@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/files/files.shared.schemas.d.ts

@@ -78,10 +78,26 @@ export declare function parseFileServeVariant(raw: unknown): FileServeVariant;
 /**
  * Statuses in which a file's bytes are safe to serve for download.
  *
- * Wave 1 rule: AV scanning is not enforced yet, so UPLOADED and LINKED
- * remain downloadable (optimistic). When AV is active, only CLEAN / LINKED
- * (post-scan) files should be downloadable; SCANNING / INFECTED /
- * QUARANTINED must be blocked.
+ * AV scanning IS wired: `FileScanningBackendService` is bound in the container and the resource
+ * upload handler calls `shouldScan` then `initiateScan`, so a scanned file moves through SCANNING
+ * to CLEAN / INFECTED / QUARANTINED. `SCANNING`, `INFECTED` and `QUARANTINED` are absent from this
+ * set and therefore blocked, which is the post-scan half of the original Wave 1 note.
+ *
+ * `UPLOADED` IS admitted, and that is correct rather than a leftover — but only because of where
+ * the scan gate now sits. Scanning is opt-in per field (`shouldScan` reads the field's
+ * `fileMetadata`), so an unscanned file legitimately terminates at UPLOADED and removing it from
+ * this set would make every such field undownloadable.
+ *
+ * The window that used to sit behind that reasoning is CLOSED (#433, 2026-09-08). A file whose
+ * field requires a scan never sits at UPLOADED at all: `resource-file-upload-handler` now AWAITS
+ * `initiateScan` — which awaits the UPLOADED -> SCANNING transition and only then fires the scan
+ * pipeline — BEFORE the upload response is sent. Previously it was fired afterwards without being
+ * awaited, so the bytes were servable for the gap between the upload committing and the transition
+ * landing.
+ *
+ * So the invariant this set relies on is external to it: **a required scan reaches SCANNING before
+ * anyone learns the upload succeeded.** Do not restore a fire-and-forget scan initiation, and do
+ * not add UPLOADED-adjacent statuses here without asking which side of that gate they fall on.
  */
 export declare const FILE_DOWNLOADABLE_STATUSES: ReadonlySet<FileStatus>;
 /**
@@ -121,6 +137,38 @@ export declare const FILE_BLOCKED_STATUSES: ReadonlySet<FileStatus>;
  * transition to. Any transition not listed here is invalid.
  */
 export declare const FILE_STATUS_TRANSITIONS: Readonly<Record<FileStatus, readonly FileStatus[]>>;
+/**
+ * Statuses from which a file may be LINKED to a resource field — the set the link-time checks
+ * (`FileOperationHandlerBackendService.validateFileFieldsForCreate/Update`,
+ * `FilesBackendService.linkFileToResource`) consult.
+ *
+ * ## Why this set exists (issue #320)
+ *
+ * Those checks used to compare against the literal `FileStatus.UPLOADED`, while
+ * {@link FILE_STATUS_TRANSITIONS} — the authority on what a status MEANS — already allowed
+ * `CLEAN → LINKED`. So a file the scanner had just certified safe was refused at the one moment it was
+ * needed, with an error naming `UPLOADED` as the expected state, and whether a scanned file could be
+ * attached at all depended on how fast the caller was relative to the scanner. Two `$in` queries in
+ * `FilesBackendService` had meanwhile grown their own `[UPLOADED, CLEAN]` pairs — three copies of one
+ * answer, one of them wrong. This is the single copy.
+ *
+ * ## Derived-CHECKED against the map, not computed from it
+ *
+ * Every member here has `LINKED` among its outgoing transitions (pinned by
+ * `files.shared.status-sets.test.ts`), so this set can never admit a transition the map forbids.
+ * It is nonetheless written out rather than computed, because the map is a superset of what linking
+ * should admit today:
+ *
+ * - `ORPHANED → LINKED` is legal in the map (a re-link after the parent was deleted with the file
+ *   kept) and is DELIBERATELY NOT admitted here. Re-linking an orphan is a distinct capability with
+ *   its own questions — whose scope does the file re-enter, what happens to its old key — and
+ *   admitting it as a side effect of fixing the `CLEAN` refusal would decide those questions by
+ *   accident. The pin asserts this exclusion by name so widening it is a choice, not drift.
+ * - `SCANNING` is absent because the map forbids `SCANNING → LINKED`: a file whose scan is in
+ *   flight is not yet known to be safe. The link path names that case with
+ *   `FILE_SCAN_IN_PROGRESS` so the caller learns to retry, rather than the generic refusal.
+ */
+export declare const FILE_LINKABLE_STATUSES: ReadonlySet<FileStatus>;
 export declare const FILE_PRIMARY_SCOPES: readonly [ResourcePrimaryScope.APPLICATION, ResourcePrimaryScope.ORGANIZATIONS, ResourcePrimaryScope.USER_SELF];
 export type FilePrimaryScope = (typeof FILE_PRIMARY_SCOPES)[number];
 export declare function validateFileScopeIdentifiers(scope: {

package/dist/esm/files/files.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/files/files.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAG7E,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IAEjB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,oBAAY,gBAAgB;IAC1B,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAIpE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,UAAU,CAK7D,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CAAC,UAAU,CAElE,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,aAAa,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,UAAU,CAOxD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC,CAWvF,CAAC;AAEF,eAAO,MAAM,mBAAmB,iHAItB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAyBpE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,YAAY,EAAE,gBAAgB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAqBV;AAuGD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,GAAG,qBAAqB,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"files.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/files/files.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAG7E,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IAEjB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,oBAAY,gBAAgB;IAC1B,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAIpE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,UAAU,CAK7D,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CAAC,UAAU,CAElE,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,aAAa,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,UAAU,CAOxD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC,CAWvF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,UAAU,CAGzD,CAAC;AAGH,eAAO,MAAM,mBAAmB,iHAItB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAyBpE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,YAAY,EAAE,gBAAgB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAqBV;AAuGD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,GAAG,qBAAqB,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/esm/files/files.shared.schemas.js

@@ -83,10 +83,26 @@ export function parseFileServeVariant(raw) {
 /**
  * Statuses in which a file's bytes are safe to serve for download.
  *
- * Wave 1 rule: AV scanning is not enforced yet, so UPLOADED and LINKED
- * remain downloadable (optimistic). When AV is active, only CLEAN / LINKED
- * (post-scan) files should be downloadable; SCANNING / INFECTED /
- * QUARANTINED must be blocked.
+ * AV scanning IS wired: `FileScanningBackendService` is bound in the container and the resource
+ * upload handler calls `shouldScan` then `initiateScan`, so a scanned file moves through SCANNING
+ * to CLEAN / INFECTED / QUARANTINED. `SCANNING`, `INFECTED` and `QUARANTINED` are absent from this
+ * set and therefore blocked, which is the post-scan half of the original Wave 1 note.
+ *
+ * `UPLOADED` IS admitted, and that is correct rather than a leftover — but only because of where
+ * the scan gate now sits. Scanning is opt-in per field (`shouldScan` reads the field's
+ * `fileMetadata`), so an unscanned file legitimately terminates at UPLOADED and removing it from
+ * this set would make every such field undownloadable.
+ *
+ * The window that used to sit behind that reasoning is CLOSED (#433, 2026-09-08). A file whose
+ * field requires a scan never sits at UPLOADED at all: `resource-file-upload-handler` now AWAITS
+ * `initiateScan` — which awaits the UPLOADED -> SCANNING transition and only then fires the scan
+ * pipeline — BEFORE the upload response is sent. Previously it was fired afterwards without being
+ * awaited, so the bytes were servable for the gap between the upload committing and the transition
+ * landing.
+ *
+ * So the invariant this set relies on is external to it: **a required scan reaches SCANNING before
+ * anyone learns the upload succeeded.** Do not restore a fire-and-forget scan initiation, and do
+ * not add UPLOADED-adjacent statuses here without asking which side of that gate they fall on.
  */
 export const FILE_DOWNLOADABLE_STATUSES = new Set([
     FileStatus.UPLOADED,
@@ -151,6 +167,41 @@ export const FILE_STATUS_TRANSITIONS = {
     [FileStatus.DELETED]: [],
     [FileStatus.FAILED]: [FileStatus.DELETED],
 };
+/**
+ * Statuses from which a file may be LINKED to a resource field — the set the link-time checks
+ * (`FileOperationHandlerBackendService.validateFileFieldsForCreate/Update`,
+ * `FilesBackendService.linkFileToResource`) consult.
+ *
+ * ## Why this set exists (issue #320)
+ *
+ * Those checks used to compare against the literal `FileStatus.UPLOADED`, while
+ * {@link FILE_STATUS_TRANSITIONS} — the authority on what a status MEANS — already allowed
+ * `CLEAN → LINKED`. So a file the scanner had just certified safe was refused at the one moment it was
+ * needed, with an error naming `UPLOADED` as the expected state, and whether a scanned file could be
+ * attached at all depended on how fast the caller was relative to the scanner. Two `$in` queries in
+ * `FilesBackendService` had meanwhile grown their own `[UPLOADED, CLEAN]` pairs — three copies of one
+ * answer, one of them wrong. This is the single copy.
+ *
+ * ## Derived-CHECKED against the map, not computed from it
+ *
+ * Every member here has `LINKED` among its outgoing transitions (pinned by
+ * `files.shared.status-sets.test.ts`), so this set can never admit a transition the map forbids.
+ * It is nonetheless written out rather than computed, because the map is a superset of what linking
+ * should admit today:
+ *
+ * - `ORPHANED → LINKED` is legal in the map (a re-link after the parent was deleted with the file
+ *   kept) and is DELIBERATELY NOT admitted here. Re-linking an orphan is a distinct capability with
+ *   its own questions — whose scope does the file re-enter, what happens to its old key — and
+ *   admitting it as a side effect of fixing the `CLEAN` refusal would decide those questions by
+ *   accident. The pin asserts this exclusion by name so widening it is a choice, not drift.
+ * - `SCANNING` is absent because the map forbids `SCANNING → LINKED`: a file whose scan is in
+ *   flight is not yet known to be safe. The link path names that case with
+ *   `FILE_SCAN_IN_PROGRESS` so the caller learns to retry, rather than the generic refusal.
+ */
+export const FILE_LINKABLE_STATUSES = new Set([
+    FileStatus.UPLOADED,
+    FileStatus.CLEAN,
+]);
 export const FILE_PRIMARY_SCOPES = [
     ResourcePrimaryScope.APPLICATION,
     ResourcePrimaryScope.ORGANIZATIONS,

package/dist/esm/files/files.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.shared.schemas.js","sourceRoot":"","sources":["../../../../src/files/files.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAA8B,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7E,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGvF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,UAYX;AAZD,WAAY,UAAU;IACpB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;IACrB,+BAAiB,CAAA;IACjB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;IACrB,+BAAiB,CAAA;IAEjB,mCAAqB,CAAA;IACrB,6BAAe,CAAA;IACf,mCAAqB,CAAA;IACrB,yCAA2B,CAAA;AAC7B,CAAC,EAZW,UAAU,KAAV,UAAU,QAYrB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,yCAAqB,CAAA;IACrB,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,OAAO,GAAG,KAAK,gBAAgB,CAAC,SAAS;QACvC,CAAC,CAAC,gBAAgB,CAAC,SAAS;QAC5B,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA4B,IAAI,GAAG,CAAC;IACzE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,KAAK;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA4B,IAAI,GAAG,CAAC;IAC9E,UAAU,CAAC,OAAO;CACnB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA4B,IAAI,GAAG,CAAC;IACpE,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,WAAW;CACvB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwD;IAC1F,CAAC,UAAU,CAAC,OAAO,CAAC,EAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;IACnE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;IAC/H,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;IACrF,CAAC,UAAU,CAAC,KAAK,CAAC,EAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACvF,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC;IACvE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAG,CAAC,UAAU,CAAC,OAAO,CAAC;IAC/C,CAAC,UAAU,CAAC,MAAM,CAAC,EAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACpE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;IAClE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAO,EAAE;IAC7B,CAAC,UAAU,CAAC,MAAM,CAAC,EAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;CAChD,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,oBAAoB,CAAC,WAAW;IAChC,oBAAoB,CAAC,aAAa;IAClC,oBAAoB,CAAC,SAAS;CACtB,CAAC;AAIX,SAAS,2BAA2B,CAAC,KAAyB;IAC5D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAGC,EACD,GAAoB;IAEpB,MAAM,aAAa,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,uBAAuB,GAAG,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC;IAExE,IAAI,aAAa,KAAK,uBAAuB,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAC/D,OAAO,EAAE,gFAAgF;SAC1F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5D,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC;QAC3B,KAAK,oBAAoB,CAAC,WAAW;YACnC,OAAO,gBAAgB,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC;QAC9D,KAAK,oBAAoB,CAAC,aAAa;YACrC,kGAAkG;YAClG,OAAO,gBAAgB,IAAI,iBAAiB,IAAI,CAAC,SAAS,CAAC;QAC7D,KAAK,oBAAoB,CAAC,SAAS;YACjC,8EAA8E;YAC9E,4EAA4E;YAC5E,+EAA+E;YAC/E,gFAAgF;YAChF,yCAAyC;YACzC,OAAO,gBAAgB,IAAI,SAAS,IAAI,CAAC,iBAAiB,CAAC;QAC7D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEzD,sCAAsC;IACtC,+FAA+F;IAC/F,8FAA8F;IAC9F,oGAAoG;IACpG,sDAAsD;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAC5G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IACtG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE7C,gCAAgC;IAChC,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACtD,uFAAuF;IACvF,wFAAwF;IACxF,wFAAwF;IACxF,0FAA0F;IAC1F,gBAAgB;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACtD,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IAEzD,2CAA2C;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAErF,iDAAiD;IACjD,8DAA8D;IAC9D,kGAAkG;IAClG,sGAAsG;IACtG,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC1D,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IAClE,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,yCAAyC;IACzC,4EAA4E;IAC5E,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACvD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,sCAAsC;IACtC,mEAAmE;IACnE,6CAA6C;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAElE,0CAA0C;IAC1C,oFAAoF;IACpF,4FAA4F;IAC5F,2FAA2F;IAE3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAEvC,mFAAmF;IACnF,oFAAoF;IACpF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEnD,uFAAuF;IACvF,sFAAsF;IACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE3C,wCAAwC;IACxC,oEAAoE;IACpE,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC7D,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE7E,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;CACjE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACjE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,+FAA+F;QAC/F,kFAAkF;QAClF,IAAI,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,cAAc,CAAC;gBACtB,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,4BAA4B,CAAC;QAChC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,EAAE,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;AAEH,CAAC,CAAC,CAAC","sourcesContent":["/**\n * Files Shared Schemas\n *\n * Reusable schemas for file uploads and file handling.\n *\n * ## Scope Model\n *\n * Files use a **segregated scope model** where scope identifiers are separate fields\n * (not hierarchical). A file belongs to exactly one primary scope:\n * - APPLICATION: App-level shared files (e.g., branding assets)\n * - ORGANIZATIONS: Org-scoped files (e.g., org documents)\n * - USER_SELF: User-private files owned by a single user (NO org — USER_SELF and\n *   ORGANIZATIONS are independent primary-scope axes; `applicationId` is the bucket anchor)\n *\n * `ANONYMOUS` is intentionally excluded from the file contract for now. The\n * file layer does not yet define anonymous upload, storage, and access semantics\n * end to end, so file resources fail closed instead of pretending support.\n *\n * Scope is **derived from the parent resource's resourcePrimaryScope** when linking.\n * Access rights are **inherited from the z_file() field** on the parent resource.\n *\n * Note: FileMetadata is defined in @wildo-ai/zod-decorators\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { FileDisplayNature, FileStorageAccepted, FileUploaderEntityType, type FileUploaderOwnership } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\n\n// Re-export FileMetadata from zod-decorators for convenience\nexport type { FileMetadata } from '@wildo-ai/zod-decorators';\nexport { FileUploaderEntityType, FileStorageAccepted } from '@wildo-ai/zod-decorators';\nexport type { FileUploaderOwnership } from '@wildo-ai/zod-decorators';\n\n/**\n * File status lifecycle enum\n *\n * NOTE — no extraction/indexing members. `EXTRACTING` / `EXTRACTED` / `INDEXED` were removed\n * 2026-08-26 with the resource-native RAG reshape (plan `resource-rag-capability`, Phase 1):\n * text extraction and embedding state are per-FIELD, per-CHUNK facts, and the RAG chunk rows\n * (Phase 2's derived-data tier, keyed `(resourceType, resourceId, fieldName, chunkIndex)` with a\n * NULLABLE `vector` as the \"needs embedding\" ledger) carry them. A single file-level status could\n * never say WHICH field's corpus was current — it was the wrong shape, not merely unused — and\n * `INDEXED` had already shipped one false claim (written to mean \"text was copied\", read as\n * \"searchable\": https://github.com/wildo-ai/wildo-ai/issues/46). The file lifecycle now ends at\n * upload/scan/link/erasure concerns, which really are per-file.\n */\nexport enum FileStatus {\n  PENDING = 'pending',\n  UPLOADED = 'uploaded',\n  LINKED = 'linked',\n  DELETED = 'deleted',\n  ORPHANED = 'orphaned',\n  FAILED = 'failed',\n\n  SCANNING = 'scanning',\n  CLEAN = 'clean',\n  INFECTED = 'infected',\n  QUARANTINED = 'quarantined',\n}\n\n/**\n * Rendition of a file's bytes requested from the serve route via `?variant=`.\n *\n * - `ORIGINAL` — the stored bytes, unchanged (the default when the param is absent).\n * - `THUMBNAIL` — a small, downscaled `webp` derived on the fly for preview surfaces\n *   (nav avatar, list/card image) so a preview never pulls a multi-MB original. Only\n *   raster images are eligible; for any other file the serve route transparently\n *   falls back to the original bytes.\n *\n * This is the WIRE CONTRACT for the serve route's `variant` query parameter — shared\n * by the frontend (which builds `?variant=thumbnail` preview URLs) and the backend\n * serve route (which parses it). Keep the string values stable across releases.\n */\nexport enum FileServeVariant {\n  ORIGINAL = 'original',\n  THUMBNAIL = 'thumbnail',\n}\n\n/**\n * Parse an untrusted `?variant=` query value into a {@link FileServeVariant}.\n * Absent or unrecognized values fall back to `ORIGINAL` (fail-safe: an unknown\n * variant serves the untransformed bytes rather than erroring).\n */\nexport function parseFileServeVariant(raw: unknown): FileServeVariant {\n  return raw === FileServeVariant.THUMBNAIL\n    ? FileServeVariant.THUMBNAIL\n    : FileServeVariant.ORIGINAL;\n}\n\n/**\n * Statuses in which a file's bytes are safe to serve for download.\n *\n * Wave 1 rule: AV scanning is not enforced yet, so UPLOADED and LINKED\n * remain downloadable (optimistic). When AV is active, only CLEAN / LINKED\n * (post-scan) files should be downloadable; SCANNING / INFECTED /\n * QUARANTINED must be blocked.\n */\nexport const FILE_DOWNLOADABLE_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.UPLOADED,\n  FileStatus.LINKED,\n  FileStatus.ORPHANED,\n  FileStatus.CLEAN,\n]);\n\n/**\n * Statuses in which a file's own METADATA must no longer be disclosed on the GLOBAL\n * `GET /files/:fileId/metadata` route (gate **G-FILE**).\n *\n * Blocking the BYTES is not enough. A privacy erasure marks the file `DELETED`, but physical cleanup\n * is a batch that runs much later — so between the two, `originalFilename` (`passport-jane-doe.pdf`)\n * and `uploadedBy` stayed readable by any member of the file's scope. \"Erased\" that leaves the\n * filename readable for weeks is not erased.\n *\n * DELIBERATELY NARROWER than {@link FILE_BLOCKED_STATUSES}: `PENDING`, `SCANNING`, `FAILED` and\n * `INFECTED` files are not servable either, but their metadata IS the diagnostic surface an uploader\n * legitimately polls (\"upload failed\", \"scan in progress\"). Withholding those would break upload UX\n * while protecting nothing — none of them is an erasure outcome. `DELETED` is the terminal state (it\n * has no outgoing transition in {@link FILE_STATUS_TRANSITIONS}) and the one an erasure produces.\n */\nexport const FILE_METADATA_WITHHELD_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.DELETED,\n]);\n\n/**\n * Value written over a file's `filename` / `originalFilename` when the file is erased for privacy.\n *\n * Both fields are REQUIRED (`z.string().min(1)`), so an erasure cannot null them without a schema\n * reshape; overwriting with one shared, non-identifying constant erases the personal data while\n * keeping the row valid, greppable and obviously-erased in logs and admin surfaces. Deliberately a\n * fixed constant rather than a per-file token: two erased files must not be distinguishable by name.\n */\nexport const ERASED_FILE_NAME_PLACEHOLDER = '[erased]';\n\n/**\n * Statuses that represent terminal or non-servable states.\n * Files in these states must not be served for download.\n */\nexport const FILE_BLOCKED_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.PENDING,\n  FileStatus.DELETED,\n  FileStatus.FAILED,\n  FileStatus.SCANNING,\n  FileStatus.INFECTED,\n  FileStatus.QUARANTINED,\n]);\n\n/**\n * Valid lifecycle transitions.\n *\n * Each key is a source status; the value is the set of statuses it can\n * transition to. Any transition not listed here is invalid.\n */\nexport const FILE_STATUS_TRANSITIONS: Readonly<Record<FileStatus, readonly FileStatus[]>> = {\n  [FileStatus.PENDING]:      [FileStatus.UPLOADED, FileStatus.FAILED],\n  [FileStatus.UPLOADED]:     [FileStatus.LINKED, FileStatus.SCANNING, FileStatus.ORPHANED, FileStatus.DELETED, FileStatus.FAILED],\n  [FileStatus.SCANNING]:     [FileStatus.CLEAN, FileStatus.INFECTED, FileStatus.FAILED],\n  [FileStatus.CLEAN]:        [FileStatus.LINKED, FileStatus.ORPHANED, FileStatus.DELETED],\n  [FileStatus.INFECTED]:     [FileStatus.QUARANTINED, FileStatus.DELETED],\n  [FileStatus.QUARANTINED]:  [FileStatus.DELETED],\n  [FileStatus.LINKED]:       [FileStatus.ORPHANED, FileStatus.DELETED],\n  [FileStatus.ORPHANED]:     [FileStatus.LINKED, FileStatus.DELETED],\n  [FileStatus.DELETED]:      [],\n  [FileStatus.FAILED]:       [FileStatus.DELETED],\n};\n\nexport const FILE_PRIMARY_SCOPES = [\n  ResourcePrimaryScope.APPLICATION,\n  ResourcePrimaryScope.ORGANIZATIONS,\n  ResourcePrimaryScope.USER_SELF,\n] as const;\n\nexport type FilePrimaryScope = (typeof FILE_PRIMARY_SCOPES)[number];\n\nfunction hasFileScopeIdentifierValue(value: string | undefined): boolean {\n  return typeof value === 'string' && value.trim() !== '';\n}\n\nfunction validateUploaderPair(\n  file: {\n    uploadedBy?: string;\n    uploadedByEntityType?: FileUploaderEntityType;\n  },\n  ctx: z.RefinementCtx,\n): void {\n  const hasUploadedBy = hasFileScopeIdentifierValue(file.uploadedBy);\n  const hasUploadedByEntityType = file.uploadedByEntityType !== undefined;\n\n  if (hasUploadedBy !== hasUploadedByEntityType) {\n    ctx.addIssue({\n      code: 'custom',\n      path: hasUploadedBy ? ['uploadedByEntityType'] : ['uploadedBy'],\n      message: 'uploadedBy and uploadedByEntityType must either both be set or both be omitted',\n    });\n  }\n}\n\nexport function validateFileScopeIdentifiers(scope: {\n  primaryScope: FilePrimaryScope;\n  applicationId: string;\n  organizationId?: string;\n  userId?: string;\n}): boolean {\n  const hasApplicationId = hasFileScopeIdentifierValue(scope.applicationId);\n  const hasOrganizationId = hasFileScopeIdentifierValue(scope.organizationId);\n  const hasUserId = hasFileScopeIdentifierValue(scope.userId);\n\n  switch (scope.primaryScope) {\n    case ResourcePrimaryScope.APPLICATION:\n      return hasApplicationId && !hasOrganizationId && !hasUserId;\n    case ResourcePrimaryScope.ORGANIZATIONS:\n      // applicationId is always required (tenant isolation); organizationId is the scope discriminator.\n      return hasApplicationId && hasOrganizationId && !hasUserId;\n    case ResourcePrimaryScope.USER_SELF:\n      // Primary scopes are a SEPARATION OF CONCERN: USER_SELF and ORGANIZATIONS are\n      // independent axes. A user's self-owned file is user-owned, NOT org-owned —\n      // `userId` is the scope discriminator and `applicationId` is the tenant/bucket\n      // anchor. `organizationId` MUST be absent (a present org would conflate the two\n      // scopes). Fail closed on any org value.\n      return hasApplicationId && hasUserId && !hasOrganizationId;\n    default:\n      return false;\n  }\n}\n\n/**\n * File resource schema\n *\n * Stores file metadata and links files to resources.\n * Files are stored via app-managed storage providers (MinIO/S3, local directory, etc.),\n * this schema tracks metadata only.\n *\n * ## Storage Identity Convention\n * `storageProvider` + `storageRef` are the persisted routing truth used to\n * reach the active storage backend. `storageKey` remains framework metadata\n * that captures the file's derived scope path for bookkeeping, diagnostics,\n * and future storage contract evolution.\n *\n * `storageKey` includes scope path derived from primaryScope:\n * - APPLICATION: `app/{applicationId}/{fileId}`\n * - ORGANIZATIONS: `org/{organizationId}/{fileId}`\n * - USER_SELF: `user/{userId}/{fileId}` (owner is the user; no org segment)\n */\nconst FileSchemaBase = z.object({\n  fileId: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ========== File Metadata ==========\n  // USER_CONTENT on both names. A filename is chosen by the person and routinely IS the personal\n  // datum — \"scan-2026-medical.pdf\" discloses a special category before the file is opened. The\n  // file's BYTES are not a field here (this resource is metadata over object storage), so this is the\n  // only place the content axis can be declared at all.\n  filename: z.string().min(1).isDBIndexed().isSummaryField().dataCategories(PersonalDataCategory.USER_CONTENT),\n  originalFilename: z.string().min(1).isSummaryField().dataCategories(PersonalDataCategory.USER_CONTENT),\n  mimeType: z.string().min(1).isDBIndexed().isSummaryField(),\n  size: z.number().min(0).isSummaryField(),\n  extension: z.string().optional(),\n  checksum: z.string().optional().isDBIndexed(),\n\n  // ========== Storage ==========\n  // `storageProvider` + `storageRef` are the persisted backend-routing truth.\n  storageProvider: z.enum(FileStorageAccepted).optional().isDBIndexed(),\n  storageRef: z.string().min(1).optional().isDBIndexed(),\n  // `storageKey` is still scoped metadata, not the storage backend handle. It embeds the\n  // file identity (`_id`, surfaced as the `fileId` virtual), so it is derived + persisted\n  // AFTER the row is created (insert-first) — hence optional at create time. `createFile`\n  // sets it once `_id` exists, and `linkFileToResource` re-derives it when the file's scope\n  // is finalized.\n  storageKey: z.string().min(1).optional().isDBIndexed(),\n  url: z.url().optional(), // Cached URL (may be presigned)\n\n  // ========== Status & Lifecycle ==========\n  status: z.enum(FileStatus).default(FileStatus.PENDING).isDBIndexed().isSummaryField(),\n\n  // ========== Nature-specific Metadata ==========\n  // Inferred from MIME type or set by analysis services (F4-03)\n  // Resolved display nature (IMAGE/VIDEO/AUDIO/DOCUMENT/GENERIC) — NOT the schema-level FileNature.\n  // Set by resolveFileDisplayNature() during upload or inferred from MIME type in toMetadataResponse().\n  // Schema declares FileNature (e.g., PDF, OFFICE), but the DB stores the resolved FileDisplayNature.\n  nature: z.enum(FileDisplayNature).optional().isDBIndexed(),\n  // Image-specific\n  width: z.number().positive().optional(),\n  height: z.number().positive().optional(),\n  thumbnailUrl: z.url().optional(),\n  // Video/Audio-specific (populated by IFileVideoAnalyzer / IFileAudioAnalyzer)\n  duration: z.number().positive().optional(), // Duration in seconds\n  // Document-specific (populated by IFileDocumentAnalyzer)\n  pageCount: z.number().positive().optional(),\n\n  // ========== Resource Linking ==========\n  // When linked, scope is derived from parent resource's resourcePrimaryScope\n  linkedResourceType: z.string().optional().isDBIndexed(),\n  linkedResourceId: z.string().optional().isDBIndexed(),\n  linkedFieldName: z.string().optional(),\n\n  // ========== Primary Scope ==========\n  // Derived from parent resource's resourcePrimaryScope when linking\n  // Determines access control and storage path\n  primaryScope: z.enum(FILE_PRIMARY_SCOPES).optional().isDBIndexed(),\n\n  // ========== Scope Identifiers ==========\n  // applicationId is ALWAYS set (from execution context at creation time) — it is the\n  // top-level tenant isolation field present on every file record regardless of primaryScope.\n  // organizationId and userId are populated only when the file's primaryScope requires them.\n\n  applicationId: z.string().isDBIndexed(),\n\n  // ORGANIZATIONS scope: org-scoped files. Set ONLY for ORGANIZATIONS-scoped files —\n  // never for USER_SELF (the two scopes are independent axes, separation of concern).\n  organizationId: z.string().optional().isDBIndexed(),\n\n  // USER_SELF scope: user-private files owned by one user. Set ONLY for USER_SELF-scoped\n  // files; the owner is the user (no org). `applicationId` is the tenant/bucket anchor.\n  userId: z.string().optional().isDBIndexed(),\n\n  // ========== Upload Metadata ==========\n  // The uploader principal is persisted as a raw id + type pair only.\n  // Any richer label/entity hydration is intentionally client-driven.\n  uploadedBy: z.string().trim().min(1).optional().isDBIndexed(),\n  uploadedByEntityType: z.enum(FileUploaderEntityType).optional().isDBIndexed(),\n\n  // ========== Timestamps ==========\n  uploadedAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  deletedAt: z.date().optional().isDBIndexed().excludeFromCreate(),\n});\n\nexport const FileSchema = FileSchemaBase.superRefine((file, ctx) => {\n  validateUploaderPair(file, ctx);\n\n  if (!file.primaryScope) {\n    // Pre-link state: applicationId is always present (set from execution context at upload time),\n    // but organizationId/userId must not be set without a primaryScope discriminator.\n    if (hasFileScopeIdentifierValue(file.organizationId) || hasFileScopeIdentifierValue(file.userId)) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['primaryScope'],\n        message: 'primaryScope is required when organizationId or userId are present',\n      });\n    }\n    return;\n  }\n\n  if (!validateFileScopeIdentifiers({\n    primaryScope: file.primaryScope,\n    applicationId: file.applicationId,\n    organizationId: file.organizationId,\n    userId: file.userId,\n  })) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['primaryScope'],\n      message: 'File scope identifiers must match the declared primaryScope',\n    });\n  }\n\n});\nexport type File = z.infer<typeof FileSchema> & FileUploaderOwnership;\n\n/**\n * Scope identifiers for file access control.\n * Populated based on primaryScope when file is created/linked.\n */\nexport interface FileScopeIdentifiers {\n  primaryScope: FilePrimaryScope;\n  /** Always required — top-level tenant isolation key, set from execution context at file creation. */\n  applicationId: string;\n  organizationId?: string;\n  userId?: string;\n}\n"]}
+{"version":3,"file":"files.shared.schemas.js","sourceRoot":"","sources":["../../../../src/files/files.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAA8B,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7E,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGvF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,UAYX;AAZD,WAAY,UAAU;IACpB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;IACrB,+BAAiB,CAAA;IACjB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;IACrB,+BAAiB,CAAA;IAEjB,mCAAqB,CAAA;IACrB,6BAAe,CAAA;IACf,mCAAqB,CAAA;IACrB,yCAA2B,CAAA;AAC7B,CAAC,EAZW,UAAU,KAAV,UAAU,QAYrB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,yCAAqB,CAAA;IACrB,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,OAAO,GAAG,KAAK,gBAAgB,CAAC,SAAS;QACvC,CAAC,CAAC,gBAAgB,CAAC,SAAS;QAC5B,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA4B,IAAI,GAAG,CAAC;IACzE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,KAAK;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA4B,IAAI,GAAG,CAAC;IAC9E,UAAU,CAAC,OAAO;CACnB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA4B,IAAI,GAAG,CAAC;IACpE,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,WAAW;CACvB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwD;IAC1F,CAAC,UAAU,CAAC,OAAO,CAAC,EAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;IACnE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;IAC/H,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;IACrF,CAAC,UAAU,CAAC,KAAK,CAAC,EAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACvF,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC;IACvE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAG,CAAC,UAAU,CAAC,OAAO,CAAC;IAC/C,CAAC,UAAU,CAAC,MAAM,CAAC,EAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACpE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;IAClE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAO,EAAE;IAC7B,CAAC,UAAU,CAAC,MAAM,CAAC,EAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;CAChD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA4B,IAAI,GAAG,CAAC;IACrE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,KAAK;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,oBAAoB,CAAC,WAAW;IAChC,oBAAoB,CAAC,aAAa;IAClC,oBAAoB,CAAC,SAAS;CACtB,CAAC;AAIX,SAAS,2BAA2B,CAAC,KAAyB;IAC5D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAGC,EACD,GAAoB;IAEpB,MAAM,aAAa,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,uBAAuB,GAAG,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC;IAExE,IAAI,aAAa,KAAK,uBAAuB,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAC/D,OAAO,EAAE,gFAAgF;SAC1F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5D,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC;QAC3B,KAAK,oBAAoB,CAAC,WAAW;YACnC,OAAO,gBAAgB,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC;QAC9D,KAAK,oBAAoB,CAAC,aAAa;YACrC,kGAAkG;YAClG,OAAO,gBAAgB,IAAI,iBAAiB,IAAI,CAAC,SAAS,CAAC;QAC7D,KAAK,oBAAoB,CAAC,SAAS;YACjC,8EAA8E;YAC9E,4EAA4E;YAC5E,+EAA+E;YAC/E,gFAAgF;YAChF,yCAAyC;YACzC,OAAO,gBAAgB,IAAI,SAAS,IAAI,CAAC,iBAAiB,CAAC;QAC7D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEzD,sCAAsC;IACtC,+FAA+F;IAC/F,8FAA8F;IAC9F,oGAAoG;IACpG,sDAAsD;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAC5G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IACtG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE7C,gCAAgC;IAChC,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACtD,uFAAuF;IACvF,wFAAwF;IACxF,wFAAwF;IACxF,0FAA0F;IAC1F,gBAAgB;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACtD,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IAEzD,2CAA2C;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAErF,iDAAiD;IACjD,8DAA8D;IAC9D,kGAAkG;IAClG,sGAAsG;IACtG,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC1D,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IAClE,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,yCAAyC;IACzC,4EAA4E;IAC5E,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACvD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,sCAAsC;IACtC,mEAAmE;IACnE,6CAA6C;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAElE,0CAA0C;IAC1C,oFAAoF;IACpF,4FAA4F;IAC5F,2FAA2F;IAE3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAEvC,mFAAmF;IACnF,oFAAoF;IACpF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEnD,uFAAuF;IACvF,sFAAsF;IACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE3C,wCAAwC;IACxC,oEAAoE;IACpE,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC7D,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE7E,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;CACjE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACjE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,+FAA+F;QAC/F,kFAAkF;QAClF,IAAI,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,cAAc,CAAC;gBACtB,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,4BAA4B,CAAC;QAChC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,EAAE,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;AAEH,CAAC,CAAC,CAAC","sourcesContent":["/**\n * Files Shared Schemas\n *\n * Reusable schemas for file uploads and file handling.\n *\n * ## Scope Model\n *\n * Files use a **segregated scope model** where scope identifiers are separate fields\n * (not hierarchical). A file belongs to exactly one primary scope:\n * - APPLICATION: App-level shared files (e.g., branding assets)\n * - ORGANIZATIONS: Org-scoped files (e.g., org documents)\n * - USER_SELF: User-private files owned by a single user (NO org — USER_SELF and\n *   ORGANIZATIONS are independent primary-scope axes; `applicationId` is the bucket anchor)\n *\n * `ANONYMOUS` is intentionally excluded from the file contract for now. The\n * file layer does not yet define anonymous upload, storage, and access semantics\n * end to end, so file resources fail closed instead of pretending support.\n *\n * Scope is **derived from the parent resource's resourcePrimaryScope** when linking.\n * Access rights are **inherited from the z_file() field** on the parent resource.\n *\n * Note: FileMetadata is defined in @wildo-ai/zod-decorators\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { FileDisplayNature, FileStorageAccepted, FileUploaderEntityType, type FileUploaderOwnership } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\n\n// Re-export FileMetadata from zod-decorators for convenience\nexport type { FileMetadata } from '@wildo-ai/zod-decorators';\nexport { FileUploaderEntityType, FileStorageAccepted } from '@wildo-ai/zod-decorators';\nexport type { FileUploaderOwnership } from '@wildo-ai/zod-decorators';\n\n/**\n * File status lifecycle enum\n *\n * NOTE — no extraction/indexing members. `EXTRACTING` / `EXTRACTED` / `INDEXED` were removed\n * 2026-08-26 with the resource-native RAG reshape (plan `resource-rag-capability`, Phase 1):\n * text extraction and embedding state are per-FIELD, per-CHUNK facts, and the RAG chunk rows\n * (Phase 2's derived-data tier, keyed `(resourceType, resourceId, fieldName, chunkIndex)` with a\n * NULLABLE `vector` as the \"needs embedding\" ledger) carry them. A single file-level status could\n * never say WHICH field's corpus was current — it was the wrong shape, not merely unused — and\n * `INDEXED` had already shipped one false claim (written to mean \"text was copied\", read as\n * \"searchable\": https://github.com/wildo-ai/wildo-ai/issues/46). The file lifecycle now ends at\n * upload/scan/link/erasure concerns, which really are per-file.\n */\nexport enum FileStatus {\n  PENDING = 'pending',\n  UPLOADED = 'uploaded',\n  LINKED = 'linked',\n  DELETED = 'deleted',\n  ORPHANED = 'orphaned',\n  FAILED = 'failed',\n\n  SCANNING = 'scanning',\n  CLEAN = 'clean',\n  INFECTED = 'infected',\n  QUARANTINED = 'quarantined',\n}\n\n/**\n * Rendition of a file's bytes requested from the serve route via `?variant=`.\n *\n * - `ORIGINAL` — the stored bytes, unchanged (the default when the param is absent).\n * - `THUMBNAIL` — a small, downscaled `webp` derived on the fly for preview surfaces\n *   (nav avatar, list/card image) so a preview never pulls a multi-MB original. Only\n *   raster images are eligible; for any other file the serve route transparently\n *   falls back to the original bytes.\n *\n * This is the WIRE CONTRACT for the serve route's `variant` query parameter — shared\n * by the frontend (which builds `?variant=thumbnail` preview URLs) and the backend\n * serve route (which parses it). Keep the string values stable across releases.\n */\nexport enum FileServeVariant {\n  ORIGINAL = 'original',\n  THUMBNAIL = 'thumbnail',\n}\n\n/**\n * Parse an untrusted `?variant=` query value into a {@link FileServeVariant}.\n * Absent or unrecognized values fall back to `ORIGINAL` (fail-safe: an unknown\n * variant serves the untransformed bytes rather than erroring).\n */\nexport function parseFileServeVariant(raw: unknown): FileServeVariant {\n  return raw === FileServeVariant.THUMBNAIL\n    ? FileServeVariant.THUMBNAIL\n    : FileServeVariant.ORIGINAL;\n}\n\n/**\n * Statuses in which a file's bytes are safe to serve for download.\n *\n * AV scanning IS wired: `FileScanningBackendService` is bound in the container and the resource\n * upload handler calls `shouldScan` then `initiateScan`, so a scanned file moves through SCANNING\n * to CLEAN / INFECTED / QUARANTINED. `SCANNING`, `INFECTED` and `QUARANTINED` are absent from this\n * set and therefore blocked, which is the post-scan half of the original Wave 1 note.\n *\n * `UPLOADED` IS admitted, and that is correct rather than a leftover — but only because of where\n * the scan gate now sits. Scanning is opt-in per field (`shouldScan` reads the field's\n * `fileMetadata`), so an unscanned file legitimately terminates at UPLOADED and removing it from\n * this set would make every such field undownloadable.\n *\n * The window that used to sit behind that reasoning is CLOSED (#433, 2026-09-08). A file whose\n * field requires a scan never sits at UPLOADED at all: `resource-file-upload-handler` now AWAITS\n * `initiateScan` — which awaits the UPLOADED -> SCANNING transition and only then fires the scan\n * pipeline — BEFORE the upload response is sent. Previously it was fired afterwards without being\n * awaited, so the bytes were servable for the gap between the upload committing and the transition\n * landing.\n *\n * So the invariant this set relies on is external to it: **a required scan reaches SCANNING before\n * anyone learns the upload succeeded.** Do not restore a fire-and-forget scan initiation, and do\n * not add UPLOADED-adjacent statuses here without asking which side of that gate they fall on.\n */\nexport const FILE_DOWNLOADABLE_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.UPLOADED,\n  FileStatus.LINKED,\n  FileStatus.ORPHANED,\n  FileStatus.CLEAN,\n]);\n\n/**\n * Statuses in which a file's own METADATA must no longer be disclosed on the GLOBAL\n * `GET /files/:fileId/metadata` route (gate **G-FILE**).\n *\n * Blocking the BYTES is not enough. A privacy erasure marks the file `DELETED`, but physical cleanup\n * is a batch that runs much later — so between the two, `originalFilename` (`passport-jane-doe.pdf`)\n * and `uploadedBy` stayed readable by any member of the file's scope. \"Erased\" that leaves the\n * filename readable for weeks is not erased.\n *\n * DELIBERATELY NARROWER than {@link FILE_BLOCKED_STATUSES}: `PENDING`, `SCANNING`, `FAILED` and\n * `INFECTED` files are not servable either, but their metadata IS the diagnostic surface an uploader\n * legitimately polls (\"upload failed\", \"scan in progress\"). Withholding those would break upload UX\n * while protecting nothing — none of them is an erasure outcome. `DELETED` is the terminal state (it\n * has no outgoing transition in {@link FILE_STATUS_TRANSITIONS}) and the one an erasure produces.\n */\nexport const FILE_METADATA_WITHHELD_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.DELETED,\n]);\n\n/**\n * Value written over a file's `filename` / `originalFilename` when the file is erased for privacy.\n *\n * Both fields are REQUIRED (`z.string().min(1)`), so an erasure cannot null them without a schema\n * reshape; overwriting with one shared, non-identifying constant erases the personal data while\n * keeping the row valid, greppable and obviously-erased in logs and admin surfaces. Deliberately a\n * fixed constant rather than a per-file token: two erased files must not be distinguishable by name.\n */\nexport const ERASED_FILE_NAME_PLACEHOLDER = '[erased]';\n\n/**\n * Statuses that represent terminal or non-servable states.\n * Files in these states must not be served for download.\n */\nexport const FILE_BLOCKED_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.PENDING,\n  FileStatus.DELETED,\n  FileStatus.FAILED,\n  FileStatus.SCANNING,\n  FileStatus.INFECTED,\n  FileStatus.QUARANTINED,\n]);\n\n/**\n * Valid lifecycle transitions.\n *\n * Each key is a source status; the value is the set of statuses it can\n * transition to. Any transition not listed here is invalid.\n */\nexport const FILE_STATUS_TRANSITIONS: Readonly<Record<FileStatus, readonly FileStatus[]>> = {\n  [FileStatus.PENDING]:      [FileStatus.UPLOADED, FileStatus.FAILED],\n  [FileStatus.UPLOADED]:     [FileStatus.LINKED, FileStatus.SCANNING, FileStatus.ORPHANED, FileStatus.DELETED, FileStatus.FAILED],\n  [FileStatus.SCANNING]:     [FileStatus.CLEAN, FileStatus.INFECTED, FileStatus.FAILED],\n  [FileStatus.CLEAN]:        [FileStatus.LINKED, FileStatus.ORPHANED, FileStatus.DELETED],\n  [FileStatus.INFECTED]:     [FileStatus.QUARANTINED, FileStatus.DELETED],\n  [FileStatus.QUARANTINED]:  [FileStatus.DELETED],\n  [FileStatus.LINKED]:       [FileStatus.ORPHANED, FileStatus.DELETED],\n  [FileStatus.ORPHANED]:     [FileStatus.LINKED, FileStatus.DELETED],\n  [FileStatus.DELETED]:      [],\n  [FileStatus.FAILED]:       [FileStatus.DELETED],\n};\n\n/**\n * Statuses from which a file may be LINKED to a resource field — the set the link-time checks\n * (`FileOperationHandlerBackendService.validateFileFieldsForCreate/Update`,\n * `FilesBackendService.linkFileToResource`) consult.\n *\n * ## Why this set exists (issue #320)\n *\n * Those checks used to compare against the literal `FileStatus.UPLOADED`, while\n * {@link FILE_STATUS_TRANSITIONS} — the authority on what a status MEANS — already allowed\n * `CLEAN → LINKED`. So a file the scanner had just certified safe was refused at the one moment it was\n * needed, with an error naming `UPLOADED` as the expected state, and whether a scanned file could be\n * attached at all depended on how fast the caller was relative to the scanner. Two `$in` queries in\n * `FilesBackendService` had meanwhile grown their own `[UPLOADED, CLEAN]` pairs — three copies of one\n * answer, one of them wrong. This is the single copy.\n *\n * ## Derived-CHECKED against the map, not computed from it\n *\n * Every member here has `LINKED` among its outgoing transitions (pinned by\n * `files.shared.status-sets.test.ts`), so this set can never admit a transition the map forbids.\n * It is nonetheless written out rather than computed, because the map is a superset of what linking\n * should admit today:\n *\n * - `ORPHANED → LINKED` is legal in the map (a re-link after the parent was deleted with the file\n *   kept) and is DELIBERATELY NOT admitted here. Re-linking an orphan is a distinct capability with\n *   its own questions — whose scope does the file re-enter, what happens to its old key — and\n *   admitting it as a side effect of fixing the `CLEAN` refusal would decide those questions by\n *   accident. The pin asserts this exclusion by name so widening it is a choice, not drift.\n * - `SCANNING` is absent because the map forbids `SCANNING → LINKED`: a file whose scan is in\n *   flight is not yet known to be safe. The link path names that case with\n *   `FILE_SCAN_IN_PROGRESS` so the caller learns to retry, rather than the generic refusal.\n */\nexport const FILE_LINKABLE_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.UPLOADED,\n  FileStatus.CLEAN,\n]);\n\n\nexport const FILE_PRIMARY_SCOPES = [\n  ResourcePrimaryScope.APPLICATION,\n  ResourcePrimaryScope.ORGANIZATIONS,\n  ResourcePrimaryScope.USER_SELF,\n] as const;\n\nexport type FilePrimaryScope = (typeof FILE_PRIMARY_SCOPES)[number];\n\nfunction hasFileScopeIdentifierValue(value: string | undefined): boolean {\n  return typeof value === 'string' && value.trim() !== '';\n}\n\nfunction validateUploaderPair(\n  file: {\n    uploadedBy?: string;\n    uploadedByEntityType?: FileUploaderEntityType;\n  },\n  ctx: z.RefinementCtx,\n): void {\n  const hasUploadedBy = hasFileScopeIdentifierValue(file.uploadedBy);\n  const hasUploadedByEntityType = file.uploadedByEntityType !== undefined;\n\n  if (hasUploadedBy !== hasUploadedByEntityType) {\n    ctx.addIssue({\n      code: 'custom',\n      path: hasUploadedBy ? ['uploadedByEntityType'] : ['uploadedBy'],\n      message: 'uploadedBy and uploadedByEntityType must either both be set or both be omitted',\n    });\n  }\n}\n\nexport function validateFileScopeIdentifiers(scope: {\n  primaryScope: FilePrimaryScope;\n  applicationId: string;\n  organizationId?: string;\n  userId?: string;\n}): boolean {\n  const hasApplicationId = hasFileScopeIdentifierValue(scope.applicationId);\n  const hasOrganizationId = hasFileScopeIdentifierValue(scope.organizationId);\n  const hasUserId = hasFileScopeIdentifierValue(scope.userId);\n\n  switch (scope.primaryScope) {\n    case ResourcePrimaryScope.APPLICATION:\n      return hasApplicationId && !hasOrganizationId && !hasUserId;\n    case ResourcePrimaryScope.ORGANIZATIONS:\n      // applicationId is always required (tenant isolation); organizationId is the scope discriminator.\n      return hasApplicationId && hasOrganizationId && !hasUserId;\n    case ResourcePrimaryScope.USER_SELF:\n      // Primary scopes are a SEPARATION OF CONCERN: USER_SELF and ORGANIZATIONS are\n      // independent axes. A user's self-owned file is user-owned, NOT org-owned —\n      // `userId` is the scope discriminator and `applicationId` is the tenant/bucket\n      // anchor. `organizationId` MUST be absent (a present org would conflate the two\n      // scopes). Fail closed on any org value.\n      return hasApplicationId && hasUserId && !hasOrganizationId;\n    default:\n      return false;\n  }\n}\n\n/**\n * File resource schema\n *\n * Stores file metadata and links files to resources.\n * Files are stored via app-managed storage providers (MinIO/S3, local directory, etc.),\n * this schema tracks metadata only.\n *\n * ## Storage Identity Convention\n * `storageProvider` + `storageRef` are the persisted routing truth used to\n * reach the active storage backend. `storageKey` remains framework metadata\n * that captures the file's derived scope path for bookkeeping, diagnostics,\n * and future storage contract evolution.\n *\n * `storageKey` includes scope path derived from primaryScope:\n * - APPLICATION: `app/{applicationId}/{fileId}`\n * - ORGANIZATIONS: `org/{organizationId}/{fileId}`\n * - USER_SELF: `user/{userId}/{fileId}` (owner is the user; no org segment)\n */\nconst FileSchemaBase = z.object({\n  fileId: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ========== File Metadata ==========\n  // USER_CONTENT on both names. A filename is chosen by the person and routinely IS the personal\n  // datum — \"scan-2026-medical.pdf\" discloses a special category before the file is opened. The\n  // file's BYTES are not a field here (this resource is metadata over object storage), so this is the\n  // only place the content axis can be declared at all.\n  filename: z.string().min(1).isDBIndexed().isSummaryField().dataCategories(PersonalDataCategory.USER_CONTENT),\n  originalFilename: z.string().min(1).isSummaryField().dataCategories(PersonalDataCategory.USER_CONTENT),\n  mimeType: z.string().min(1).isDBIndexed().isSummaryField(),\n  size: z.number().min(0).isSummaryField(),\n  extension: z.string().optional(),\n  checksum: z.string().optional().isDBIndexed(),\n\n  // ========== Storage ==========\n  // `storageProvider` + `storageRef` are the persisted backend-routing truth.\n  storageProvider: z.enum(FileStorageAccepted).optional().isDBIndexed(),\n  storageRef: z.string().min(1).optional().isDBIndexed(),\n  // `storageKey` is still scoped metadata, not the storage backend handle. It embeds the\n  // file identity (`_id`, surfaced as the `fileId` virtual), so it is derived + persisted\n  // AFTER the row is created (insert-first) — hence optional at create time. `createFile`\n  // sets it once `_id` exists, and `linkFileToResource` re-derives it when the file's scope\n  // is finalized.\n  storageKey: z.string().min(1).optional().isDBIndexed(),\n  url: z.url().optional(), // Cached URL (may be presigned)\n\n  // ========== Status & Lifecycle ==========\n  status: z.enum(FileStatus).default(FileStatus.PENDING).isDBIndexed().isSummaryField(),\n\n  // ========== Nature-specific Metadata ==========\n  // Inferred from MIME type or set by analysis services (F4-03)\n  // Resolved display nature (IMAGE/VIDEO/AUDIO/DOCUMENT/GENERIC) — NOT the schema-level FileNature.\n  // Set by resolveFileDisplayNature() during upload or inferred from MIME type in toMetadataResponse().\n  // Schema declares FileNature (e.g., PDF, OFFICE), but the DB stores the resolved FileDisplayNature.\n  nature: z.enum(FileDisplayNature).optional().isDBIndexed(),\n  // Image-specific\n  width: z.number().positive().optional(),\n  height: z.number().positive().optional(),\n  thumbnailUrl: z.url().optional(),\n  // Video/Audio-specific (populated by IFileVideoAnalyzer / IFileAudioAnalyzer)\n  duration: z.number().positive().optional(), // Duration in seconds\n  // Document-specific (populated by IFileDocumentAnalyzer)\n  pageCount: z.number().positive().optional(),\n\n  // ========== Resource Linking ==========\n  // When linked, scope is derived from parent resource's resourcePrimaryScope\n  linkedResourceType: z.string().optional().isDBIndexed(),\n  linkedResourceId: z.string().optional().isDBIndexed(),\n  linkedFieldName: z.string().optional(),\n\n  // ========== Primary Scope ==========\n  // Derived from parent resource's resourcePrimaryScope when linking\n  // Determines access control and storage path\n  primaryScope: z.enum(FILE_PRIMARY_SCOPES).optional().isDBIndexed(),\n\n  // ========== Scope Identifiers ==========\n  // applicationId is ALWAYS set (from execution context at creation time) — it is the\n  // top-level tenant isolation field present on every file record regardless of primaryScope.\n  // organizationId and userId are populated only when the file's primaryScope requires them.\n\n  applicationId: z.string().isDBIndexed(),\n\n  // ORGANIZATIONS scope: org-scoped files. Set ONLY for ORGANIZATIONS-scoped files —\n  // never for USER_SELF (the two scopes are independent axes, separation of concern).\n  organizationId: z.string().optional().isDBIndexed(),\n\n  // USER_SELF scope: user-private files owned by one user. Set ONLY for USER_SELF-scoped\n  // files; the owner is the user (no org). `applicationId` is the tenant/bucket anchor.\n  userId: z.string().optional().isDBIndexed(),\n\n  // ========== Upload Metadata ==========\n  // The uploader principal is persisted as a raw id + type pair only.\n  // Any richer label/entity hydration is intentionally client-driven.\n  uploadedBy: z.string().trim().min(1).optional().isDBIndexed(),\n  uploadedByEntityType: z.enum(FileUploaderEntityType).optional().isDBIndexed(),\n\n  // ========== Timestamps ==========\n  uploadedAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  deletedAt: z.date().optional().isDBIndexed().excludeFromCreate(),\n});\n\nexport const FileSchema = FileSchemaBase.superRefine((file, ctx) => {\n  validateUploaderPair(file, ctx);\n\n  if (!file.primaryScope) {\n    // Pre-link state: applicationId is always present (set from execution context at upload time),\n    // but organizationId/userId must not be set without a primaryScope discriminator.\n    if (hasFileScopeIdentifierValue(file.organizationId) || hasFileScopeIdentifierValue(file.userId)) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['primaryScope'],\n        message: 'primaryScope is required when organizationId or userId are present',\n      });\n    }\n    return;\n  }\n\n  if (!validateFileScopeIdentifiers({\n    primaryScope: file.primaryScope,\n    applicationId: file.applicationId,\n    organizationId: file.organizationId,\n    userId: file.userId,\n  })) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['primaryScope'],\n      message: 'File scope identifiers must match the declared primaryScope',\n    });\n  }\n\n});\nexport type File = z.infer<typeof FileSchema> & FileUploaderOwnership;\n\n/**\n * Scope identifiers for file access control.\n * Populated based on primaryScope when file is created/linked.\n */\nexport interface FileScopeIdentifiers {\n  primaryScope: FilePrimaryScope;\n  /** Always required — top-level tenant isolation key, set from execution context at file creation. */\n  applicationId: string;\n  organizationId?: string;\n  userId?: string;\n}\n"]}

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.d.ts

@@ -36,5 +36,5 @@
  * @see a2a-token-budget-state.shared.resources-config.schemas.ts — the 3-scope role precedent
  */
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
-export declare const a2aPushDeliveryLogPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.DELETE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, any>>;
+export declare const a2aPushDeliveryLogPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE | CoreResourceOperation.DELETE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, any>>;
 //# sourceMappingURL=a2a-push-delivery-log.shared.resources-config.schemas.d.ts.map

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,EACL,qBAAqB,EAEtB,MAAM,gDAAgD,CAAC;AAsCxD,eAAO,MAAM,sCAAsC,mTA4IlD,CAAC"}
+{"version":3,"file":"a2a-push-delivery-log.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,EACL,qBAAqB,EAEtB,MAAM,gDAAgD,CAAC;AAuCxD,eAAO,MAAM,sCAAsC,uVA+KlD,CAAC"}

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.js

@@ -42,6 +42,7 @@ import { ResourceSystemAccessMode } from '../resources/resources-config.shared.s
 import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory.js';
 import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 import { a2aPushDeliveryLogPolymorphicDeclaration, A2APushDeliveryStatus, } from './a2a-push-delivery-log.shared.schemas.js';
 /**
  * Who may read a delivery row.
@@ -98,6 +99,21 @@ export const a2aPushDeliveryLogPolymorphicFactories = createPolymorphicResourceC
     // fail-closed subject-export authority refuses the whole runtime graph at companion bootstrap
     // ("no effective portability provenance … (undeclared)" for every field).
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /**
+     * Subject erasure RETAINS this row and scrubs the delivered payload.
+ *
+ * The delivery record — what was sent, when, to which endpoint, and whether it succeeded — is the
+ * operational evidence this resource exists to keep. The `payload` is not: it carries the task's own
+ * content, which originated with the person, and a payload can hold anything a task held.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The row is work performed for a person, not the person;
+ *  its owner FK names the scope the work ran in. The subject's session ends through the `USERS` row.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
@@ -106,8 +122,25 @@ export const a2aPushDeliveryLogPolymorphicFactories = createPolymorphicResourceC
         CoreResourceOperation.UPDATE,
         CoreResourceOperation.DELETE,
         CoreResourceOperation.DELETE_MANY,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it
+         * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the
+         * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the
+         * verb the impersonalize writer uses to stamp the retention markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [{
                     variantType: ResourceOperationVariantType.API_CALL,

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;IAC7D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;CAC1D,CAAC;AAEF,qGAAqG;AACrG,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;IAChE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,EAAE;QAClB,4FAA4F;QAC5F,8FAA8F;QAC9F,iFAAiF;QACjF,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,0FAA0F;IAC1F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,0EAA0E;IAC1E,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,0FAA0F;oBAC1F,yFAAyF;oBACzF,yFAAyF;oBACzF,gBAAgB,EAAE,CAAC,QAAQ,EAAE,0BAA0B,EAAE,eAAe,CAAC;oBACzE,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAU;iBAC7D,CAAC;SACH;QACD,2FAA2F;QAC3F,kFAAkF;QAClF,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,wFAAwF;QACxF,0FAA0F;QAC1F,+FAA+F;QAC/F,0FAA0F;QAC1F,+FAA+F;QAC/F,iGAAiG;QACjG,kGAAkG;QAClG,qCAAqC;QACrC,EAAE;QACF,6FAA6F;QAC7F,mGAAmG;QACnG,kGAAkG;QAClG,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,gGAAgG;QAChG,iGAAiG;QACjG,uFAAuF;QACvF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8FAA8F;QAC9F,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * A2A Push Delivery Log Resource Configuration — polymorphic across the three A2A owner scopes.\n *\n * Produces 3 factory functions (USER + ORG + APP). Spread into the registry factory map:\n *   ...a2aPushDeliveryLogPolymorphicFactories\n *\n * Operation set, and why each one is shaped the way it is:\n *   - READ / LIST / SEARCH (API)             : an owner inspects what was delivered on its behalf\n *   - CREATE               (INTERNAL_CALL)   : dispatcher-only — a delivery row is EVIDENCE, and a\n *                                              client that could author one could fabricate proof\n *                                              that a notification was sent\n *   - UPDATE               (INTERNAL_CALL)   : the worker's lifecycle transitions\n *                                              (PENDING → IN_FLIGHT → DELIVERED/FAILED)\n *   - DELETE / DELETE_MANY (REPOSITORY_ONLY) : reserved for retention purging. Deliberately NO\n *                                              external single-row delete — a trail an owner can\n *                                              selectively erase is not a trail\n *\n * **Route-lessness and TIER are two different questions, and conflating them broke this resource.**\n * `INTERNAL_CALL` and `REPOSITORY_ONLY` are both route-less — neither exposes an HTTP surface, so the\n * \"never a public mutation\" property above holds identically under either. What they differ on is which\n * tier can REACH them. CREATE and UPDATE are written by `A2APushDeliveryLogRepository` through\n * `*AsSystem` (the service tier), which resolves via `getServiceOperationPathDefault` and matches only\n * `INTERNAL_CALL` / `API_CALL`; they were authored `REPOSITORY_ONLY` and therefore threw on every write\n * until 2026-08-11. DELETE / DELETE_MANY correctly STAY `REPOSITORY_ONLY`: nothing calls them through\n * `*AsSystem` — retention purging and the owner-scope composition cascade both run at the repository\n * tier, which is exactly the tier `REPOSITORY_ONLY` serves. Enumerated deliberately rather than swept:\n * changing a variant nothing calls would have been churn, and leaving one a caller DOES reach was the bug.\n *\n * Deliberately NO `RETRY` custom operation, unlike the M2M delivery log. Retry there is an admin\n * repairing a tenant's own integration; here the caller is an external agent client, and letting it\n * re-fire deliveries on demand would hand it an amplifier pointed at a URL it also chose. Retries\n * are the worker's, on its own backoff schedule. If an operator-driven retry is ever wanted it\n * belongs on an admin surface, not on this resource.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts — the pattern\n * @see a2a-token-budget-state.shared.resources-config.schemas.ts — the 3-scope role precedent\n */\n\nimport { z } from 'zod';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport {\n  a2aPushDeliveryLogPolymorphicDeclaration,\n  A2APushDeliveryStatus,\n} from './a2a-push-delivery-log.shared.schemas';\n\n/**\n * Who may read a delivery row.\n *\n * A row names a webhook URL the owner itself registered and the outcome of contacting it. It\n * carries no message content by construction (the payload is a `statusUpdate`, never a `Task` — see\n * `a2a-push-notification-delivery.backend.utils.ts`), so owner-level read is the right bar rather\n * than an admin one: the party that configured the delivery is the party that needs to see whether\n * it worked, and forcing them to an admin to diagnose their own webhook helps nobody.\n *\n * Follows the token-budget precedent for the same three scopes.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_USER],\n};\n\n/** Writes are the dispatcher's and the worker's; the role here gates nothing reachable over HTTP. */\nconst SYSTEM_WRITE_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\nexport const a2aPushDeliveryLogPolymorphicFactories = createPolymorphicResourceConfigurations(\n  a2aPushDeliveryLogPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    /**\n     * Opt the runtime into scoped writes on the owner's behalf. Absent this, every `*AsSystem` verb\n     * fails closed.\n     *\n     * This resource follows the TASK service's pattern rather than the M2M delivery log's, and the\n     * difference is not stylistic: the M2M dispatcher runs inside the resource operation that\n     * triggered the webhook and therefore holds that operation's `ExecutionContext`, whereas a push\n     * notification is triggered by `advanceTask` — a system-owned transition with no caller context\n     * to borrow. Synthesising one at the call site would fabricate an authority nobody granted;\n     * `*AsSystem` is the door built for exactly this.\n     *\n     * No `delete` mode: nothing system-deletes a delivery row. Removal is retention purging or the\n     * owner-scope cascade, both of which run through their own paths.\n     */\n    systemAccessPolicy: {\n      // The subject's own delivery evidence — including the webhook URLs they registered. Granted\n      // because the owner can already READ/LIST/SEARCH these rows over the API, so withholding them\n      // from a subject export would make the export narrower than the product surface.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    // Art. 20 portability provenance for the field sweep this user-DEPENDENT resource enters.\n    // Every field on a delivery row is delivery mechanics the SYSTEM observed while attempting the\n    // webhook (attempt counts, timestamps, response status, the destination recorded at send time)\n    // — none of it is content the subject provided on THIS row, so the blanket default is OBSERVED,\n    // matching the A2A siblings (task, execution, token-budget state). Without this declaration the\n    // fail-closed subject-export authority refuses the whole runtime graph at companion bootstrap\n    // (\"no effective portability provenance … (undeclared)\" for every field).\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `failureReason` is searchable because \"why did my webhook stop working\" is the question\n          // this resource exists to answer. `httpUrl` is NOT: it would let a caller enumerate rows\n          // by destination, and the owner already knows its own URLs from the configuration plane.\n          searchableFields: ['taskId', 'pushNotificationConfigId', 'failureReason'],\n          filterFields: {\n            status: z.enum(A2APushDeliveryStatus),\n            taskId: z.string(),\n            resourceServerInstanceRef: z.string(),\n            createdAt: z.date(),\n          },\n          sortFields: ['createdAt', 'status', 'attemptCount'] as const,\n        }],\n      },\n      // A delivery row is EVIDENCE that a notification was attempted. Authoring one from outside\n      // would let a caller fabricate that evidence — so CREATE carries NO HTTP surface.\n      //\n      // ⚠️ `INTERNAL_CALL`, not `REPOSITORY_ONLY`, and the distinction is load-bearing rather than\n      // stylistic. Both are route-less, so both withhold the surface equally; what differs is which\n      // TIER can reach them. `A2APushDeliveryLogRepository` writes through `*AsSystem`, which\n      // dispatches via the service tier and resolves through `getServiceOperationPathDefault` —\n      // matching only `INTERNAL_CALL` / `API_CALL`. This op was authored `REPOSITORY_ONLY`, so every\n      // `open()` threw `resources_registry_operation_path_not_found`, the dispatcher's no-throw\n      // contract swallowed it at WARN, and the whole push-delivery feature was inert for eleven days\n      // while the agent card advertised it (measured 2026-08-11 by the live lane; the config was green\n      // at boot throughout, because a variant satisfies every \"the op exists\" check and fails only when\n      // a service-tier caller invokes it).\n      //\n      // The sibling `flows-actors-task` config states the same rule for the same reason and is the\n      // pattern this follows: \"INTERNAL_CALL (not REPOSITORY_ONLY) is mandatory\". Keep the two in step —\n      // both are written by the A2A runtime through `*AsSystem`, governed by `systemAccessPolicy` above\n      // rather than by the op RBAC (`SYSTEM_WRITE_ROLES` gates nothing reachable here).\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // The worker's lifecycle transitions, reached through `updateAsSystem` — so `INTERNAL_CALL` for\n      // exactly the reason CREATE is, and broken the same way while it was not. Still no HTTP surface:\n      // exposing UPDATE would let a caller mark its own undelivered notifications DELIVERED.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Retention purging. Bulk twin of DELETE, and REPOSITORY_ONLY for the same reason: a trail an\n      // owner can selectively erase is not a trail.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"a2a-push-delivery-log.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;IAC7D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;CAC1D,CAAC;AAEF,qGAAqG;AACrG,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;IAChE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,EAAE;QAClB,4FAA4F;QAC5F,8FAA8F;QAC9F,iFAAiF;QACjF,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,0FAA0F;IAC1F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,0EAA0E;IAC1E,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;OAMG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,0FAA0F;oBAC1F,yFAAyF;oBACzF,yFAAyF;oBACzF,gBAAgB,EAAE,CAAC,QAAQ,EAAE,0BAA0B,EAAE,eAAe,CAAC;oBACzE,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAU;iBAC7D,CAAC;SACH;QACD,2FAA2F;QAC3F,kFAAkF;QAClF,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,wFAAwF;QACxF,0FAA0F;QAC1F,+FAA+F;QAC/F,0FAA0F;QAC1F,+FAA+F;QAC/F,iGAAiG;QACjG,kGAAkG;QAClG,qCAAqC;QACrC,EAAE;QACF,6FAA6F;QAC7F,mGAAmG;QACnG,kGAAkG;QAClG,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,gGAAgG;QAChG,iGAAiG;QACjG,uFAAuF;QACvF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8FAA8F;QAC9F,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * A2A Push Delivery Log Resource Configuration — polymorphic across the three A2A owner scopes.\n *\n * Produces 3 factory functions (USER + ORG + APP). Spread into the registry factory map:\n *   ...a2aPushDeliveryLogPolymorphicFactories\n *\n * Operation set, and why each one is shaped the way it is:\n *   - READ / LIST / SEARCH (API)             : an owner inspects what was delivered on its behalf\n *   - CREATE               (INTERNAL_CALL)   : dispatcher-only — a delivery row is EVIDENCE, and a\n *                                              client that could author one could fabricate proof\n *                                              that a notification was sent\n *   - UPDATE               (INTERNAL_CALL)   : the worker's lifecycle transitions\n *                                              (PENDING → IN_FLIGHT → DELIVERED/FAILED)\n *   - DELETE / DELETE_MANY (REPOSITORY_ONLY) : reserved for retention purging. Deliberately NO\n *                                              external single-row delete — a trail an owner can\n *                                              selectively erase is not a trail\n *\n * **Route-lessness and TIER are two different questions, and conflating them broke this resource.**\n * `INTERNAL_CALL` and `REPOSITORY_ONLY` are both route-less — neither exposes an HTTP surface, so the\n * \"never a public mutation\" property above holds identically under either. What they differ on is which\n * tier can REACH them. CREATE and UPDATE are written by `A2APushDeliveryLogRepository` through\n * `*AsSystem` (the service tier), which resolves via `getServiceOperationPathDefault` and matches only\n * `INTERNAL_CALL` / `API_CALL`; they were authored `REPOSITORY_ONLY` and therefore threw on every write\n * until 2026-08-11. DELETE / DELETE_MANY correctly STAY `REPOSITORY_ONLY`: nothing calls them through\n * `*AsSystem` — retention purging and the owner-scope composition cascade both run at the repository\n * tier, which is exactly the tier `REPOSITORY_ONLY` serves. Enumerated deliberately rather than swept:\n * changing a variant nothing calls would have been churn, and leaving one a caller DOES reach was the bug.\n *\n * Deliberately NO `RETRY` custom operation, unlike the M2M delivery log. Retry there is an admin\n * repairing a tenant's own integration; here the caller is an external agent client, and letting it\n * re-fire deliveries on demand would hand it an amplifier pointed at a URL it also chose. Retries\n * are the worker's, on its own backoff schedule. If an operator-driven retry is ever wanted it\n * belongs on an admin surface, not on this resource.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts — the pattern\n * @see a2a-token-budget-state.shared.resources-config.schemas.ts — the 3-scope role precedent\n */\n\nimport { z } from 'zod';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport {\n  a2aPushDeliveryLogPolymorphicDeclaration,\n  A2APushDeliveryStatus,\n} from './a2a-push-delivery-log.shared.schemas';\n\n/**\n * Who may read a delivery row.\n *\n * A row names a webhook URL the owner itself registered and the outcome of contacting it. It\n * carries no message content by construction (the payload is a `statusUpdate`, never a `Task` — see\n * `a2a-push-notification-delivery.backend.utils.ts`), so owner-level read is the right bar rather\n * than an admin one: the party that configured the delivery is the party that needs to see whether\n * it worked, and forcing them to an admin to diagnose their own webhook helps nobody.\n *\n * Follows the token-budget precedent for the same three scopes.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_USER],\n};\n\n/** Writes are the dispatcher's and the worker's; the role here gates nothing reachable over HTTP. */\nconst SYSTEM_WRITE_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\nexport const a2aPushDeliveryLogPolymorphicFactories = createPolymorphicResourceConfigurations(\n  a2aPushDeliveryLogPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    /**\n     * Opt the runtime into scoped writes on the owner's behalf. Absent this, every `*AsSystem` verb\n     * fails closed.\n     *\n     * This resource follows the TASK service's pattern rather than the M2M delivery log's, and the\n     * difference is not stylistic: the M2M dispatcher runs inside the resource operation that\n     * triggered the webhook and therefore holds that operation's `ExecutionContext`, whereas a push\n     * notification is triggered by `advanceTask` — a system-owned transition with no caller context\n     * to borrow. Synthesising one at the call site would fabricate an authority nobody granted;\n     * `*AsSystem` is the door built for exactly this.\n     *\n     * No `delete` mode: nothing system-deletes a delivery row. Removal is retention purging or the\n     * owner-scope cascade, both of which run through their own paths.\n     */\n    systemAccessPolicy: {\n      // The subject's own delivery evidence — including the webhook URLs they registered. Granted\n      // because the owner can already READ/LIST/SEARCH these rows over the API, so withholding them\n      // from a subject export would make the export narrower than the product surface.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    // Art. 20 portability provenance for the field sweep this user-DEPENDENT resource enters.\n    // Every field on a delivery row is delivery mechanics the SYSTEM observed while attempting the\n    // webhook (attempt counts, timestamps, response status, the destination recorded at send time)\n    // — none of it is content the subject provided on THIS row, so the blanket default is OBSERVED,\n    // matching the A2A siblings (task, execution, token-budget state). Without this declaration the\n    // fail-closed subject-export authority refuses the whole runtime graph at companion bootstrap\n    // (\"no effective portability provenance … (undeclared)\" for every field).\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the delivered payload.\n *\n * The delivery record — what was sent, when, to which endpoint, and whether it succeeded — is the\n * operational evidence this resource exists to keep. The `payload` is not: it carries the task's own\n * content, which originated with the person, and a payload can hold anything a task held.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is work performed for a person, not the person;\n *  its owner FK names the scope the work ran in. The subject's session ends through the `USERS` row.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      CoreResourceOperation.DELETE_MANY,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `failureReason` is searchable because \"why did my webhook stop working\" is the question\n          // this resource exists to answer. `httpUrl` is NOT: it would let a caller enumerate rows\n          // by destination, and the owner already knows its own URLs from the configuration plane.\n          searchableFields: ['taskId', 'pushNotificationConfigId', 'failureReason'],\n          filterFields: {\n            status: z.enum(A2APushDeliveryStatus),\n            taskId: z.string(),\n            resourceServerInstanceRef: z.string(),\n            createdAt: z.date(),\n          },\n          sortFields: ['createdAt', 'status', 'attemptCount'] as const,\n        }],\n      },\n      // A delivery row is EVIDENCE that a notification was attempted. Authoring one from outside\n      // would let a caller fabricate that evidence — so CREATE carries NO HTTP surface.\n      //\n      // ⚠️ `INTERNAL_CALL`, not `REPOSITORY_ONLY`, and the distinction is load-bearing rather than\n      // stylistic. Both are route-less, so both withhold the surface equally; what differs is which\n      // TIER can reach them. `A2APushDeliveryLogRepository` writes through `*AsSystem`, which\n      // dispatches via the service tier and resolves through `getServiceOperationPathDefault` —\n      // matching only `INTERNAL_CALL` / `API_CALL`. This op was authored `REPOSITORY_ONLY`, so every\n      // `open()` threw `resources_registry_operation_path_not_found`, the dispatcher's no-throw\n      // contract swallowed it at WARN, and the whole push-delivery feature was inert for eleven days\n      // while the agent card advertised it (measured 2026-08-11 by the live lane; the config was green\n      // at boot throughout, because a variant satisfies every \"the op exists\" check and fails only when\n      // a service-tier caller invokes it).\n      //\n      // The sibling `flows-actors-task` config states the same rule for the same reason and is the\n      // pattern this follows: \"INTERNAL_CALL (not REPOSITORY_ONLY) is mandatory\". Keep the two in step —\n      // both are written by the A2A runtime through `*AsSystem`, governed by `systemAccessPolicy` above\n      // rather than by the op RBAC (`SYSTEM_WRITE_ROLES` gates nothing reachable here).\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // The worker's lifecycle transitions, reached through `updateAsSystem` — so `INTERNAL_CALL` for\n      // exactly the reason CREATE is, and broken the same way while it was not. Still no HTTP surface:\n      // exposing UPDATE would let a caller mark its own undelivered notifications DELIVERED.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Retention purging. Bulk twin of DELETE, and REPOSITORY_ONLY for the same reason: a trail an\n      // owner can selectively erase is not a trail.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;iBA+EnC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,EAAE,4BAA4B,EAI1E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;kBAMnD,CAAC"}
+{"version":3,"file":"a2a-push-delivery-log.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;iBAqFnC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,EAAE,4BAA4B,EAI1E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;kBAMnD,CAAC"}

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.schemas.js

@@ -31,7 +31,8 @@
  */
 import { z } from 'zod';
 import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
-import { addDataCategories, initZodDecorators } from '@wildo-ai/zod-decorators';
+import { addDataCategories, initZodDecorators, addImpersonalizeWith } from '@wildo-ai/zod-decorators';
+import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier, } from '../resources/resources.shared.core.definitions.js';
 import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey, } from '../resources/utils/resource-polymorphism.schemas.js';
 initZodDecorators(z);
@@ -100,7 +101,10 @@ export const A2APushDeliveryLogSchema = z.object({
     // `addDataCategories` rather than the fluent form: `z.unknown()` is one of the types that carry NO
     // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one), so
     // `.dataCategories(...)` does not type-check on it. The helper is the documented escape hatch.
-    payload: addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),
+    // REMOVE on erasure. The delivered payload carries the task's own content, which originated with the
+    // person — so it is content this row HOLDS. `z.unknown()` accepts null, so REMOVE is clearable here even
+    // though the field is not written `.optional()`.
+    payload: addImpersonalizeWith(addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),
     status: z
         .enum(A2APushDeliveryStatus)
         .default(A2APushDeliveryStatus.PENDING)

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEhF,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;AACnB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExD,qFAAqF;IACrF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE5D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3E;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD,sGAAsG;IACtG,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,iGAAiG;IACjG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,6FAA6F;IAC7F,+FAA+F;IAC/F,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC;IAE1E,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,qBAAqB,CAAC;SAC3B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,+FAA+F;IAC/F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,cAAc,EAAE;CACpB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAmC;IAC9E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,WAAW,EAAE,uBAAuB;IACpC,UAAU,EAAE,wBAAwB;IACpC,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/**\n * A2A push-notification delivery log — one row per (task state change × registered webhook).\n *\n * ## Why this is a SIBLING of the M2M webhook delivery log rather than a variant of it\n *\n * The two share a delivery PATTERN — write the row before enqueueing, one queue job per row, the\n * worker classifies the response and either retries or terminates — and that pattern is reused\n * deliberately, down to the transport primitive. What they do not share is a SCOPE SET:\n * `M2MWebhookDeliveryLog` is stamped out for `ORGANIZATIONS` and `APPLICATION`, while an A2A task\n * can be owned by a **USER** as well. A delegated-user A2A caller is the ordinary case, not an edge\n * one, so extending the M2M resource would have meant adding a user-scoped variant — a whole\n * user-facing resource surface — to a shipped feature on behalf of a different subsystem.\n *\n * Keeping them separate also keeps the two producers separable in every query: a resource-operation\n * notification and a task-lifecycle notification are different facts about different things, and an\n * operator filtering one should never have to exclude the other by hand.\n *\n * ## Why the row is written BEFORE the delivery is attempted\n *\n * Copied from the M2M dispatcher's reasoning, because it is the property that makes this table\n * worth having: if the worker created the row on its first attempt, an unreachable queue would\n * leave no trace at all. Writing it up front means an operator always sees an entry per\n * (task transition × webhook), including the deliveries that never got as far as being tried.\n *\n * spec-cite: A2A 1.0 §4.3.3 — *\"Agents MUST attempt delivery at least once for each configured\n * webhook\"* — and §13.2, which asks for retry with exponential backoff and permits giving up after\n * a configured number of consecutive failures. This row is where all three become observable.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts — the pattern this mirrors\n * @see a2a-token-budget-state.shared.schemas.ts — the 3-scope A2A polymorphic precedent\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories, initZodDecorators } from '@wildo-ai/zod-decorators';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  optOutPolymorphicAutoBusinessKey,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\n/**\n * The delivery lifecycle:\n *   PENDING → IN_FLIGHT → DELIVERED   (acknowledged with 2xx)\n *   PENDING → IN_FLIGHT → PENDING     (transient failure — retry scheduled with backoff)\n *   PENDING → IN_FLIGHT → FAILED      (terminal — non-retryable status, or attempts exhausted)\n *\n * Deliberately its OWN enum rather than a reuse of `M2MWebhookDeliveryLogStatus`, even though the\n * members coincide. That enum is named for, and owned by, the M2M notifications feature; importing\n * it here would couple flows-actors to that subsystem's release cycle for no gain, and would make\n * either feature's future state change a cross-feature edit. If a third outbound-delivery consumer\n * ever appears, the answer is to extract ONE shared vocabulary — not to have the second consumer\n * borrow the first one's.\n */\nexport enum A2APushDeliveryStatus {\n  PENDING = 'pending',\n  IN_FLIGHT = 'in_flight',\n  DELIVERED = 'delivered',\n  FAILED = 'failed',\n}\n\nexport const A2APushDeliveryLogSchema = z.object({\n  /** Document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The stable identity of this delivery, generated once when the row is written and sent with\n   * every attempt so a receiver can deduplicate.\n   *\n   * spec-cite: A2A 1.0 §4.3.3 — *\"Clients SHOULD process notifications idempotently, as duplicate\n   * deliveries may occur\"*. A client can only honour that if duplicates are RECOGNISABLE, which\n   * means the id must be stable across retries — hence generated at row creation, never per attempt.\n   */\n  deliveryId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The task whose transition triggered this notification. */\n  taskId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** Which registered configuration this row delivers to — a task may have several. */\n  pushNotificationConfigId: z.string().min(1).isSummaryField(),\n\n  /**\n   * The agent instance the task belongs to. Carried so an operator can attribute deliveries per\n   * agent, and so a per-instance purge never reaches another agent's rows — the same isolation\n   * axis the task read enforces.\n   */\n  resourceServerInstanceRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The machine credential that owns the task, when one does.\n   *\n   * Carried because the worker must RE-READ the live configuration to obtain the client's\n   * credential (see the worker for why the secret is not copied onto this row), and that read\n   * enforces all four isolation axes. Without this field the read falls back to the \"no credential\"\n   * sentinel and matches nothing for any task a machine client created — which is most A2A tasks,\n   * since client-credentials auth is the ordinary way an agent connects.\n   *\n   * Optional rather than sentinel-defaulted: a delegated-user task genuinely has no machine\n   * credential, and storing a sentinel here would make \"absent\" and \"explicitly none\" the same\n   * value on a row whose whole job is to be evidence.\n   */\n  machineCredentialId: z.string().min(1).optional(),\n\n  /** The destination, captured as it was AT DISPATCH — a later config edit must not rewrite history. */\n  httpUrl: z.url(),\n\n  payloadHash: z.string().min(1),\n  // USER_CONTENT — the delivered payload carries the task's own content, which originated with the\n  // person. The declaration says what the field is FOR; a payload can hold anything a task held.\n  //\n  // `addDataCategories` rather than the fluent form: `z.unknown()` is one of the types that carry NO\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one), so\n  // `.dataCategories(...)` does not type-check on it. The helper is the documented escape hatch.\n  payload: addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n\n  status: z\n    .enum(A2APushDeliveryStatus)\n    .default(A2APushDeliveryStatus.PENDING)\n    .isDBIndexed()\n    .isSummaryField(),\n\n  attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n  lastAttemptAt: z.date().optional(),\n  /** When the next retry becomes eligible. Indexed — this is the worker's drain query. */\n  nextAttemptAt: z.date().optional().isDBIndexed(),\n\n  responseStatus: z.number().int().optional(),\n  /** Truncated by the worker before persistence: a webhook may answer with an unbounded body. */\n  responseBodyTruncated: z.string().optional(),\n  failureReason: z.string().optional().isSummaryField(),\n\n  deliveredAt: z.date().optional(),\n  failedAt: z.date().optional(),\n\n  createdAt: z\n    .date()\n    .default(() => new Date())\n    .isDBIndexed()\n    .isSummaryField(),\n});\n\nexport type A2APushDeliveryLogBase = z.infer<typeof A2APushDeliveryLogSchema>;\n\n/**\n * The three owner scopes an A2A task — and therefore its deliveries — can belong to.\n *\n * Mirrors `flowActorTasksPolymorphicDeclaration`'s scope set exactly, and must keep mirroring it: a\n * task owner with no delivery-log variant is a task whose notifications cannot be recorded, which\n * is the audit hole this table exists to close.\n */\nexport const A2A_PUSH_DELIVERY_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Produces 3 variants:\n *   - users         → `userA2aPushDeliveryLog`        (`userId` injected)\n *   - organizations → `organizationA2aPushDeliveryLog` (`organizationId` injected)\n *   - applications  → `applicationA2aPushDeliveryLog`  (`applicationId` injected)\n *\n * Multi-row, so it opts OUT of the singleton auto-business-key: unlike the token-budget\n * accumulator, there are many delivery rows per owner and the owner FK is not their identity.\n */\nexport const a2aPushDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aPushDeliveryLog',\n  baseFieldIdentifier: 'a2aPushDeliveryLogId',\n  baseEnumKey: 'A2A_PUSH_DELIVERY_LOG',\n  baseSchema: A2APushDeliveryLogSchema,\n  variants: A2A_PUSH_DELIVERY_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"a2a-push-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAE/E,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;AACnB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExD,qFAAqF;IACrF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE5D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3E;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD,sGAAsG;IACtG,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,iGAAiG;IACjG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,6FAA6F;IAC7F,+FAA+F;IAC/F,qGAAqG;IACrG,yGAAyG;IACzG,iDAAiD;IACjD,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC,EACjE,aAAa,CAAC,MAAM,CACrB;IAED,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,qBAAqB,CAAC;SAC3B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,+FAA+F;IAC/F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,cAAc,EAAE;CACpB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAmC;IAC9E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,WAAW,EAAE,uBAAuB;IACpC,UAAU,EAAE,wBAAwB;IACpC,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/**\n * A2A push-notification delivery log — one row per (task state change × registered webhook).\n *\n * ## Why this is a SIBLING of the M2M webhook delivery log rather than a variant of it\n *\n * The two share a delivery PATTERN — write the row before enqueueing, one queue job per row, the\n * worker classifies the response and either retries or terminates — and that pattern is reused\n * deliberately, down to the transport primitive. What they do not share is a SCOPE SET:\n * `M2MWebhookDeliveryLog` is stamped out for `ORGANIZATIONS` and `APPLICATION`, while an A2A task\n * can be owned by a **USER** as well. A delegated-user A2A caller is the ordinary case, not an edge\n * one, so extending the M2M resource would have meant adding a user-scoped variant — a whole\n * user-facing resource surface — to a shipped feature on behalf of a different subsystem.\n *\n * Keeping them separate also keeps the two producers separable in every query: a resource-operation\n * notification and a task-lifecycle notification are different facts about different things, and an\n * operator filtering one should never have to exclude the other by hand.\n *\n * ## Why the row is written BEFORE the delivery is attempted\n *\n * Copied from the M2M dispatcher's reasoning, because it is the property that makes this table\n * worth having: if the worker created the row on its first attempt, an unreachable queue would\n * leave no trace at all. Writing it up front means an operator always sees an entry per\n * (task transition × webhook), including the deliveries that never got as far as being tried.\n *\n * spec-cite: A2A 1.0 §4.3.3 — *\"Agents MUST attempt delivery at least once for each configured\n * webhook\"* — and §13.2, which asks for retry with exponential backoff and permits giving up after\n * a configured number of consecutive failures. This row is where all three become observable.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts — the pattern this mirrors\n * @see a2a-token-budget-state.shared.schemas.ts — the 3-scope A2A polymorphic precedent\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories, initZodDecorators, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  optOutPolymorphicAutoBusinessKey,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\n/**\n * The delivery lifecycle:\n *   PENDING → IN_FLIGHT → DELIVERED   (acknowledged with 2xx)\n *   PENDING → IN_FLIGHT → PENDING     (transient failure — retry scheduled with backoff)\n *   PENDING → IN_FLIGHT → FAILED      (terminal — non-retryable status, or attempts exhausted)\n *\n * Deliberately its OWN enum rather than a reuse of `M2MWebhookDeliveryLogStatus`, even though the\n * members coincide. That enum is named for, and owned by, the M2M notifications feature; importing\n * it here would couple flows-actors to that subsystem's release cycle for no gain, and would make\n * either feature's future state change a cross-feature edit. If a third outbound-delivery consumer\n * ever appears, the answer is to extract ONE shared vocabulary — not to have the second consumer\n * borrow the first one's.\n */\nexport enum A2APushDeliveryStatus {\n  PENDING = 'pending',\n  IN_FLIGHT = 'in_flight',\n  DELIVERED = 'delivered',\n  FAILED = 'failed',\n}\n\nexport const A2APushDeliveryLogSchema = z.object({\n  /** Document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The stable identity of this delivery, generated once when the row is written and sent with\n   * every attempt so a receiver can deduplicate.\n   *\n   * spec-cite: A2A 1.0 §4.3.3 — *\"Clients SHOULD process notifications idempotently, as duplicate\n   * deliveries may occur\"*. A client can only honour that if duplicates are RECOGNISABLE, which\n   * means the id must be stable across retries — hence generated at row creation, never per attempt.\n   */\n  deliveryId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The task whose transition triggered this notification. */\n  taskId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** Which registered configuration this row delivers to — a task may have several. */\n  pushNotificationConfigId: z.string().min(1).isSummaryField(),\n\n  /**\n   * The agent instance the task belongs to. Carried so an operator can attribute deliveries per\n   * agent, and so a per-instance purge never reaches another agent's rows — the same isolation\n   * axis the task read enforces.\n   */\n  resourceServerInstanceRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The machine credential that owns the task, when one does.\n   *\n   * Carried because the worker must RE-READ the live configuration to obtain the client's\n   * credential (see the worker for why the secret is not copied onto this row), and that read\n   * enforces all four isolation axes. Without this field the read falls back to the \"no credential\"\n   * sentinel and matches nothing for any task a machine client created — which is most A2A tasks,\n   * since client-credentials auth is the ordinary way an agent connects.\n   *\n   * Optional rather than sentinel-defaulted: a delegated-user task genuinely has no machine\n   * credential, and storing a sentinel here would make \"absent\" and \"explicitly none\" the same\n   * value on a row whose whole job is to be evidence.\n   */\n  machineCredentialId: z.string().min(1).optional(),\n\n  /** The destination, captured as it was AT DISPATCH — a later config edit must not rewrite history. */\n  httpUrl: z.url(),\n\n  payloadHash: z.string().min(1),\n  // USER_CONTENT — the delivered payload carries the task's own content, which originated with the\n  // person. The declaration says what the field is FOR; a payload can hold anything a task held.\n  //\n  // `addDataCategories` rather than the fluent form: `z.unknown()` is one of the types that carry NO\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one), so\n  // `.dataCategories(...)` does not type-check on it. The helper is the documented escape hatch.\n  // REMOVE on erasure. The delivered payload carries the task's own content, which originated with the\n  // person — so it is content this row HOLDS. `z.unknown()` accepts null, so REMOVE is clearable here even\n  // though the field is not written `.optional()`.\n  payload: addImpersonalizeWith(\n    addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n\n  status: z\n    .enum(A2APushDeliveryStatus)\n    .default(A2APushDeliveryStatus.PENDING)\n    .isDBIndexed()\n    .isSummaryField(),\n\n  attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n  lastAttemptAt: z.date().optional(),\n  /** When the next retry becomes eligible. Indexed — this is the worker's drain query. */\n  nextAttemptAt: z.date().optional().isDBIndexed(),\n\n  responseStatus: z.number().int().optional(),\n  /** Truncated by the worker before persistence: a webhook may answer with an unbounded body. */\n  responseBodyTruncated: z.string().optional(),\n  failureReason: z.string().optional().isSummaryField(),\n\n  deliveredAt: z.date().optional(),\n  failedAt: z.date().optional(),\n\n  createdAt: z\n    .date()\n    .default(() => new Date())\n    .isDBIndexed()\n    .isSummaryField(),\n});\n\nexport type A2APushDeliveryLogBase = z.infer<typeof A2APushDeliveryLogSchema>;\n\n/**\n * The three owner scopes an A2A task — and therefore its deliveries — can belong to.\n *\n * Mirrors `flowActorTasksPolymorphicDeclaration`'s scope set exactly, and must keep mirroring it: a\n * task owner with no delivery-log variant is a task whose notifications cannot be recorded, which\n * is the audit hole this table exists to close.\n */\nexport const A2A_PUSH_DELIVERY_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Produces 3 variants:\n *   - users         → `userA2aPushDeliveryLog`        (`userId` injected)\n *   - organizations → `organizationA2aPushDeliveryLog` (`organizationId` injected)\n *   - applications  → `applicationA2aPushDeliveryLog`  (`applicationId` injected)\n *\n * Multi-row, so it opts OUT of the singleton auto-business-key: unlike the token-budget\n * accumulator, there are many delivery rows per owner and the owner FK is not their identity.\n */\nexport const a2aPushDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aPushDeliveryLog',\n  baseFieldIdentifier: 'a2aPushDeliveryLogId',\n  baseEnumKey: 'A2A_PUSH_DELIVERY_LOG',\n  baseSchema: A2APushDeliveryLogSchema,\n  variants: A2A_PUSH_DELIVERY_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.d.ts

@@ -57,5 +57,5 @@ import { CoreResourceOperation } from '../resources/resources.shared.core.defini
  *   - organizationA2aTokenBudgetState
  *   - applicationA2aTokenBudgetState
  */
-export declare const a2aTokenBudgetStatePolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE, any>>;
+export declare const a2aTokenBudgetStatePolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=a2a-token-budget-state.shared.resources-config.schemas.d.ts.map

package/dist/esm/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AA2BzG;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,oLAsEnD,CAAC"}
+{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AA4BzG;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,qPA8InD,CAAC"}