            — `AnonymousUser.ipHash` (line 15).\n *\n * Length caps mirror the existing `AnonymousUser.userAgent` truncation\n * pattern (`.substring(0, 256)` in `createAnonymousUser`) — applied at\n * the schema level here so the boundary is explicit and re-used at every\n * write site.\n */\n\nimport { z } from 'zod';\n\nconst MAX_UTM_FIELD_LENGTH = 256;\nconst MAX_REFERRER_LENGTH = 2048;       // URLs can be long (oauth callbacks etc.)\nconst MAX_LANDING_PATH_LENGTH = 2048;\nconst MAX_ACCEPT_LANGUAGE_LENGTH = 256;\n\n/**\n * Standard UTM parameter subobject. Every field optional because\n * organic / direct traffic carries no UTM params at all.\n */\nexport const UtmParametersSchema = z.object({\n  source   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  medium   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  campaign : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  term     : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  content  : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n});\n\nexport type UtmParameters = z.infer<typeof UtmParametersSchema>;\n\nexport const AnonymousUserMarketingMetadataSchema = z.object({\n  utm            : UtmParametersSchema.optional(),\n  referrer       : z.string().max(MAX_REFERRER_LENGTH).optional(),\n  landingPath    : z.string().max(MAX_LANDING_PATH_LENGTH).optional(),\n  acceptLanguage : z.string().max(MAX_ACCEPT_LANGUAGE_LENGTH).optional(),\n});\n\nexport type AnonymousUserMarketingMetadata = z.infer<typeof AnonymousUserMarketingMetadataSchema>;\n"]}

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAA4B,MAAM,+CAA+C,CAAC;AAGzG,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,cAAc,mBAAmB;IACjC,sFAAsF;IACtF,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,2CAA2C;;;iBAOtD,CAAC;AAEH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C;;;;iBAOvD,CAAC;AAEH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH;;;;;;;;;GASG;AACH,eAAO,MAAM,mDAAmD;;iBAG9D,CAAC;AACH,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAEhI;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oDAAoD;;iBAG/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,QAC0H,CAAC;AAE9K,0KAA0K;AAC1K,eAAO,MAAM,wCAAwC,QAAQ,CAAC;AAE9D,eAAO,MAAM,yDAAyD,GACpE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;kBAsP9C,CAAC"}
+{"version":3,"file":"anonymous-users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAA4B,MAAM,+CAA+C,CAAC;AAGzG,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,cAAc,mBAAmB;IACjC,sFAAsF;IACtF,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,2CAA2C;;;iBAOtD,CAAC;AAEH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C;;;;iBAOvD,CAAC;AAEH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH;;;;;;;;;GASG;AACH,eAAO,MAAM,mDAAmD;;iBAG9D,CAAC;AACH,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAEhI;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oDAAoD;;iBAG/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,QAC0H,CAAC;AAE9K,0KAA0K;AAC1K,eAAO,MAAM,wCAAwC,QAAQ,CAAC;AAE9D,eAAO,MAAM,yDAAyD,GACpE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;kBAsP9C,CAAC"}

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAIX;AAJD,WAAY,yBAAyB;IACnC,8DAAiC,CAAA;IACjC,sFAAsF;IACtF,gFAAmD,CAAA;AACrD,CAAC,EAJW,yBAAyB,KAAzB,yBAAyB,QAIpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SACrD,QAAQ,CAAC,qJAAqJ,CAAC;IAClK,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SAC5D,QAAQ,CAAC,iJAAiJ,CAAC;CAC/J,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC/C,QAAQ,CAAC,+GAA+G,CAAC;IAC5H,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC7C,QAAQ,CAAC,qEAAqE,CAAC;IAClF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC/D,QAAQ,CAAC,gEAAgE,CAAC;CAC9E,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAClC,QAAQ,CAAC,6NAA6N,CAAC;CAC3O,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;SAClB,QAAQ,CAAC,4LAA4L,CAAC;CAC1M,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,0BAA0B,CAAC,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,WAAW,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE,CAAC;AAE9K,0KAA0K;AAC1K,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,yDAAyD,GAAG,CACvE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,eAAe;IACpD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC7F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,iFAAiF;IACjF,6EAA6E;IAC7E,kFAAkF;IAClF,8EAA8E;IAC9E,sFAAsF;IACtF,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAChE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,yBAAyB;IAC1C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,6EAA6E;oBAC7E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,gFAAgF;oBAChF,gFAAgF;oBAChF,kEAAkE;oBAClE,iFAAiF;oBACjF,wFAAwF;oBACxF,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wGAAwG;oBACvJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,CAAC,yBAAyB,CAAC,cAAc,CAAC,EAAE;YAC1C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,2CAA2C;oBACvD,iBAAiB,EAAE,4CAA4C;oBAC/D,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD;;;;;;;;;;;;;;;uBAeG;oBACH,gCAAgC,EAAE,IAAI;oBACtC;;;;;;;;;;;uBAWG;oBACH,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACrC,MAAM,OAAO,GAAG,2CAA2C,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC1E,OAAO;4BACL,OAAO,EAAE;gCACP,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC;qCACjE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gCACzD,eAAe;6BAChB;yBACF,CAAC;oBACJ,CAAC;oBACD,qFAAqF;oBACrF,iFAAiF;oBACjF,4FAA4F;oBAC5F,yEAAyE;oBACzE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD;;;;;;;;;;WAUG;QACH,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,mDAAmD;oBAC/D,iBAAiB,EAAE,oDAAoD;oBACvE,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,wFAAwF;oBACxF,wFAAwF;oBACxF,0FAA0F;oBAC1F,sFAAsF;oBACtF,gCAAgC,EAAE,IAAI;oBACtC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser Resource Configuration (W7.3a)\n *\n * System resource — identity anchor for anonymous sessions.\n * CREATE, UPDATE, and DELETE are INTERNAL_CALL (managed by AnonymousSessionBackendService via service layer).\n * READ is admin-only (super-admin inspection). The anonymous session reaches its OWNED\n * data through the nested `/anonymous-users/{uuidRef}/…` routes (which filter\n * children by the `anonymousUserId` FK = `uuidRef`) and validates itself via the JWT —\n * it never reads its own AnonymousUser row. See the READ variant note for why anon\n * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).\n */\n\nimport { z } from 'zod';\n\nimport { AnonymousUserSchema } from './anonymous-users.shared.schema';\nimport { ConsentPurpose, normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourcesConfigNamingUtils } from '../resources/utils/resources-config-naming.utils';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * Custom operations on the anonymous identity anchor.\n *\n * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent\n * decision was declared on this resource's UPDATE — *\"a visitor's or a lead's consent decision is as\n * recordable as a member's\"* — while every operation here is `INTERNAL_CALL` or super-admin, so no\n * visitor could reach it. The recording contract was written for a door nobody built (#1258).\n */\nexport enum AnonymousUsers_Operations {\n  RECORD_CONSENT = 'record_consent',\n  /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */\n  RECORD_NOTICE_DELIVERED = 'record_notice_delivered',\n}\n\n/**\n * What a visitor's consent surface sends when they decide.\n *\n * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise\n *\n * A decision is `(granted subset-of offered, at an instant)` — see\n * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the\n * person saw, and the server does not know it: the marketing website is statically built and derives\n * its panel from its OWN live providers, which this backend never sees. So the client is the only\n * party that can state it.\n *\n * The blast radius is confined by construction, which is what makes that acceptable:\n *\n * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the\n *   request, so no visitor can describe another visitor's decision;\n * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes\n *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an\n *   account that has already decided;\n * - it grants no privilege a visitor does not already have — they may tick the same boxes on the\n *   application's own consent surface a minute later.\n *\n * The residual is a shared browser whose first visitor lies: the next person to register from it\n * starts with grants they did not make. That is the pre-existing shared-browser exposure of any\n * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.\n *\n * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same\n * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the\n * fact that a decision happened.\n */\nexport const AnonymousUsersRecordConsentRequestDtoSchema = z.object({\n  /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */\n  grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16)\n    .describe('Every purpose the visitor granted, as a complete set: a purpose left out is not granted. A purpose not also listed in `offeredPurposes` is ignored.'),\n  /** The purposes the surface actually put in front of them. What is absent was never asked. */\n  offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16)\n    .describe('The purposes the consent surface actually asked the visitor about. A purpose absent from this list is recorded as never asked, not as declined.'),\n});\n\nexport type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;\n\n/**\n * What the visitor gets back: their OWN decision, and nothing else.\n *\n * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`\n * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the\n * controller's response validation — measured live as `controller_resource_validation_failed` after\n * the write had already succeeded (#1267).\n *\n * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and\n * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`\n * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a\n * consent click would disclose more than the click.\n *\n * The decision itself IS safe to return to the session that just made it, and useful: a client can\n * reconcile what the server stored — including the instant, which the server owns — without a read\n * door on a resource whose READ is deliberately admin-only.\n */\nexport const AnonymousUsersRecordConsentResponseDtoSchema = z.object({\n  consentedPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes now recorded as granted for this anonymous session: the granted purposes that were also offered.'),\n  offeredPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes recorded as offered to the visitor with this decision.'),\n  consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional()\n    .describe(\"When the decision was recorded, taken from the server's clock.\"),\n});\n\nexport type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;\n\n/**\n * What a visitor's public-document page sends when a governed document renders for them (#1258 Step\n * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,\n * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers\n * have different security characteristics and each already has a proven pattern to reuse.\n *\n * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from\n * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to\n * have met a release that was never in force, or the wrong version of one that was.\n */\nexport const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({\n  documentRef: z.string().trim().min(1)\n    .describe('Reference of the governed document the visitor was shown, such as the privacy notice. The delivery is recorded against the release of that document currently in force, when one allows it; a client cannot name a version.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;\n\n/**\n * Declared rather than inherited, for the same reason as its consent sibling: a custom operation\n * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at\n * all, so there is no row to fail validation against — an explicit, minimal response avoids\n * reintroducing that trap by construction.\n *\n * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to\n * the audit trail against its in-force release, and `false` when nothing was written — no release of\n * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.\n * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,\n * and the caller does not act on it: the page has already been shown.\n */\nexport const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({\n  recorded: z.boolean()\n    .describe('Whether this showing of the document was recorded. `false` when no release of the document in force records deliveries, or the record could not be written; the page itself is unaffected.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;\n\n/**\n * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed\n * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,\n * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the\n * resource or operation identifier changes, on a public door nobody monitors.\n *\n * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that\n * carve (it cannot import the resources layer), and this door is reached only from the signed-out\n * pages of the APPLICATION itself, which already imports this package freely.\n */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH =\n  `/${ResourcesConfigNamingUtils.toKebabCase(CoreResourceType.ANONYMOUS_USERS)}/${ResourcesConfigNamingUtils.toKebabCase(AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED)}`;\n\n/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = 'PUT';\n\nexport const anonymousUsersResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<typeof AnonymousUsers_Operations,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof AnonymousUserSchema\n>({\n  mainSchema: AnonymousUserSchema,\n  resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ANONYMOUS_USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Session-init (`AnonymousSessionBackendService.createAnonymousUser`) writes the\n  // first-touch `marketingMetadata` (`.isBackendOnly()`) and a client-supplied\n  // custom `_id` in-process, with no HTTP request context to survive the strict-DTO\n  // strip. `createAsSystem` re-attaches the backend-only field after the parse,\n  // fail-closed behind this opt-in. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: AnonymousUsers_Operations,\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Admin-only (super-admin inspection). Intentionally NOT anon-self-read: the\n          // framework resolves a direct read-by-identifier to `{ _id: <value> }`, but an\n          // anonymous session's identity is its client `uuidRef` (its `_id` is a server\n          // ObjectId), so a self-read would look up `{ _id: <uuidRef> }` and never match.\n          // The anonymous session never needs this — it reaches owned data via the nested\n          // `/anonymous-users/{uuidRef}/…` routes (children filtered by the\n          // `anonymousUserId` FK = `uuidRef`) and validates via the JWT. If anon self-read\n          // is ever required, implement it to resolve by `uuidRef` (custom read impl), not `_id`.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    /**\n     * APPLICATION-WIDE by design, and unconfined by construction — recorded 2026-08-12 because it\n     * previously said nothing, and silence is what this resource class keeps getting wrong.\n     *\n     * `anonymousUsers` is its own scope ROOT: `resourceFieldIdentifier` IS the ANONYMOUS scope's\n     * field, so both repositories blacklist that axis and this LIST compiles with no scope predicate\n     * (`base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep).\n     *\n     * Unlike `organizations`, that is CORRECT here rather than a hole, and the reason is semantic\n     * rather than a judgement call: an anonymous session is a pre-authentication visitor of the\n     * APPLICATION. It has no organization — there is no tenant to confine it to — so a \"confined\"\n     * anonymous listing would name a relationship that does not exist. `super-admin` is therefore\n     * the whole of the control, and it is the right one.\n     *\n     * ⚠️ If anonymous sessions ever gain a tenant association, this becomes an ORGANIZATIONS-axis\n     * question and `assignScopeRootCollectionConfinementToFilter` is where it is answered — that\n     * authority is deliberately scoped to the tenant axis today.\n     *\n     * The sibling decisions live in `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Application-wide by design — see the block above; there is no tenant to confine a pre-auth visitor to\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    /**\n     * The visitor's own consent decision, recorded against their anonymous session (#1258).\n     *\n     * ## Why it is COLLECTION-level and carries no id\n     *\n     * `resourceOperationLike: UPDATE_MANY` puts it at the collection path with its own name segment\n     * and NO entity id — the `reset-features` shape. That is not a convenience: it is what keeps the\n     * door safe.\n     *\n     * An entity-addressed variant would resolve `{ _id: <value> }`, and an anonymous session's\n     * identity is its client `uuidRef` while its `_id` is a server ObjectId — the exact trap the READ\n     * variant above documents, and the reason anon self-read was never offered. Worse, it would put\n     * the row's address in the REQUEST, where a visitor could name another visitor's session.\n     *\n     * With no id, the custom implementation selects the row by `uuidRef` taken from the verified\n     * session JWT (`executionContext.anonymousUserId`). The selector is server-derived, so describing\n     * another visitor's decision is not expressible rather than merely refused.\n     *\n     * **This resource is its own scope ROOT**, so both repositories blacklist the anonymous axis and\n     * the contextual filter contributes NO predicate here (that is why LIST is super-admin). Nothing\n     * confines this write except the selector the implementation builds, which is why the selector is\n     * the thing under test.\n     *\n     * LOW risk: it writes one person's own privacy choice on a pre-identity row holding no account.\n     * `auditBelowRiskFloor` is what makes it leave a row anyway — the same declaration, and the same\n     * reasoning, as the UPDATE variant above and the lead's CREATE: buying the row by mis-declaring\n     * the verb's danger would corrupt the risk vocabulary every other control reads.\n     *\n     * Rate-limited per IP like the lead form, because it is a public unauthenticated write and an\n     * anonymous session is free to mint.\n     *\n     * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's own decision is recordable before\n     * they have an account, against the session it was made in.\n     */\n    [AnonymousUsers_Operations.RECORD_CONSENT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordConsentRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordConsentResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          /*\n           * Without this the operation answers 403 to the only caller it exists for (#1267), and the\n           * gate that refuses it is RIGHT: a collection-shaped write on a scope root reads as an\n           * unconfined DIRECTORY write, and `enforceApplicationWideReadAdmission` then demands a\n           * two-person elevation no visitor can hold.\n           *\n           * The declaration says the missing half: this write IS confined, by\n           * `createAnonymousConsentFactories`, to `{ uuidRef: executionContext.anonymousUserId }` —\n           * the value the session JWT was verified to carry, never anything from the request. The\n           * collection shape is a CONSEQUENCE of making the row unaddressable, not evidence that a\n           * set is being written.\n           *\n           * That confinement is the obligation the flag creates, and it is pinned in\n           * `anonymous-consent.custom-impl.backend.service.test.ts` with a hostile payload naming\n           * another session in `uuidRef`, `_id` and `anonymousUserId`.\n           */\n          admitsSelfConfinedScopeRootWrite: true,\n          /*\n           * Map the REQUEST shape onto the RESOURCE shape before the pipeline validates it — the\n           * `reset-to-defaults` idiom. The request names two purpose LISTS, which are not schema\n           * paths; the service tier validates against the resource schema, so without this the whole\n           * payload is unrecognised and the operation answers `service_resource_validation_failed`\n           * (measured live, #1267).\n           *\n           * The intersection is applied HERE so the stored grants can never exceed what the same\n           * request claims to have offered, whatever a later handler does with them. No\n           * `consentDecidedAt`: the custom implementation stamps the server's clock through\n           * `buildConsentDecisionPatch`, so a caller-authored instant cannot enter.\n           */\n          basicPrefixOperation: ({ inputDto }) => {\n            const request = AnonymousUsersRecordConsentRequestDtoSchema.parse(inputDto);\n            const offeredPurposes = normalizeConsentPurposes(request.offeredPurposes);\n            return {\n              privacy: {\n                consentedPurposes: normalizeConsentPurposes(request.grantedPurposes)\n                  .filter((purpose) => offeredPurposes.includes(purpose)),\n                offeredPurposes,\n              },\n            };\n          },\n          // No `authoritativeFields`: the request contract is two purpose LISTS and carries no\n          // `privacy` block, so there is no caller-supplied value to overwrite. The custom\n          // implementation composes the stored block itself. Declaring one here would be a guard over\n          // a field nothing can send — an untested claim that reads as protection.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    /**\n     * A visitor's own public-document page tells the server it rendered — `NOTICE_DELIVERED`, the\n     * anonymous half of #1258 Step 5 / R11. Same shape as `RECORD_CONSENT` and the same reasons:\n     * public, unauthenticated, one collection-level write with no id in the URL, so the request\n     * cannot name a row. Unlike its sibling, this write touches NO row on this resource at all — it\n     * only needs the verified session identity to attribute a `GOVERNED_DOCUMENT_INTERACTION_RECORDED`\n     * audit row, via `recordGovernedDocumentNoticeDelivered`.\n     *\n     * Rate-limited per IP like its sibling: a public unauthenticated write, and an anonymous session\n     * is free to mint.\n     */\n    [AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordNoticeDeliveredRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordNoticeDeliveredResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // Same obligation as `RECORD_CONSENT`, for the same reason (#1267): a collection-shaped\n          // write on this scope-root resource is otherwise read as an unconfined directory write.\n          // The custom implementation confines it to the verified session's own identity and writes\n          // no row at all — nothing here is a directory write in substance, only in HTTP shape.\n          admitsSelfConfinedScopeRootWrite: true,\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"anonymous-users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAIX;AAJD,WAAY,yBAAyB;IACnC,8DAAiC,CAAA;IACjC,sFAAsF;IACtF,gFAAmD,CAAA;AACrD,CAAC,EAJW,yBAAyB,KAAzB,yBAAyB,QAIpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SACrD,QAAQ,CAAC,qJAAqJ,CAAC;IAClK,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SAC5D,QAAQ,CAAC,iJAAiJ,CAAC;CAC/J,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC/C,QAAQ,CAAC,+GAA+G,CAAC;IAC5H,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC7C,QAAQ,CAAC,qEAAqE,CAAC;IAClF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC/D,QAAQ,CAAC,gEAAgE,CAAC;CAC9E,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAClC,QAAQ,CAAC,6NAA6N,CAAC;CAC3O,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;SAClB,QAAQ,CAAC,4LAA4L,CAAC;CAC1M,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,0BAA0B,CAAC,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,WAAW,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE,CAAC;AAE9K,0KAA0K;AAC1K,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,yDAAyD,GAAG,CACvE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,eAAe;IACpD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC7F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,iFAAiF;IACjF,6EAA6E;IAC7E,kFAAkF;IAClF,8EAA8E;IAC9E,sFAAsF;IACtF,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAChE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,yBAAyB;IAC1C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,6EAA6E;oBAC7E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,gFAAgF;oBAChF,gFAAgF;oBAChF,kEAAkE;oBAClE,iFAAiF;oBACjF,wFAAwF;oBACxF,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wGAAwG;oBACvJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,CAAC,yBAAyB,CAAC,cAAc,CAAC,EAAE;YAC1C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,2CAA2C;oBACvD,iBAAiB,EAAE,4CAA4C;oBAC/D,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD;;;;;;;;;;;;;;;uBAeG;oBACH,gCAAgC,EAAE,IAAI;oBACtC;;;;;;;;;;;uBAWG;oBACH,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACrC,MAAM,OAAO,GAAG,2CAA2C,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC1E,OAAO;4BACL,OAAO,EAAE;gCACP,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC;qCACjE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gCACzD,eAAe;6BAChB;yBACF,CAAC;oBACJ,CAAC;oBACD,qFAAqF;oBACrF,iFAAiF;oBACjF,4FAA4F;oBAC5F,yEAAyE;oBACzE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD;;;;;;;;;;WAUG;QACH,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,mDAAmD;oBAC/D,iBAAiB,EAAE,oDAAoD;oBACvE,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,wFAAwF;oBACxF,wFAAwF;oBACxF,0FAA0F;oBAC1F,sFAAsF;oBACtF,gCAAgC,EAAE,IAAI;oBACtC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser Resource Configuration (W7.3a)\n *\n * System resource — identity anchor for anonymous sessions.\n * CREATE, UPDATE, and DELETE are INTERNAL_CALL (managed by AnonymousSessionBackendService via service layer).\n * READ is admin-only (super-admin inspection). The anonymous session reaches its OWNED\n * data through the nested `/anonymous-users/{uuidRef}/…` routes (which filter\n * children by the `anonymousUserId` FK = `uuidRef`) and validates itself via the JWT —\n * it never reads its own AnonymousUser row. See the READ variant note for why anon\n * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).\n */\n\nimport { z } from 'zod';\n\nimport { AnonymousUserSchema } from './anonymous-users.shared.schema';\nimport { ConsentPurpose, normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourcesConfigNamingUtils } from '../resources/utils/resources-config-naming.utils';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * Custom operations on the anonymous identity anchor.\n *\n * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent\n * decision was declared on this resource's UPDATE — *\"a visitor's or a lead's consent decision is as\n * recordable as a member's\"* — while every operation here is `INTERNAL_CALL` or super-admin, so no\n * visitor could reach it. The recording contract was written for a door nobody built (#1258).\n */\nexport enum AnonymousUsers_Operations {\n  RECORD_CONSENT = 'record_consent',\n  /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */\n  RECORD_NOTICE_DELIVERED = 'record_notice_delivered',\n}\n\n/**\n * What a visitor's consent surface sends when they decide.\n *\n * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise\n *\n * A decision is `(granted subset-of offered, at an instant)` — see\n * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the\n * person saw, and the server does not know it: the marketing website is statically built and derives\n * its panel from its OWN live providers, which this backend never sees. So the client is the only\n * party that can state it.\n *\n * The blast radius is confined by construction, which is what makes that acceptable:\n *\n * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the\n *   request, so no visitor can describe another visitor's decision;\n * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes\n *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an\n *   account that has already decided;\n * - it grants no privilege a visitor does not already have — they may tick the same boxes on the\n *   application's own consent surface a minute later.\n *\n * The residual is a shared browser whose first visitor lies: the next person to register from it\n * starts with grants they did not make. That is the pre-existing shared-browser exposure of any\n * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.\n *\n * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same\n * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the\n * fact that a decision happened.\n */\nexport const AnonymousUsersRecordConsentRequestDtoSchema = z.object({\n  /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */\n  grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16)\n    .describe('Every purpose the visitor granted, as a complete set: a purpose left out is not granted. A purpose not also listed in `offeredPurposes` is ignored.'),\n  /** The purposes the surface actually put in front of them. What is absent was never asked. */\n  offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16)\n    .describe('The purposes the consent surface actually asked the visitor about. A purpose absent from this list is recorded as never asked, not as declined.'),\n});\n\nexport type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;\n\n/**\n * What the visitor gets back: their OWN decision, and nothing else.\n *\n * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`\n * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the\n * controller's response validation — measured live as `controller_resource_validation_failed` after\n * the write had already succeeded (#1267).\n *\n * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and\n * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`\n * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a\n * consent click would disclose more than the click.\n *\n * The decision itself IS safe to return to the session that just made it, and useful: a client can\n * reconcile what the server stored — including the instant, which the server owns — without a read\n * door on a resource whose READ is deliberately admin-only.\n */\nexport const AnonymousUsersRecordConsentResponseDtoSchema = z.object({\n  consentedPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes now recorded as granted for this anonymous session: the granted purposes that were also offered.'),\n  offeredPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes recorded as offered to the visitor with this decision.'),\n  consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional()\n    .describe(\"When the decision was recorded, taken from the server's clock.\"),\n});\n\nexport type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;\n\n/**\n * What a visitor's public-document page sends when a governed document renders for them (#1258 Step\n * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,\n * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers\n * have different security characteristics and each already has a proven pattern to reuse.\n *\n * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from\n * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to\n * have met a release that was never in force, or the wrong version of one that was.\n */\nexport const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({\n  documentRef: z.string().trim().min(1)\n    .describe('Reference of the governed document the visitor was shown, such as the privacy notice. The delivery is recorded against the release of that document currently in force, when one allows it; a client cannot name a version.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;\n\n/**\n * Declared rather than inherited, for the same reason as its consent sibling: a custom operation\n * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at\n * all, so there is no row to fail validation against — an explicit, minimal response avoids\n * reintroducing that trap by construction.\n *\n * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to\n * the audit trail against its in-force release, and `false` when nothing was written — no release of\n * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.\n * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,\n * and the caller does not act on it: the page has already been shown.\n */\nexport const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({\n  recorded: z.boolean()\n    .describe('Whether this showing of the document was recorded. `false` when no release of the document in force records deliveries, or the record could not be written; the page itself is unaffected.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;\n\n/**\n * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed\n * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,\n * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the\n * resource or operation identifier changes, on a public door nobody monitors.\n *\n * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that\n * carve (it cannot import the resources layer), and this door is reached only from the signed-out\n * pages of the APPLICATION itself, which already imports this package freely.\n */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH =\n  `/${ResourcesConfigNamingUtils.toKebabCase(CoreResourceType.ANONYMOUS_USERS)}/${ResourcesConfigNamingUtils.toKebabCase(AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED)}`;\n\n/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = 'PUT';\n\nexport const anonymousUsersResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<typeof AnonymousUsers_Operations,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof AnonymousUserSchema\n>({\n  mainSchema: AnonymousUserSchema,\n  resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ANONYMOUS_USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Session-init (`AnonymousSessionBackendService.createAnonymousUser`) writes the\n  // first-touch `marketingMetadata` (`.isBackendOnly()`) and a client-supplied\n  // custom `_id` in-process, with no HTTP request context to survive the strict-DTO\n  // strip. `createAsSystem` re-attaches the backend-only field after the parse,\n  // fail-closed behind this opt-in. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: AnonymousUsers_Operations,\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Admin-only (super-admin inspection). Intentionally NOT anon-self-read: the\n          // framework resolves a direct read-by-identifier to `{ _id: <value> }`, but an\n          // anonymous session's identity is its client `uuidRef` (its `_id` is a server\n          // ObjectId), so a self-read would look up `{ _id: <uuidRef> }` and never match.\n          // The anonymous session never needs this — it reaches owned data via the nested\n          // `/anonymous-users/{uuidRef}/…` routes (children filtered by the\n          // `anonymousUserId` FK = `uuidRef`) and validates via the JWT. If anon self-read\n          // is ever required, implement it to resolve by `uuidRef` (custom read impl), not `_id`.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    /**\n     * APPLICATION-WIDE by design, and unconfined by construction — recorded 2026-08-12 because it\n     * previously said nothing, and silence is what this resource class keeps getting wrong.\n     *\n     * `anonymousUsers` is its own scope ROOT: `resourceFieldIdentifier` IS the ANONYMOUS scope's\n     * field, so both repositories blacklist that axis and this LIST compiles with no scope predicate\n     * (`base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep).\n     *\n     * Unlike `organizations`, that is CORRECT here rather than a hole, and the reason is semantic\n     * rather than a judgement call: an anonymous session is a pre-authentication visitor of the\n     * APPLICATION. It has no organization — there is no tenant to confine it to — so a \"confined\"\n     * anonymous listing would name a relationship that does not exist. `super-admin` is therefore\n     * the whole of the control, and it is the right one.\n     *\n     * ⚠️ If anonymous sessions ever gain a tenant association, this becomes an ORGANIZATIONS-axis\n     * question and `assignScopeRootCollectionConfinementToFilter` is where it is answered — that\n     * authority is deliberately scoped to the tenant axis today.\n     *\n     * The sibling decisions live in `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Application-wide by design — see the block above; there is no tenant to confine a pre-auth visitor to\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    /**\n     * The visitor's own consent decision, recorded against their anonymous session (#1258).\n     *\n     * ## Why it is COLLECTION-level and carries no id\n     *\n     * `resourceOperationLike: UPDATE_MANY` puts it at the collection path with its own name segment\n     * and NO entity id — the `reset-features` shape. That is not a convenience: it is what keeps the\n     * door safe.\n     *\n     * An entity-addressed variant would resolve `{ _id: <value> }`, and an anonymous session's\n     * identity is its client `uuidRef` while its `_id` is a server ObjectId — the exact trap the READ\n     * variant above documents, and the reason anon self-read was never offered. Worse, it would put\n     * the row's address in the REQUEST, where a visitor could name another visitor's session.\n     *\n     * With no id, the custom implementation selects the row by `uuidRef` taken from the verified\n     * session JWT (`executionContext.anonymousUserId`). The selector is server-derived, so describing\n     * another visitor's decision is not expressible rather than merely refused.\n     *\n     * **This resource is its own scope ROOT**, so both repositories blacklist the anonymous axis and\n     * the contextual filter contributes NO predicate here (that is why LIST is super-admin). Nothing\n     * confines this write except the selector the implementation builds, which is why the selector is\n     * the thing under test.\n     *\n     * LOW risk: it writes one person's own privacy choice on a pre-identity row holding no account.\n     * `auditBelowRiskFloor` is what makes it leave a row anyway — the same declaration, and the same\n     * reasoning, as the UPDATE variant above and the lead's CREATE: buying the row by mis-declaring\n     * the verb's danger would corrupt the risk vocabulary every other control reads.\n     *\n     * Rate-limited per IP like the lead form, because it is a public unauthenticated write and an\n     * anonymous session is free to mint.\n     *\n     * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's own decision is recordable before\n     * they have an account, against the session it was made in.\n     */\n    [AnonymousUsers_Operations.RECORD_CONSENT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordConsentRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordConsentResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          /*\n           * Without this the operation answers 403 to the only caller it exists for (#1267), and the\n           * gate that refuses it is RIGHT: a collection-shaped write on a scope root reads as an\n           * unconfined DIRECTORY write, and `enforceApplicationWideReadAdmission` then demands a\n           * two-person elevation no visitor can hold.\n           *\n           * The declaration says the missing half: this write IS confined, by\n           * `createAnonymousConsentFactories`, to `{ uuidRef: executionContext.anonymousUserId }` —\n           * the value the session JWT was verified to carry, never anything from the request. The\n           * collection shape is a CONSEQUENCE of making the row unaddressable, not evidence that a\n           * set is being written.\n           *\n           * That confinement is the obligation the flag creates, and it is pinned in\n           * `anonymous-consent.custom-impl.backend.service.test.ts` with a hostile payload naming\n           * another session in `uuidRef`, `_id` and `anonymousUserId`.\n           */\n          admitsSelfConfinedScopeRootWrite: true,\n          /*\n           * Map the REQUEST shape onto the RESOURCE shape before the pipeline validates it — the\n           * `reset-to-defaults` idiom. The request names two purpose LISTS, which are not schema\n           * paths; the service tier validates against the resource schema, so without this the whole\n           * payload is unrecognised and the operation answers `service_resource_validation_failed`\n           * (measured live, #1267).\n           *\n           * The intersection is applied HERE so the stored grants can never exceed what the same\n           * request claims to have offered, whatever a later handler does with them. No\n           * `consentDecidedAt`: the custom implementation stamps the server's clock through\n           * `buildConsentDecisionPatch`, so a caller-authored instant cannot enter.\n           */\n          basicPrefixOperation: ({ inputDto }) => {\n            const request = AnonymousUsersRecordConsentRequestDtoSchema.parse(inputDto);\n            const offeredPurposes = normalizeConsentPurposes(request.offeredPurposes);\n            return {\n              privacy: {\n                consentedPurposes: normalizeConsentPurposes(request.grantedPurposes)\n                  .filter((purpose) => offeredPurposes.includes(purpose)),\n                offeredPurposes,\n              },\n            };\n          },\n          // No `authoritativeFields`: the request contract is two purpose LISTS and carries no\n          // `privacy` block, so there is no caller-supplied value to overwrite. The custom\n          // implementation composes the stored block itself. Declaring one here would be a guard over\n          // a field nothing can send — an untested claim that reads as protection.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    /**\n     * A visitor's own public-document page tells the server it rendered — `NOTICE_DELIVERED`, the\n     * anonymous half of #1258 Step 5 / R11. Same shape as `RECORD_CONSENT` and the same reasons:\n     * public, unauthenticated, one collection-level write with no id in the URL, so the request\n     * cannot name a row. Unlike its sibling, this write touches NO row on this resource at all — it\n     * only needs the verified session identity to attribute a `GOVERNED_DOCUMENT_INTERACTION_RECORDED`\n     * audit row, via `recordGovernedDocumentNoticeDelivered`.\n     *\n     * Rate-limited per IP like its sibling: a public unauthenticated write, and an anonymous session\n     * is free to mint.\n     */\n    [AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordNoticeDeliveredRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordNoticeDeliveredResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // Same obligation as `RECORD_CONSENT`, for the same reason (#1267): a collection-shaped\n          // write on this scope-root resource is otherwise read as an unconfined directory write.\n          // The custom implementation confines it to the verified session's own identity and writes\n          // no row at all — nothing here is a directory write in substance, only in HTTP shape.\n          admitsSelfConfinedScopeRootWrite: true,\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/anonymous-users.shared.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.schema.d.ts","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,wEAAwE;AACxE,oBAAY,gCAAgC;IAC1C,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;iBAwFxB,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,OAAO,oBAA2C,CAAC;AACrF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"anonymous-users.shared.schema.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,wEAAwE;AACxE,oBAAY,gCAAgC;IAC1C,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;iBAwFxB,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,OAAO,oBAA2C,CAAC;AACrF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/users/anonymous-users.shared.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.schema.js","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAE1G,wEAAwE;AACxE,MAAM,CAAN,IAAY,gCAIX;AAJD,WAAY,gCAAgC;IAC1C,uDAAmB,CAAA;IACnB,yDAAqB,CAAA;IACrB,uDAAmB,CAAA;AACrB,CAAC,EAJW,gCAAgC,KAAhC,gCAAgC,QAI3C;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,EAAE;IACzG;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE;IACrG,oFAAoF;IACpF,oGAAoG;IACpG,oDAAoD;IACpD,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5G;;;;;;;;OAQG;IACH,iBAAiB,EAAE,oCAAoC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;SAC/E,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC7C,wDAAwD;IACxD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACzF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;CAC/D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,oBAAoB,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { AnonymousUserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { AnonymousUserMarketingMetadataSchema } from \"./anonymous-user-marketing-metadata.shared.schemas\";\n\n/** W7.3a: Status of anonymous→authenticated ownership transposition. */\nexport enum AnonymousUserTranspositionStatus {\n  PENDING = 'pending',\n  COMPLETE = 'complete',\n  PARTIAL = 'partial',\n}\n\nconst _AnonymousUserSchema = z.object({\n  /**\n   * Server-minted MongoDB identity (ObjectId, surfaced as a hex string).\n   * `.isPrimaryKey()` = the standard server-generated primary key (composite:\n   * excludeFromCreate + hidden + unique + indexed), IDENTICAL to every other\n   * resource — which is what makes session-init a normal create (it is server-minted,\n   * so it is never in the create payload, so it never crashes the strict-DTO parse).\n   *\n   * This is a PURE internal storage id. It is NOT the anonymous user's relational\n   * identity: children (`draft-notes`, `inbound-contacts`) reference {@link uuidRef}\n   * via their `anonymousUserId` FK, the session JWT carries `uuidRef`, and the nested\n   * `/anonymous-users/{uuidRef}/…` routes key off `uuidRef` — never this `_id`.\n   * See {@link uuidRef} for why the relational identity is the client handle, not `_id`.\n   */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n  /**\n   * The anonymous user's RELATIONAL / business identity: a client-generated,\n   * unguessable UUID handle for the session (`crypto.randomUUID()` in the frontend\n   * `AnonymousSessionContext`). Everything client-facing keys off THIS, not `_id`:\n   * the `anonymousUserId` FK on child resources, the session JWT payload, the nested\n   * `/anonymous-users/{uuidRef}/draft-notes` URL param (+ its coherence check),\n   * and the cross-origin handoff. `_id` stays a pure internal DB storage id.\n   *\n   * Why the client generates it and why it is the identity (not `_id`):\n   * - **Cross-origin continuity**: a visitor starts on the marketing site\n   *   (`example.com`) and continues in the app (`app.example.com`) — two origins with\n   *   SEPARATE localStorage. The handle is generated client-side and handed across, so\n   *   the same anonymous user is resolved on both. It also survives page reload / the\n   *   24h JWT expiry (presented again at `x-anonymous-session-init` to re-resolve).\n   * - **Unguessable adoption handle**: presenting this value at init ADOPTS the\n   *   session, so it must be unguessable. A random UUID is; a server `_id`\n   *   (ObjectId = timestamp + counter) is partially enumerable — the wrong primitive.\n   * - **`_id` is a database concern**: the client value must never BE `_id`; it lives\n   *   here as an indexed, unique reference. Using one client-facing identity end-to-end\n   *   (rather than translating a client handle ⇄ a server `_id` at every seam) is why\n   *   children's `anonymousUserId` carries `uuidRef`.\n   *\n   * Set in-process by `AnonymousSessionBackendService.createAnonymousUser` from the\n   * validated init header. Unique-indexed for concurrent-tab / cross-origin\n   * create-or-resolve dedup. `.excludeFromUpdate()` — an immutable identity handle.\n   * Readable (not `.isBackendOnly()`) so the anonymous-session-cleanup batch can filter\n   * a user's children by it; it is not sensitive (the client that generated it already\n   * holds it, and it grants only zero-value anonymous access).\n   */\n  uuidRef: z.string().min(1).isDBIndexed().isUnique({ scope: 'global', sparse: false }).excludeFromUpdate(),\n  /**\n   * The visitor's consent decision. CREATE cannot carry it: a session starts undecided, and the\n   * contract says so rather than trusting every caller to.\n   *\n   * A decision is written only by the doors that record it: the collection-level `record_consent`\n   * and the admin UPDATE, both of which emit an audit row\n   * (`evidence-requirement:consent-decision-transition-record` C2). CREATE sits below the automatic\n   * audit floor, so a consent value accepted there would be stored and leave no trace. That was not\n   * hypothetical: session start once wrote keys the schema did not have, and every visitor silently\n   * received a default consent level (#534). Excluding the block, rather than auditing every session\n   * start, states the truth (nothing is decided at creation) and costs no row per visitor.\n   *\n   * The default is exactly the \"never asked\" state: no grants, nothing offered, no decision instant.\n   *\n   * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a verb that cannot write a consent decision\n   * cannot write one silently.\n   */\n  privacy: AnonymousUserPrivacySchema.default(AnonymousUserPrivacySchema.parse({})).excludeFromCreate(),\n  // An anonymous user IS a person — one without an account. This resource declares no\n  // `exportSubject`, which is why a subject-export-based sweep misses it entirely; the categories are\n  // owed regardless of whether the row is exportable.\n  //\n  // USAGE for the user agent (a device/browser observation), IDENTITY for the IP hash: hashing does\n  // not stop it identifying — it is a pseudonymous identifier, GDPR Art. 4(5), the same reading the\n  // audit row's `clientInstanceId` already carries. LOCATION alongside, because an IP narrows where\n  // the person is even when hashed against a rainbow-table attacker rather than against the operator.\n  userAgent: z.string().optional().dataCategories(PersonalDataCategory.USAGE),\n  ipHash: z.string().optional().dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.LOCATION]),\n  /**\n   * Phase 0.5 (Q-D=β): first-touch marketing attribution captured at\n   * session-init time and never overwritten. Lives here on the\n   * `AnonymousUser` (the session anchor) rather than on\n   * `InboundContact` (the conversion row) so we get attribution for\n   * sessions that convert via signup OR contact form OR not at all.\n   * `.isBackendOnly()` strips it from every client-facing response —\n   * marketing analytics joins via `anonymousUserId` server-side only.\n   */\n  marketingMetadata: AnonymousUserMarketingMetadataSchema.optional().isBackendOnly()\n    .dataCategories(PersonalDataCategory.USAGE),\n  /** W7.3a: Set when anonymous user registers/logs in. */\n  convertedToUserId: z.string().optional(),\n  transpositionStatus: z.enum(AnonymousUserTranspositionStatus).optional().isSummaryField(),\n  createdAt: z.date().default(() => new Date()).isSummaryField(),\n});\n\nexport const AnonymousUserSchema: typeof _AnonymousUserSchema = _AnonymousUserSchema;\nexport type AnonymousUser = z.infer<typeof _AnonymousUserSchema>;\n"]}
+{"version":3,"file":"anonymous-users.shared.schema.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAE1G,wEAAwE;AACxE,MAAM,CAAN,IAAY,gCAIX;AAJD,WAAY,gCAAgC;IAC1C,uDAAmB,CAAA;IACnB,yDAAqB,CAAA;IACrB,uDAAmB,CAAA;AACrB,CAAC,EAJW,gCAAgC,KAAhC,gCAAgC,QAI3C;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,EAAE;IACzG;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE;IACrG,oFAAoF;IACpF,oGAAoG;IACpG,oDAAoD;IACpD,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5G;;;;;;;;OAQG;IACH,iBAAiB,EAAE,oCAAoC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;SAC/E,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC7C,wDAAwD;IACxD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACzF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;CAC/D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,oBAAoB,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { AnonymousUserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { AnonymousUserMarketingMetadataSchema } from \"./anonymous-user-marketing-metadata.shared.schemas\";\n\n/** W7.3a: Status of anonymous→authenticated ownership transposition. */\nexport enum AnonymousUserTranspositionStatus {\n  PENDING = 'pending',\n  COMPLETE = 'complete',\n  PARTIAL = 'partial',\n}\n\nconst _AnonymousUserSchema = z.object({\n  /**\n   * Server-minted MongoDB identity (ObjectId, surfaced as a hex string).\n   * `.isPrimaryKey()` = the standard server-generated primary key (composite:\n   * excludeFromCreate + hidden + unique + indexed), IDENTICAL to every other\n   * resource — which is what makes session-init a normal create (it is server-minted,\n   * so it is never in the create payload, so it never crashes the strict-DTO parse).\n   *\n   * This is a PURE internal storage id. It is NOT the anonymous user's relational\n   * identity: children (`draft-notes`, `inbound-contacts`) reference {@link uuidRef}\n   * via their `anonymousUserId` FK, the session JWT carries `uuidRef`, and the nested\n   * `/anonymous-users/{uuidRef}/…` routes key off `uuidRef` — never this `_id`.\n   * See {@link uuidRef} for why the relational identity is the client handle, not `_id`.\n   */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n  /**\n   * The anonymous user's RELATIONAL / business identity: a client-generated,\n   * unguessable UUID handle for the session (`crypto.randomUUID()` in the frontend\n   * `AnonymousSessionContext`). Everything client-facing keys off THIS, not `_id`:\n   * the `anonymousUserId` FK on child resources, the session JWT payload, the nested\n   * `/anonymous-users/{uuidRef}/draft-notes` URL param (+ its coherence check),\n   * and the cross-origin handoff. `_id` stays a pure internal DB storage id.\n   *\n   * Why the client generates it and why it is the identity (not `_id`):\n   * - **Cross-origin continuity**: a visitor starts on the marketing site\n   *   (`example.com`) and continues in the app (`app.example.com`) — two origins with\n   *   SEPARATE localStorage. The handle is generated client-side and handed across, so\n   *   the same anonymous user is resolved on both. It also survives page reload / the\n   *   24h JWT expiry (presented again at `x-anonymous-session-init` to re-resolve).\n   * - **Unguessable adoption handle**: presenting this value at init ADOPTS the\n   *   session, so it must be unguessable. A random UUID is; a server `_id`\n   *   (ObjectId = timestamp + counter) is partially enumerable — the wrong primitive.\n   * - **`_id` is a database concern**: the client value must never BE `_id`; it lives\n   *   here as an indexed, unique reference. Using one client-facing identity end-to-end\n   *   (rather than translating a client handle ⇄ a server `_id` at every seam) is why\n   *   children's `anonymousUserId` carries `uuidRef`.\n   *\n   * Set in-process by `AnonymousSessionBackendService.createAnonymousUser` from the\n   * validated init header. Unique-indexed for concurrent-tab / cross-origin\n   * create-or-resolve dedup. `.excludeFromUpdate()` — an immutable identity handle.\n   * Readable (not `.isBackendOnly()`) so the anonymous-session-cleanup batch can filter\n   * a user's children by it; it is not sensitive (the client that generated it already\n   * holds it, and it grants only zero-value anonymous access).\n   */\n  uuidRef: z.string().min(1).isDBIndexed().isUnique({ scope: 'global', sparse: false }).excludeFromUpdate(),\n  /**\n   * The visitor's consent decision. CREATE cannot carry it: a session starts undecided, and the\n   * contract says so rather than trusting every caller to.\n   *\n   * A decision is written only by the doors that record it: the collection-level `record_consent`\n   * and the admin UPDATE, both of which emit an audit row\n   * (`evidence-requirement:consent-decision-transition-record` C2). CREATE sits below the automatic\n   * audit floor, so a consent value accepted there would be stored and leave no trace. That was not\n   * hypothetical: session start once wrote keys the schema did not have, and every visitor silently\n   * received a default consent level (#534). Excluding the block, rather than auditing every session\n   * start, states the truth (nothing is decided at creation) and costs no row per visitor.\n   *\n   * The default is exactly the \"never asked\" state: no grants, nothing offered, no decision instant.\n   *\n   * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a verb that cannot write a consent decision\n   * cannot write one silently.\n   */\n  privacy: AnonymousUserPrivacySchema.default(AnonymousUserPrivacySchema.parse({})).excludeFromCreate(),\n  // An anonymous user IS a person — one without an account. This resource declares no\n  // `exportSubject`, which is why a subject-export-based sweep misses it entirely; the categories are\n  // owed regardless of whether the row is exportable.\n  //\n  // USAGE for the user agent (a device/browser observation), IDENTITY for the IP hash: hashing does\n  // not stop it identifying — it is a pseudonymous identifier, GDPR Art. 4(5), the same reading the\n  // audit row's `clientInstanceId` already carries. LOCATION alongside, because an IP narrows where\n  // the person is even when hashed against a rainbow-table attacker rather than against the operator.\n  userAgent: z.string().optional().dataCategories(PersonalDataCategory.USAGE),\n  ipHash: z.string().optional().dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.LOCATION]),\n  /**\n   * Phase 0.5 (Q-D=β): first-touch marketing attribution captured at\n   * session-init time and never overwritten. Lives here on the\n   * `AnonymousUser` (the session anchor) rather than on\n   * `InboundContact` (the conversion row) so we get attribution for\n   * sessions that convert via signup OR contact form OR not at all.\n   * `.isBackendOnly()` strips it from every client-facing response —\n   * marketing analytics joins via `anonymousUserId` server-side only.\n   */\n  marketingMetadata: AnonymousUserMarketingMetadataSchema.optional().isBackendOnly()\n    .dataCategories(PersonalDataCategory.USAGE),\n  /** W7.3a: Set when anonymous user registers/logs in. */\n  convertedToUserId: z.string().optional(),\n  transpositionStatus: z.enum(AnonymousUserTranspositionStatus).optional().isSummaryField(),\n  createdAt: z.date().default(() => new Date()).isSummaryField(),\n});\n\nexport const AnonymousUserSchema: typeof _AnonymousUserSchema = _AnonymousUserSchema;\nexport type AnonymousUser = z.infer<typeof _AnonymousUserSchema>;\n"]}

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAI/C,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;iCAyL9C,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAI/C,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;iCAyL9C,CAAC"}