@dakkitor/api-contracts 1.8.0 → 1.9.2

package/dist/abilities/abilities.contract.d.ts

@@ -14,6 +14,7 @@ export interface AbilityRule {
     inverted?: boolean;
 }
 export declare const AdminAbilities: AbilityRule[];
+export declare const AutomaticCallerAbilities: AbilityRule[];
 export declare const KpiAbilities: AbilityRule[];
 export declare const FirstAgentAbilities: AbilityRule[];
 export declare const SecondAgentAbilities: AbilityRule[];
@@ -38,6 +39,7 @@ export declare const RoleAbilities: {
     readonly WORKER_CURATOR: AbilityRule[];
     readonly INTERCONNECTION: AbilityRule[];
     readonly OUTREACH: AbilityRule[];
+    readonly AUTOMATIC_CALLER: AbilityRule[];
 };
 export type RoleAbilitiesType = typeof RoleAbilities;
 /**
@@ -46,7 +48,7 @@ export type RoleAbilitiesType = typeof RoleAbilities;
  * Kept in sync with the abilities JSON files by abilities.contract.spec.ts,
  * which fails on any JSON subject missing from the known-subject registry.
  */
-export declare const VIRTUAL_SUBJECTS: readonly ["FaDashboardWidgets", "SaDashboardWidgets", "DashboardTrends", "AdminFaDashboardWidgets", "AdminSaDashboardWidgets", "AdminAgentStats", "AdminProofs", "AdminDashboardTrends", "FirstAgentTutorials", "CuratedMatchWorkspace", "JobCandidate", "LeadActivityEvent", "FilterCandidateContactHistorySchema", "SecondAgentTutorials", "SortActiveSchema", "SortBookingSchema", "SortJobSchema", "SortWorkerSchema", "SortCuratedWorkerSchema", "SortLeadSchema", "SortOwnResearchLeadSchema", "SortClientSchema", "SortCompanySchema", "SortCollaborationSchema", "SortCollaborationCheckingSchema", "SortClientContactSchema", "SortCallHistorySchema", "SortUserSchema", "SortCrewSchema", "FilterExportJobSchema", "OutreachClaim", "OutreachRequest", "RelayPod"];
+export declare const VIRTUAL_SUBJECTS: readonly ["FaDashboardWidgets", "SaDashboardWidgets", "DashboardTrends", "AdminSharedDashboardWidgets", "AdminFaDashboardWidgets", "AdminSaDashboardWidgets", "AdminAgentStats", "AdminProofs", "AdminDashboardTrends", "FirstAgentTutorials", "CuratedMatchWorkspace", "JobCandidate", "CandidateCallingQueue", "LeadActivityEvent", "FilterCandidateContactHistorySchema", "SecondAgentTutorials", "SortActiveSchema", "SortBookingSchema", "SortJobSchema", "SortWorkerSchema", "SortCuratedWorkerSchema", "SortLeadSchema", "SortOwnResearchLeadSchema", "SortClientSchema", "SortCompanySchema", "SortCollaborationSchema", "SortCollaborationCheckingSchema", "SortClientContactSchema", "SortCallHistorySchema", "SortUserSchema", "SortCrewSchema", "FilterExportJobSchema", "OutreachClaim", "OutreachRequest", "RelayPod"];
 export type VirtualSubjects = (typeof VIRTUAL_SUBJECTS)[number];
 /**
  * Roles an OFFICE_MANAGER may assign to users they create.
@@ -61,7 +63,32 @@ export declare const OFFICE_MANAGER_ASSIGNABLE_ROLES: readonly ["FIRST_AGENT", "
  * inverted ability rule never fires for an admin-who-is-also-an-OM.
  */
 export declare function getRolesOmCannotAssign(actingUserRoles: readonly UserRole[] | undefined): UserRole[];
+/**
+ * Deliberately does NOT list AUTOMATIC_CALLER even though
+ * `hasSharedCuratedMatchAccess` recognises it. This constant is typed against
+ * `UserRole`, which is the ASSIGNABLE role list — service roles (BOT,
+ * CRON_SCHEDULER, OUTREACH_SERVICE, AUTOMATIC_CALLER) are all absent from it
+ * by design, because no human may hand one out through the users API. Use the
+ * function, not this list, to ask whether a viewer has the access.
+ */
 export declare const SHARED_CURATED_MATCH_ROLES: readonly ["ADMIN", "WORKER_CURATOR", "INTERCONNECTION"];
+/**
+ * AUTOMATIC_CALLER is here because the reachability prober is a genuine
+ * shared-curated-match viewer: it ranks jobs and candidates through exactly
+ * the same `job_call_priority_scores` rows and the same candidate-eligibility
+ * SQL an agent does, and BOTH refuse a viewer without this access —
+ * `eligibleCandidateBulkSql` degrades to a hard-coded `FALSE`, and
+ * `JobCallPriorityRefreshProcessor` DELETES the viewer's scores. Stating it
+ * once here keeps the ranking, the refresh and the driver in agreement;
+ * the alternative was borrowing WORKER_CURATOR at the driver's call sites,
+ * which is both a lie about the seat and two copies to drift apart.
+ *
+ * This widens NO authenticated surface. The seat's password is `no-login`, it
+ * holds no abilities (`automatic-caller.abilities.json` is `[]`), and it is
+ * excluded from every user roster by HIDDEN_SERVICE_ROLES — so the only code
+ * that can ever present these roles is server-side code that constructs them
+ * from the constant on purpose.
+ */
 export declare function hasSharedCuratedMatchAccess(roles: readonly string[] | null | undefined): boolean;
 /**
  * Roles whose JOB-FIRST CANDIDATE scope is global: inside a specific job's

package/dist/abilities/abilities.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abilities.contract.d.ts","sourceRoot":"","sources":["../../contracts/abilities/abilities.contract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EAAoC,CAAC;AAC7E,eAAO,MAAM,YAAY,EAAE,WAAW,EAAkC,CAAC;AACzE,eAAO,MAAM,mBAAmB,EAAE,WAAW,EACP,CAAC;AACvC,eAAO,MAAM,oBAAoB,EAAE,WAAW,EACP,CAAC;AACxC,eAAO,MAAM,iBAAiB,EAAE,WAAW,EACP,CAAC;AACrC,eAAO,MAAM,YAAY,EAAE,WAAW,EAAkC,CAAC;AACzE,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,wBAAwB,EAAE,WAAW,EACP,CAAC;AAC5C,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,wBAAwB,EAAE,WAAW,EACP,CAAC;AAC5C,eAAO,MAAM,iBAAiB,EAAE,WAAW,EACP,CAAC;AAErC,eAAO,MAAM,aAAa;;;;;;;;;;;;;CAahB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,OAAO,aAAa,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,8uBAkCnB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,+BAA+B,0CAGJ,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,GAC/C,QAAQ,EAAE,CAMZ;AAED,eAAO,MAAM,0BAA0B,yDAIC,CAAC;AAWzC,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAQT;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,uCAGC,CAAC;AAEzC;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAIT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAMT"}
+{"version":3,"file":"abilities.contract.d.ts","sourceRoot":"","sources":["../../contracts/abilities/abilities.contract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EAAoC,CAAC;AAC7E,eAAO,MAAM,wBAAwB,EAAE,WAAW,EACP,CAAC;AAC5C,eAAO,MAAM,YAAY,EAAE,WAAW,EAAkC,CAAC;AACzE,eAAO,MAAM,mBAAmB,EAAE,WAAW,EACP,CAAC;AACvC,eAAO,MAAM,oBAAoB,EAAE,WAAW,EACP,CAAC;AACxC,eAAO,MAAM,iBAAiB,EAAE,WAAW,EACP,CAAC;AACrC,eAAO,MAAM,YAAY,EAAE,WAAW,EAAkC,CAAC;AACzE,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,wBAAwB,EAAE,WAAW,EACP,CAAC;AAC5C,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,wBAAwB,EAAE,WAAW,EACP,CAAC;AAC5C,eAAO,MAAM,iBAAiB,EAAE,WAAW,EACP,CAAC;AAErC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;CAchB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,OAAO,aAAa,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,syBAoCnB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,+BAA+B,0CAGJ,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,GAC/C,QAAQ,EAAE,CAMZ;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,yDAIC,CAAC;AAWzC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAST;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,uCAGC,CAAC;AAEzC;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAIT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAMT"}

package/dist/abilities/abilities.contract.js

@@ -10,12 +10,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GLOBAL_CURATED_SCOPE_ROLES = exports.SHARED_CURATED_MATCH_ROLES = exports.OFFICE_MANAGER_ASSIGNABLE_ROLES = exports.VIRTUAL_SUBJECTS = exports.RoleAbilities = exports.OutreachAbilities = exports.InterconnectionAbilities = exports.WorkerCuratorAbilities = exports.OfficeManagerAbilities = exports.OutreachServiceAbilities = exports.CronSchedulerAbilities = exports.BotAbilities = exports.TeamLeadAbilities = exports.SecondAgentAbilities = exports.FirstAgentAbilities = exports.KpiAbilities = exports.AdminAbilities = void 0;
+exports.GLOBAL_CURATED_SCOPE_ROLES = exports.SHARED_CURATED_MATCH_ROLES = exports.OFFICE_MANAGER_ASSIGNABLE_ROLES = exports.VIRTUAL_SUBJECTS = exports.RoleAbilities = exports.OutreachAbilities = exports.InterconnectionAbilities = exports.WorkerCuratorAbilities = exports.OfficeManagerAbilities = exports.OutreachServiceAbilities = exports.CronSchedulerAbilities = exports.BotAbilities = exports.TeamLeadAbilities = exports.SecondAgentAbilities = exports.FirstAgentAbilities = exports.KpiAbilities = exports.AutomaticCallerAbilities = exports.AdminAbilities = void 0;
 exports.getRolesOmCannotAssign = getRolesOmCannotAssign;
 exports.hasSharedCuratedMatchAccess = hasSharedCuratedMatchAccess;
 exports.hasGlobalCuratedCandidateScope = hasGlobalCuratedCandidateScope;
 exports.isCandidateOnlyCuratedViewer = isCandidateOnlyCuratedViewer;
 const admin_abilities_json_1 = __importDefault(require("./admin.abilities.json"));
+const automatic_caller_abilities_json_1 = __importDefault(require("./automatic-caller.abilities.json"));
 const bot_abilities_json_1 = __importDefault(require("./bot.abilities.json"));
 const cron_scheduler_abilities_json_1 = __importDefault(require("./cron-scheduler.abilities.json"));
 const first_agent_abilities_json_1 = __importDefault(require("./first-agent.abilities.json"));
@@ -29,6 +30,7 @@ const interconnection_abilities_json_1 = __importDefault(require("./interconnect
 const outreach_abilities_json_1 = __importDefault(require("./outreach.abilities.json"));
 const users_contract_1 = require("../users/users.contract");
 exports.AdminAbilities = admin_abilities_json_1.default;
+exports.AutomaticCallerAbilities = automatic_caller_abilities_json_1.default;
 exports.KpiAbilities = kpi_abilities_json_1.default;
 exports.FirstAgentAbilities = first_agent_abilities_json_1.default;
 exports.SecondAgentAbilities = second_agent_abilities_json_1.default;
@@ -53,6 +55,7 @@ exports.RoleAbilities = {
     WORKER_CURATOR: exports.WorkerCuratorAbilities,
     INTERCONNECTION: exports.InterconnectionAbilities,
     OUTREACH: exports.OutreachAbilities,
+    AUTOMATIC_CALLER: exports.AutomaticCallerAbilities,
 };
 /**
  * Virtual subjects that don't correspond to entity classes.
@@ -64,6 +67,7 @@ exports.VIRTUAL_SUBJECTS = [
     'FaDashboardWidgets',
     'SaDashboardWidgets',
     'DashboardTrends',
+    'AdminSharedDashboardWidgets',
     'AdminFaDashboardWidgets',
     'AdminSaDashboardWidgets',
     'AdminAgentStats',
@@ -72,6 +76,7 @@ exports.VIRTUAL_SUBJECTS = [
     'FirstAgentTutorials',
     'CuratedMatchWorkspace',
     'JobCandidate',
+    'CandidateCallingQueue',
     'LeadActivityEvent',
     'FilterCandidateContactHistorySchema',
     'SecondAgentTutorials',
@@ -117,6 +122,14 @@ function getRolesOmCannotAssign(actingUserRoles) {
     const allowed = new Set(exports.OFFICE_MANAGER_ASSIGNABLE_ROLES);
     return users_contract_1.UserRoleSchema.options.filter((role) => !allowed.has(role));
 }
+/**
+ * Deliberately does NOT list AUTOMATIC_CALLER even though
+ * `hasSharedCuratedMatchAccess` recognises it. This constant is typed against
+ * `UserRole`, which is the ASSIGNABLE role list — service roles (BOT,
+ * CRON_SCHEDULER, OUTREACH_SERVICE, AUTOMATIC_CALLER) are all absent from it
+ * by design, because no human may hand one out through the users API. Use the
+ * function, not this list, to ask whether a viewer has the access.
+ */
 exports.SHARED_CURATED_MATCH_ROLES = [
     'ADMIN',
     'WORKER_CURATOR',
@@ -126,11 +139,29 @@ function hasInterconnectionModifierPair(roles) {
     return (roles?.includes('SECOND_AGENT') === true &&
         roles.includes('INTERCONNECTION'));
 }
+/**
+ * AUTOMATIC_CALLER is here because the reachability prober is a genuine
+ * shared-curated-match viewer: it ranks jobs and candidates through exactly
+ * the same `job_call_priority_scores` rows and the same candidate-eligibility
+ * SQL an agent does, and BOTH refuse a viewer without this access —
+ * `eligibleCandidateBulkSql` degrades to a hard-coded `FALSE`, and
+ * `JobCallPriorityRefreshProcessor` DELETES the viewer's scores. Stating it
+ * once here keeps the ranking, the refresh and the driver in agreement;
+ * the alternative was borrowing WORKER_CURATOR at the driver's call sites,
+ * which is both a lie about the seat and two copies to drift apart.
+ *
+ * This widens NO authenticated surface. The seat's password is `no-login`, it
+ * holds no abilities (`automatic-caller.abilities.json` is `[]`), and it is
+ * excluded from every user roster by HIDDEN_SERVICE_ROLES — so the only code
+ * that can ever present these roles is server-side code that constructs them
+ * from the constant on purpose.
+ */
 function hasSharedCuratedMatchAccess(roles) {
     if (!roles)
         return false;
     return (roles.includes('ADMIN') ||
         roles.includes('WORKER_CURATOR') ||
+        roles.includes('AUTOMATIC_CALLER') ||
         hasInterconnectionModifierPair(roles));
 }
 /**

package/dist/abilities/abilities.contract.spec.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const abilities_contract_1 = require("./abilities.contract");
+const users_contract_1 = require("../users/users.contract");
 /**
  * Entity subjects the API resolves through SUBJECT_CLASS_MAP
  * (apps/api/src/modules/casl/casl-ability.factory.ts). Mirrored here because
@@ -29,6 +30,7 @@ const ENTITY_SUBJECTS = [
     'Job',
     'Lead',
     'LeadAssignment',
+    'LeadCallback',
     'Location',
     'Office',
     'OwnResearchLead',
@@ -95,6 +97,21 @@ describe('abilities JSON subject validity', () => {
         expect(violations).toEqual([]);
     });
 });
+describe('candidate calling queue grants', () => {
+    it('registers the virtual subject and grants SECOND_AGENT queue control', () => {
+        expect(abilities_contract_1.VIRTUAL_SUBJECTS).toContain('CandidateCallingQueue');
+        expect(abilities_contract_1.SecondAgentAbilities.filter((rule) => rule.subject === 'CandidateCallingQueue')).toEqual([
+            { action: 'read', subject: 'CandidateCallingQueue' },
+            { action: 'create', subject: 'CandidateCallingQueue' },
+            { action: 'update', subject: 'CandidateCallingQueue' },
+            { action: 'delete', subject: 'CandidateCallingQueue' },
+        ]);
+    });
+    it('lets SECOND_AGENT receive aggregate job call-priority fields', () => {
+        const jobReadRule = abilities_contract_1.SecondAgentAbilities.find((rule) => rule.action === 'read' && rule.subject === 'Job');
+        expect(jobReadRule?.fields).toEqual(expect.arrayContaining(['callPriority', 'callPriority.*']));
+    });
+});
 describe('Relay pod membership grants', () => {
     it('grants no RelayPod authority; pod access comes from membership', () => {
         const relayPodRules = abilities_contract_1.OutreachAbilities.filter((rule) => rule.subject === 'RelayPod');
@@ -133,10 +150,34 @@ describe('shared curated match access', () => {
         [['FIRST_AGENT', 'INTERCONNECTION'], false],
         [['SECOND_AGENT'], false],
         [['FIRST_AGENT'], false],
+        [['AUTOMATIC_CALLER'], true],
         [[], false],
     ])('%j => %s', (roles, expected) => {
         expect((0, abilities_contract_1.hasSharedCuratedMatchAccess)(roles)).toBe(expected);
     });
+    /**
+     * AUTOMATIC_CALLER is the only role here that no human may hold, and that
+     * fact is the ENTIRE safety argument for granting it this access: the
+     * reachability prober needs the same candidate pool an agent sees, and the
+     * seat is safe to give it to only because the seat cannot be handed out.
+     *
+     * That argument rests on the role being absent from UserRoleSchema — the
+     * assignable list the users API validates create/update against — and
+     * nothing asserted it. A future "publish all the roles" refactor would
+     * otherwise hand shared-curated-match access to a role a human CAN be
+     * assigned, with a green suite. Same assumption, same test, for the three
+     * older service roles, which carry more authority still.
+     */
+    it.each(['AUTOMATIC_CALLER', 'BOT', 'CRON_SCHEDULER', 'OUTREACH_SERVICE'])('keeps the %s service role out of the assignable role list', (serviceRole) => {
+        expect(users_contract_1.UserRoleSchema.options).not.toContain(serviceRole);
+    });
+    it('never grants shared curated match access to an assignable role by accident', () => {
+        // The positive cases above are deliberate. This one guards the inverse:
+        // every assignable role that passes must be one someone chose, so adding
+        // a role to UserRoleSchema can never quietly widen the predicate.
+        const assignableWithAccess = users_contract_1.UserRoleSchema.options.filter((role) => (0, abilities_contract_1.hasSharedCuratedMatchAccess)([role]));
+        expect(assignableWithAccess.sort()).toEqual(['ADMIN', 'WORKER_CURATOR']);
+    });
     it('grants only the purpose-limited workspace, not curated internals', () => {
         expect(abilities_contract_1.InterconnectionAbilities).toEqual(expect.arrayContaining([
             { action: 'read', subject: 'CuratedMatchWorkspace' },
@@ -166,9 +207,28 @@ describe('shared curated match access', () => {
             },
         ]);
     });
-    it('grants SECOND_AGENT no CuratedWorker rule', () => {
-        const subjects = abilities_contract_1.SecondAgentAbilities.map((rule) => rule.subject);
-        expect(subjects).not.toContain('CuratedWorker');
+    it('grants SECOND_AGENT an update on CuratedWorker restricted to exactly the AI-appliable profile fields', () => {
+        // Scoped to power CandidateCallProfileFactsService's automatic write path
+        // (apps/api/src/modules/candidate-calling/services/candidate-call-profile-facts.service.ts,
+        // the `AppliableField` union, which gained `nationality` 2026-08-21 —
+        // see NATIONALITY_AUTO_APPLY_CONFIDENCE) — SECOND_AGENT still has no
+        // unconditioned `update CuratedWorker` the way WORKER_CURATOR does.
+        const curatedWorkerRules = abilities_contract_1.SecondAgentAbilities.filter((rule) => rule.subject === 'CuratedWorker');
+        expect(curatedWorkerRules).toEqual([
+            {
+                action: 'update',
+                subject: 'CuratedWorker',
+                fields: [
+                    'postcode',
+                    'transportMethods',
+                    'englishLevel',
+                    'hasTools',
+                    'hasPpe',
+                    'trades',
+                    'nationality',
+                ],
+            },
+        ]);
     });
 });
 describe('isCandidateOnlyCuratedViewer', () => {

package/dist/abilities/admin-dashboard.abilities.test.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const abilities_contract_1 = require("./abilities.contract");
 const subjects = [
+    'AdminSharedDashboardWidgets',
     'AdminFaDashboardWidgets',
     'AdminSaDashboardWidgets',
     'AdminAgentStats',

package/dist/abilities/automatic-caller.abilities.json

@@ -0,0 +1 @@
+[]

package/dist/abilities/first-agent.abilities.json

@@ -788,6 +788,20 @@
             "agentId": "{{ id }}"
         }
     },
+    {
+        "action": "read",
+        "subject": "LeadCallback",
+        "conditions": {
+            "agentId": "{{ id }}"
+        }
+    },
+    {
+        "action": "update",
+        "subject": "LeadCallback",
+        "conditions": {
+            "agentId": "{{ id }}"
+        }
+    },
     {
         "action": "read",
         "subject": "CallHistory",

package/dist/abilities/interconnection.abilities.json

@@ -34,6 +34,8 @@
             "job",
             "job.*",
             "channel",
+            "direction",
+            "durationSeconds",
             "contactedAt",
             "outcome",
             "feedbackAt",
@@ -46,6 +48,11 @@
             "jobResult",
             "jobResult.*",
             "canRecordFeedback",
+            "managedCallId",
+            "managedFeedbackStatus",
+            "managedCallStatus",
+            "managedHasRecording",
+            "managedCallSource",
             "worker.name.value",
             "worker.name.exact",
             "worker.phone",
@@ -76,6 +83,15 @@
     {
         "action": "read",
         "subject": "FilterCandidateContactHistorySchema",
-        "fields": ["worker", "worker.*", "job", "job.*", "status", "channel"]
+        "fields": [
+            "worker",
+            "worker.*",
+            "worker.name.*",
+            "job",
+            "job.*",
+            "job.location.*",
+            "status",
+            "channel"
+        ]
     }
 ]

package/dist/abilities/office-manager.abilities.json

@@ -47,6 +47,10 @@
             "officeId": { "$in": "{{ managedOfficeIds }}" }
         }
     },
+    {
+        "action": "read",
+        "subject": "AdminSharedDashboardWidgets"
+    },
     {
         "action": "read",
         "subject": "AdminFaDashboardWidgets"

package/dist/abilities/second-agent.abilities.json

@@ -125,6 +125,8 @@
             "longitude",
             "postcode",
             "filledPositions",
+            "callPriority",
+            "callPriority.*",
             "pay",
             "pay.isNegotiable",
             "pay.rate",
@@ -692,6 +694,8 @@
             "job",
             "job.*",
             "channel",
+            "direction",
+            "durationSeconds",
             "contactedAt",
             "outcome",
             "feedbackAt",
@@ -704,6 +708,11 @@
             "jobResult",
             "jobResult.*",
             "canRecordFeedback",
+            "managedCallId",
+            "managedFeedbackStatus",
+            "managedCallStatus",
+            "managedHasRecording",
+            "managedCallSource",
             "worker.name.value",
             "worker.name.exact",
             "worker.phone",
@@ -734,6 +743,44 @@
     {
         "action": "read",
         "subject": "FilterCandidateContactHistorySchema",
-        "fields": ["worker", "worker.*", "job", "job.*", "status", "channel"]
+        "fields": [
+            "worker",
+            "worker.*",
+            "worker.name.*",
+            "job",
+            "job.*",
+            "job.location.*",
+            "status",
+            "channel"
+        ]
+    },
+    {
+        "action": "update",
+        "subject": "CuratedWorker",
+        "fields": [
+            "postcode",
+            "transportMethods",
+            "englishLevel",
+            "hasTools",
+            "hasPpe",
+            "trades",
+            "nationality"
+        ]
+    },
+    {
+        "action": "read",
+        "subject": "CandidateCallingQueue"
+    },
+    {
+        "action": "create",
+        "subject": "CandidateCallingQueue"
+    },
+    {
+        "action": "update",
+        "subject": "CandidateCallingQueue"
+    },
+    {
+        "action": "delete",
+        "subject": "CandidateCallingQueue"
     }
 ]

package/dist/abilities/worker-curator.abilities.json

@@ -188,6 +188,8 @@
             "job",
             "job.*",
             "channel",
+            "direction",
+            "durationSeconds",
             "contactedAt",
             "outcome",
             "feedbackAt",
@@ -200,6 +202,11 @@
             "jobResult",
             "jobResult.*",
             "canRecordFeedback",
+            "managedCallId",
+            "managedFeedbackStatus",
+            "managedCallStatus",
+            "managedHasRecording",
+            "managedCallSource",
             "worker.name.value",
             "worker.name.exact",
             "worker.phone",
@@ -230,6 +237,15 @@
     {
         "action": "read",
         "subject": "FilterCandidateContactHistorySchema",
-        "fields": ["worker", "worker.*", "job", "job.*", "status", "channel"]
+        "fields": [
+            "worker",
+            "worker.*",
+            "worker.name.*",
+            "job",
+            "job.*",
+            "job.location.*",
+            "status",
+            "channel"
+        ]
     }
 ]