@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/flows-actors/flows-actors-task.shared.resources-config.schemas.js

@@ -0,0 +1,223 @@
+/**
+ * Flows-Actors Task — Resource Configuration (POLYMORPHIC)
+ * ========================================================
+ *
+ * The persisted WORK record behind the A2A `Task` object, stamped out as THREE
+ * owner-scope variants from one polymorphic declaration (`userFlowActorTasks` /
+ * `organizationFlowActorTasks` / `applicationFlowActorTasks`). Spread the produced
+ * factories into the registry factory map:
+ *   ...flowActorTasksPolymorphicFactories
+ *
+ * This is a DIFFERENT PLANE from `flowActorExecutions`: executions own
+ * conversational session history, tasks own an addressable/pollable/cancelable
+ * work lifecycle. See the base schema for why merging them is wrong.
+ *
+ * Scope + access model (mirrors the execution family — same owner scopes, same
+ * RBAC shape — so a task is always readable by exactly the principal that drove
+ * the turn):
+ *   - Owner = the injected scope FK per variant. READ/LIST are `API_CALL`, roles
+ *     resolved PER VARIANT by `polymorphicRole`: a user reads its own (APP_USER +
+ *     USER_SELF filter), a machine reads its org/app variant with its granted
+ *     org/app role. NOTE these roles govern the HTTP surface only — the A2A
+ *     `tasks/get` path does NOT use them (it reads via the ACL-bypassing `readAsSystem`
+ *     and isolates by owner filter instead; see `A2ATaskBackendService`). Tightening
+ *     `polymorphicRole` therefore does not tighten `tasks/get`.
+ *   - CREATE/UPDATE are `INTERNAL_CALL` super-admin: only the runtime materialises
+ *     a task and advances its lifecycle, via `*AsSystem` (governed by
+ *     `systemAccessPolicy`, not the op RBAC). INTERNAL_CALL (not REPOSITORY_ONLY)
+ *     is mandatory — `*AsSystem` dispatches through the service tier and resolves
+ *     the op via `getServiceOperationPathDefault`, which only matches
+ *     INTERNAL_CALL / API_CALL variants.
+ *   - `tasks/cancel` is an UPDATE (status → `CANCELLED`), NOT a delete: the A2A
+ *     spec requires cancel to return the task's UPDATED STATE rather than remove it, so the record must
+ *     spec-cite: A2A v0.2.5 §7.4 (tasks/cancel returns a Task)
+ *     survive cancellation.
+ *   - DELETE exists as a single owner-facing `API_CALL` default. It is REQUIRED,
+ *     not optional: the polymorphic owner relationship is a COMPOSITION, and a
+ *     composition child with no core DELETE op makes the parent's cascade throw
+ *     `ErrorType.CONFIGURATION` inside the delete transaction and roll the parent
+ *     delete back (the exact latent bug the platform hit on
+ *     `wildoApplication*` children — see `resources-relationships.custom.shared.definitions.ts`).
+ *     Its role floor is DISTINCT from read: a user deletes only their own task;
+ *     org/app tasks are shared scope data and require org/app admin.
+ *
+ * @see flows-actors-task.shared.schemas.ts — the polymorphic declaration + base schema
+ * @see flows-actors-execution.shared.resources-config.schemas.ts — the sibling plane
+ */
+import { z } from 'zod';
+import { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../resources/resources.shared.schemas.js';
+import { FlowsActors_Status } from './flows-actors.commons.shared.schemas.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { flowActorTasksPolymorphicDeclaration, FlowActorTaskUpdateInternalSchema, } from './flows-actors-task.shared.schemas.js';
+/**
+ * Per-variant owner-read role map. Identical shape to the execution family so a
+ * caller that can read its conversation can read the tasks that conversation
+ * produced — no new role, no authorizer change. The scope authorizer + contextual
+ * filter isolate rows to the owner; the role is the operation floor.
+ */
+const OWNER_READ_ROLES = {
+    // USER variant: the scope FK IS the principal, so `APP_USER` plus the contextual filter yields
+    // exactly "my own rows". Correct, and unchanged.
+    [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],
+    // ── MACHINE variants: ADMIN-only, and this is a CORRECTION (review finding F5-1) ──
+    //
+    // These previously granted `ORG_MEMBER` / `APP_USER`, inherited from the USER variant where that
+    // is right. On the machine variants it is not: the scope FK does not identify the principal.
+    // `applicationId` is a DEPLOYMENT SINGLETON, so every application-scope principal resolves to the
+    // same contextual filter, and `organizationId` is shared by every machine client of one tenant.
+    // The generic REST plane therefore let a PEER principal read another client's rows — the whole
+    // `messages[]` log on an execution, and `title` (the opening 120 chars of the originating prompt)
+    // on a task. That is exactly the cross-client disclosure the credential axis closed on the A2A
+    // plane; the axis was applied there and not here, and both planes read the same rows.
+    //
+    // The resolution follows the reasoning the DELETE map below ALREADY documents: an org/app record
+    // is SHARED SCOPE DATA, not owner data. Whoever administers the scope may inspect it; a peer
+    // principal inside that scope may not. Roles are the framework's single authorization axis, so
+    // this is expressed there rather than by inventing a second one.
+    //
+    // The A2A path is unaffected — it reads through `readAsSystem` and isolates by its own
+    // owner + agent + credential filter, which is stricter than either role set.
+    [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+    [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+};
+/**
+ * Per-variant DELETE role map. Delete authority is DELIBERATELY DISTINCT from read
+ * (destroying a work record ≠ reading it): a user deletes only their OWN task, but
+ * an org/app task is SHARED scope data, so removing it requires ORG_ADMIN /
+ * APP_ADMIN_SUPER_ADMIN — not any org member / app user who can merely read it.
+ */
+const OWNER_DELETE_ROLES = {
+    [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],
+    [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+    [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+};
+/**
+ * Polymorphic factory map for flows-actors tasks. Spread into
+ * `coreShared_ResourcesConfigurations_FactoryMap`:
+ *   ...flowActorTasksPolymorphicFactories
+ *
+ * Produces entries for:
+ *   - userFlowActorTasks
+ *   - organizationFlowActorTasks
+ *   - applicationFlowActorTasks
+ */
+export const flowActorTasksPolymorphicFactories = createPolymorphicResourceConfigurations(flowActorTasksPolymorphicDeclaration, {
+    isSystemResource: true,
+    // Opt the runtime (system actor) into scoped writes/reads on the owner's
+    // behalf. Absent this, every `*AsSystem` verb fails closed. No `delete` mode:
+    // the runtime never system-deletes a task — cancellation is an UPDATE, and
+    // removal is owner-driven or cascade-driven.
+    systemAccessPolicy: {
+        // Subject-export disclosure. The subject's own flow tasks. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.
+        exportSubject: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+    },
+    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.UPDATE,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        // === READ === backs A2A `tasks/get`. Owner reads their own task.
+        [CoreResourceOperation.READ]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: OWNER_READ_ROLES,
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        // === LIST === owner enumerates their tasks (e.g. every task of one contextId).
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: OWNER_READ_ROLES,
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    // DECLARED, because without it the promise is unservable (review finding M-2).
+                    //
+                    // The schema indexes `contextId` and both the schema and the spec say the index exists so
+                    // a client can "enumerate every task of one conversation". None of that was reachable: with
+                    // no `filterFields` the request schema falls back to the base filter (`searchRequest`,
+                    // `createdAt`, `updatedAt`), so the one query the index was built for could not be
+                    // expressed. An index serving no reachable query is cost without benefit, and a documented
+                    // capability nobody can call is worse than an absent one.
+                    //
+                    // `status` rides along for the obvious companion query ("my unfinished work"). The agent
+                    // and credential axes are deliberately NOT filterable — they are AUTHORIZATION inputs
+                    // derived from the caller's own principal, and accepting them from the query string would
+                    // invite the misreading that a caller may choose them.
+                    filterFields: {
+                        contextId: z.string(),
+                        status: z.enum(FlowsActors_Status),
+                    },
+                }],
+        },
+        // === CREATE === runtime materialises a task when the turn becomes non-inline: either the
+        // selected A2A dialect explicitly requests non-blocking work, or a blocking user-delegated
+        // turn reaches an approval-gated tool and must return `input-required` with an addressable
+        // task. No explicit request DTO: auto-derives per variant so the injected owner FK is
+        // required on the correct variant.
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the write that first
+                    // persists requester-supplied content is recorded, so access to it is reconstructable.
+                    //
+                    // LOW is the honest risk of a runtime bookkeeping write, but the audit floor would then
+                    // drop it — and this is the write that FIRST PERSISTS the prompt excerpt in `title`
+                    // (review finding M-6). Recording the creation of a content-bearing row is exactly what
+                    // "record access decisions" asks for, so the event is emitted below the floor rather than
+                    // by inflating a risk level that would then misreport the operation's danger.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                }],
+        },
+        // === UPDATE === advances the lifecycle: status transitions, artifacts,
+        // terminal outcome — and backs `tasks/cancel` (status → CANCELLED), which the
+        // A2A spec requires to return the updated state rather than remove the record.
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — a destructive protocol
+                    // verb leaves persistence-tier evidence, not only a transport-tier record.
+                    //
+                    // Same reasoning as CREATE: this is the write `tasks/cancel` lands on, so its absence
+                    // from the trail would leave a destructive protocol verb unrecorded at the persistence
+                    // tier even though the transport audits the call.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    requestDto: FlowActorTaskUpdateInternalSchema,
+                }],
+        },
+        // === DELETE === owner-facing removal, and the op the composition cascade
+        // selects on owner deletion (the repository tier picks the
+        // `isOperationDefault === true` DELETE). Declaring it is MANDATORY for a
+        // composition child — see the header note.
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: OWNER_DELETE_ROLES,
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=flows-actors-task.shared.resources-config.schemas.js.map

package/dist/esm/flows-actors/flows-actors-task.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows-actors-task.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/flows-actors-task.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,+FAA+F;IAC/F,iDAAiD;IACjD,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,qFAAqF;IACrF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,sFAAsF;IACtF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,iEAAiE;IACjE,EAAE;IACF,uFAAuF;IACvF,6EAA6E;IAC7E,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CACvF,oCAAoC,EACpC;IACE,gBAAgB,EAAE,IAAI;IAEtB,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,6CAA6C;IAC7C,kBAAkB,EAAE;QAClB,+RAA+R;QAC/R,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,kEAAkE;QAClE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,gFAAgF;QAChF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,+EAA+E;oBAC/E,EAAE;oBACF,0FAA0F;oBAC1F,4FAA4F;oBAC5F,uFAAuF;oBACvF,mFAAmF;oBACnF,2FAA2F;oBAC3F,0DAA0D;oBAC1D,EAAE;oBACF,yFAAyF;oBACzF,sFAAsF;oBACtF,0FAA0F;oBAC1F,uDAAuD;oBACvD,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;qBACnC;iBACF,CAAC;SACH;QAED,0FAA0F;QAC1F,2FAA2F;QAC3F,2FAA2F;QAC3F,sFAAsF;QACtF,mCAAmC;QACnC,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,sFAAsF;oBACtF,uFAAuF;oBACvF,EAAE;oBACF,wFAAwF;oBACxF,oFAAoF;oBACpF,wFAAwF;oBACxF,0FAA0F;oBAC1F,8EAA8E;oBAC9E,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C,CAAC;SACH;QAED,wEAAwE;QACxE,8EAA8E;QAC9E,+EAA+E;QAC/E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,wFAAwF;oBACxF,2EAA2E;oBAC3E,EAAE;oBACF,sFAAsF;oBACtF,uFAAuF;oBACvF,kDAAkD;oBAClD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,iCAAiC;iBAC9C,CAAC;SACH;QAED,0EAA0E;QAC1E,2DAA2D;QAC3D,yEAAyE;QACzE,2CAA2C;QAC3C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * Flows-Actors Task — Resource Configuration (POLYMORPHIC)\n * ========================================================\n *\n * The persisted WORK record behind the A2A `Task` object, stamped out as THREE\n * owner-scope variants from one polymorphic declaration (`userFlowActorTasks` /\n * `organizationFlowActorTasks` / `applicationFlowActorTasks`). Spread the produced\n * factories into the registry factory map:\n *   ...flowActorTasksPolymorphicFactories\n *\n * This is a DIFFERENT PLANE from `flowActorExecutions`: executions own\n * conversational session history, tasks own an addressable/pollable/cancelable\n * work lifecycle. See the base schema for why merging them is wrong.\n *\n * Scope + access model (mirrors the execution family — same owner scopes, same\n * RBAC shape — so a task is always readable by exactly the principal that drove\n * the turn):\n *   - Owner = the injected scope FK per variant. READ/LIST are `API_CALL`, roles\n *     resolved PER VARIANT by `polymorphicRole`: a user reads its own (APP_USER +\n *     USER_SELF filter), a machine reads its org/app variant with its granted\n *     org/app role. NOTE these roles govern the HTTP surface only — the A2A\n *     `tasks/get` path does NOT use them (it reads via the ACL-bypassing `readAsSystem`\n *     and isolates by owner filter instead; see `A2ATaskBackendService`). Tightening\n *     `polymorphicRole` therefore does not tighten `tasks/get`.\n *   - CREATE/UPDATE are `INTERNAL_CALL` super-admin: only the runtime materialises\n *     a task and advances its lifecycle, via `*AsSystem` (governed by\n *     `systemAccessPolicy`, not the op RBAC). INTERNAL_CALL (not REPOSITORY_ONLY)\n *     is mandatory — `*AsSystem` dispatches through the service tier and resolves\n *     the op via `getServiceOperationPathDefault`, which only matches\n *     INTERNAL_CALL / API_CALL variants.\n *   - `tasks/cancel` is an UPDATE (status → `CANCELLED`), NOT a delete: the A2A\n *     spec requires cancel to return the task's UPDATED STATE rather than remove it, so the record must\n *     spec-cite: A2A v0.2.5 §7.4 (tasks/cancel returns a Task)\n *     survive cancellation.\n *   - DELETE exists as a single owner-facing `API_CALL` default. It is REQUIRED,\n *     not optional: the polymorphic owner relationship is a COMPOSITION, and a\n *     composition child with no core DELETE op makes the parent's cascade throw\n *     `ErrorType.CONFIGURATION` inside the delete transaction and roll the parent\n *     delete back (the exact latent bug the platform hit on\n *     `wildoApplication*` children — see `resources-relationships.custom.shared.definitions.ts`).\n *     Its role floor is DISTINCT from read: a user deletes only their own task;\n *     org/app tasks are shared scope data and require org/app admin.\n *\n * @see flows-actors-task.shared.schemas.ts — the polymorphic declaration + base schema\n * @see flows-actors-execution.shared.resources-config.schemas.ts — the sibling plane\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { FlowsActors_Status } from './flows-actors.commons.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport {\n  flowActorTasksPolymorphicDeclaration,\n  FlowActorTaskUpdateInternalSchema,\n} from './flows-actors-task.shared.schemas';\n\n/**\n * Per-variant owner-read role map. Identical shape to the execution family so a\n * caller that can read its conversation can read the tasks that conversation\n * produced — no new role, no authorizer change. The scope authorizer + contextual\n * filter isolate rows to the owner; the role is the operation floor.\n */\nconst OWNER_READ_ROLES = {\n  // USER variant: the scope FK IS the principal, so `APP_USER` plus the contextual filter yields\n  // exactly \"my own rows\". Correct, and unchanged.\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  // ── MACHINE variants: ADMIN-only, and this is a CORRECTION (review finding F5-1) ──\n  //\n  // These previously granted `ORG_MEMBER` / `APP_USER`, inherited from the USER variant where that\n  // is right. On the machine variants it is not: the scope FK does not identify the principal.\n  // `applicationId` is a DEPLOYMENT SINGLETON, so every application-scope principal resolves to the\n  // same contextual filter, and `organizationId` is shared by every machine client of one tenant.\n  // The generic REST plane therefore let a PEER principal read another client's rows — the whole\n  // `messages[]` log on an execution, and `title` (the opening 120 chars of the originating prompt)\n  // on a task. That is exactly the cross-client disclosure the credential axis closed on the A2A\n  // plane; the axis was applied there and not here, and both planes read the same rows.\n  //\n  // The resolution follows the reasoning the DELETE map below ALREADY documents: an org/app record\n  // is SHARED SCOPE DATA, not owner data. Whoever administers the scope may inspect it; a peer\n  // principal inside that scope may not. Roles are the framework's single authorization axis, so\n  // this is expressed there rather than by inventing a second one.\n  //\n  // The A2A path is unaffected — it reads through `readAsSystem` and isolates by its own\n  // owner + agent + credential filter, which is stricter than either role set.\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n/**\n * Per-variant DELETE role map. Delete authority is DELIBERATELY DISTINCT from read\n * (destroying a work record ≠ reading it): a user deletes only their OWN task, but\n * an org/app task is SHARED scope data, so removing it requires ORG_ADMIN /\n * APP_ADMIN_SUPER_ADMIN — not any org member / app user who can merely read it.\n */\nconst OWNER_DELETE_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n/**\n * Polymorphic factory map for flows-actors tasks. Spread into\n * `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...flowActorTasksPolymorphicFactories\n *\n * Produces entries for:\n *   - userFlowActorTasks\n *   - organizationFlowActorTasks\n *   - applicationFlowActorTasks\n */\nexport const flowActorTasksPolymorphicFactories = createPolymorphicResourceConfigurations(\n  flowActorTasksPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    // Opt the runtime (system actor) into scoped writes/reads on the owner's\n    // behalf. Absent this, every `*AsSystem` verb fails closed. No `delete` mode:\n    // the runtime never system-deletes a task — cancellation is an UPDATE, and\n    // removal is owner-driven or cascade-driven.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own flow tasks. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n      // === READ === backs A2A `tasks/get`. Owner reads their own task.\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // === LIST === owner enumerates their tasks (e.g. every task of one contextId).\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // DECLARED, because without it the promise is unservable (review finding M-2).\n          //\n          // The schema indexes `contextId` and both the schema and the spec say the index exists so\n          // a client can \"enumerate every task of one conversation\". None of that was reachable: with\n          // no `filterFields` the request schema falls back to the base filter (`searchRequest`,\n          // `createdAt`, `updatedAt`), so the one query the index was built for could not be\n          // expressed. An index serving no reachable query is cost without benefit, and a documented\n          // capability nobody can call is worse than an absent one.\n          //\n          // `status` rides along for the obvious companion query (\"my unfinished work\"). The agent\n          // and credential axes are deliberately NOT filterable — they are AUTHORIZATION inputs\n          // derived from the caller's own principal, and accepting them from the query string would\n          // invite the misreading that a caller may choose them.\n          filterFields: {\n            contextId: z.string(),\n            status: z.enum(FlowsActors_Status),\n          },\n        }],\n      },\n\n      // === CREATE === runtime materialises a task when the turn becomes non-inline: either the\n      // selected A2A dialect explicitly requests non-blocking work, or a blocking user-delegated\n      // turn reaches an approval-gated tool and must return `input-required` with an addressable\n      // task. No explicit request DTO: auto-derives per variant so the injected owner FK is\n      // required on the correct variant.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the write that first\n          // persists requester-supplied content is recorded, so access to it is reconstructable.\n          //\n          // LOW is the honest risk of a runtime bookkeeping write, but the audit floor would then\n          // drop it — and this is the write that FIRST PERSISTS the prompt excerpt in `title`\n          // (review finding M-6). Recording the creation of a content-bearing row is exactly what\n          // \"record access decisions\" asks for, so the event is emitted below the floor rather than\n          // by inflating a risk level that would then misreport the operation's danger.\n          auditableEvent: { auditBelowRiskFloor: true },\n        }],\n      },\n\n      // === UPDATE === advances the lifecycle: status transitions, artifacts,\n      // terminal outcome — and backs `tasks/cancel` (status → CANCELLED), which the\n      // A2A spec requires to return the updated state rather than remove the record.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — a destructive protocol\n          // verb leaves persistence-tier evidence, not only a transport-tier record.\n          //\n          // Same reasoning as CREATE: this is the write `tasks/cancel` lands on, so its absence\n          // from the trail would leave a destructive protocol verb unrecorded at the persistence\n          // tier even though the transport audits the call.\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: FlowActorTaskUpdateInternalSchema,\n        }],\n      },\n\n      // === DELETE === owner-facing removal, and the op the composition cascade\n      // selects on owner deletion (the repository tier picks the\n      // `isOperationDefault === true` DELETE). Declaring it is MANDATORY for a\n      // composition child — see the header note.\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            polymorphicRole: OWNER_DELETE_ROLES,\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n    },\n  },\n);\n"]}