@opencxh/domain 1.170.0 → 1.172.1

package/dist/entities/ai-budget/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 /**
  * A ceiling on what may be spent on AI in one period.
  *
@@ -18,8 +18,12 @@ export interface AiBudget {
      * tenant, including the ones attributed to nobody (kb indexing, transcription,
      * playbooks running as the organisation). That unattributed spend is real and
      * it has to land somewhere.
+     *
+     * Named `ownerScope` like every other scoped entity. It was `scope` — the one
+     * deviation from the platform's convention, where `scope` is reserved for OAuth
+     * scopes, an unrelated concept that happens to share the word.
      */
-    scope: OwnerScope;
+    ownerScope: OwnerScope;
     /**
      * Warn here. Absent = never warn, only block. Both absent is allowed and means
      * the budget does nothing — the UI says so rather than pretending it is armed.
@@ -57,7 +61,7 @@ export type AiBudgetClearable = "softLimitNanos" | "hardLimitNanos";
  * what an ambiguous sentinel (`0`? that is a real limit) never could.
  */
 export interface AiBudgetInput {
-    scope?: OwnerScope;
+    ownerScope?: OwnerScope;
     softLimitNanos?: number;
     hardLimitNanos?: number;
     period?: AiBudgetPeriod;

package/dist/entities/ai-profile/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OrgTeamScope } from '../scope/types';
 export interface PredefinedPrompt {
     name: string;
     prompt: string;
@@ -7,11 +7,13 @@ export interface AIProfile<T extends Record<string, any> = Record<string, any>>
     id: string;
     organizationId: string;
     /**
-     * Who may use this profile. Company-wide (`org`) or bound to a `team`; profiles
-     * are never personal. The server resolves one on create (`normalizeProfileScope`),
-     * so it is always present.
+     * Who may use this profile. Company-wide (`org`) or bound to a `team`; profiles are
+     * never personal. The server resolves one on create (`normalizeProfileScope`), so it is
+     * always present.
+     *
+     * "Never personal" was prose while the type allowed it. `OrgTeamScope` states it.
      */
-    ownerScope: OwnerScope;
+    ownerScope: OrgTeamScope;
     name: string;
     description?: string;
     accountId: string;

package/dist/entities/analytics/dashboard.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 import { DimensionId } from './dimensions';
 import { WidgetConfig } from './report';
 /**

package/dist/entities/artifact/types.d.ts

@@ -1,5 +1,5 @@
 import { ToolSource } from '../../platform/ai-tools';
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 import { ArtifactBlock } from './blocks';
 /**
  * Een artefact: een afgerond, deelbaar snapshot-document dat de assistent maakt

package/dist/entities/calendar-event/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 export type CalendarEventStatus = "confirmed" | "cancelled" | "tentative";
 export type AttendeeResponse = "accepted" | "declined" | "tentative" | "none";
 export interface EventAttendee {

package/dist/entities/communication/message-template.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 export interface MessageTemplate {
     id: string;
     name: string;

package/dist/entities/company/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 /** Where a company row came from. `local` is a row somebody created by hand. */
 export interface CompanySource {
     providerId: string;

package/dist/entities/contact/provider.d.ts

@@ -1,5 +1,6 @@
 import { CommunicationScheme } from '../../platform/communication';
-import { Contact, OwnerScope } from './types';
+import { OwnerScope } from '../scope/types';
+import { Contact } from './types';
 export interface ContactSearchQuery {
     text?: string;
     scope?: OwnerScope[];

package/dist/entities/contact/types.d.ts

@@ -1,20 +1,11 @@
 import { CommunicationScheme } from '../../platform/communication';
+import { OwnerScope } from '../scope/types';
 export interface ContactEndpoint {
     scheme: CommunicationScheme;
     resource: string;
     label?: string;
     primary?: boolean;
 }
-export type OwnerScope = {
-    kind: "personal";
-    userId: string;
-} | {
-    kind: "team";
-    teamId: string;
-} | {
-    kind: "org";
-    organizationId: string;
-};
 export interface ContactSource {
     providerId: string;
     externalId?: string;

package/dist/entities/live-lens/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 import { ConditionStep, ForEachStep, LookupStep, ParallelStep, Step } from '../playbook/types';
 /**
  * Een **leesbaan**: wat er meeleest tijdens een levend gesprek, en aan wie het iets toont.

package/dist/entities/memory/ingest.d.ts

@@ -53,9 +53,22 @@ export interface MemoryReplaceRequest {
  * Bron-gestuurd wissen. De **bron** pusht dit; de hub interpreteert geen deletes: de
  * mapping van een verwijderd contact naar zijn interacties leeft in comms, en
  * `contacts:deleted` publiceert alleen `{ id }` — zonder `organizationId`.
+ *
+ * ## Er staat geen `source` in, en dat was de bug
+ *
+ * Dit veld bestond en de purge filterde erop: alleen geheugen mét die bron werd gewist. De
+ * serverkant leidde hem af uit de *aanroepende* app (`requireApp`), dus comms wiste met
+ * `source: "communication"` en crm zou met `"crm"` wissen. Maar geheugen wordt geschreven door
+ * de app die het *vastlegt* — `"context"` voor een notitie, `ctx.app` voor de
+ * `memory_remember`-tool. Nooit door de app die het subject verwijdert.
+ *
+ * Netto matchte de purge dus niets: een verwijderd contact of gesprek liet zijn geheugen
+ * staan. Een retentie-lek, en niet zichtbaar, want `{ removed: 0 }` is een geldig antwoord.
+ *
+ * Een purge is subject-gescopeerd en niet bron-gescopeerd: "dit subject bestaat niet meer, haal
+ * alles erover weg". Dat de aanroeper een app moet zijn blijft de poort; het is geen filter.
  */
 export interface MemoryPurgeRequest {
     organizationId: string;
-    source: string;
     subjects: MemorySubjectKey[];
 }

package/dist/entities/memory/kind.d.ts

@@ -1,5 +1,5 @@
 import { LocaleBundle } from '../analytics/dashboard';
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 import { MemoryKindId, MemoryVisibility } from './item';
 /**
  * Wat er onthouden mág worden, en met welke regels.

package/dist/entities/playbook/actor.d.ts

@@ -1,5 +1,6 @@
 import { ActingIdentity } from '../../platform/identity';
-import { OwnerScope } from '../contact/types';
+import { toActingIdentity } from '../scope/actor';
+import { OwnerScope } from '../scope/types';
 /**
  * `ownerScope` **is** de actor van een playbook: er is geen apart `runAs`-veld.
  * Zichtbaarheid, werkgebied en toeschrijving volgen dus uit hetzelfde veld.
@@ -8,7 +9,7 @@ import { OwnerScope } from '../contact/types';
  * entity), aan de uitvoerkant `user` (zoals elke andere acting identity). Deze
  * functie is die vertaling, en de enige plek waar hij hoort.
  */
-export declare function playbookActor(scope: OwnerScope): ActingIdentity;
+export declare const playbookActor: typeof toActingIdentity;
 /**
  * Namens wie deze run handelt.
  *

package/dist/entities/playbook/types.d.ts

@@ -1,6 +1,6 @@
 import { ActingIdentity } from '../../platform/identity';
 import { ResourceRef } from '../../platform/resource';
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 /**
  * Playbooks — event-driven automation met AI-stappen. Zie docs/PLAYBOOKS.md.
  *

package/dist/entities/scope/actor.d.ts

@@ -0,0 +1,16 @@
+import { ActingIdentity } from '../../platform/identity';
+import { OwnerScope } from './types';
+/**
+ * An owner scope as the identity that acts for it.
+ *
+ * Storage calls the personal rung `personal`, execution calls it `user`, and `org`
+ * carries an id on one side and not on the other. This is that translation, and it is
+ * meant to be the only one: a hand-rolled `kind === "personal" ? "user" : …` at a call
+ * site is how two vocabularies for the same three rungs drift apart.
+ *
+ * It arrived as `playbookActor` in `entities/playbook/`, whose own docstring already
+ * claimed to be "the only place this belongs" — correct, but it read as
+ * playbook-specific while every scoped entity needs the same conversion. `playbookActor`
+ * stays as a name so the playbook call sites and their tests keep working.
+ */
+export declare function toActingIdentity(scope: OwnerScope): ActingIdentity;

package/dist/entities/{note → scope}/index.d.ts

@@ -1 +1,2 @@
+export * from './actor';
 export * from './types';

package/dist/entities/scope/scope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/entities/scope/types.d.ts

@@ -0,0 +1,53 @@
+/**
+ * One vocabulary for "whose is this".
+ *
+ * ## Why this is its own module
+ *
+ * `OwnerScope` lived in `entities/contact/types.ts`, and nineteen other entities —
+ * work, task, topic, playbook, artifact, calendar-event, time-entry, memory, … —
+ * imported the platform's scoping primitive *from the contact entity*. Nothing was
+ * broken by that; it just meant the answer to "which type do I use to say who owns
+ * this" was somewhere nobody would look, and a new entity picked whatever it found
+ * first. The audit counted six different spellings in use.
+ *
+ * ## The field-name convention
+ *
+ * **The field is always called `ownerScope`.** `scope` is reserved for OAuth scopes,
+ * which are an unrelated concept that happens to share the word — `AiBudget.scope` is
+ * the one place that still deviates.
+ *
+ * ## The three rungs, and the fourth spelling
+ *
+ * Storage says `personal` / `team` / `org`. The execution side —
+ * {@link ActingIdentity} in `platform/identity.ts` — says `user` / `team` / `org`, and
+ * its `org` carries no id because the tenant is already in context there. Those are
+ * genuinely two vocabularies for two layers, not an accident, and the bridge between
+ * them is `toActingIdentity` next door. That function is the **only** place the
+ * translation belongs; a hand-rolled `kind === "personal" ? "user" : …` at a call site
+ * is how the two drift apart.
+ */
+export type OwnerScope = {
+    kind: "personal";
+    userId: string;
+} | {
+    kind: "team";
+    teamId: string;
+} | {
+    kind: "org";
+    organizationId: string;
+};
+/**
+ * A scope that cannot be personal.
+ *
+ * For records that are shared by definition: a topic one person can see cannot be read
+ * by the colleague who takes over the conversation, and the same goes for an AI profile
+ * or a work type. Those rules exist today as prose in the entity's docstring, with the
+ * type still permitting `personal` — which means nothing enforces them.
+ *
+ * Applying this to an existing entity is a type *tightening*, so it can surface rows
+ * that already violate the rule. Query for personal-scoped rows first; that is why it
+ * is offered here rather than applied everywhere at once.
+ */
+export type OrgTeamScope = Exclude<OwnerScope, {
+    kind: "personal";
+}>;

package/dist/entities/task/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 export type TaskStatus = "open" | "in_progress" | "done" | "cancelled";
 export type TaskPriority = "low" | "normal" | "high" | "urgent";
 export type TaskInitiator = "user" | "system";

package/dist/entities/time-entry/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 /**
  * Waar een urenregel in zijn leven staat.
  *

package/dist/entities/topic/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OrgTeamScope } from '../scope/types';
 /**
  * Een onderwerp is een **etiket** op een gesprek: waar gaat dit over. Verder niets.
  *
@@ -12,11 +12,13 @@ export interface Topic {
     id: string;
     organizationId: string;
     /**
-     * Van wie dit onderwerp is. `org` of `team`; **`personal` wordt geweigerd bij het schrijven** —
-     * een onderwerp dat maar één persoon kent, kan een collega niet lezen op een gesprek dat hij
-     * overneemt. Het type laat het toe omdat `OwnerScope` gedeeld is; de validatie niet.
+     * Van wie dit onderwerp is: `org` of `team`. Een onderwerp dat maar één persoon kent, kan
+     * een collega niet lezen op een gesprek dat hij overneemt.
+     *
+     * Dit stond hier als proza terwijl het type `personal` toestond, dus handhaafde niets het
+     * behalve de schrijfvalidatie. `OrgTeamScope` zegt het nu in het type.
      */
-    ownerScope: OwnerScope;
+    ownerScope: OrgTeamScope;
     name: string;
     description: string;
     /**

package/dist/entities/work/types.d.ts

@@ -1,4 +1,4 @@
-import { OwnerScope } from '../contact/types';
+import { OwnerScope } from '../scope/types';
 /**
  * Work management — één entiteit voor alles wat *werk* is.
  *