@wildo-ai/saas-models 1.1.7 → 1.1.9

package/dist/esm/billing/billing-configuration.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-configuration.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAE9F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sDAAsD;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC;;;;;;;;;;;OAWG;IAEH;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,gDAAgD;IAChD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IAE7D;;;OAGG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ;;;;;;;;WAQG;QACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QAEhF;;;;;;;;;;;WAWG;QACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;KAC7E,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,eAAe,EAAE,kBAAkB,CAAC,QAAQ;QAC5C,kBAAkB,EAAE,cAAc,CAAC,SAAS;KAC7C,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAElG;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB;;;;;WAKG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB;;;WAGG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,iEAAiE;QACjE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACpD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC;IAEH,oHAAoH;IACpH;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,yGAAyG;QACzG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sIAAsI,CAAC;QACpL,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;QACtI,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;QACrH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;KACpJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5D,kEAAkE;IAElE,uFAAuF;IACvF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,8DAA8D;QAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C;;;;;WAKG;QACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,uDAAuD;QACvD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,uFAAuF;QACvF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACxF;;;;;;;;WAQG;QACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAChF,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB;QACrD,mBAAmB,EAAE,aAAa,CAAC,aAAa;KACjD,CAAC,CAAC;CACJ,CAAC,CAAC","sourcesContent":["/**\n * Billing Configuration Schema (Shared)\n *\n * Top-level billing configuration that custom apps provide at startup.\n * Controls: provider selection, currency, tax policy, enabled scopes,\n * and default behavior policies.\n *\n * @see billing-and-features-system.md §6.7 (Billing Configuration)\n */\n\nimport { z } from 'zod';\nimport { CurrencySchema } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  TaxCalculationMode,\n  TaxDisplayMode,\n  ProrationBehavior,\n  BillingTiming,\n} from './billing-enums.shared.schemas';\nimport { ReferredRewardSchema, ReferrerRewardSchema } from './referral-reward.shared.schemas';\n\nexport const BillingConfigurationSchema = z.object({\n  /** Master switch: is billing enabled for this app? */\n  enabled: z.boolean().default(false),\n  /** Which billing provider to use (e.g., 'stripe') */\n  providerRef: z.string().optional(),\n\n  /*\n   * NO `webhooks` block. `path` and `signingSecretRef` were declared here and read by NOTHING —\n   * `signingSecretRef` had zero references outside its own declaration — and they were removed on\n   * 2026-09-08 (#408) rather than relabelled, because unlike the commercial-intent keys below they\n   * were not even an input to anything.\n   *\n   * The route and the signing secret both come from the provider module's `WEBHOOK_ORIGINATOR`\n   * contract: `buildWebhookEndpoints` mounts it at `/api/v1/webhooks/<provider>/billing`. That is\n   * the single authority, and `webhook-auto-controller.backend.service.ts` already recorded the\n   * same conclusion when endpoint-level path/secret extras were dropped as dead in the 2026-05-06\n   * reshape. This block was the copy that survived that sweep.\n   */\n\n  /**\n   * DECLARATION-ONLY (#408, 2026-09-08). Read by the application-creation commercial-model brief and\n   * by no runtime billing path: nothing validates a product's currency against these, and what\n   * reaches the provider is each price's own `currency`. Authoring them records the commercial\n   * intent a reviewer reads; it enforces nothing.\n   */\n  defaultCurrency: CurrencySchema.default('USD'),\n  /** DECLARATION-ONLY — see `defaultCurrency`. */\n  supportedCurrencies: z.array(CurrencySchema).default(['USD']),\n\n  /**\n   * Tax configuration — calculation is ALWAYS delegated to provider (Stripe Tax, etc.).\n   * We never calculate tax locally.\n   */\n  tax: z.object({\n    /**\n     * Whether the PROVIDER computes tax on a purchase. READ since 2026-09-08 (#408): the checkout\n     * path — the only production purchase route — sends `automaticTax` from this value.\n     *\n     * It reached nothing before that, so `PROVIDER_MANAGED` changed no behaviour and the provider\n     * account's own configuration silently decided. Enabling it changes invoice totals and the tax\n     * amounts persisted against them, which is why it is a decision an application makes rather\n     * than a default the framework picks.\n     */\n    calculationMode: z.enum(TaxCalculationMode).default(TaxCalculationMode.DISABLED),\n\n    /**\n     * How prices are DISPLAYED to users (does not affect provider calculation).\n     * - 'exclusive': Prices shown excluding tax (HT / ex-VAT). Tax added at checkout.\n     *   Common for B2B. Shows \"$49/mo\" and tax is added separately.\n     * - 'inclusive': Prices shown including tax (TTC / inc-VAT). Tax is embedded.\n     *   Common for consumer-facing. Shows \"€49/mo TTC\" and tax is extracted at checkout.\n     *\n     * DECLARATIVE ONLY: nothing reads this value. It is not an application-wide default that\n     * `product.taxDisplayMode` and `price.taxBehavior` override, because there is no resolution\n     * chain between the three. What reaches the billing provider is each price's own\n     * `taxBehavior`, and only that.\n     */\n    defaultDisplayMode: z.enum(TaxDisplayMode).default(TaxDisplayMode.EXCLUSIVE),\n  }).default(() => ({\n    calculationMode: TaxCalculationMode.DISABLED,\n    defaultDisplayMode: TaxDisplayMode.EXCLUSIVE,\n  })),\n\n  /**\n   * Which scopes can have billing accounts (default: ORGANIZATIONS only).\n   * Can be extended to include USER_SELF (personal billing).\n   */\n  enabledScopes: z.array(z.enum(ResourcePrimaryScope)).default([ResourcePrimaryScope.ORGANIZATIONS]),\n\n  /**\n   * Promotions configuration.\n   * Controls whether the promotions subsystem is active.\n   */\n  promotions: z.object({\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08), and the sharpest of them: the promotions subsystem runs\n     * UNCONDITIONALLY. Promotion codes are applied at `billing-account.mutations` and resolved in\n     * `billing-state`, neither of which consults this flag — so setting it `false` disables\n     * nothing, which is a stronger statement than \"is not read\".\n     */\n    enabled: z.boolean().default(true),\n  }).default(() => ({\n    enabled: true,\n  })),\n\n  /**\n   * Credit pool configuration.\n   * Controls whether credit pools are enabled and defines default pool behavior.\n   */\n  creditPools: z.object({\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08) — same shape as `promotions.enabled` above, and the same\n     * correction: credit pools run unconditionally in `billing-state`, so `false` disables nothing.\n     */\n    enabled: z.boolean().default(true),\n    /** Default initial balance for auto-created pools (default 0) */\n    defaultInitialBalance: z.number().min(0).default(0),\n  }).default(() => ({\n    enabled: true,\n    defaultInitialBalance: 0,\n  })),\n\n  /** @wildo_source:part:start saas.models.billing.referral-program facet:layer:shared facet:audience:app-developer */\n  /**\n   * The referral program (#1802): whether organizations may issue referral codes, and what each side\n   * receives when a referral converts (the referred account's first paid invoice).\n   *\n   * The rewards are copied onto each referral when its code is issued, so changing them here affects\n   * codes issued afterwards and never re-prices a referral already made. A reward's `featureKey` must\n   * name a registered boolean feature; startup WARNS about one that does not, like every other feature\n   * reference, and a feature nobody registered grants nothing.\n   */\n  referrals: z.object({\n    /** Off by default: issuing codes that promise rewards is a commercial decision the application makes. */\n    enabled: z.boolean().default(false).describe('Whether organizations may issue referral codes. Redeeming and converting codes already issued keeps working when this is turned off.'),\n    referrerReward: ReferrerRewardSchema.optional().describe('What the referrer receives when a referral converts. Absent means nothing.'),\n    referredReward: ReferredRewardSchema.optional().describe('What the referred account receives. Absent means nothing.'),\n    codeValidityDays: z.number().int().min(1).default(30).describe('How many days a referral code can be redeemed after it is issued. Defaults to 30.'),\n  }).default(() => ({ enabled: false, codeValidityDays: 30 })),\n  /** @wildo_source:part:end saas.models.billing.referral-program */\n\n  /** Global billing policy defaults (overridden by ProductBehaviorPolicy per product) */\n  defaultBehaviorPolicy: z.object({\n    /** Default trial days for new subscriptions (0 = no trial) */\n    defaultTrialDays: z.number().min(0).default(0),\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08). Dunning — how long to wait and how often to retry after a\n     * failed payment — is configured at the PROVIDER, on its own schedule, and nothing here reaches\n     * it. Binding them would mean writing a provider's retry settings from application config, which\n     * is a different feature from reading a policy at a call site.\n     */\n    paymentGracePeriodDays: z.number().min(0).default(3),\n    /** DECLARATION-ONLY — see `paymentGracePeriodDays`. */\n    maxPaymentRetries: z.number().min(0).default(3),\n    /** Default proration when no product-specific policy. READ by the change-plan path. */\n    defaultProration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n    /**\n     * Default cancellation timing when neither the caller nor the plan product names one.\n     *\n     * READ since 2026-09-08 (#408). It was dead until then, and it is bound rather than relabelled\n     * because — unlike its neighbours above — it needs no provider call at all: cancellation timing\n     * is resolved locally, so the only thing standing between this key and meaning something was a\n     * reader. The chain is caller → product `behaviorPolicy.cancellation.defaultBehavior` → this →\n     * period-end.\n     */\n    defaultCancellation: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).default(() => ({\n    defaultTrialDays: 0,\n    paymentGracePeriodDays: 3,\n    maxPaymentRetries: 3,\n    defaultProration: ProrationBehavior.CREATE_PRORATIONS,\n    defaultCancellation: BillingTiming.AT_PERIOD_END,\n  })),\n});\nexport type BillingConfiguration = z.infer<typeof BillingConfigurationSchema>;\n"]}
+{"version":3,"file":"billing-configuration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-configuration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAE9F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sDAAsD;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC;;;;;;;;;;;OAWG;IAEH;;;;;OAKG;IACH,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,gDAAgD;IAChD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IAE7D;;;OAGG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ;;;;;;;;WAQG;QACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QAEhF;;;;;;;;;;;WAWG;QACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;KAC7E,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,eAAe,EAAE,kBAAkB,CAAC,QAAQ;QAC5C,kBAAkB,EAAE,cAAc,CAAC,SAAS;KAC7C,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAElG;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB;;;;;WAKG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB;;;WAGG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,iEAAiE;QACjE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACpD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC;IAEH,oHAAoH;IACpH;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,yGAAyG;QACzG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sIAAsI,CAAC;QACpL,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;QACtI,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;QACrH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;KACpJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5D,kEAAkE;IAElE,uFAAuF;IACvF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,8DAA8D;QAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C;;;;;WAKG;QACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,uDAAuD;QACvD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,uFAAuF;QACvF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QACxF;;;;;;;;WAQG;QACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;KAChF,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB;QACrD,mBAAmB,EAAE,aAAa,CAAC,aAAa;KACjD,CAAC,CAAC;CACJ,CAAC,CAAC","sourcesContent":["/**\n * Billing Configuration Schema (Shared)\n *\n * Top-level billing configuration that custom apps provide at startup.\n * Controls: provider selection, currency, tax policy, enabled scopes,\n * and default behavior policies.\n *\n * @see billing-and-features-system.md §6.7 (Billing Configuration)\n */\n\nimport { z } from 'zod';\nimport { CurrencySchema } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  TaxCalculationMode,\n  TaxDisplayMode,\n  ProrationBehavior,\n  BillingTiming,\n} from './billing-enums.shared.schemas';\nimport { ReferredRewardSchema, ReferrerRewardSchema } from './referral-reward.shared.schemas';\n\nexport const BillingConfigurationSchema = z.object({\n  /** Master switch: is billing enabled for this app? */\n  enabled: z.boolean().default(false),\n  /** Which billing provider to use (e.g., 'stripe') */\n  providerRef: z.string().optional(),\n\n  /*\n   * NO `webhooks` block. `path` and `signingSecretRef` were declared here and read by NOTHING —\n   * `signingSecretRef` had zero references outside its own declaration — and they were removed on\n   * 2026-09-08 (#408) rather than relabelled, because unlike the commercial-intent keys below they\n   * were not even an input to anything.\n   *\n   * The route and the signing secret both come from the provider module's `WEBHOOK_ORIGINATOR`\n   * contract: `buildWebhookEndpoints` mounts it at `/api/v1/webhooks/<provider>/billing`. That is\n   * the single authority, and `webhook-auto-controller.backend.service.ts` already recorded the\n   * same conclusion when endpoint-level path/secret extras were dropped as dead in the 2026-05-06\n   * reshape. This block was the copy that survived that sweep.\n   */\n\n  /**\n   * DECLARATION-ONLY (#408, 2026-09-08). Read by the application-creation commercial-model brief and\n   * by no runtime billing path: nothing validates a product's currency against these, and what\n   * reaches the provider is each price's own `currency`. Authoring them records the commercial\n   * intent a reviewer reads; it enforces nothing.\n   */\n  defaultCurrency: CurrencySchema.default('USD'),\n  /** DECLARATION-ONLY — see `defaultCurrency`. */\n  supportedCurrencies: z.array(CurrencySchema).default(['USD']),\n\n  /**\n   * Tax configuration — calculation is ALWAYS delegated to provider (Stripe Tax, etc.).\n   * We never calculate tax locally.\n   */\n  tax: z.object({\n    /**\n     * Whether the PROVIDER computes tax on a purchase. READ since 2026-09-08 (#408): the checkout\n     * path — the only production purchase route — sends `automaticTax` from this value.\n     *\n     * It reached nothing before that, so `PROVIDER_MANAGED` changed no behaviour and the provider\n     * account's own configuration silently decided. Enabling it changes invoice totals and the tax\n     * amounts persisted against them, which is why it is a decision an application makes rather\n     * than a default the framework picks.\n     */\n    calculationMode: z.enum(TaxCalculationMode).default(TaxCalculationMode.DISABLED),\n\n    /**\n     * How prices are DISPLAYED to users (does not affect provider calculation).\n     * - 'exclusive': Prices shown excluding tax (HT / ex-VAT). Tax added at checkout.\n     *   Common for B2B. Shows \"$49/mo\" and tax is added separately.\n     * - 'inclusive': Prices shown including tax (TTC / inc-VAT). Tax is embedded.\n     *   Common for consumer-facing. Shows \"€49/mo TTC\" and tax is extracted at checkout.\n     *\n     * DECLARATIVE ONLY: nothing reads this value. It is not an application-wide default that\n     * `product.taxDisplayMode` and `price.taxBehavior` override, because there is no resolution\n     * chain between the three. What reaches the billing provider is each price's own\n     * `taxBehavior`, and only that.\n     */\n    defaultDisplayMode: z.enum(TaxDisplayMode).default(TaxDisplayMode.EXCLUSIVE),\n  }).default(() => ({\n    calculationMode: TaxCalculationMode.DISABLED,\n    defaultDisplayMode: TaxDisplayMode.EXCLUSIVE,\n  })),\n\n  /**\n   * Which scopes can have billing accounts (default: ORGANIZATIONS only).\n   * Can be extended to include USER_SELF (personal billing).\n   */\n  enabledScopes: z.array(z.enum(ResourcePrimaryScope)).default([ResourcePrimaryScope.ORGANIZATIONS]),\n\n  /**\n   * Promotions configuration.\n   * Controls whether the promotions subsystem is active.\n   */\n  promotions: z.object({\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08), and the sharpest of them: the promotions subsystem runs\n     * UNCONDITIONALLY. Promotion codes are applied at `billing-account.mutations` and resolved in\n     * `billing-state`, neither of which consults this flag — so setting it `false` disables\n     * nothing, which is a stronger statement than \"is not read\".\n     */\n    enabled: z.boolean().default(true),\n  }).default(() => ({\n    enabled: true,\n  })),\n\n  /**\n   * Credit pool configuration.\n   * Controls whether credit pools are enabled and defines default pool behavior.\n   */\n  creditPools: z.object({\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08) — same shape as `promotions.enabled` above, and the same\n     * correction: credit pools run unconditionally in `billing-state`, so `false` disables nothing.\n     */\n    enabled: z.boolean().default(true),\n    /** Default initial balance for auto-created pools (default 0) */\n    defaultInitialBalance: z.number().min(0).default(0),\n  }).default(() => ({\n    enabled: true,\n    defaultInitialBalance: 0,\n  })),\n\n  /** @wildo_source:part:start saas.models.billing.referral-program facet:layer:shared facet:audience:app-developer */\n  /**\n   * The referral program (#1802): whether organizations may issue referral codes, and what each side\n   * receives when a referral converts (the referred account's first paid invoice).\n   *\n   * The rewards are copied onto each referral when its code is issued, so changing them here affects\n   * codes issued afterwards and never re-prices a referral already made. A reward's `featureKey` must\n   * name a registered boolean feature; startup WARNS about one that does not, like every other feature\n   * reference, and a feature nobody registered grants nothing.\n   */\n  referrals: z.object({\n    /** Off by default: issuing codes that promise rewards is a commercial decision the application makes. */\n    enabled: z.boolean().default(false).describe('Whether organizations may issue referral codes. Redeeming and converting codes already issued keeps working when this is turned off.'),\n    referrerReward: ReferrerRewardSchema.optional().describe('What the referrer receives when a referral converts. Absent means nothing.'),\n    referredReward: ReferredRewardSchema.optional().describe('What the referred account receives. Absent means nothing.'),\n    codeValidityDays: z.number().int().min(1).default(30).describe('How many days a referral code can be redeemed after it is issued. Defaults to 30.'),\n  }).default(() => ({ enabled: false, codeValidityDays: 30 })),\n  /** @wildo_source:part:end saas.models.billing.referral-program */\n\n  /** Global billing policy defaults (overridden by ProductBehaviorPolicy per product) */\n  defaultBehaviorPolicy: z.object({\n    /** Default trial days for new subscriptions (0 = no trial) */\n    defaultTrialDays: z.number().min(0).default(0),\n    /**\n     * DECLARATION-ONLY (#408, 2026-09-08). Dunning — how long to wait and how often to retry after a\n     * failed payment — is configured at the PROVIDER, on its own schedule, and nothing here reaches\n     * it. Binding them would mean writing a provider's retry settings from application config, which\n     * is a different feature from reading a policy at a call site.\n     */\n    paymentGracePeriodDays: z.number().min(0).default(3),\n    /** DECLARATION-ONLY — see `paymentGracePeriodDays`. */\n    maxPaymentRetries: z.number().min(0).default(3),\n    /** Default proration when no product-specific policy. READ by the change-plan path. */\n    defaultProration: z.enum(ProrationBehavior).default(ProrationBehavior.CREATE_PRORATIONS),\n    /**\n     * Default cancellation timing when neither the caller nor the plan product names one.\n     *\n     * READ since 2026-09-08 (#408). It was dead until then, and it is bound rather than relabelled\n     * because — unlike its neighbours above — it needs no provider call at all: cancellation timing\n     * is resolved locally, so the only thing standing between this key and meaning something was a\n     * reader. The chain is caller → product `behaviorPolicy.cancellation.defaultBehavior` → this →\n     * period-end.\n     */\n    defaultCancellation: z.enum(BillingTiming).default(BillingTiming.AT_PERIOD_END),\n  }).default(() => ({\n    defaultTrialDays: 0,\n    paymentGracePeriodDays: 3,\n    maxPaymentRetries: 3,\n    defaultProration: ProrationBehavior.CREATE_PRORATIONS,\n    defaultCancellation: BillingTiming.AT_PERIOD_END,\n  })),\n});\nexport type BillingConfiguration = z.infer<typeof BillingConfigurationSchema>;\n"]}

package/dist/esm/billing/billing-enums.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-enums.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/billing-enums.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAI3J;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,oBAAY,WAAW;IACrB,gEAAgE;IAChE,IAAI,SAAS;IACb,6DAA6D;IAC7D,KAAK,UAAU;IACf,kEAAkE;IAClE,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,sEAAsE;IACtE,WAAW,gBAAgB;IAC3B,0EAA0E;IAC1E,IAAI,SAAS;CACd;AAMD;;;;GAIG;AACH,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAID;;GAEG;AAKH;;;;GAIG;AACH,oBAAY,aAAa;IACvB,SAAS,cAAc;IACvB,aAAa,kBAAkB;CAChC;AACD,sEAAsE;AAMtE;;GAEG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;CAC1C;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,cAAc,mBAAmB;IACjC,MAAM,WAAW;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;GASG;AACH,oBAAY,6BAA6B;IACvC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,mCAAmC;IAC7C,qHAAqH;IACrH,wBAAwB,6BAA6B;IACrD,0HAA0H;IAC1H,sCAAsC,2CAA2C;IACjF,gHAAgH;IAChH,uBAAuB,4BAA4B;IACnD,iFAAiF;IACjF,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,yCAAyC;IACnD,qGAAqG;IACrG,kCAAkC,uCAAuC;IACzE;;;OAGG;IACH,wCAAwC,6CAA6C;IACrF;;;;;OAKG;IACH,qCAAqC,0CAA0C;IAC/E;;;;OAIG;IACH,kCAAkC,uCAAuC;IACzE,kGAAkG;IAClG,yCAAyC,8CAA8C;IACvF;;;OAGG;IACH,+BAA+B,oCAAoC;CACpE;AAMD;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;CACtB;AAYD;;;;;GAKG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,SAAS,cAAc;CACxB;AAID;;GAEG;AACH,oBAAY,aAAa;IACvB,sBAAsB;IACtB,MAAM,WAAW;IACjB,0BAA0B;IAC1B,cAAc,mBAAmB;IACjC,uBAAuB;IACvB,QAAQ,aAAa;IACrB,yBAAyB;IACzB,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,YAAY;IACtB,UAAU,eAAe;IACzB,YAAY,iBAAiB;CAC9B;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,eAAe,oBAAoB;CACpC;AAED;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,6DAA6D;IAC7D,QAAQ,aAAa;IACrB,mEAAmE;IACnE,KAAK,UAAU;CAChB;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC,WAAW,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC;;;;;;OAMG;IACH,kBAAkB,2BAA2B;IAC7C,kGAAkG;IAClG,WAAW,qBAAqB;IAChC;;;;;;;;;;;;OAYG;IACH,YAAY,sBAAsB;IAClC;;;OAGG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;GAIG;AACH,oBAAY,8BAA8B;IACxC;;;;OAIG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,SAAU,CAAC"}
+{"version":3,"file":"billing-enums.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-enums.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAI3J;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,oBAAY,WAAW;IACrB,gEAAgE;IAChE,IAAI,SAAS;IACb,6DAA6D;IAC7D,KAAK,UAAU;IACf,kEAAkE;IAClE,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,sEAAsE;IACtE,WAAW,gBAAgB;IAC3B,0EAA0E;IAC1E,IAAI,SAAS;CACd;AAMD;;;;GAIG;AACH,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAID;;GAEG;AAKH;;;;GAIG;AACH,oBAAY,aAAa;IACvB,SAAS,cAAc;IACvB,aAAa,kBAAkB;CAChC;AACD,sEAAsE;AAMtE;;GAEG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;CAC1C;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,cAAc,mBAAmB;IACjC,MAAM,WAAW;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;GASG;AACH,oBAAY,6BAA6B;IACvC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,mCAAmC;IAC7C,qHAAqH;IACrH,wBAAwB,6BAA6B;IACrD,0HAA0H;IAC1H,sCAAsC,2CAA2C;IACjF,gHAAgH;IAChH,uBAAuB,4BAA4B;IACnD,iFAAiF;IACjF,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,yCAAyC;IACnD,qGAAqG;IACrG,kCAAkC,uCAAuC;IACzE;;;OAGG;IACH,wCAAwC,6CAA6C;IACrF;;;;;OAKG;IACH,qCAAqC,0CAA0C;IAC/E;;;;OAIG;IACH,kCAAkC,uCAAuC;IACzE,kGAAkG;IAClG,yCAAyC,8CAA8C;IACvF;;;OAGG;IACH,+BAA+B,oCAAoC;CACpE;AAMD;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;CACtB;AAYD;;;;;GAKG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,SAAS,cAAc;CACxB;AAID;;GAEG;AACH,oBAAY,aAAa;IACvB,sBAAsB;IACtB,MAAM,WAAW;IACjB,0BAA0B;IAC1B,cAAc,mBAAmB;IACjC,uBAAuB;IACvB,QAAQ,aAAa;IACrB,yBAAyB;IACzB,IAAI,SAAS;CACd;AAED;;GAEG;AACH,oBAAY,YAAY;IACtB,UAAU,eAAe;IACzB,YAAY,iBAAiB;CAC9B;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,eAAe,oBAAoB;CACpC;AAED;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,6DAA6D;IAC7D,QAAQ,aAAa;IACrB,mEAAmE;IACnE,KAAK,UAAU;CAChB;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC,WAAW,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC;;;;;;OAMG;IACH,kBAAkB,2BAA2B;IAC7C,kGAAkG;IAClG,WAAW,qBAAqB;IAChC;;;;;;;;;;;;OAYG;IACH,YAAY,sBAAsB;IAClC;;;OAGG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;GAIG;AACH,oBAAY,8BAA8B;IACxC;;;;OAIG;IACH,QAAQ,mBAAmB;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,SAAU,CAAC"}

package/dist/esm/billing/billing-enums.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-enums.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/billing-enums.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAE3J,sEAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAN,IAAY,WAaX;AAbD,WAAY,WAAW;IACrB,gEAAgE;IAChE,4BAAa,CAAA;IACb,6DAA6D;IAC7D,8BAAe,CAAA;IACf,kEAAkE;IAClE,kCAAmB,CAAA;IACnB,6EAA6E;IAC7E,oCAAqB,CAAA;IACrB,sEAAsE;IACtE,0CAA2B,CAAA;IAC3B,0EAA0E;IAC1E,4BAAa,CAAA;AACf,CAAC,EAbW,WAAW,KAAX,WAAW,QAatB;AAED,oGAAoG;AACpG,8EAA8E;AAC9E,mGAAmG;AAEnG;;;;GAIG;AACH,MAAM,CAAN,IAAY,cAGX;AAHD,WAAY,cAAc;IACxB,6BAAW,CAAA;IACX,6BAAW,CAAA;AACb,CAAC,EAHW,cAAc,KAAd,cAAc,QAGzB;AAED,sEAAsE;AAEtE;;GAEG;AACH,8FAA8F;AAC9F,gGAAgG;AAChG,gGAAgG;AAEhG;;;;GAIG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,wCAAuB,CAAA;IACvB,gDAA+B,CAAA;AACjC,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AACD,sEAAsE;AAEtE,2FAA2F;AAE3F,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACnC,oDAAuB,CAAA;IACvB,sEAAyC,CAAA;AAC3C,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,mCAAW,CAAA;IACX,mCAAW,CAAA;IACX,qCAAa,CAAA;AACf,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,oDAAiC,CAAA;IACjC,oCAAiB,CAAA;AACnB,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,8CAAqB,CAAA;IACrB,sDAA6B,CAAA;AAC/B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,6BAUX;AAVD,WAAY,6BAA6B;IACvC;;;;;;;OAOG;IACH,oFAAmD,CAAA;AACrD,CAAC,EAVW,6BAA6B,KAA7B,6BAA6B,QAUxC;AAED,sEAAsE;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,mCASX;AATD,WAAY,mCAAmC;IAC7C,qHAAqH;IACrH,4FAAqD,CAAA;IACrD,0HAA0H;IAC1H,wHAAiF,CAAA;IACjF,gHAAgH;IAChH,0FAAmD,CAAA;IACnD,iFAAiF;IACjF,oFAA6C,CAAA;AAC/C,CAAC,EATW,mCAAmC,KAAnC,mCAAmC,QAS9C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,yCA4BX;AA5BD,WAAY,yCAAyC;IACnD,qGAAqG;IACrG,sHAAyE,CAAA;IACzE;;;OAGG;IACH,kIAAqF,CAAA;IACrF;;;;;OAKG;IACH,4HAA+E,CAAA;IAC/E;;;;OAIG;IACH,sHAAyE,CAAA;IACzE,kGAAkG;IAClG,oIAAuF,CAAA;IACvF;;;OAGG;IACH,gHAAmE,CAAA;AACrE,CAAC,EA5BW,yCAAyC,KAAzC,yCAAyC,QA4BpD;AAED,sEAAsE;AAEtE,0FAA0F;AAE1F;;GAEG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,2DAAqC,CAAA;IACrC,2CAAqB,CAAA;AACvB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,sEAAsE;AAEtE,8FAA8F;AAE9F,0FAA0F;AAC1F,mGAAmG;AACnG,iCAAiC;AAEjC,sEAAsE;AAEtE;;;;;GAKG;AACH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAN,IAAY,aASX;AATD,WAAY,aAAa;IACvB,sBAAsB;IACtB,kCAAiB,CAAA;IACjB,0BAA0B;IAC1B,kDAAiC,CAAA;IACjC,uBAAuB;IACvB,sCAAqB,CAAA;IACrB,yBAAyB;IACzB,8BAAa,CAAA;AACf,CAAC,EATW,aAAa,KAAb,aAAa,QASxB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,YAGX;AAHD,WAAY,YAAY;IACtB,yCAAyB,CAAA;IACzB,6CAA6B,CAAA;AAC/B,CAAC,EAHW,YAAY,KAAZ,YAAY,QAGvB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,kCAAa,CAAA;IACb,4CAAuB,CAAA;IACvB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,KAAjB,iBAAiB,QAI5B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,qCAAmB,CAAA;IACnB,uCAAqB,CAAA;IACrB,yCAAuB,CAAA;IACvB,qCAAmB,CAAA;IACnB,yCAAuB,CAAA;AACzB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,2CAAqB,CAAA;IACrB,yCAAmB,CAAA;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,2CAAqB,CAAA;IACrB,yCAAmB,CAAA;IACnB,yDAAmC,CAAA;AACrC,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,6DAA6D;IAC7D,8CAAqB,CAAA;IACrB,mEAAmE;IACnE,wCAAe,CAAA;AACjB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BA8BX;AA9BD,WAAY,0BAA0B;IACpC;;;;;;OAMG;IACH,2EAA6C,CAAA;IAC7C,kGAAkG;IAClG,8DAAgC,CAAA;IAChC;;;;;;;;;;;;OAYG;IACH,gEAAkC,CAAA;IAClC;;;OAGG;IACH,yDAA2B,CAAA;AAC7B,CAAC,EA9BW,0BAA0B,KAA1B,0BAA0B,QA8BrC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACxC;;;;OAIG;IACH,6DAA2B,CAAA;AAC7B,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,OAAO,CAAC","sourcesContent":["/**\n * Billing Enums (Shared)\n *\n * All billing-system enums used across backend, frontend, and shared models.\n * These supersede the legacy enums from billing.shared.schemas.ts.\n *\n * Enums shared with the standard billing interface (PricingModel, BillingInterval,\n * TaxDisplayMode, SubscriptionStatus, InvoiceStatus, ProrationBehavior) are defined in\n * @wildo-ai/external-connectors-models and re-exported here for convenience.\n *\n * @see billing-and-features-system.md §6 (Billing Schemas)\n */\n\nexport { PricingModel, BillingInterval, TaxDisplayMode, SubscriptionStatus, InvoiceStatus, ProrationBehavior } from '@wildo-ai/external-connectors-models';\n\n// ── Product & Pricing ──────────────────────────────────────────────\n\n/**\n * @wildo_source:part:start saas.models.billing.catalog-vocabularies facet:layer:shared facet:audience:app-developer\n *\n * The vocabularies an application types into its own product catalogue — the `ProductDefinition[]`\n * it exports from its shared library and hands to the engine with its module declarations.\n *\n * Imported from `@wildo-ai/saas-models`. `PricingModel`, `BillingInterval` and `ProrationBehavior`\n * are re-exported from the connector models, because their values ARE the provider's wire values.\n *\n * The authored catalogue is the source of truth; provider-dashboard edits are not read back.\n * A complete sync detects active local product keys absent from the array and deactivates those\n * products and their active local prices, retaining the rows and reporting live subscribers.\n * It does not archive provider products/prices or migrate/cancel subscribers. Treat provider\n * retirement and customer migration as separate decisions, and inspect the complete sync result.\n *\n * Product types available in the billing catalog.\n *\n * | Type        | Creates subscription? | Repeatable? | Grants features? | Usage tracked? |\n * |-------------|----------------------|-------------|------------------|----------------|\n * | PLAN        | Yes (exclusive)      | No (switch) | Yes              | No             |\n * | ADDON       | Yes (stackable)      | No (toggle) | Yes              | No             |\n * | METERED     | Yes                  | No          | Optional         | Yes            |\n * | ONE_TIME    | No                   | No (once)   | Optional         | No             |\n * | CREDIT_PACK | No                   | Yes         | No (credits)     | Credits-based  |\n * | ITEM        | No                   | Yes         | Optional         | No             |\n */\nexport enum ProductType {\n  /** Subscription plan, mutually exclusive per billing account */\n  PLAN = 'plan',\n  /** Optional subscription add-on, stackable on top of plan */\n  ADDON = 'addon',\n  /** Usage-based subscription (consumption reported to provider) */\n  METERED = 'metered',\n  /** Single purchase, once per billing account (e.g., setup fee, migration) */\n  ONE_TIME = 'one_time',\n  /** Buy a pack of credits/tokens (repeatable, consumable over time) */\n  CREDIT_PACK = 'credit_pack',\n  /** Purchasable item, repeatable (e.g., report generation, data export) */\n  ITEM = 'item',\n}\n\n// ProductPriceDisclosure / ProductAvailability: declared in `./public-pricing-catalog.shared.atoms`\n// (#1835) — import-free so the website's browser bundle can name them through\n// `@wildo-ai/saas-models/public-runtime`. Not re-exported here; the package root exports the atom.\n\n/**\n * Limit grant mode: how this product's limits compose with other products.\n * - SET: absolute value (replaces, used for PLAN base limits)\n * - ADD: additive (stacks on top, used for ADDON bonus limits)\n */\nexport enum LimitGrantMode {\n  SET = 'set',\n  ADD = 'add',\n}\n\n// ── Billing Lifecycle ──────────────────────────────────────────────\n\n/**\n * Proration behavior for plan changes (upgrade/downgrade).\n */\n// ProrationBehavior: re-exported from @wildo-ai/external-connectors-models (see top of file).\n// Moved there 2026-09-08 (#516) because its three values ARE the provider's wire values, so the\n// request contract has to be able to name the type — see TaxDisplayMode for the same reasoning.\n\n/**\n * Billing timing: when a cancellation takes effect (`behaviorPolicy.cancellation.defaultBehavior`), and when a plan\n * change takes effect (`behaviorPolicy.upgrade.timing` / `downgrade.timing`, #1868). A plan change `at_period_end` is\n * carried as the subscription's `pendingPlanChange` and applied at renewal through a provider subscription schedule.\n */\nexport enum BillingTiming {\n  IMMEDIATE = 'immediate',\n  AT_PERIOD_END = 'at_period_end',\n}\n/** @wildo_source:part:end saas.models.billing.catalog-vocabularies */\n\n// BillingInterval: re-exported from @wildo-ai/external-connectors-models (see top of file)\n\n// ── Metering & Usage ───────────────────────────────────────────────\n\n/**\n * Metering aggregation window for usage records.\n */\nexport enum MeteringAggregationWindow {\n  PER_FLUSH = 'per_flush',\n  PER_BILLING_PERIOD = 'per_billing_period',\n}\n\n/**\n * Usage aggregation type for metered prices.\n */\nexport enum UsageAggregationType {\n  SUM = 'sum',\n  MAX = 'max',\n  LAST = 'last',\n}\n\n/**\n * Usage record source type.\n */\nexport enum UsageSourceType {\n  OPERATION = 'operation',\n  RESOURCE_COUNT = 'resource_count',\n  CUSTOM = 'custom',\n}\n\n/**\n * Where one metered usage row stands with respect to the provider flush.\n *\n * This was a BOOLEAN (`reportedToProvider`) until 2026-09-09, and the third state is the whole\n * reason it is an enum now (#512). A boolean can say \"not yet reported\" and \"reported\", and the\n * flush selects on the first — so a row that can NEVER be reported has nowhere to go. It stays\n * pending, is re-selected by every run, fails identically, and grows an error backlog that no\n * operator action can drain, on a five-minute schedule.\n *\n * The three states are genuinely distinct and must not be collapsed:\n *\n * - {@link PENDING} — the flush will try again. Every newly recorded row starts here.\n * - {@link REPORTED} — the provider acknowledged the quantity. `reportedAt` says when. Terminal,\n *   and money has moved: never move a row back out of this state.\n * - {@link UNREPORTABLE} — the flush determined the row can never be reported, for a reason named\n *   in `unreportableReason`. Terminal, and NO money moved. Marking such a row `REPORTED` instead\n *   would drain the backlog just as well and would be a lie no later reader could detect, which is\n *   exactly why the state exists rather than a shortcut.\n */\nexport enum UsageRecordFlushState {\n  PENDING = 'pending',\n  REPORTED = 'reported',\n  UNREPORTABLE = 'unreportable',\n}\n\n/**\n * Why a usage row was determined to be permanently unreportable.\n *\n * One member today, and it is a closed vocabulary rather than a free string because the operator\n * reading a retained financial record needs to know which permanent condition applies — and because\n * the distinction between a PERMANENT and a TRANSIENT failure is the judgement this whole state\n * turns on. A billing account that merely has no `providerCustomerId` yet is transient: the account\n * exists, provisioning may still complete, and such a row stays {@link UsageRecordFlushState.PENDING}.\n * Only a condition that cannot resolve itself belongs here.\n */\nexport enum UsageRecordUnreportableReason {\n  /**\n   * The billing account row no longer exists.\n   *\n   * Reachable by design: usage rows are RETAINED when their subject is erased (the tax/audit\n   * obligation on `usage-record.shared.schemas.ts`), so a deleted account legitimately leaves rows\n   * behind with no provider customer to report them to. Nothing can restore the mapping, so the\n   * quantity will never be billed and saying so on the row is the only honest outcome.\n   */\n  BILLING_ACCOUNT_DELETED = 'billing_account_deleted',\n}\n\n// ── Provider reconciliation ────────────────────────────────────────\n\n/**\n * What KIND of disagreement a billing reconciliation run found between local billing state and the\n * provider.\n *\n * A closed vocabulary rather than free text on a log line, because each kind has a different\n * treatment and a different meaning when it persists, and a recorded run has to be able to say\n * which one it saw how many times:\n *\n * - the two DRIFT kinds and the MISSING kind are REPAIRED, within the provider-authoritative field\n *   set only;\n * - {@link SUBSCRIPTION_PROVIDER_STATE_UNREADABLE} is NEVER repaired — a failed read, including a\n *   provider saying the subscription does not exist, is not evidence the subscription ended, so it\n *   is reported and nothing is written.\n *\n * A steady non-zero count of any repaired kind means webhook delivery is failing and the sweep is\n * papering over it; that is a different problem from the sweep failing, and only a per-kind count\n * can tell them apart.\n */\nexport enum BillingReconciliationDivergenceKind {\n  /** A live, provider-linked subscription disagreed with the provider on at least one provider-authoritative field. */\n  SUBSCRIPTION_FIELD_DRIFT = 'subscription_field_drift',\n  /** The provider's state for a provider-linked subscription could not be read. Reported only; local state is untouched. */\n  SUBSCRIPTION_PROVIDER_STATE_UNREADABLE = 'subscription_provider_state_unreadable',\n  /** An invoice the provider holds for a known customer had no local record — its webhook was never delivered. */\n  INVOICE_MISSING_LOCALLY = 'invoice_missing_locally',\n  /** A locally recorded invoice carried a different status from the provider's. */\n  INVOICE_STATUS_DRIFT = 'invoice_status_drift',\n}\n\n/**\n * A population a reconciliation run met and deliberately did NOT compare against the provider.\n *\n * Counted per run, because a sweep that silently skips rows is indistinguishable from one that\n * compared them and found agreement — and \"we reconciled everything\" is only a true sentence when\n * the skipped populations are stated beside it. Each member is a DECISION with a reason, not a gap:\n *\n * Populations that are never compared by design and therefore never met at all — terminal\n * subscriptions, subscriptions known only to the provider, subscription items, invoice totals, and\n * invoices older than the per-customer lookback — are named on `BillingReconciliationBackendService`\n * rather than here, because a run cannot count what it never selects.\n */\nexport enum BillingReconciliationUncomparedPopulation {\n  /** A local subscription with no provider link: there is no provider record to compare it against. */\n  SUBSCRIPTION_WITHOUT_PROVIDER_LINK = 'subscription_without_provider_link',\n  /**\n   * A provider-linked subscription whose mutation slot holds a PREPARED admission: one of its mutations is\n   * about to call the provider, so the run neither read nor wrote it. Its next run re-reads it.\n   */\n  SUBSCRIPTION_MUTATION_ADMISSION_PREPARED = 'subscription_mutation_admission_prepared',\n  /**\n   * A provider-linked subscription the run read and found disagreeing, but whose mutation slot was written after that read, so nothing\n   * was written: the difference may already be gone. The writer is not always a mutation or a webhook — recovery moving a held\n   * generation behind newer ones advances the same version without settling anything — so this counts a read to REPEAT, never a\n   * mutation observed. Counted here rather than as a divergence the run cannot confirm. Its next run re-reads it.\n   */\n  SUBSCRIPTION_SUPERSEDED_BEFORE_REPAIR = 'subscription_superseded_before_repair',\n  /**\n   * A provider-linked subscription whose billing account or provider link no longer matches the identity its mutation slot\n   * records. A mutation refuses the same condition as `slot_identity_changed`; the run neither compares nor writes it, and it\n   * stays held until recovery resolves the slot.\n   */\n  SUBSCRIPTION_SLOT_IDENTITY_CHANGED = 'subscription_slot_identity_changed',\n  /** A billing account with no provider customer: nothing at the provider can hold its invoices. */\n  BILLING_ACCOUNT_WITHOUT_PROVIDER_CUSTOMER = 'billing_account_without_provider_customer',\n  /**\n   * A billing scope whose rows exceeded one run's page ceiling. The remainder is left to the next run:\n   * reconciliation is idempotent, so a prefix is safe, but the count says the run did not cover the scope.\n   */\n  SCOPE_TRUNCATED_AT_PAGE_CEILING = 'scope_truncated_at_page_ceiling',\n}\n\n// ── Tax ────────────────────────────────────────────────────────────\n\n// TaxDisplayMode: re-exported from @wildo-ai/external-connectors-models (see top of file)\n\n/**\n * Tax calculation mode: provider-managed or disabled.\n */\nexport enum TaxCalculationMode {\n  PROVIDER_MANAGED = 'provider_managed',\n  DISABLED = 'disabled',\n}\n\n// ── Subscription & Invoice Status ──────────────────────────────────\n\n// SubscriptionStatus: re-exported from @wildo-ai/external-connectors-models (see top of file)\n\n// InvoiceStatus: re-exported from @wildo-ai/external-connectors-models (see top of file).\n// It moved there on 2026-09-09 so `StandardBilling_InvoiceData` could name it; the specifier every\n// consumer imports is unchanged.\n\n// ── Billing Scope ──────────────────────────────────────────────────\n\n/**\n * Billing-compatible scope types.\n * Subset of ResourcePrimaryScope — excludes APPLICATION which has no billing variants.\n * Used by scope-agnostic billing resources (e.g., Referrals) that reference\n * billing accounts across different polymorphic collections.\n */\nexport enum BillingScopeType {\n  ORGANIZATIONS = 'organizations',\n  USER_SELF = 'user_self',\n}\n\n// ── Promotions & Referrals ─────────────────────────────────────────\n\n/**\n * Promotion type.\n */\nexport enum PromotionType {\n  /** Direct discount */\n  COUPON = 'coupon',\n  /** Code-based discount */\n  PROMOTION_CODE = 'promotion_code',\n  /** Referral program */\n  REFERRAL = 'referral',\n  /** Special deal/offer */\n  DEAL = 'deal',\n}\n\n/**\n * Discount type for promotions.\n */\nexport enum DiscountType {\n  PERCENTAGE = 'percentage',\n  FIXED_AMOUNT = 'fixed_amount',\n}\n\n/**\n * Promotion duration (how long the discount applies).\n */\nexport enum PromotionDuration {\n  ONCE = 'once',\n  REPEATING = 'repeating',\n  FOREVER = 'forever',\n}\n\n/**\n * Referral status lifecycle.\n */\nexport enum ReferralStatus {\n  PENDING = 'pending',\n  ACCEPTED = 'accepted',\n  CONVERTED = 'converted',\n  EXPIRED = 'expired',\n  CANCELLED = 'cancelled',\n}\n\n/**\n * What a referrer receives when a referral converts (#1802). Each member names the fields it reads in\n * `ReferrerRewardSchema` and how it is delivered:\n *\n * - `CREDIT` — `credits` added to the `creditPoolKey` credit pool, as a GRANT (not a purchase).\n * - `DISCOUNT` — a `percentOff` coupon on the account's active subscription, for `discountDuration`.\n * - `FEATURE` — the boolean feature `featureKey`, for `durationDays` after conversion or permanently.\n *\n * `COMMISSION` was removed: a commission is a payout to the referrer, and the framework has no payout\n * mechanism, so a declared commission could only ever be recorded and never paid.\n */\nexport enum ReferrerRewardType {\n  CREDIT = 'credit',\n  DISCOUNT = 'discount',\n  FEATURE = 'feature',\n}\n\n/**\n * What a referred account receives (#1802). The first three are delivered like the referrer's, when the\n * referral converts. `TRIAL_EXTENSION` shapes the purchase itself: every subscription checkout the\n * referred account opens while the referral is ACCEPTED gets `trialExtensionDays` more trial.\n */\nexport enum ReferredRewardType {\n  CREDIT = 'credit',\n  DISCOUNT = 'discount',\n  FEATURE = 'feature',\n  TRIAL_EXTENSION = 'trial_extension',\n}\n\n/**\n * Where credits added to a pool came from (#1802). A pool counts them separately — `totalPurchased` for\n * credits a customer paid for, `totalGranted` for credits given to them — because the two answer\n * different questions: what was sold, and what was given away.\n */\nexport enum CreditPoolTopUpSource {\n  /** Credits from a paid purchase (a credit-pack checkout). */\n  PURCHASE = 'purchase',\n  /** Credits given without a purchase, such as a referral reward. */\n  GRANT = 'grant',\n}\n\n// ── Provider checkout metadata: the framework/caller trust boundary ─────────────\n\n/**\n * Prefix that marks a provider-metadata key as FRAMEWORK-AUTHORITATIVE.\n *\n * ## Why a reserved namespace exists at all\n *\n * A provider checkout session carries ONE flat `metadata` map, and two parties want to write into\n * it: the framework (which needs to recognise the purchase when the provider echoes the session\n * back on `checkout.session.completed`) and the application's own caller (who legitimately wants\n * to tag the purchase for their analytics or reconciliation).\n *\n * Those two writers do not have the same authority. The framework's entries decide WHICH billing\n * account is credited and HOW MUCH — the provider replays them verbatim inside a genuinely SIGNED\n * webhook, so a signature proves the provider sent them, never that the framework wrote them. The\n * caller's entries decide nothing.\n *\n * Sharing one un-partitioned namespace between those two authorities is what turned a caller-supplied\n * map into a credit-minting primitive: the producer spread caller metadata LAST, so `billingAccountId`\n * / `productKey` / `quantity` were simply overwritable, and the webhook consumer read the result back\n * as trusted framework state. Ordering alone is not the fix — swapping the spread leaves an\n * unmarked namespace in which the NEXT authoritative key is one careless line from being overridable\n * again. The prefix makes the trust boundary a property of the KEY, so it survives refactors.\n *\n * The boundary is enforced in three places, deliberately overlapping:\n * 1. the OPEN_CHECKOUT request DTO REFUSES any caller key carrying this prefix (loud, at the edge);\n * 2. the metadata builder writes the reserved entries LAST (structural, cannot be forgotten);\n * 3. the webhook consumer reads ONLY reserved keys, and re-derives the billing account from\n *    provider-authoritative data rather than trusting the echoed value.\n *\n * @see BillingCheckoutMetadataKey for the reserved key vocabulary itself.\n */\nexport const BILLING_RESERVED_METADATA_KEY_PREFIX = 'wildo_';\n\n/**\n * The closed vocabulary of framework-authoritative provider-metadata keys.\n *\n * Every member MUST start with {@link BILLING_RESERVED_METADATA_KEY_PREFIX} — that is what makes the\n * DTO's caller-key refusal and the consumer's read-only-reserved rule line up. A member added\n * without the prefix would be silently overridable by a caller, which is the whole defect this\n * vocabulary exists to prevent, so a pinned test asserts the prefix across every member.\n *\n * Named rather than inlined because each member carries a different obligation on the consumer side\n * (one is cross-checked against provider truth, one selects the product, one is bounded and\n * strictly parsed) and a bare string literal has nowhere to record that.\n */\nexport enum BillingCheckoutMetadataKey {\n  /**\n   * The billing account the checkout was opened FOR.\n   *\n   * Written for traceability and cross-checking only. The webhook consumer re-derives the account\n   * from the provider-authoritative customer id on the event and REFUSES the event if the echoed\n   * value disagrees — it is never used as the account to credit.\n   */\n  BILLING_ACCOUNT_ID = 'wildo_billingAccountId',\n  /** The catalog product key purchased — selects the credit pool and credits-per-unit on top-up. */\n  PRODUCT_KEY = 'wildo_productKey',\n  /**\n   * The PROMOTION row whose code the framework validated when it opened this checkout, so the\n   * redemption can be counted when the session COMPLETES (#518).\n   *\n   * Absent when the purchase used no code, which is the common case.\n   *\n   * Stamped rather than re-derived from the completed session, because the provider reports the\n   * DISCOUNT it applied and not the Wildo row that authorised it — and the row is what carries\n   * `maxRedemptions`. Like every key here it is written for the framework's own reconciliation and is\n   * never trusted as authority on its own: the redemption is counted with a compare-and-swap that\n   * refuses past the cap, so a tampered value can at worst count a redemption against a promotion\n   * that has room for one.\n   */\n  PROMOTION_ID = 'wildo_promotionId',\n  /**\n   * The purchased quantity, as a decimal integer string (provider metadata values are strings).\n   * Strictly parsed and bounded by {@link BILLING_CHECKOUT_MAX_QUANTITY} on the way back in.\n   */\n  QUANTITY = 'wildo_quantity',\n}\n\n/**\n * Framework-authoritative metadata keys the engine writes on a provider SUBSCRIPTION (#535), in the same reserved namespace\n * as {@link BillingCheckoutMetadataKey} and under the same rule: every member starts with\n * {@link BILLING_RESERVED_METADATA_KEY_PREFIX}, so no caller-authored metadata can be mistaken for it.\n */\nexport enum BillingSubscriptionMetadataKey {\n  /**\n   * `<slotId>:<generation>` of the subscription mutation that sent the update. Written so reconciliation can match a\n   * provider object to the durable mutation that caused it — including a change whose response was lost. A reference, never\n   * authority on its own: a match is confirmed against the stored mutation's identity.\n   */\n  MUTATION = 'wildo_mutation',\n}\n\n/**\n * Upper bound on a single checkout's line-item quantity, applied on BOTH sides of the provider\n * round trip: the OPEN_CHECKOUT request DTO refuses more, and the webhook consumer refuses to\n * honour more.\n *\n * One shared constant rather than two, because a consumer bound lower than the producer bound would\n * silently refuse legitimate large purchases the framework itself allowed to be billed — the\n * failure mode where the customer is charged and the credits never arrive.\n *\n * The value is a framework policy ceiling, not a provider-derived one: it is deliberately far above\n * any plausible self-serve purchase and far below the range where an unbounded quantity becomes a\n * credit-minting primitive. An application whose catalog genuinely sells in larger units should\n * raise it here, where both sides read it, rather than at either end.\n */\nexport const BILLING_CHECKOUT_MAX_QUANTITY = 999_999;\n"]}
+{"version":3,"file":"billing-enums.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-enums.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAE3J,sEAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAN,IAAY,WAaX;AAbD,WAAY,WAAW;IACrB,gEAAgE;IAChE,4BAAa,CAAA;IACb,6DAA6D;IAC7D,8BAAe,CAAA;IACf,kEAAkE;IAClE,kCAAmB,CAAA;IACnB,6EAA6E;IAC7E,oCAAqB,CAAA;IACrB,sEAAsE;IACtE,0CAA2B,CAAA;IAC3B,0EAA0E;IAC1E,4BAAa,CAAA;AACf,CAAC,EAbW,WAAW,KAAX,WAAW,QAatB;AAED,oGAAoG;AACpG,8EAA8E;AAC9E,mGAAmG;AAEnG;;;;GAIG;AACH,MAAM,CAAN,IAAY,cAGX;AAHD,WAAY,cAAc;IACxB,6BAAW,CAAA;IACX,6BAAW,CAAA;AACb,CAAC,EAHW,cAAc,KAAd,cAAc,QAGzB;AAED,sEAAsE;AAEtE;;GAEG;AACH,8FAA8F;AAC9F,gGAAgG;AAChG,gGAAgG;AAEhG;;;;GAIG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,wCAAuB,CAAA;IACvB,gDAA+B,CAAA;AACjC,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AACD,sEAAsE;AAEtE,2FAA2F;AAE3F,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACnC,oDAAuB,CAAA;IACvB,sEAAyC,CAAA;AAC3C,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,mCAAW,CAAA;IACX,mCAAW,CAAA;IACX,qCAAa,CAAA;AACf,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,oDAAiC,CAAA;IACjC,oCAAiB,CAAA;AACnB,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,8CAAqB,CAAA;IACrB,sDAA6B,CAAA;AAC/B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,6BAUX;AAVD,WAAY,6BAA6B;IACvC;;;;;;;OAOG;IACH,oFAAmD,CAAA;AACrD,CAAC,EAVW,6BAA6B,KAA7B,6BAA6B,QAUxC;AAED,sEAAsE;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,mCASX;AATD,WAAY,mCAAmC;IAC7C,qHAAqH;IACrH,4FAAqD,CAAA;IACrD,0HAA0H;IAC1H,wHAAiF,CAAA;IACjF,gHAAgH;IAChH,0FAAmD,CAAA;IACnD,iFAAiF;IACjF,oFAA6C,CAAA;AAC/C,CAAC,EATW,mCAAmC,KAAnC,mCAAmC,QAS9C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,yCA4BX;AA5BD,WAAY,yCAAyC;IACnD,qGAAqG;IACrG,sHAAyE,CAAA;IACzE;;;OAGG;IACH,kIAAqF,CAAA;IACrF;;;;;OAKG;IACH,4HAA+E,CAAA;IAC/E;;;;OAIG;IACH,sHAAyE,CAAA;IACzE,kGAAkG;IAClG,oIAAuF,CAAA;IACvF;;;OAGG;IACH,gHAAmE,CAAA;AACrE,CAAC,EA5BW,yCAAyC,KAAzC,yCAAyC,QA4BpD;AAED,sEAAsE;AAEtE,0FAA0F;AAE1F;;GAEG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,2DAAqC,CAAA;IACrC,2CAAqB,CAAA;AACvB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,sEAAsE;AAEtE,8FAA8F;AAE9F,0FAA0F;AAC1F,mGAAmG;AACnG,iCAAiC;AAEjC,sEAAsE;AAEtE;;;;;GAKG;AACH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAN,IAAY,aASX;AATD,WAAY,aAAa;IACvB,sBAAsB;IACtB,kCAAiB,CAAA;IACjB,0BAA0B;IAC1B,kDAAiC,CAAA;IACjC,uBAAuB;IACvB,sCAAqB,CAAA;IACrB,yBAAyB;IACzB,8BAAa,CAAA;AACf,CAAC,EATW,aAAa,KAAb,aAAa,QASxB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,YAGX;AAHD,WAAY,YAAY;IACtB,yCAAyB,CAAA;IACzB,6CAA6B,CAAA;AAC/B,CAAC,EAHW,YAAY,KAAZ,YAAY,QAGvB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,kCAAa,CAAA;IACb,4CAAuB,CAAA;IACvB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,KAAjB,iBAAiB,QAI5B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,qCAAmB,CAAA;IACnB,uCAAqB,CAAA;IACrB,yCAAuB,CAAA;IACvB,qCAAmB,CAAA;IACnB,yCAAuB,CAAA;AACzB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,2CAAqB,CAAA;IACrB,yCAAmB,CAAA;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,2CAAqB,CAAA;IACrB,yCAAmB,CAAA;IACnB,yDAAmC,CAAA;AACrC,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,6DAA6D;IAC7D,8CAAqB,CAAA;IACrB,mEAAmE;IACnE,wCAAe,CAAA;AACjB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BA8BX;AA9BD,WAAY,0BAA0B;IACpC;;;;;;OAMG;IACH,2EAA6C,CAAA;IAC7C,kGAAkG;IAClG,8DAAgC,CAAA;IAChC;;;;;;;;;;;;OAYG;IACH,gEAAkC,CAAA;IAClC;;;OAGG;IACH,yDAA2B,CAAA;AAC7B,CAAC,EA9BW,0BAA0B,KAA1B,0BAA0B,QA8BrC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACxC;;;;OAIG;IACH,6DAA2B,CAAA;AAC7B,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,OAAO,CAAC","sourcesContent":["/**\n * Billing Enums (Shared)\n *\n * All billing-system enums used across backend, frontend, and shared models.\n * These supersede the legacy enums from billing.shared.schemas.ts.\n *\n * Enums shared with the standard billing interface (PricingModel, BillingInterval,\n * TaxDisplayMode, SubscriptionStatus, InvoiceStatus, ProrationBehavior) are defined in\n * @wildo-ai/external-connectors-models and re-exported here for convenience.\n *\n * @see billing-and-features-system.md §6 (Billing Schemas)\n */\n\nexport { PricingModel, BillingInterval, TaxDisplayMode, SubscriptionStatus, InvoiceStatus, ProrationBehavior } from '@wildo-ai/external-connectors-models';\n\n// ── Product & Pricing ──────────────────────────────────────────────\n\n/**\n * @wildo_source:part:start saas.models.billing.catalog-vocabularies facet:layer:shared facet:audience:app-developer\n *\n * The vocabularies an application types into its own product catalogue — the `ProductDefinition[]`\n * it exports from its shared library and hands to the engine with its module declarations.\n *\n * Imported from `@wildo-ai/saas-models`. `PricingModel`, `BillingInterval` and `ProrationBehavior`\n * are re-exported from the connector models, because their values ARE the provider's wire values.\n *\n * The authored catalogue is the source of truth; provider-dashboard edits are not read back.\n * A complete sync detects active local product keys absent from the array and deactivates those\n * products and their active local prices, retaining the rows and reporting live subscribers.\n * It does not archive provider products/prices or migrate/cancel subscribers. Treat provider\n * retirement and customer migration as separate decisions, and inspect the complete sync result.\n *\n * Product types available in the billing catalog.\n *\n * | Type        | Creates subscription? | Repeatable? | Grants features? | Usage tracked? |\n * |-------------|----------------------|-------------|------------------|----------------|\n * | PLAN        | Yes (exclusive)      | No (switch) | Yes              | No             |\n * | ADDON       | Yes (stackable)      | No (toggle) | Yes              | No             |\n * | METERED     | Yes                  | No          | Optional         | Yes            |\n * | ONE_TIME    | No                   | No (once)   | Optional         | No             |\n * | CREDIT_PACK | No                   | Yes         | No (credits)     | Credits-based  |\n * | ITEM        | No                   | Yes         | Optional         | No             |\n */\nexport enum ProductType {\n  /** Subscription plan, mutually exclusive per billing account */\n  PLAN = 'plan',\n  /** Optional subscription add-on, stackable on top of plan */\n  ADDON = 'addon',\n  /** Usage-based subscription (consumption reported to provider) */\n  METERED = 'metered',\n  /** Single purchase, once per billing account (e.g., setup fee, migration) */\n  ONE_TIME = 'one_time',\n  /** Buy a pack of credits/tokens (repeatable, consumable over time) */\n  CREDIT_PACK = 'credit_pack',\n  /** Purchasable item, repeatable (e.g., report generation, data export) */\n  ITEM = 'item',\n}\n\n// ProductPriceDisclosure / ProductAvailability: declared in `./public-pricing-catalog.shared.atoms`\n// (#1835) — import-free so the website's browser bundle can name them through\n// `@wildo-ai/saas-models/public-runtime`. Not re-exported here; the package root exports the atom.\n\n/**\n * Limit grant mode: how this product's limits compose with other products.\n * - SET: absolute value (replaces, used for PLAN base limits)\n * - ADD: additive (stacks on top, used for ADDON bonus limits)\n */\nexport enum LimitGrantMode {\n  SET = 'set',\n  ADD = 'add',\n}\n\n// ── Billing Lifecycle ──────────────────────────────────────────────\n\n/**\n * Proration behavior for plan changes (upgrade/downgrade).\n */\n// ProrationBehavior: re-exported from @wildo-ai/external-connectors-models (see top of file).\n// Moved there 2026-09-08 (#516) because its three values ARE the provider's wire values, so the\n// request contract has to be able to name the type — see TaxDisplayMode for the same reasoning.\n\n/**\n * Billing timing: when a cancellation takes effect (`behaviorPolicy.cancellation.defaultBehavior`), and when a plan\n * change takes effect (`behaviorPolicy.upgrade.timing` / `downgrade.timing`, #1868). A plan change `at_period_end` is\n * carried as the subscription's `pendingPlanChange` and applied at renewal through a provider subscription schedule.\n */\nexport enum BillingTiming {\n  IMMEDIATE = 'immediate',\n  AT_PERIOD_END = 'at_period_end',\n}\n/** @wildo_source:part:end saas.models.billing.catalog-vocabularies */\n\n// BillingInterval: re-exported from @wildo-ai/external-connectors-models (see top of file)\n\n// ── Metering & Usage ───────────────────────────────────────────────\n\n/**\n * Metering aggregation window for usage records.\n */\nexport enum MeteringAggregationWindow {\n  PER_FLUSH = 'per_flush',\n  PER_BILLING_PERIOD = 'per_billing_period',\n}\n\n/**\n * Usage aggregation type for metered prices.\n */\nexport enum UsageAggregationType {\n  SUM = 'sum',\n  MAX = 'max',\n  LAST = 'last',\n}\n\n/**\n * Usage record source type.\n */\nexport enum UsageSourceType {\n  OPERATION = 'operation',\n  RESOURCE_COUNT = 'resource_count',\n  CUSTOM = 'custom',\n}\n\n/**\n * Where one metered usage row stands with respect to the provider flush.\n *\n * This was a BOOLEAN (`reportedToProvider`) until 2026-09-09, and the third state is the whole\n * reason it is an enum now (#512). A boolean can say \"not yet reported\" and \"reported\", and the\n * flush selects on the first — so a row that can NEVER be reported has nowhere to go. It stays\n * pending, is re-selected by every run, fails identically, and grows an error backlog that no\n * operator action can drain, on a five-minute schedule.\n *\n * The three states are genuinely distinct and must not be collapsed:\n *\n * - {@link PENDING} — the flush will try again. Every newly recorded row starts here.\n * - {@link REPORTED} — the provider acknowledged the quantity. `reportedAt` says when. Terminal,\n *   and money has moved: never move a row back out of this state.\n * - {@link UNREPORTABLE} — the flush determined the row can never be reported, for a reason named\n *   in `unreportableReason`. Terminal, and NO money moved. Marking such a row `REPORTED` instead\n *   would drain the backlog just as well and would be a lie no later reader could detect, which is\n *   exactly why the state exists rather than a shortcut.\n */\nexport enum UsageRecordFlushState {\n  PENDING = 'pending',\n  REPORTED = 'reported',\n  UNREPORTABLE = 'unreportable',\n}\n\n/**\n * Why a usage row was determined to be permanently unreportable.\n *\n * One member today, and it is a closed vocabulary rather than a free string because the operator\n * reading a retained financial record needs to know which permanent condition applies — and because\n * the distinction between a PERMANENT and a TRANSIENT failure is the judgement this whole state\n * turns on. A billing account that merely has no `providerCustomerId` yet is transient: the account\n * exists, provisioning may still complete, and such a row stays {@link UsageRecordFlushState.PENDING}.\n * Only a condition that cannot resolve itself belongs here.\n */\nexport enum UsageRecordUnreportableReason {\n  /**\n   * The billing account row no longer exists.\n   *\n   * Reachable by design: usage rows are RETAINED when their subject is erased (the tax/audit\n   * obligation on `usage-record.shared.schemas.ts`), so a deleted account legitimately leaves rows\n   * behind with no provider customer to report them to. Nothing can restore the mapping, so the\n   * quantity will never be billed and saying so on the row is the only honest outcome.\n   */\n  BILLING_ACCOUNT_DELETED = 'billing_account_deleted',\n}\n\n// ── Provider reconciliation ────────────────────────────────────────\n\n/**\n * What KIND of disagreement a billing reconciliation run found between local billing state and the\n * provider.\n *\n * A closed vocabulary rather than free text on a log line, because each kind has a different\n * treatment and a different meaning when it persists, and a recorded run has to be able to say\n * which one it saw how many times:\n *\n * - the two DRIFT kinds and the MISSING kind are REPAIRED, within the provider-authoritative field\n *   set only;\n * - {@link SUBSCRIPTION_PROVIDER_STATE_UNREADABLE} is NEVER repaired — a failed read, including a\n *   provider saying the subscription does not exist, is not evidence the subscription ended, so it\n *   is reported and nothing is written.\n *\n * A steady non-zero count of any repaired kind means webhook delivery is failing and the sweep is\n * papering over it; that is a different problem from the sweep failing, and only a per-kind count\n * can tell them apart.\n */\nexport enum BillingReconciliationDivergenceKind {\n  /** A live, provider-linked subscription disagreed with the provider on at least one provider-authoritative field. */\n  SUBSCRIPTION_FIELD_DRIFT = 'subscription_field_drift',\n  /** The provider's state for a provider-linked subscription could not be read. Reported only; local state is untouched. */\n  SUBSCRIPTION_PROVIDER_STATE_UNREADABLE = 'subscription_provider_state_unreadable',\n  /** An invoice the provider holds for a known customer had no local record — its webhook was never delivered. */\n  INVOICE_MISSING_LOCALLY = 'invoice_missing_locally',\n  /** A locally recorded invoice carried a different status from the provider's. */\n  INVOICE_STATUS_DRIFT = 'invoice_status_drift',\n}\n\n/**\n * A population a reconciliation run met and deliberately did NOT compare against the provider.\n *\n * Counted per run, because a sweep that silently skips rows is indistinguishable from one that\n * compared them and found agreement — and \"we reconciled everything\" is only a true sentence when\n * the skipped populations are stated beside it. Each member is a DECISION with a reason, not a gap:\n *\n * Populations that are never compared by design and therefore never met at all — terminal\n * subscriptions, subscriptions known only to the provider, subscription items, invoice totals, and\n * invoices older than the per-customer lookback — are named on `BillingReconciliationBackendService`\n * rather than here, because a run cannot count what it never selects.\n */\nexport enum BillingReconciliationUncomparedPopulation {\n  /** A local subscription with no provider link: there is no provider record to compare it against. */\n  SUBSCRIPTION_WITHOUT_PROVIDER_LINK = 'subscription_without_provider_link',\n  /**\n   * A provider-linked subscription whose mutation slot holds a PREPARED admission: one of its mutations is\n   * about to call the provider, so the run neither read nor wrote it. Its next run re-reads it.\n   */\n  SUBSCRIPTION_MUTATION_ADMISSION_PREPARED = 'subscription_mutation_admission_prepared',\n  /**\n   * A provider-linked subscription the run read and found disagreeing, but whose mutation slot was written after that read, so nothing\n   * was written: the difference may already be gone. The writer is not always a mutation or a webhook — recovery moving a held\n   * generation behind newer ones advances the same version without settling anything — so this counts a read to REPEAT, never a\n   * mutation observed. Counted here rather than as a divergence the run cannot confirm. Its next run re-reads it.\n   */\n  SUBSCRIPTION_SUPERSEDED_BEFORE_REPAIR = 'subscription_superseded_before_repair',\n  /**\n   * A provider-linked subscription whose billing account or provider link no longer matches the identity its mutation slot\n   * records. A mutation refuses the same condition as `slot_identity_changed`; the run neither compares nor writes it, and it\n   * stays held until recovery resolves the slot.\n   */\n  SUBSCRIPTION_SLOT_IDENTITY_CHANGED = 'subscription_slot_identity_changed',\n  /** A billing account with no provider customer: nothing at the provider can hold its invoices. */\n  BILLING_ACCOUNT_WITHOUT_PROVIDER_CUSTOMER = 'billing_account_without_provider_customer',\n  /**\n   * A billing scope whose rows exceeded one run's page ceiling. The remainder is left to the next run:\n   * reconciliation is idempotent, so a prefix is safe, but the count says the run did not cover the scope.\n   */\n  SCOPE_TRUNCATED_AT_PAGE_CEILING = 'scope_truncated_at_page_ceiling',\n}\n\n// ── Tax ────────────────────────────────────────────────────────────\n\n// TaxDisplayMode: re-exported from @wildo-ai/external-connectors-models (see top of file)\n\n/**\n * Tax calculation mode: provider-managed or disabled.\n */\nexport enum TaxCalculationMode {\n  PROVIDER_MANAGED = 'provider_managed',\n  DISABLED = 'disabled',\n}\n\n// ── Subscription & Invoice Status ──────────────────────────────────\n\n// SubscriptionStatus: re-exported from @wildo-ai/external-connectors-models (see top of file)\n\n// InvoiceStatus: re-exported from @wildo-ai/external-connectors-models (see top of file).\n// It moved there on 2026-09-09 so `StandardBilling_InvoiceData` could name it; the specifier every\n// consumer imports is unchanged.\n\n// ── Billing Scope ──────────────────────────────────────────────────\n\n/**\n * Billing-compatible scope types.\n * Subset of ResourcePrimaryScope — excludes APPLICATION which has no billing variants.\n * Used by scope-agnostic billing resources (e.g., Referrals) that reference\n * billing accounts across different polymorphic collections.\n */\nexport enum BillingScopeType {\n  ORGANIZATIONS = 'organizations',\n  USER_SELF = 'user_self',\n}\n\n// ── Promotions & Referrals ─────────────────────────────────────────\n\n/**\n * Promotion type.\n */\nexport enum PromotionType {\n  /** Direct discount */\n  COUPON = 'coupon',\n  /** Code-based discount */\n  PROMOTION_CODE = 'promotion_code',\n  /** Referral program */\n  REFERRAL = 'referral',\n  /** Special deal/offer */\n  DEAL = 'deal',\n}\n\n/**\n * Discount type for promotions.\n */\nexport enum DiscountType {\n  PERCENTAGE = 'percentage',\n  FIXED_AMOUNT = 'fixed_amount',\n}\n\n/**\n * Promotion duration (how long the discount applies).\n */\nexport enum PromotionDuration {\n  ONCE = 'once',\n  REPEATING = 'repeating',\n  FOREVER = 'forever',\n}\n\n/**\n * Referral status lifecycle.\n */\nexport enum ReferralStatus {\n  PENDING = 'pending',\n  ACCEPTED = 'accepted',\n  CONVERTED = 'converted',\n  EXPIRED = 'expired',\n  CANCELLED = 'cancelled',\n}\n\n/**\n * What a referrer receives when a referral converts (#1802). Each member names the fields it reads in\n * `ReferrerRewardSchema` and how it is delivered:\n *\n * - `CREDIT` — `credits` added to the `creditPoolKey` credit pool, as a GRANT (not a purchase).\n * - `DISCOUNT` — a `percentOff` coupon on the account's active subscription, for `discountDuration`.\n * - `FEATURE` — the boolean feature `featureKey`, for `durationDays` after conversion or permanently.\n *\n * `COMMISSION` was removed: a commission is a payout to the referrer, and the framework has no payout\n * mechanism, so a declared commission could only ever be recorded and never paid.\n */\nexport enum ReferrerRewardType {\n  CREDIT = 'credit',\n  DISCOUNT = 'discount',\n  FEATURE = 'feature',\n}\n\n/**\n * What a referred account receives (#1802). The first three are delivered like the referrer's, when the\n * referral converts. `TRIAL_EXTENSION` shapes the purchase itself: every subscription checkout the\n * referred account opens while the referral is ACCEPTED gets `trialExtensionDays` more trial.\n */\nexport enum ReferredRewardType {\n  CREDIT = 'credit',\n  DISCOUNT = 'discount',\n  FEATURE = 'feature',\n  TRIAL_EXTENSION = 'trial_extension',\n}\n\n/**\n * Where credits added to a pool came from (#1802). A pool counts them separately — `totalPurchased` for\n * credits a customer paid for, `totalGranted` for credits given to them — because the two answer\n * different questions: what was sold, and what was given away.\n */\nexport enum CreditPoolTopUpSource {\n  /** Credits from a paid purchase (a credit-pack checkout). */\n  PURCHASE = 'purchase',\n  /** Credits given without a purchase, such as a referral reward. */\n  GRANT = 'grant',\n}\n\n// ── Provider checkout metadata: the framework/caller trust boundary ─────────────\n\n/**\n * Prefix that marks a provider-metadata key as FRAMEWORK-AUTHORITATIVE.\n *\n * ## Why a reserved namespace exists at all\n *\n * A provider checkout session carries ONE flat `metadata` map, and two parties want to write into\n * it: the framework (which needs to recognise the purchase when the provider echoes the session\n * back on `checkout.session.completed`) and the application's own caller (who legitimately wants\n * to tag the purchase for their analytics or reconciliation).\n *\n * Those two writers do not have the same authority. The framework's entries decide WHICH billing\n * account is credited and HOW MUCH — the provider replays them verbatim inside a genuinely SIGNED\n * webhook, so a signature proves the provider sent them, never that the framework wrote them. The\n * caller's entries decide nothing.\n *\n * Sharing one un-partitioned namespace between those two authorities is what turned a caller-supplied\n * map into a credit-minting primitive: the producer spread caller metadata LAST, so `billingAccountId`\n * / `productKey` / `quantity` were simply overwritable, and the webhook consumer read the result back\n * as trusted framework state. Ordering alone is not the fix — swapping the spread leaves an\n * unmarked namespace in which the NEXT authoritative key is one careless line from being overridable\n * again. The prefix makes the trust boundary a property of the KEY, so it survives refactors.\n *\n * The boundary is enforced in three places, deliberately overlapping:\n * 1. the OPEN_CHECKOUT request DTO REFUSES any caller key carrying this prefix (loud, at the edge);\n * 2. the metadata builder writes the reserved entries LAST (structural, cannot be forgotten);\n * 3. the webhook consumer reads ONLY reserved keys, and re-derives the billing account from\n *    provider-authoritative data rather than trusting the echoed value.\n *\n * @see BillingCheckoutMetadataKey for the reserved key vocabulary itself.\n */\nexport const BILLING_RESERVED_METADATA_KEY_PREFIX = 'wildo_';\n\n/**\n * The closed vocabulary of framework-authoritative provider-metadata keys.\n *\n * Every member MUST start with {@link BILLING_RESERVED_METADATA_KEY_PREFIX} — that is what makes the\n * DTO's caller-key refusal and the consumer's read-only-reserved rule line up. A member added\n * without the prefix would be silently overridable by a caller, which is the whole defect this\n * vocabulary exists to prevent, so a pinned test asserts the prefix across every member.\n *\n * Named rather than inlined because each member carries a different obligation on the consumer side\n * (one is cross-checked against provider truth, one selects the product, one is bounded and\n * strictly parsed) and a bare string literal has nowhere to record that.\n */\nexport enum BillingCheckoutMetadataKey {\n  /**\n   * The billing account the checkout was opened FOR.\n   *\n   * Written for traceability and cross-checking only. The webhook consumer re-derives the account\n   * from the provider-authoritative customer id on the event and REFUSES the event if the echoed\n   * value disagrees — it is never used as the account to credit.\n   */\n  BILLING_ACCOUNT_ID = 'wildo_billingAccountId',\n  /** The catalog product key purchased — selects the credit pool and credits-per-unit on top-up. */\n  PRODUCT_KEY = 'wildo_productKey',\n  /**\n   * The PROMOTION row whose code the framework validated when it opened this checkout, so the\n   * redemption can be counted when the session COMPLETES (#518).\n   *\n   * Absent when the purchase used no code, which is the common case.\n   *\n   * Stamped rather than re-derived from the completed session, because the provider reports the\n   * DISCOUNT it applied and not the Wildo row that authorised it — and the row is what carries\n   * `maxRedemptions`. Like every key here it is written for the framework's own reconciliation and is\n   * never trusted as authority on its own: the redemption is counted with a compare-and-swap that\n   * refuses past the cap, so a tampered value can at worst count a redemption against a promotion\n   * that has room for one.\n   */\n  PROMOTION_ID = 'wildo_promotionId',\n  /**\n   * The purchased quantity, as a decimal integer string (provider metadata values are strings).\n   * Strictly parsed and bounded by {@link BILLING_CHECKOUT_MAX_QUANTITY} on the way back in.\n   */\n  QUANTITY = 'wildo_quantity',\n}\n\n/**\n * Framework-authoritative metadata keys the engine writes on a provider SUBSCRIPTION (#535), in the same reserved namespace\n * as {@link BillingCheckoutMetadataKey} and under the same rule: every member starts with\n * {@link BILLING_RESERVED_METADATA_KEY_PREFIX}, so no caller-authored metadata can be mistaken for it.\n */\nexport enum BillingSubscriptionMetadataKey {\n  /**\n   * `<slotId>:<generation>` of the subscription mutation that sent the update. Written so reconciliation can match a\n   * provider object to the durable mutation that caused it — including a change whose response was lost. A reference, never\n   * authority on its own: a match is confirmed against the stored mutation's identity.\n   */\n  MUTATION = 'wildo_mutation',\n}\n\n/**\n * Upper bound on a single checkout's line-item quantity, applied on BOTH sides of the provider\n * round trip: the OPEN_CHECKOUT request DTO refuses more, and the webhook consumer refuses to\n * honour more.\n *\n * One shared constant rather than two, because a consumer bound lower than the producer bound would\n * silently refuse legitimate large purchases the framework itself allowed to be billed — the\n * failure mode where the customer is charged and the credits never arrive.\n *\n * The value is a framework policy ceiling, not a provider-derived one: it is deliberately far above\n * any plausible self-serve purchase and far below the range where an unbounded quantity becomes a\n * credit-minting primitive. An application whose catalog genuinely sells in larger units should\n * raise it here, where both sides read it, rather than at either end.\n */\nexport const BILLING_CHECKOUT_MAX_QUANTITY = 999_999;\n"]}

package/dist/esm/billing/billing-types.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing-types.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/billing-types.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAQ7E,YAAY,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAI7H;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,MAAM,EAAE,UAAU,CAAC;IACnB,4DAA4D;IAC5D,SAAS,EAAE,KAAK,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,+DAA+D;IAC/D,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,aAAa,CAAC;IACtB,2EAA2E;IAC3E,WAAW,EAAE,IAAI,CAAC;CACnB;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;iBAc7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,gGAAgG;AAChG,oBAAY,iBAAiB;IAC3B,eAAe,mBAAmB;IAClC,YAAY,iBAAiB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,YAAY,gBAAgB;IAC5B,iBAAiB,qBAAqB;CACvC;AAED,0FAA0F;AAC1F,oBAAY,wBAAwB;IAClC,SAAS,cAAc;IACvB,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,8BAA8B,8FAAwE,CAAC;AACpH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqErC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
+{"version":3,"file":"billing-types.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/billing-types.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAQ7E,YAAY,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAI7H;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,MAAM,EAAE,UAAU,CAAC;IACnB,4DAA4D;IAC5D,SAAS,EAAE,KAAK,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,+DAA+D;IAC/D,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,aAAa,CAAC;IACtB,2EAA2E;IAC3E,WAAW,EAAE,IAAI,CAAC;CACnB;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;iBAc7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,gGAAgG;AAChG,oBAAY,iBAAiB;IAC3B,eAAe,mBAAmB;IAClC,YAAY,iBAAiB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,YAAY,gBAAgB;IAC5B,iBAAiB,qBAAqB;CACvC;AAED,0FAA0F;AAC1F,oBAAY,wBAAwB;IAClC,SAAS,cAAc;IACvB,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,8BAA8B,8FAAwE,CAAC;AACpH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqErC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/esm/billing/billing-types.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-types.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/billing-types.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAsC9F,sEAAsE;AAEtE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,sDAAsD;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,CACjB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;QACxF,0CAA0C;QAC1C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QACrG,6DAA6D;QAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uEAAuE,CAAC;QAC9G,6BAA6B;QAC7B,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KAC9E,CAAC,CACH,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CAC/D,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IACzG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;CACjE,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,gGAAgG;AAChG,MAAM,CAAN,IAAY,iBASX;AATD,WAAY,iBAAiB;IAC3B,uDAAkC,CAAA;IAClC,kDAA6B,CAAA;IAC7B,0CAAqB,CAAA;IACrB,sCAAiB,CAAA;IACjB,0CAAqB,CAAA;IACrB,oCAAe,CAAA;IACf,iDAA4B,CAAA;IAC5B,2DAAsC,CAAA;AACxC,CAAC,EATW,iBAAiB,KAAjB,iBAAiB,QAS5B;AAED,0FAA0F;AAC1F,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,mDAAuB,CAAA;IACvB,uDAA2B,CAAA;AAC7B,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAGpH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,mGAAmG;IACnG,YAAY,EAAE,8BAA8B,CAAC,QAAQ,CAAC,wJAAwJ,CAAC;IAC/M,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+EAA+E,CAAC;IACzI,mHAAmH;IACnH,kHAAkH;IAClH,8GAA8G;IAC9G,YAAY,EAAE,6BAA6B,CAAC,MAAM,CAAC;QACjD,MAAM,EAAE,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,oHAAoH,CAAC;KAClL,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IACvF,uGAAuG;IACvG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,aAAa,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,0LAA0L,CAAC;IAC5R,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC/H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACxC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,mGAAmG,CAAC;QACnJ,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,iEAAiE,CAAC;KAChH,CAAC,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IACnD,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC7G;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,eAAe,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,4LAA4L,CAAC;IAC1S;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uQAAuQ,CAAC;IACvU,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;CAC7F,CAAC,CAAC","sourcesContent":["/**\n * Billing Supporting Types (Shared)\n *\n * Types used by the billing API, frontend hooks, and provider interface.\n * These are NOT DB schemas — they are API response shapes, provider abstractions,\n * and aggregated views.\n *\n * @see billing-and-features-system.md §6.2c (Supporting Types)\n */\n\nimport { z } from 'zod';\nimport type { MoneyValue } from '@wildo-ai/zod-decorators';\nimport type { BillingTiming } from './billing-enums.shared.schemas';\nimport { BillingAccountSchema } from './billing-account.shared.schemas';\nimport { BillingSubscriptionBaseSchema } from './subscription.shared.schemas';\nimport { ProductSchema } from './product.shared.schemas';\nimport { PriceSchema } from './price.shared.schemas';\nimport { InvoiceRefSchema } from './invoice-ref.shared.schemas';\nimport { PromotionSchema } from './promotions.shared.schemas';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { markEmbeddedResourceSchema } from '../resources/embedded-resource-mark.shared.utils';\n\n// ── Provider Canonical Types ───────────────────────────────────────\n// StandardBilling_SubscriptionData and StandardBilling_InvoicePreview are\n// defined in @wildo-ai/external-connectors-models (standard billing interface)\n// and re-exported here for convenience.\nexport type { StandardBilling_SubscriptionData, StandardBilling_InvoicePreview } from '@wildo-ai/external-connectors-models';\n\n// ── Invoice Preview ────────────────────────────────────────────────\n\n/**\n * Presentation value used by the billing plan-change preview. BillingContext transports the\n * provider DTO; the plan-change flow converts its minor-unit amounts into this money shape.\n * Invoice amount due must not be presented as an immediate charge without the resolved settlement policy.\n *\n * All monetary amounts use MoneyValue for bigint precision and self-contained currency.\n */\nexport interface InvoicePreview {\n  /** Previewed invoice amount due; settlement timing must be stated separately. */\n  amount: MoneyValue;\n  /** Line items breakdown (what changed, prorated amounts) */\n  lineItems: Array<{\n    description: string;\n    amount: MoneyValue;\n    quantity: number;\n  }>;\n  /** Invoice period boundaries, not a guaranteed charge time. */\n  periodStart: Date;\n  periodEnd: Date;\n  /**\n   * When the change takes effect (#1868): `immediate`, or `at_period_end` — then the previewed invoice is the renewal invoice on the\n   * new plan, and confirming charges nothing now.\n   */\n  timing: BillingTiming;\n  /** When the change takes effect: now, or the end of the current period. */\n  effectiveAt: Date;\n}\n\n// ── Usage Summary ──────────────────────────────────────────────────\n\n/**\n * Usage summary: aggregated usage data for the frontend UsageDashboard.\n * Computed from UsageRecords, keyed by metered product key.\n *\n * Authored as a Zod schema (not a bare interface) so it can compose into\n * `BillingStateResponseSchema` — the runtime contract wired as the `GET_STATE`\n * custom operation's `customResponseDto`. `UsageSummary` is derived from it to\n * keep the type and the runtime shape from drifting.\n */\nexport const UsageSummarySchema = z.object({\n  /** Usage per metered product, keyed by product key */\n  byProduct: z.record(\n    z.string(),\n    z.object({\n      currentPeriodUsage: z.number().describe(\"Usage recorded in the current billing period.\"),\n      /** Previous period (for trend display) */\n      previousPeriodUsage: z.number().optional().describe(\"Usage recorded in the previous billing period.\"),\n      /** Usage limit (from product/subscription, if applicable) */\n      limit: z.number().optional().describe(\"The usage limit set by the product or subscription, when one applies.\"),\n      /** Last usage recorded at */\n      lastRecordedAt: z.date().optional().describe(\"When usage was last recorded.\"),\n    }),\n  ).describe(\"Usage per metered product, keyed by product key.\"),\n});\nexport type UsageSummary = z.infer<typeof UsageSummarySchema>;\n\n// ── Billing State Response ─────────────────────────────────────────\n\n/**\n * Per-pool credit balance projection embedded in the aggregated billing state.\n *\n * A lean view (NOT the full `CreditPool` resource) built by the billing-state\n * facade purely for the frontend balance display, keyed by pool key.\n */\nexport const CreditPoolBalanceSchema = z.object({\n  available: z.number().describe(\"Credits available to spend.\"),\n  totalPurchased: z.number().describe(\"Credits purchased in total.\"),\n  totalGranted: z.number().describe(\"Credits given without a purchase in total, such as referral rewards.\"),\n  totalConsumed: z.number().describe(\"Credits consumed in total.\"),\n});\nexport type CreditPoolBalance = z.infer<typeof CreditPoolBalanceSchema>;\n\n/**\n * Aggregated billing state returned by the lazy facade endpoint.\n * Single source of truth for frontend BillingProvider and backend controller.\n *\n * Authored as a Zod schema (not a bare interface) because the `GET_STATE`\n * custom operation wires it as its `customResponseDto`. That operation borrows\n * the COUNT verb for its route/verb via `resourceOperationLike` but returns\n * THIS aggregated shape — so without a `customResponseDto` the DTO builder would\n * assign it the COUNT default envelope (`{ count }`), and the service output\n * would fail `transformOutput`'s `internalDto.parse` → HTTP 500. The composed\n * schema gives the builder the real runtime contract to validate against and to\n * project the external response. `BillingStateResponse` is derived from it so the\n * type and the runtime contract cannot drift.\n */\n/** Independently loaded portions of the aggregate. Derived catalog projections use PRODUCTS. */\nexport enum BillingStateSlice {\n  BILLING_ACCOUNT = 'billingAccount',\n  SUBSCRIPTION = 'subscription',\n  PRODUCTS = 'products',\n  PRICES = 'prices',\n  INVOICES = 'invoices',\n  USAGE = 'usage',\n  CREDIT_POOLS = 'creditPools',\n  ACTIVE_PROMOTIONS = 'activePromotions',\n}\n\n/** Empty data is meaningful only when its query (and required dependencies) succeeded. */\nexport enum BillingSliceAvailability {\n  AVAILABLE = 'available',\n  UNAVAILABLE = 'unavailable',\n}\n\nexport const BillingStateAvailabilitySchema = z.record(z.enum(BillingStateSlice), z.enum(BillingSliceAvailability));\nexport type BillingStateAvailability = z.infer<typeof BillingStateAvailabilitySchema>;\n\nexport const BillingStateResponseSchema = z.object({\n  /** Query failures keep their empty transport placeholders but MUST NOT be presented as absence. */\n  availability: BillingStateAvailabilitySchema.describe(\"Whether each part of this response loaded. A part marked `unavailable` failed to load: its empty value means nothing, and must not be read as absence.\"),\n  billingAccount: BillingAccountSchema.nullable().describe(\"The billing account of the caller's scope, or `null` when the scope has none.\"),\n  // The subscription and the invoice refs are not marked as embedded records like the products below: which resource\n  // they are depends on the caller's scope. So the few fields no other source describes here are described in place\n  // (#1625), rather than on the base schemas, where they would replace each resource's own, richer description.\n  subscription: BillingSubscriptionBaseSchema.extend({\n    status: BillingSubscriptionBaseSchema.shape.status.describe(\"The subscription's lifecycle state as the billing provider reports it, such as `active`, `trialing` or `past_due`.\"),\n  }).nullable().describe(\"The scope's current subscription, or `null` when it has none.\"),\n  // Products, prices and promotions are each one resource's records, described by that resource (#1625).\n  products: z.array(markEmbeddedResourceSchema(ProductSchema, CoreResourceType.PRODUCTS)).describe(\"Every product visible in this scope, including ones no longer on sale, so a plan someone already holds can still be named. Which of them can be acquired now is `acquirableProductKeys`.\"),\n  prices: z.array(markEmbeddedResourceSchema(PriceSchema, CoreResourceType.PRICES)).describe(\"The prices visible in this scope.\"),\n  invoices: z.array(InvoiceRefSchema.extend({\n    status: InvoiceRefSchema.shape.status.describe(\"The invoice's payment state as the billing provider reports it, such as `open`, `paid` or `void`.\"),\n    total: InvoiceRefSchema.shape.total.describe('The invoice total: an amount in minor units, with its currency.'),\n  })).describe(\"References to the scope's invoices.\"),\n  usage: UsageSummarySchema.describe(\"Metered usage in this scope.\"),\n  creditPools: z.record(z.string(), CreditPoolBalanceSchema).describe(\"Credit balances, keyed by credit pool.\"),\n  /**\n   * Scope/product-visible promotions for the current billing surface.\n   *\n   * This list intentionally excludes promotions that are inactive, exhausted,\n   * unsynced with the billing provider, or targeted only at products outside the\n   * current scope. It is not a promise that every entry is redeemable for any\n   * arbitrary checkout item the user might pick next.\n   */\n  activePromotions: z.array(markEmbeddedResourceSchema(PromotionSchema, CoreResourceType.PROMOTIONS)).describe(\"Promotions visible in this scope: active, not exhausted, synced with the billing provider, and targeting a product in scope. Not a promise that each one applies to a particular checkout.\"),\n  /**\n   * The subset of `products` (by `key`) a caller may ACQUIRE right now — buy, or move a\n   * subscription onto.\n   *\n   * ## Why a sibling key set rather than a filter on `products`\n   *\n   * One call serves two surfaces that want OPPOSITE things from it. An acquisition surface (a\n   * pricing table) must not offer a plan the purchase gate will refuse; a holding surface (the\n   * \"your current plan\" panel, the subscription-item → product resolution in the frontend billing\n   * context) must still be able to NAME a plan the catalogue has withdrawn, because a customer\n   * already on a retired plan is exactly who needs to see what they hold. Filtering `products` by\n   * `isActive` would serve the first and break the second — the same trade the `REMOVE_ADDON` call\n   * site settles by reading with `REFERENCE` intent rather than `ACQUIRE`.\n   *\n   * So the response DISTINGUISHES instead of filtering: `products` stays the full scope-visible\n   * catalog, and this set states which of them acquisition may offer.\n   *\n   * ## Why the server answers it at all\n   *\n   * `Product.isActive` is the declared off-boarding path, and the backend gate that makes\n   * retirement TRUE (`readProductByKey` with `ACQUIRE` intent) applies ONE predicate to it. A\n   * listing surface holds rows, not keys, so it cannot use that reader — and every listing left to\n   * itself re-derives the rule from the raw column. That had already happened twice by 2026-09-09,\n   * in a frontend component and in the reader, agreeing only by luck. This set is computed by the\n   * gate's own predicate, so a surface that reads it cannot drift from what checkout will accept.\n   *\n   * NOT a visibility answer: `isPublic` is a per-surface decision the server cannot take for every\n   * caller (a back-office catalog shows non-public rows). A customer pricing table composes the\n   * two; it must not re-spell either.\n   *\n   * The aggregate producer sets this field and BillingContext preserves it. Consumers\n   * must check PRODUCTS availability before interpreting this projection: an empty set\n   * from an unavailable catalog does not prove that nothing can be acquired.\n   *\n   * Absence therefore means \"the producer did not project acquirability\", never \"nothing is\n   * acquirable\" and never \"everything is\". A consumer that receives the set MUST use it in\n   * preference to re-deriving the rule; a consumer that does not is on the older, weaker footing\n   * this field exists to retire.\n   */\n  acquirableProductKeys: z.array(z.string()).optional().describe(\"The keys of the products in `products` that may be bought, or moved onto, right now. Absent means this was not computed, not that nothing can be acquired. Check `availability` for products first: from a catalog that failed to load, an empty list proves nothing.\"),\n  scopeType: z.enum(ResourcePrimaryScope).describe(\"The scope this billing state belongs to.\"),\n});\nexport type BillingStateResponse = z.infer<typeof BillingStateResponseSchema>;\n"]}
+{"version":3,"file":"billing-types.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/billing-types.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAsC9F,sEAAsE;AAEtE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,sDAAsD;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,CACjB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;QACxF,0CAA0C;QAC1C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QACrG,6DAA6D;QAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uEAAuE,CAAC;QAC9G,6BAA6B;QAC7B,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KAC9E,CAAC,CACH,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CAC/D,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IACzG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;CACjE,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,gGAAgG;AAChG,MAAM,CAAN,IAAY,iBASX;AATD,WAAY,iBAAiB;IAC3B,uDAAkC,CAAA;IAClC,kDAA6B,CAAA;IAC7B,0CAAqB,CAAA;IACrB,sCAAiB,CAAA;IACjB,0CAAqB,CAAA;IACrB,oCAAe,CAAA;IACf,iDAA4B,CAAA;IAC5B,2DAAsC,CAAA;AACxC,CAAC,EATW,iBAAiB,KAAjB,iBAAiB,QAS5B;AAED,0FAA0F;AAC1F,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,mDAAuB,CAAA;IACvB,uDAA2B,CAAA;AAC7B,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAGpH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,mGAAmG;IACnG,YAAY,EAAE,8BAA8B,CAAC,QAAQ,CAAC,wJAAwJ,CAAC;IAC/M,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+EAA+E,CAAC;IACzI,mHAAmH;IACnH,kHAAkH;IAClH,8GAA8G;IAC9G,YAAY,EAAE,6BAA6B,CAAC,MAAM,CAAC;QACjD,MAAM,EAAE,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,oHAAoH,CAAC;KAClL,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IACvF,uGAAuG;IACvG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,aAAa,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,0LAA0L,CAAC;IAC5R,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC/H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACxC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,mGAAmG,CAAC;QACnJ,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,iEAAiE,CAAC;KAChH,CAAC,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IACnD,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC7G;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,eAAe,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,4LAA4L,CAAC;IAC1S;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uQAAuQ,CAAC;IACvU,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;CAC7F,CAAC,CAAC","sourcesContent":["/**\n * Billing Supporting Types (Shared)\n *\n * Types used by the billing API, frontend hooks, and provider interface.\n * These are NOT DB schemas — they are API response shapes, provider abstractions,\n * and aggregated views.\n *\n * @see billing-and-features-system.md §6.2c (Supporting Types)\n */\n\nimport { z } from 'zod';\nimport type { MoneyValue } from '@wildo-ai/zod-decorators';\nimport type { BillingTiming } from './billing-enums.shared.schemas';\nimport { BillingAccountSchema } from './billing-account.shared.schemas';\nimport { BillingSubscriptionBaseSchema } from './subscription.shared.schemas';\nimport { ProductSchema } from './product.shared.schemas';\nimport { PriceSchema } from './price.shared.schemas';\nimport { InvoiceRefSchema } from './invoice-ref.shared.schemas';\nimport { PromotionSchema } from './promotions.shared.schemas';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { markEmbeddedResourceSchema } from '../resources/embedded-resource-mark.shared.utils';\n\n// ── Provider Canonical Types ───────────────────────────────────────\n// StandardBilling_SubscriptionData and StandardBilling_InvoicePreview are\n// defined in @wildo-ai/external-connectors-models (standard billing interface)\n// and re-exported here for convenience.\nexport type { StandardBilling_SubscriptionData, StandardBilling_InvoicePreview } from '@wildo-ai/external-connectors-models';\n\n// ── Invoice Preview ────────────────────────────────────────────────\n\n/**\n * Presentation value used by the billing plan-change preview. BillingContext transports the\n * provider DTO; the plan-change flow converts its minor-unit amounts into this money shape.\n * Invoice amount due must not be presented as an immediate charge without the resolved settlement policy.\n *\n * All monetary amounts use MoneyValue for bigint precision and self-contained currency.\n */\nexport interface InvoicePreview {\n  /** Previewed invoice amount due; settlement timing must be stated separately. */\n  amount: MoneyValue;\n  /** Line items breakdown (what changed, prorated amounts) */\n  lineItems: Array<{\n    description: string;\n    amount: MoneyValue;\n    quantity: number;\n  }>;\n  /** Invoice period boundaries, not a guaranteed charge time. */\n  periodStart: Date;\n  periodEnd: Date;\n  /**\n   * When the change takes effect (#1868): `immediate`, or `at_period_end` — then the previewed invoice is the renewal invoice on the\n   * new plan, and confirming charges nothing now.\n   */\n  timing: BillingTiming;\n  /** When the change takes effect: now, or the end of the current period. */\n  effectiveAt: Date;\n}\n\n// ── Usage Summary ──────────────────────────────────────────────────\n\n/**\n * Usage summary: aggregated usage data for the frontend UsageDashboard.\n * Computed from UsageRecords, keyed by metered product key.\n *\n * Authored as a Zod schema (not a bare interface) so it can compose into\n * `BillingStateResponseSchema` — the runtime contract wired as the `GET_STATE`\n * custom operation's `customResponseDto`. `UsageSummary` is derived from it to\n * keep the type and the runtime shape from drifting.\n */\nexport const UsageSummarySchema = z.object({\n  /** Usage per metered product, keyed by product key */\n  byProduct: z.record(\n    z.string(),\n    z.object({\n      currentPeriodUsage: z.number().describe(\"Usage recorded in the current billing period.\"),\n      /** Previous period (for trend display) */\n      previousPeriodUsage: z.number().optional().describe(\"Usage recorded in the previous billing period.\"),\n      /** Usage limit (from product/subscription, if applicable) */\n      limit: z.number().optional().describe(\"The usage limit set by the product or subscription, when one applies.\"),\n      /** Last usage recorded at */\n      lastRecordedAt: z.date().optional().describe(\"When usage was last recorded.\"),\n    }),\n  ).describe(\"Usage per metered product, keyed by product key.\"),\n});\nexport type UsageSummary = z.infer<typeof UsageSummarySchema>;\n\n// ── Billing State Response ─────────────────────────────────────────\n\n/**\n * Per-pool credit balance projection embedded in the aggregated billing state.\n *\n * A lean view (NOT the full `CreditPool` resource) built by the billing-state\n * facade purely for the frontend balance display, keyed by pool key.\n */\nexport const CreditPoolBalanceSchema = z.object({\n  available: z.number().describe(\"Credits available to spend.\"),\n  totalPurchased: z.number().describe(\"Credits purchased in total.\"),\n  totalGranted: z.number().describe(\"Credits given without a purchase in total, such as referral rewards.\"),\n  totalConsumed: z.number().describe(\"Credits consumed in total.\"),\n});\nexport type CreditPoolBalance = z.infer<typeof CreditPoolBalanceSchema>;\n\n/**\n * Aggregated billing state returned by the lazy facade endpoint.\n * Single source of truth for frontend BillingProvider and backend controller.\n *\n * Authored as a Zod schema (not a bare interface) because the `GET_STATE`\n * custom operation wires it as its `customResponseDto`. That operation borrows\n * the COUNT verb for its route/verb via `resourceOperationLike` but returns\n * THIS aggregated shape — so without a `customResponseDto` the DTO builder would\n * assign it the COUNT default envelope (`{ count }`), and the service output\n * would fail `transformOutput`'s `internalDto.parse` → HTTP 500. The composed\n * schema gives the builder the real runtime contract to validate against and to\n * project the external response. `BillingStateResponse` is derived from it so the\n * type and the runtime contract cannot drift.\n */\n/** Independently loaded portions of the aggregate. Derived catalog projections use PRODUCTS. */\nexport enum BillingStateSlice {\n  BILLING_ACCOUNT = 'billingAccount',\n  SUBSCRIPTION = 'subscription',\n  PRODUCTS = 'products',\n  PRICES = 'prices',\n  INVOICES = 'invoices',\n  USAGE = 'usage',\n  CREDIT_POOLS = 'creditPools',\n  ACTIVE_PROMOTIONS = 'activePromotions',\n}\n\n/** Empty data is meaningful only when its query (and required dependencies) succeeded. */\nexport enum BillingSliceAvailability {\n  AVAILABLE = 'available',\n  UNAVAILABLE = 'unavailable',\n}\n\nexport const BillingStateAvailabilitySchema = z.record(z.enum(BillingStateSlice), z.enum(BillingSliceAvailability));\nexport type BillingStateAvailability = z.infer<typeof BillingStateAvailabilitySchema>;\n\nexport const BillingStateResponseSchema = z.object({\n  /** Query failures keep their empty transport placeholders but MUST NOT be presented as absence. */\n  availability: BillingStateAvailabilitySchema.describe(\"Whether each part of this response loaded. A part marked `unavailable` failed to load: its empty value means nothing, and must not be read as absence.\"),\n  billingAccount: BillingAccountSchema.nullable().describe(\"The billing account of the caller's scope, or `null` when the scope has none.\"),\n  // The subscription and the invoice refs are not marked as embedded records like the products below: which resource\n  // they are depends on the caller's scope. So the few fields no other source describes here are described in place\n  // (#1625), rather than on the base schemas, where they would replace each resource's own, richer description.\n  subscription: BillingSubscriptionBaseSchema.extend({\n    status: BillingSubscriptionBaseSchema.shape.status.describe(\"The subscription's lifecycle state as the billing provider reports it, such as `active`, `trialing` or `past_due`.\"),\n  }).nullable().describe(\"The scope's current subscription, or `null` when it has none.\"),\n  // Products, prices and promotions are each one resource's records, described by that resource (#1625).\n  products: z.array(markEmbeddedResourceSchema(ProductSchema, CoreResourceType.PRODUCTS)).describe(\"Every product visible in this scope, including ones no longer on sale, so a plan someone already holds can still be named. Which of them can be acquired now is `acquirableProductKeys`.\"),\n  prices: z.array(markEmbeddedResourceSchema(PriceSchema, CoreResourceType.PRICES)).describe(\"The prices visible in this scope.\"),\n  invoices: z.array(InvoiceRefSchema.extend({\n    status: InvoiceRefSchema.shape.status.describe(\"The invoice's payment state as the billing provider reports it, such as `open`, `paid` or `void`.\"),\n    total: InvoiceRefSchema.shape.total.describe('The invoice total: an amount in minor units, with its currency.'),\n  })).describe(\"References to the scope's invoices.\"),\n  usage: UsageSummarySchema.describe(\"Metered usage in this scope.\"),\n  creditPools: z.record(z.string(), CreditPoolBalanceSchema).describe(\"Credit balances, keyed by credit pool.\"),\n  /**\n   * Scope/product-visible promotions for the current billing surface.\n   *\n   * This list intentionally excludes promotions that are inactive, exhausted,\n   * unsynced with the billing provider, or targeted only at products outside the\n   * current scope. It is not a promise that every entry is redeemable for any\n   * arbitrary checkout item the user might pick next.\n   */\n  activePromotions: z.array(markEmbeddedResourceSchema(PromotionSchema, CoreResourceType.PROMOTIONS)).describe(\"Promotions visible in this scope: active, not exhausted, synced with the billing provider, and targeting a product in scope. Not a promise that each one applies to a particular checkout.\"),\n  /**\n   * The subset of `products` (by `key`) a caller may ACQUIRE right now — buy, or move a\n   * subscription onto.\n   *\n   * ## Why a sibling key set rather than a filter on `products`\n   *\n   * One call serves two surfaces that want OPPOSITE things from it. An acquisition surface (a\n   * pricing table) must not offer a plan the purchase gate will refuse; a holding surface (the\n   * \"your current plan\" panel, the subscription-item → product resolution in the frontend billing\n   * context) must still be able to NAME a plan the catalogue has withdrawn, because a customer\n   * already on a retired plan is exactly who needs to see what they hold. Filtering `products` by\n   * `isActive` would serve the first and break the second — the same trade the `REMOVE_ADDON` call\n   * site settles by reading with `REFERENCE` intent rather than `ACQUIRE`.\n   *\n   * So the response DISTINGUISHES instead of filtering: `products` stays the full scope-visible\n   * catalog, and this set states which of them acquisition may offer.\n   *\n   * ## Why the server answers it at all\n   *\n   * `Product.isActive` is the declared off-boarding path, and the backend gate that makes\n   * retirement TRUE (`readProductByKey` with `ACQUIRE` intent) applies ONE predicate to it. A\n   * listing surface holds rows, not keys, so it cannot use that reader — and every listing left to\n   * itself re-derives the rule from the raw column. That had already happened twice by 2026-09-09,\n   * in a frontend component and in the reader, agreeing only by luck. This set is computed by the\n   * gate's own predicate, so a surface that reads it cannot drift from what checkout will accept.\n   *\n   * NOT a visibility answer: `isPublic` is a per-surface decision the server cannot take for every\n   * caller (a back-office catalog shows non-public rows). A customer pricing table composes the\n   * two; it must not re-spell either.\n   *\n   * The aggregate producer sets this field and BillingContext preserves it. Consumers\n   * must check PRODUCTS availability before interpreting this projection: an empty set\n   * from an unavailable catalog does not prove that nothing can be acquired.\n   *\n   * Absence therefore means \"the producer did not project acquirability\", never \"nothing is\n   * acquirable\" and never \"everything is\". A consumer that receives the set MUST use it in\n   * preference to re-deriving the rule; a consumer that does not is on the older, weaker footing\n   * this field exists to retire.\n   */\n  acquirableProductKeys: z.array(z.string()).optional().describe(\"The keys of the products in `products` that may be bought, or moved onto, right now. Absent means this was not computed, not that nothing can be acquired. Check `availability` for products first: from a catalog that failed to load, an empty list proves nothing.\"),\n  scopeType: z.enum(ResourcePrimaryScope).describe(\"The scope this billing state belongs to.\"),\n});\nexport type BillingStateResponse = z.infer<typeof BillingStateResponseSchema>;\n"]}

package/dist/esm/billing/credit-pool.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAQzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,oBAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,OAAO,YAAY;IACnB;8GAC0G;IAC1G,MAAM,WAAW;CAClB;AAID,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;iBAOrC,CAAC;AAEH,eAAO,MAAM,+BAA+B,wQA+J3C,CAAC"}
+{"version":3,"file":"credit-pool.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAQzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,oBAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,OAAO,YAAY;IACnB;8GAC0G;IAC1G,MAAM,WAAW;CAClB;AAID,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;iBAOrC,CAAC;AAEH,eAAO,MAAM,+BAA+B,wQA+J3C,CAAC"}

package/dist/esm/billing/credit-pool.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,4CAAmB,CAAA;IACnB;8GAC0G;IAC1G,0CAAiB,CAAA;AACnB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;CAClH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,wSAAwS;IACxS,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,+GAA+G;QAC/G,+GAA+G;QAC/G,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,EAAE;IAE3E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBACxG,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBACxG,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,yFAAyF;QACzF,6CAA6C;QAC7C,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,sCAAsC;QACtC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;wBACvF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,4BAA4B;iBACzC,CAAC;SACH;QACD,8FAA8F;QAC9F,8DAA8D;QAC9D,EAAE;QACF,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,iGAAiG;QACjG,yFAAyF;QACzF,wFAAwF;QACxF,8FAA8F;QAC9F,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,iDAAiD;QACjD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBACxG,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,0BAA0B;iBACvC,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Credit Pool Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...creditPoolsPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { creditPoolsPolymorphicDeclaration } from './credit-pool.shared.schemas';\nimport { CreditPoolTopUpSource } from './billing-enums.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum CreditPool_Operations {\n  /** Consume credits from the pool. System-only (INTERNAL_CALL) — called by custom service code that\n   *  meters a paid capability, never directly by a client. */\n  CONSUME = 'consume',\n  /** Top up credits. System-only (INTERNAL_CALL) — invoked by the billing webhook router after a\n   *  verified CREDIT_PACK purchase, never by a client. The client \"buy credits\" action is OPEN_CHECKOUT. */\n  TOP_UP = 'top_up',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const CreditPool_ConsumeRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const CreditPool_TopUpRequestDto = z.object({\n  credits: z.number().min(1),\n  /**\n   * Whether the credits were bought or given (#1802). A purchase counts toward `totalPurchased`, a grant\n   * toward `totalGranted`; both add to `available`. Defaults to `purchase`, the credit-pack checkout.\n   */\n  source: z.enum(CreditPoolTopUpSource).default(CreditPoolTopUpSource.PURCHASE).systemEnum('CreditPoolTopUpSource'),\n});\n\nexport const creditPoolsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  creditPoolsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: CreditPool_Operations,\n    /** Subject-export disclosure. The subject's own credit balances. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: {\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      // A referral credit (#1802) is granted to an account that may never have bought a pack, so its pool is created\n      // by the referral program — a trusted in-process write with no request, whose scope FK comes from the account.\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * credit balances — available, purchased and consumed amounts — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n *\n * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit-balance mutation is\n      // system-only; it is never client-initiated.\n      //\n      // CONSUME is INTERNAL_CALL (no HTTP route), matching TOP_UP and the CRUD siblings. It is invoked\n      // by service code that meters a paid feature (its enum doc: \"called by custom service code\"), not\n      // by a client — the balance decrement happens as a side effect of using a metered capability, not\n      // as a direct client action. Leaving it API_CALL let a client spend its own credits arbitrarily\n      // (self-harm, not a grant) and, more importantly, made a system-automated op part of the client\n      // attack surface. The `polymorphicRole` is retained for internal-authorization parity and no\n      // longer confers client reachability.\n      [CreditPool_Operations.CONSUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_MEMBER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_ConsumeRequestDto,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit GRANT (balance increase)\n      // is system/payment-gated only; it is never client-initiated.\n      //\n      // TOP_UP is INTERNAL_CALL (no HTTP route), matching its CREATE/UPDATE siblings above. It\n      // increments the spendable balance, so it must be reachable ONLY from server code that has\n      // already verified payment: the billing webhook router computes `credits` from the PAID\n      // product/quantity and invokes it via `executeCustomOperation` (which resolves the INTERNAL_CALL\n      // default through `getServiceOperationPathDefault`). It was previously API_CALL gated to\n      // ORG_OWNER, which let a tenant owner `PUT …/credit-pools/{id}/top-up {credits: N}` and\n      // self-grant unlimited paid credits — the client \"buy credits\" action is OPEN_CHECKOUT, not a\n      // direct balance write, so this route had no legitimate client caller. (The spec previously\n      // hinted at a manual admin grant here; a support-initiated grant, if ever needed, belongs on a\n      // separate platform-super-admin op with a mandatory audit event, NOT on a tenant-owner route.)\n      // The `polymorphicRole` below is retained for internal-authorization parity with the CRUD ops\n      // and no longer confers any client reachability.\n      [CreditPool_Operations.TOP_UP]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_TopUpRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"credit-pool.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B;gEAC4D;IAC5D,4CAAmB,CAAA;IACnB;8GAC0G;IAC1G,0CAAiB,CAAA;AACnB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;CAClH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,wSAAwS;IACxS,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,+GAA+G;QAC/G,+GAA+G;QAC/G,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,EAAE;IAE3E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBACxG,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBACxG,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,yFAAyF;QACzF,6CAA6C;QAC7C,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,sCAAsC;QACtC,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;wBACvF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,4BAA4B;iBACzC,CAAC;SACH;QACD,8FAA8F;QAC9F,8DAA8D;QAC9D,EAAE;QACF,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,iGAAiG;QACjG,yFAAyF;QACzF,wFAAwF;QACxF,8FAA8F;QAC9F,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,iDAAiD;QACjD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBACxG,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,0BAA0B;iBACvC,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Credit Pool Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...creditPoolsPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { creditPoolsPolymorphicDeclaration } from './credit-pool.shared.schemas';\nimport { CreditPoolTopUpSource } from './billing-enums.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum CreditPool_Operations {\n  /** Consume credits from the pool. System-only (INTERNAL_CALL) — called by custom service code that\n   *  meters a paid capability, never directly by a client. */\n  CONSUME = 'consume',\n  /** Top up credits. System-only (INTERNAL_CALL) — invoked by the billing webhook router after a\n   *  verified CREDIT_PACK purchase, never by a client. The client \"buy credits\" action is OPEN_CHECKOUT. */\n  TOP_UP = 'top_up',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const CreditPool_ConsumeRequestDto = z.object({\n  credits: z.number().min(1),\n});\n\nexport const CreditPool_TopUpRequestDto = z.object({\n  credits: z.number().min(1),\n  /**\n   * Whether the credits were bought or given (#1802). A purchase counts toward `totalPurchased`, a grant\n   * toward `totalGranted`; both add to `available`. Defaults to `purchase`, the credit-pack checkout.\n   */\n  source: z.enum(CreditPoolTopUpSource).default(CreditPoolTopUpSource.PURCHASE).systemEnum('CreditPoolTopUpSource'),\n});\n\nexport const creditPoolsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  creditPoolsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: CreditPool_Operations,\n    /** Subject-export disclosure. The subject's own credit balances. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: {\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      // A referral credit (#1802) is granted to an account that may never have bought a pack, so its pool is created\n      // by the referral program — a trusted in-process write with no request, whose scope FK comes from the account.\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is\n * credit balances — available, purchased and consumed amounts — amounts and contract terms about the ACCOUNT. They\n * describe nobody once the linked USER row is scrubbed, and they must survive erasure for the tax/audit\n * obligation this family exists to serve, so they can be neither scrubbed nor honestly declared as\n * personal data the row holds. The person is the scope foreign key, which the never-scrub floor protects.\n *\n * The assertion is CHECKED in both directions: the factory refuses `RETAIN_ONLY` if any field declares an\n * impersonalize treatment, and (since 2026-08-31) if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit-balance mutation is\n      // system-only; it is never client-initiated.\n      //\n      // CONSUME is INTERNAL_CALL (no HTTP route), matching TOP_UP and the CRUD siblings. It is invoked\n      // by service code that meters a paid feature (its enum doc: \"called by custom service code\"), not\n      // by a client — the balance decrement happens as a side effect of using a metered capability, not\n      // as a direct client action. Leaving it API_CALL let a client spend its own credits arbitrarily\n      // (self-harm, not a grant) and, more importantly, made a system-automated op part of the client\n      // attack surface. The `polymorphicRole` is retained for internal-authorization parity and no\n      // longer confers client reachability.\n      [CreditPool_Operations.CONSUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_MEMBER],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_ConsumeRequestDto,\n        }],\n      },\n      // assurance-control: WILDO.BILLING.CREDIT_GRANT_INTEGRITY — a credit GRANT (balance increase)\n      // is system/payment-gated only; it is never client-initiated.\n      //\n      // TOP_UP is INTERNAL_CALL (no HTTP route), matching its CREATE/UPDATE siblings above. It\n      // increments the spendable balance, so it must be reachable ONLY from server code that has\n      // already verified payment: the billing webhook router computes `credits` from the PAID\n      // product/quantity and invokes it via `executeCustomOperation` (which resolves the INTERNAL_CALL\n      // default through `getServiceOperationPathDefault`). It was previously API_CALL gated to\n      // ORG_OWNER, which let a tenant owner `PUT …/credit-pools/{id}/top-up {credits: N}` and\n      // self-grant unlimited paid credits — the client \"buy credits\" action is OPEN_CHECKOUT, not a\n      // direct balance write, so this route had no legitimate client caller. (The spec previously\n      // hinted at a manual admin grant here; a support-initiated grant, if ever needed, belongs on a\n      // separate platform-super-admin op with a mandatory audit event, NOT on a tenant-owner route.)\n      // The `polymorphicRole` below is retained for internal-authorization parity with the CRUD ops\n      // and no longer confers any client reachability.\n      [CreditPool_Operations.TOP_UP]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: CreditPool_TopUpRequestDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/credit-pool.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB;;;;;;;;;;iBA8B3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;;kBAU5C,CAAC"}
+{"version":3,"file":"credit-pool.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB;;;;;;;;;;iBA8B3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;;kBAU5C,CAAC"}

package/dist/esm/billing/credit-pool.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"credit-pool.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAErG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAEvM,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;SACtE,QAAQ,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEjD,gCAAgC;IAChC,iGAAiG;IACjG,gDAAgD;IAChD,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IACxE,uDAAuD;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAC7E;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,mHAAmH,CAAC;IACzM,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Credit Pool Schema (Shared) — Polymorphic\n *\n * Tracks credit balances for CREDIT_PACK products.\n * Created/topped-up when a CREDIT_PACK purchase completes.\n * Decremented when credits are consumed (via custom service code).\n *\n * One pool per creditPoolKey per billing account.\n * Database index: `{ billingAccountId: 1, poolKey: 1 }` compound unique.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, credit pools are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationCreditPools  (with organizationId + organizationBillingAccountId)\n *   - userCreditPools          (with userId + userBillingAccountId)\n *\n *\n * Credit flow:\n * 1. User purchases CREDIT_PACK → Checkout completes → webhook\n * 2. Webhook router: creates/updates CreditPool (available += creditsPerUnit * quantity)\n * 3. CreditPool CONSUME custom op: validates balance and decrements available\n * 4. CreditPool TOP_UP custom op: increments available after purchase\n * 5. Frontend shows balance via BillingStateResponse.creditPools\n *\n * @see billing-and-features-system.md §9 (Credit Pool)\n */\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\n\nexport const CreditPoolSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField().describe(\"The id of the billing account that holds these credits.\"),\n\n  /** Pool identifier (matches ProductDefinition.purchaseConfig.creditPoolKey, e.g., 'ai_tokens') */\n  poolKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable()\n    .isUnique({ compoundWith: 'billingAccountId' }),\n\n  /** Current available balance */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. A balance is a financial fact\n  // about the account holder, not a usage metric.\n  // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n  // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n  // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n  // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n  // resource config (#138).\n  available: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n  /** Total credits ever purchased (for audit/display) */\n  totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n  /**\n   * Total credits ever GIVEN rather than bought — a referral reward, for instance (#1802). Kept apart from\n   * `totalPurchased` so the pool still answers what was sold: `available` is `totalPurchased + totalGranted\n   * - totalConsumed`.\n   */\n  totalGranted: z.number().min(0).default(0).isSummaryField().isNotEditable().describe('Credits given to the account without a purchase, such as a referral reward. Counted apart from purchased credits.'),\n  /** Total credits consumed (for audit/display) */\n  totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type CreditPool = z.infer<typeof CreditPoolSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const creditPoolsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'creditPools',\n  baseFieldIdentifier: 'creditPoolId',\n  baseEnumKey: 'CREDIT_POOLS',\n  baseSchema: CreditPoolSchema,\n  // Many pools per billing-account / scope (composite key: billingAccountId +\n  // poolKey) — opt out of the polymorphism engine's singleton-per-scope\n  // business-key auto-default. If pools ever become seedable, declare an\n  // explicit `businessKeyFields: ['billingAccountId', 'poolKey']` instead.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"credit-pool.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/credit-pool.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAErG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAEvM,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;SACtE,QAAQ,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEjD,gCAAgC;IAChC,iGAAiG;IACjG,gDAAgD;IAChD,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IACxE,uDAAuD;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAC7E;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,mHAAmH,CAAC;IACzM,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Credit Pool Schema (Shared) — Polymorphic\n *\n * Tracks credit balances for CREDIT_PACK products.\n * Created/topped-up when a CREDIT_PACK purchase completes.\n * Decremented when credits are consumed (via custom service code).\n *\n * One pool per creditPoolKey per billing account.\n * Database index: `{ billingAccountId: 1, poolKey: 1 }` compound unique.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, credit pools are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationCreditPools  (with organizationId + organizationBillingAccountId)\n *   - userCreditPools          (with userId + userBillingAccountId)\n *\n *\n * Credit flow:\n * 1. User purchases CREDIT_PACK → Checkout completes → webhook\n * 2. Webhook router: creates/updates CreditPool (available += creditsPerUnit * quantity)\n * 3. CreditPool CONSUME custom op: validates balance and decrements available\n * 4. CreditPool TOP_UP custom op: increments available after purchase\n * 5. Frontend shows balance via BillingStateResponse.creditPools\n *\n * @see billing-and-features-system.md §9 (Credit Pool)\n */\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\n\nexport const CreditPoolSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField().describe(\"The id of the billing account that holds these credits.\"),\n\n  /** Pool identifier (matches ProductDefinition.purchaseConfig.creditPoolKey, e.g., 'ai_tokens') */\n  poolKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable()\n    .isUnique({ compoundWith: 'billingAccountId' }),\n\n  /** Current available balance */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts`. A balance is a financial fact\n  // about the account holder, not a usage metric.\n  // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n  // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n  // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n  // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n  // resource config (#138).\n  available: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n  /** Total credits ever purchased (for audit/display) */\n  totalPurchased: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n  /**\n   * Total credits ever GIVEN rather than bought — a referral reward, for instance (#1802). Kept apart from\n   * `totalPurchased` so the pool still answers what was sold: `available` is `totalPurchased + totalGranted\n   * - totalConsumed`.\n   */\n  totalGranted: z.number().min(0).default(0).isSummaryField().isNotEditable().describe('Credits given to the account without a purchase, such as a referral reward. Counted apart from purchased credits.'),\n  /** Total credits consumed (for audit/display) */\n  totalConsumed: z.number().min(0).default(0).isSummaryField().isNotEditable(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type CreditPool = z.infer<typeof CreditPoolSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const creditPoolsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'creditPools',\n  baseFieldIdentifier: 'creditPoolId',\n  baseEnumKey: 'CREDIT_POOLS',\n  baseSchema: CreditPoolSchema,\n  // Many pools per billing-account / scope (composite key: billingAccountId +\n  // poolKey) — opt out of the polymorphism engine's singleton-per-scope\n  // business-key auto-default. If pools ever become seedable, declare an\n  // explicit `businessKeyFields: ['billingAccountId', 'poolKey']` instead.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAYzG,eAAO,MAAM,+BAA+B,oRAwH3C,CAAC"}
+{"version":3,"file":"invoice-ref.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AAYzG,eAAO,MAAM,+BAA+B,oRAwH3C,CAAC"}

package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,gWAAgW;IAChW,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IACvE,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,4EAA4E;oBAC5E,8EAA8E;oBAC9E,sEAAsE;oBACtE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBAClI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,QAAQ,CAAC;oBAC5B,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBAClI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBAClI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Invoice Reference Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...invoiceRefsPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { invoiceRefsPolymorphicDeclaration } from './invoice-ref.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nexport const invoiceRefsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  invoiceRefsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    /** Subject-export disclosure. The subject's own invoice references — also legally retained records they are entitled to. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the provider-hosted document URLs.\n *\n * `hostedInvoiceUrl` and `invoicePdfUrl` address documents that carry the person's name and billing\n * address, so they are personal data this row holds and take `REMOVE`. `total` deliberately keeps its\n * FINANCIAL category and takes NO treatment: it is retained under the same tax obligation, and the mode\n * permits a categorized field to survive when the law requires it.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: invoices are a user-facing collection (Settings Hub → Billing →\n          // Invoices, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n          // strip the op from the frontend registry and register no HTTP route.\n          // Writes are INTERNAL_CALL (service-pipeline, no HTTP; created by Stripe webhooks, not users).\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['status'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: {},\n          sortFields: [],\n          maxPaginatedResultPerPageLimit: 50,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"invoice-ref.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CACpF,iCAAiC,EACjC;IACE,gBAAgB,EAAE,IAAI;IACtB,gWAAgW;IAChW,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IACvE,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,4EAA4E;oBAC5E,8EAA8E;oBAC9E,sEAAsE;oBACtE,+FAA+F;oBAC/F,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBAClI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;wBACtF,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;qBACpD;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,QAAQ,CAAC;oBAC5B,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBAClI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,2BAA2B,CAAC;wBAClI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,2BAA2B,CAAC;qBAChG;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Invoice Reference Resource Configuration — Polymorphic\n *\n * Produces 3 factory functions (one per scope variant) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...invoiceRefsPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { invoiceRefsPolymorphicDeclaration } from './invoice-ref.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nexport const invoiceRefsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  invoiceRefsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    /** Subject-export disclosure. The subject's own invoice references — also legally retained records they are entitled to. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config. */\n    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the provider-hosted document URLs.\n *\n * `hostedInvoiceUrl` and `invoicePdfUrl` address documents that carry the person's name and billing\n * address, so they are personal data this row holds and take `REMOVE`. `total` deliberately keeps its\n * FINANCIAL category and takes NO treatment: it is retained under the same tax obligation, and the mode\n * permits a categorized field to survive when the law requires it.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR the\n *  record belongs to — and the enum prescribes `NO_PRINCIPAL` for exactly that shape. The subject's own\n *  session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // API_CALL: invoices are a user-facing collection (Settings Hub → Billing →\n          // Invoices, and the resource presets' LIST/READ views). REPOSITORY_ONLY would\n          // strip the op from the frontend registry and register no HTTP route.\n          // Writes are INTERNAL_CALL (service-pipeline, no HTTP; created by Stripe webhooks, not users).\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['status'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: {},\n          sortFields: [],\n          maxPaginatedResultPerPageLimit: 50,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS],\n            [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER, CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/billing/invoice-ref.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/invoice-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAG/D,eAAO,MAAM,gBAAgB;;;;;;;;;;iBAmD3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;;kBAQ5C,CAAC"}
+{"version":3,"file":"invoice-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAG/D,eAAO,MAAM,gBAAgB;;;;;;;;;;iBAmD3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,iCAAiC;;;;;;;;;;kBAQ5C,CAAC"}

package/dist/esm/billing/invoice-ref.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-ref.shared.schemas.js","sourceRoot":"","sources":["../../../src/billing/invoice-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IAExL,2EAA2E;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;IAExF,uEAAuE;IACvE,sGAAsG;IACtG,KAAK,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAE7H;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iGAAiG;IACjG,uGAAuG;IACvG,wGAAwG;IACxG,uGAAuG;IACvG,uFAAuF;IACvF,gBAAgB,EAAE,oBAAoB,CACpC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IACD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IAED,yBAAyB;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE;IAE7C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,uEAAuE;IACvE,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Invoice Reference Schema (Shared) — Polymorphic\n *\n * Thin reference synced FROM provider (webhook-driven), NOT created by Wildo.\n * Only stores what's needed for: billing status checks, quick display, and provider links.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, invoice refs are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationInvoiceRefs  (with organizationId + organizationBillingAccountId)\n *   - userInvoiceRefs          (with userId + userBillingAccountId)\n *\n *\n * @see billing-and-features-system.md §6.4 (Invoice References)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { z_money, CurrencyAllowed, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { InvoiceStatus } from './billing-enums.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\n\nexport const InvoiceRefSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().describe(\"The id of the billing account this invoice was issued to.\"),\n\n  /** Status - needed for billing status checks (past_due detection, etc.) */\n  status: z.enum(InvoiceStatus).isDBIndexed().isSummaryField().systemEnum('InvoiceStatus'),\n\n  /** Total amount - needed for quick display in subscription overview */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts` for why this rides the shared base.\n  total: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT] }).isSummaryField().dataCategories(PersonalDataCategory.FINANCIAL),\n\n  /**\n   * Provider-hosted invoice URLs — **backend-only, deliberately not exposed to clients.**\n   *\n   * These are CAPABILITY-STYLE links: whoever holds one can open the document, with no\n   * authentication. And the document is a tax invoice, which is legally required to carry the\n   * customer's full name and billing address (EU VAT Directive 2006/112/EC Art. 226(5), and\n   * equivalents elsewhere) — so the invoice PDF is personal data even though this row is not.\n   *\n   * That combination is why the URLs cannot sit in the response DTO. After a subject erasure the\n   * row is deliberately RETAINED and stays visible for accounting, and an ordinarily-readable link\n   * to a document rendering the erased person's name and address would defeat the erasure.\n   *\n   * The document itself is NEVER scrubbed or unlinked: mutilating it would void it as a tax\n   * record, which is precisely what the retention obligation exists to preserve (GDPR Art. 17(3)(b)\n   * exempts processing required by a legal obligation). Access is what is controlled, not content.\n   *\n   * The user-facing door is the provider's own customer portal\n   * (`StandardBilling_Interface.createCustomerPortalSession`, surfaced as the billing account's\n   * `open_portal` operation), which authenticates the viewer provider-side and is the conventional\n   * SaaS shape. Backend code reads these fields normally — they are present on `internalDto`.\n   */\n  // The URL IS the invoice: anyone holding it reads the line items. A category, not mere metadata.\n  // REMOVE both URLs on erasure. They address provider-hosted documents that CARRY the person's name and\n  // billing address — content about them, not an amount about the invoice. `total` deliberately keeps its\n  // category and takes NO treatment: it is retained under the tax/audit obligation this family exists to\n  // serve, and the mode permits a categorized field to survive when the law requires it.\n  hostedInvoiceUrl: addImpersonalizeWith(\n    z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n    RedactionType.REMOVE,\n  ),\n  invoicePdfUrl: addImpersonalizeWith(\n    z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n    RedactionType.REMOVE,\n  ),\n\n  /** Provider reference */\n  providerInvoiceId: z.string().isBackendOnly(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type InvoiceRef = z.infer<typeof InvoiceRefSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const invoiceRefsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'invoiceRefs',\n  baseFieldIdentifier: 'invoiceRefId',\n  baseEnumKey: 'INVOICE_REFS',\n  baseSchema: InvoiceRefSchema,\n  // Many invoices per scope (LIST/SEARCH/CREATE/UPDATE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"invoice-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/invoice-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IAExL,2EAA2E;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;IAExF,uEAAuE;IACvE,sGAAsG;IACtG,KAAK,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAE7H;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iGAAiG;IACjG,uGAAuG;IACvG,wGAAwG;IACxG,uGAAuG;IACvG,uFAAuF;IACvF,gBAAgB,EAAE,oBAAoB,CACpC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IACD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IAED,yBAAyB;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE;IAE7C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;IACzE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,gBAAgB;IAC5B,uEAAuE;IACvE,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/**\n * Invoice Reference Schema (Shared) — Polymorphic\n *\n * Thin reference synced FROM provider (webhook-driven), NOT created by Wildo.\n * Only stores what's needed for: billing status checks, quick display, and provider links.\n *\n * POLYMORPHIC EXPANSION: Like subscriptions, invoice refs are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n *   - organizationInvoiceRefs  (with organizationId + organizationBillingAccountId)\n *   - userInvoiceRefs          (with userId + userBillingAccountId)\n *\n *\n * @see billing-and-features-system.md §6.4 (Invoice References)\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { z_money, CurrencyAllowed, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { InvoiceStatus } from './billing-enums.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\n\nexport const InvoiceRefSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().describe(\"The id of the billing account this invoice was issued to.\"),\n\n  /** Status - needed for billing status checks (past_due detection, etc.) */\n  status: z.enum(InvoiceStatus).isDBIndexed().isSummaryField().systemEnum('InvoiceStatus'),\n\n  /** Total amount - needed for quick display in subscription overview */\n  // FINANCIAL — see the note on `billing-account.shared.schemas.ts` for why this rides the shared base.\n  total: z_money({ currenciesAllowed: [CurrencyAllowed.FIAT] }).isSummaryField().dataCategories(PersonalDataCategory.FINANCIAL),\n\n  /**\n   * Provider-hosted invoice URLs — **backend-only, deliberately not exposed to clients.**\n   *\n   * These are CAPABILITY-STYLE links: whoever holds one can open the document, with no\n   * authentication. And the document is a tax invoice, which is legally required to carry the\n   * customer's full name and billing address (EU VAT Directive 2006/112/EC Art. 226(5), and\n   * equivalents elsewhere) — so the invoice PDF is personal data even though this row is not.\n   *\n   * That combination is why the URLs cannot sit in the response DTO. After a subject erasure the\n   * row is deliberately RETAINED and stays visible for accounting, and an ordinarily-readable link\n   * to a document rendering the erased person's name and address would defeat the erasure.\n   *\n   * The document itself is NEVER scrubbed or unlinked: mutilating it would void it as a tax\n   * record, which is precisely what the retention obligation exists to preserve (GDPR Art. 17(3)(b)\n   * exempts processing required by a legal obligation). Access is what is controlled, not content.\n   *\n   * The user-facing door is the provider's own customer portal\n   * (`StandardBilling_Interface.createCustomerPortalSession`, surfaced as the billing account's\n   * `open_portal` operation), which authenticates the viewer provider-side and is the conventional\n   * SaaS shape. Backend code reads these fields normally — they are present on `internalDto`.\n   */\n  // The URL IS the invoice: anyone holding it reads the line items. A category, not mere metadata.\n  // REMOVE both URLs on erasure. They address provider-hosted documents that CARRY the person's name and\n  // billing address — content about them, not an amount about the invoice. `total` deliberately keeps its\n  // category and takes NO treatment: it is retained under the tax/audit obligation this family exists to\n  // serve, and the mode permits a categorized field to survive when the law requires it.\n  hostedInvoiceUrl: addImpersonalizeWith(\n    z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n    RedactionType.REMOVE,\n  ),\n  invoicePdfUrl: addImpersonalizeWith(\n    z.string().optional().isBackendOnly().dataCategories(PersonalDataCategory.FINANCIAL),\n    RedactionType.REMOVE,\n  ),\n\n  /** Provider reference */\n  providerInvoiceId: z.string().isBackendOnly(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type InvoiceRef = z.infer<typeof InvoiceRefSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const invoiceRefsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'invoiceRefs',\n  baseFieldIdentifier: 'invoiceRefId',\n  baseEnumKey: 'INVOICE_REFS',\n  baseSchema: InvoiceRefSchema,\n  // Many invoices per scope (LIST/SEARCH/CREATE/UPDATE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/billing/price.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"price.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/billing/price.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAI/C,KAAK,aAAa,GACd,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,iDAAiD,GAC5D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;iCAoG9C,CAAC"}
+{"version":3,"file":"price.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/price.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,oBAAoB,EACrB,MAAM,uCAAuC,CAAC;AAI/C,KAAK,aAAa,GACd,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,iDAAiD,GAC5D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;iCAoG9C,CAAC"}