@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/flows-actors/agent-work-decisions.shared.schemas.js

@@ -0,0 +1,472 @@
+/**
+ * # Agent-work decisions: what an expert did with an agent's proposal (#1599)
+ *
+ * An AI-native service firm's moat is its experts' corrections to agent work. This file is the record of them: one
+ * row per decision a person took on something an agent PROPOSED (a tool call, an actor's reviewable output, a drafted
+ * row), in two resources split by what the law asks of each half:
+ *
+ * - `agentWorkDecisions` — the METADATA, always written: who decided what, on which agent's proposal, for which case,
+ *   when, and how far the final version is from the proposal (paths, an edit distance, two tenant-keyed digests).
+ *   Bound to `AUDIT_LOGS`: it is the operator's evidence of how agent work was supervised, and it must outlive the
+ *   content it describes.
+ * - `agentWorkDecisionContents` — the CONTENT (proposal, final, the JSON Patch between them, a reason text), written
+ *   ONLY when the tenant opted in (`CorrectionContentCapture.WITH_CONTENT`). Bound to `RESOURCE_DATA`: it is the
+ *   client's material, kept only as long as the rest of the tenant's data.
+ *
+ * One resource would have forced one retention period on both halves; the record of a decision must be kept longer
+ * than the words it decided on (#1613 binds one class per resource).
+ *
+ * Two organization settings govern the second half and its reuse: `agentWorkCaptureSettings` (the opt-in, with its
+ * stated purpose and the role that may read content) and `evaluationExportAuthorizations` (the basis on which a
+ * tenant's decisions may be exported as evaluation data). Every export is recorded in `evaluationDatasetExports`.
+ *
+ * ## Why not the audit trail
+ *
+ * The decision is audited once, by #1594's `HUMAN_DECISION_RESOLVED`. The trail replicates to a SIEM and an immutable
+ * ledger, so it is metadata-only by design and can never hold a proposal or a final version, nor be scrubbed when the
+ * case is erased. These rows can.
+ *
+ * ## What is never stored here
+ *
+ * - The FINAL work product: the record POINTS at it (`finalWorkProductRef`); the row lives in the application's own
+ *   table, whose erasure and retention already apply.
+ * - An unkeyed digest of content: `proposedDigest` / `finalDigest` are HMAC-SHA256 under a key derived per tenant from
+ *   the application's primary secret. An unkeyed hash of low-entropy content (a status, a title) is reversed by
+ *   enumeration, even in an erasable resource.
+ * - Free-text reasons in the metadata: `reasonCode` is a value of the application-declared vocabulary; free text goes
+ *   to the opt-in content only.
+ */
+import { z } from 'zod';
+import { initZodDecorators, addImpersonalizeWith } from '@wildo-ai/zod-decorators';
+import { AgentWorkDecisionSurface, AgentWorkReasonCodeSchema, HumanDecision_Outcome } from './human-decision.shared.schemas.js';
+import { WorkUnitRefSchema } from '../resources/work-unit.shared.schemas.js';
+import { ExecutionRefSchema } from './work-attribution.shared.schemas.js';
+import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
+import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
+import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey, } from '../resources/utils/resource-polymorphism.schemas.js';
+initZodDecorators(z);
+/**
+ * @wildo_source:part:start saas.models.agent-work-decision-vocabulary facet:layer:shared facet:family:flows-actors facet:audience:app-developer
+ *
+ * How a decision record came to be written.
+ */
+export var AgentWorkDecisionRecordSource;
+(function (AgentWorkDecisionRecordSource) {
+    /** Written by the settle that won the decision, right after its compare-and-swap. */
+    AgentWorkDecisionRecordSource["SETTLEMENT"] = "settlement";
+    /**
+     * Written by the repair sweep from the execution row's resolution columns, because the process died between the
+     * settle and the write. Metadata only: content captured in the lost window is not reconstructed.
+     */
+    AgentWorkDecisionRecordSource["ROW_REPAIR"] = "row_repair";
+})(AgentWorkDecisionRecordSource || (AgentWorkDecisionRecordSource = {}));
+/** Why an evaluation-dataset export was refused (#1599 I7). */
+export var EvaluationDatasetExportRefusalReason;
+(function (EvaluationDatasetExportRefusalReason) {
+    /** The organization has recorded no export authorisation. */
+    EvaluationDatasetExportRefusalReason["NO_AUTHORIZATION"] = "no_authorization";
+    /** The organization's authorisation is revoked. */
+    EvaluationDatasetExportRefusalReason["AUTHORIZATION_REVOKED"] = "authorization_revoked";
+})(EvaluationDatasetExportRefusalReason || (EvaluationDatasetExportRefusalReason = {}));
+/** What an override-rate summary groups by. */
+export var AgentWorkDecisionGrouping;
+(function (AgentWorkDecisionGrouping) {
+    AgentWorkDecisionGrouping["AGENT"] = "agent";
+    AgentWorkDecisionGrouping["TOOL"] = "tool";
+    AgentWorkDecisionGrouping["CASE"] = "case";
+    AgentWorkDecisionGrouping["DECIDER"] = "decider";
+})(AgentWorkDecisionGrouping || (AgentWorkDecisionGrouping = {}));
+/**
+ * Whether a tenant keeps the CONTENT of its experts' corrections. OFF by default (GDPR Art. 25(2) data protection by
+ * default; the OpenTelemetry GenAI conventions ask instrumentations not to capture content by default): the override
+ * rate needs only the outcome.
+ */
+export var CorrectionContentCapture;
+(function (CorrectionContentCapture) {
+    /** Outcome, timestamps, paths and digests only. The default, and what an organization with no setting gets. */
+    CorrectionContentCapture["METADATA_ONLY"] = "metadata_only";
+    /** Also the proposal, the final version, the diff and a reason text, in `agentWorkDecisionContents`. */
+    CorrectionContentCapture["WITH_CONTENT"] = "with_content";
+})(CorrectionContentCapture || (CorrectionContentCapture = {}));
+/**
+ * The legal basis a tenant records for exporting its experts' corrections as evaluation data. There is no third
+ * member: an export with no recorded basis is refused.
+ */
+export var EvaluationExportBasis;
+(function (EvaluationExportBasis) {
+    /**
+     * The firm acts as PROCESSOR and the controller (its client) documented the instruction to improve the firm's
+     * agents on this data (GDPR Art. 28(3)(a)).
+     */
+    EvaluationExportBasis["PROCESSOR_DOCUMENTED_INSTRUCTION"] = "processor_documented_instruction";
+    /**
+     * The firm acts as CONTROLLER and assessed the further use as compatible with the original purpose (GDPR
+     * Art. 5(1)(b), Art. 6(4)), with pseudonymisation as a safeguard.
+     */
+    EvaluationExportBasis["CONTROLLER_COMPATIBILITY_ASSESSED"] = "controller_compatibility_assessed";
+})(EvaluationExportBasis || (EvaluationExportBasis = {}));
+/** Whether an export authorisation currently admits an export. */
+export var EvaluationExportAuthorizationStatus;
+(function (EvaluationExportAuthorizationStatus) {
+    /**
+     * Nobody granted one. The state the organization's row is created in when its settings page is first read (the row
+     * records that no decision was taken; it is not one). Exports are refused. Only a row that was never ACTIVE may hold
+     * it: withdrawing a grant is REVOKED, which marks the datasets built under it.
+     */
+    EvaluationExportAuthorizationStatus["NOT_GRANTED"] = "not_granted";
+    /** Granted, on the recorded basis. Exports are admitted. */
+    EvaluationExportAuthorizationStatus["ACTIVE"] = "active";
+    /** Withdrawn by the organization. Exports are refused, and datasets built under it are marked. */
+    EvaluationExportAuthorizationStatus["REVOKED"] = "revoked";
+})(EvaluationExportAuthorizationStatus || (EvaluationExportAuthorizationStatus = {}));
+/** Why an exported dataset may no longer be used. */
+export var EvaluationDatasetInvalidationReason;
+(function (EvaluationDatasetInvalidationReason) {
+    /** A case it contains was erased. */
+    EvaluationDatasetInvalidationReason["SUBJECT_ERASURE"] = "subject_erasure";
+    /** The authorisation it was exported under was revoked. */
+    EvaluationDatasetInvalidationReason["CONSENT_WITHDRAWN"] = "consent_withdrawn";
+})(EvaluationDatasetInvalidationReason || (EvaluationDatasetInvalidationReason = {}));
+/**
+ * The outcomes a person actually DECIDED. The override rate counts only these: a lapse, a withdrawal or a lapsed
+ * authority is nobody's judgement on the proposal, and counting it would move the rate without any expert having
+ * looked.
+ */
+export const AGENT_WORK_DECISION_RATED_OUTCOMES = Object.freeze([
+    HumanDecision_Outcome.ACCEPTED,
+    HumanDecision_Outcome.ACCEPTED_WITH_MODIFICATIONS,
+    HumanDecision_Outcome.REJECTED,
+]);
+/** The outcomes that OVERRIDE the proposal: the numerator of the override rate. */
+export const AGENT_WORK_DECISION_OVERRIDE_OUTCOMES = Object.freeze([
+    HumanDecision_Outcome.ACCEPTED_WITH_MODIFICATIONS,
+    HumanDecision_Outcome.REJECTED,
+]);
+/** @wildo_source:part:end saas.models.agent-work-decision-vocabulary */
+/** A pointer at a row of the application: the final work product, never a copy of it. */
+export const AgentWorkProductRefSchema = z.strictObject({
+    resourceType: z.string().min(1).max(120).describe('Name of the resource the final work product is a row of, as the API names it.'),
+    resourceId: z.string().min(1).max(200).describe('Id of that row. The decision points at the final version; it never holds a copy.'),
+});
+/**
+ * @wildo_source:part:start saas.models.agent-work-review-config facet:layer:shared facet:family:flows-actors facet:audience:app-developer
+ *
+ * `agentWorkReview` in the backend configuration (#1599): the application's reason-code vocabulary for corrections,
+ * and the case resources whose work is privileged (an export of such a case needs its client's recorded consent).
+ * Optional: absent, reason codes are refused and no case is treated as privileged.
+ */
+export const AgentWorkReviewConfigSchema = z.strictObject({
+    /** The reason codes an expert may give for a correction. A code outside this list is refused, never stored. */
+    reasonCodes: z.array(AgentWorkReasonCodeSchema).max(200).default([]),
+    /** Work-unit resource types whose cases are privileged or confidential (a matter, a patient file). */
+    privilegedCaseResourceTypes: z.array(z.string().min(1).max(120)).max(50).default([]),
+});
+/** @wildo_source:part:end saas.models.agent-work-review-config */
+/** A tenant-keyed HMAC-SHA256, hex. */
+const KeyedDigestSchema = z.string().regex(/^[0-9a-f]{64}$/);
+//===============================================================
+//  agentWorkDecisions — the metadata record
+//===============================================================
+export const AgentWorkDecisionBaseSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /**
+     * The ONE decision id (#1594's `pendingDecisionRef` = `HumanDecision_Request.decisionId`), or the id the application
+     * supplied to `recordOutputReview`. Unique, so every writer (the settle, the repair sweep, a retried output review)
+     * records a decision at most once. Uniqueness is per variant store, like every polymorphic business key: a decision
+     * is recorded in the scope of the execution it paused, so one ref never has two candidate stores.
+     */
+    decisionRef: z.string().min(1).max(200).isUnique({ scope: 'global', sparse: false }).excludeFromUpdate().isSummaryField(),
+    surface: z.enum(AgentWorkDecisionSurface).systemEnum('AgentWorkDecisionSurface').isDBIndexed().isSummaryField(),
+    outcome: z.enum(HumanDecision_Outcome).systemEnum('HumanDecision_Outcome').isDBIndexed().isSummaryField(),
+    /**
+     * The tenant the work was done for: the case row's organization when there is a case, else the organization the
+     * decision was routed in or the execution belongs to. Absent only for work outside any organization. Stored on
+     * every variant because the override rate and the export are per tenant, whichever principal owned the thread.
+     */
+    workOrganizationId: z.string().min(1).isDBIndexed().optional(),
+    /** The actor system (or agent) whose proposal was decided. */
+    agentRef: z.string().min(1).max(200).isDBIndexed().isSummaryField(),
+    /** The agent's declared version when it has one. */
+    agentVersion: z.string().min(1).max(120).optional(),
+    toolName: z.string().min(1).max(200).isDBIndexed().optional(),
+    // Work references (#1598): which case, which run, which task.
+    caseRef: WorkUnitRefSchema.optional(),
+    executionRef: ExecutionRefSchema.optional(),
+    taskRef: z.string().min(1).max(200).optional(),
+    /** The row the final version lives in. The record points at it rather than copying it. */
+    finalWorkProductRef: AgentWorkProductRefSchema.optional(),
+    // Diff statistics — what changed, never what it changed to.
+    /**
+     * The paths the final version changed, added or removed, sorted: an RFC 6901 pointer without its leading `/`, so a
+     * top-level argument reads as its own name (`title`). `[]` when accepted as proposed.
+     */
+    modifiedPaths: z.array(z.string().max(400)).default([]),
+    /** Levenshtein distance between the canonical JSON of the proposal and of the final version, when both were known. */
+    editDistance: z.number().int().min(0).optional(),
+    /** HMAC-SHA256 of the canonical proposal under the tenant's correction key. Never an unkeyed hash. */
+    proposedDigest: KeyedDigestSchema.optional(),
+    /** HMAC-SHA256 of the canonical final version under the same key. Equal digests: accepted as proposed. */
+    finalDigest: KeyedDigestSchema.optional(),
+    /** A value of the application-declared reason vocabulary. Never free text. */
+    reasonCode: AgentWorkReasonCodeSchema.optional(),
+    /**
+     * Who decided. Severable: an erasure removes it and keeps the decision, which is the operator's evidence that agent
+     * work was supervised.
+     */
+    deciderUserId: addImpersonalizeWith(z.string().min(1).isDBIndexed().optional().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),
+    /** The route role that admitted the decider, when a role route admitted them (#1594). */
+    admittedByRole: z.string().min(1).max(120).optional(),
+    /**
+     * When the proposal was PUT BEFORE the decider: #1594's claim instant when the decision was claimed, else the instant
+     * it was requested. Never the time this record was written. `decidedAt − presentedAt` is a proxy for review effort,
+     * and it is labelled as a proxy wherever it is summed.
+     */
+    presentedAt: z.date().isDBIndexed(),
+    decidedAt: z.date().isDBIndexed().isSummaryField(),
+    recordSource: z.enum(AgentWorkDecisionRecordSource).systemEnum('AgentWorkDecisionRecordSource'),
+    /** Whether a content row was written beside this record (the tenant's opt-in held when it was decided). */
+    contentRecorded: z.boolean().default(false),
+    createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+});
+//===============================================================
+//  agentWorkDecisionContents — the opt-in content
+//===============================================================
+export const AgentWorkDecisionContentBaseSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The decision this content belongs to; unique, so a retried write cannot store the content twice. */
+    decisionRef: z.string().min(1).max(200).isUnique({ scope: 'global', sparse: false }).excludeFromUpdate().isSummaryField(),
+    /** The case the content is about: an erasure of that row scrubs this content, whatever scope it lives in. */
+    caseRef: WorkUnitRefSchema.optional(),
+    /** The tenant, for the per-tenant reads of the export. */
+    workOrganizationId: z.string().min(1).isDBIndexed().optional(),
+    /** The proposal, as canonical JSON. */
+    proposalJson: addImpersonalizeWith(z.string().max(200_000).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),
+    /** The final version, as canonical JSON. */
+    finalJson: addImpersonalizeWith(z.string().max(200_000).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),
+    /** The RFC 6902 JSON Patch from the proposal to the final version, as JSON. */
+    diffJson: addImpersonalizeWith(z.string().max(200_000).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),
+    /** The decider's own words, when they gave any. */
+    reasonText: addImpersonalizeWith(z.string().max(4_000).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),
+    createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+});
+//===============================================================
+//  Polymorphic declarations (the owner scope of the paused work)
+//===============================================================
+/**
+ * The three owner scopes a decision is recorded in: the scope of the execution it paused (a user's own chat, an
+ * organization's machine turn, an application's), or the organization of an output review. Multi-row per scope, so
+ * the injected owner FK is not a business key.
+ */
+export const AGENT_WORK_DECISION_SCOPE_VARIANTS = [
+    { parentResourceType: CoreResourceType.USERS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS], isPrimaryScope: true },
+    { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },
+    { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },
+].map(optOutPolymorphicAutoBusinessKey);
+/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */
+export const agentWorkDecisionsPolymorphicDeclaration = declarePolymorphicSchemas({
+    baseResourceType: 'agentWorkDecisions',
+    baseFieldIdentifier: 'agentWorkDecisionId',
+    baseEnumKey: 'AGENT_WORK_DECISIONS',
+    baseSchema: AgentWorkDecisionBaseSchema,
+    variants: AGENT_WORK_DECISION_SCOPE_VARIANTS,
+});
+/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */
+export const agentWorkDecisionContentsPolymorphicDeclaration = declarePolymorphicSchemas({
+    baseResourceType: 'agentWorkDecisionContents',
+    baseFieldIdentifier: 'agentWorkDecisionContentId',
+    baseEnumKey: 'AGENT_WORK_DECISION_CONTENTS',
+    baseSchema: AgentWorkDecisionContentBaseSchema,
+    variants: AGENT_WORK_DECISION_SCOPE_VARIANTS,
+});
+//===============================================================
+//  The organization's settings: content capture, and export authorisation
+//===============================================================
+/**
+ * @wildo_source:part:start saas.models.agent-work-capture-settings facet:layer:shared facet:family:flows-actors facet:audience:app-developer
+ *
+ * One organization's choice to keep the CONTENT of its experts' corrections (#1599 D5). No row means
+ * `METADATA_ONLY`. Every change is audited (`CORRECTION_CAPTURE_SETTING_CHANGED`). Keeping content needs a stated
+ * purpose; the engine refuses `WITH_CONTENT` without one.
+ */
+export const AgentWorkCaptureSettingsSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),
+    contentCapture: z.enum(CorrectionContentCapture).systemEnum('CorrectionContentCapture').default(CorrectionContentCapture.METADATA_ONLY).isSummaryField(),
+    /** Why the content is kept, stated by the organization. Required to turn capture on. */
+    purpose: z.string().min(1).max(2_000).optional(),
+    /**
+     * The organization role that may READ captured content (an organization administrator always may). Content is the
+     * client's material; the role says who among its people may see what the experts changed.
+     */
+    contentReaderRole: z.string().min(1).max(120).optional(),
+    /** Keep content only for these cases (a matter-by-matter opt-in). Empty: every case of the organization. */
+    narrowToCaseRefs: z.array(WorkUnitRefSchema).max(500).default([]),
+    createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+    updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+});
+/** @wildo_source:part:end saas.models.agent-work-capture-settings */
+/** One client consent an export may rely on, for privileged or confidential work on one case. */
+export const EvaluationExportConsentSchema = z.strictObject({
+    caseRef: WorkUnitRefSchema.describe('The case the client consented for. A case of a resource the application declares privileged is exported only with such a consent.'),
+    /** Where the consent is recorded (an engagement-letter clause, a signed form): a reference, never the text. */
+    consentRef: z.string().min(1).max(500).describe('Where the client\'s consent is recorded, such as an engagement-letter clause or a signed form. A reference, never the consent text.'),
+    recordedAt: z.iso.datetime({ offset: true }).describe('When the consent was recorded.'),
+});
+/**
+ * @wildo_source:part:start saas.models.evaluation-export-authorization facet:layer:shared facet:family:flows-actors facet:audience:app-developer
+ *
+ * One organization's recorded authorisation to export its experts' corrections as evaluation data (#1599 D7). No row,
+ * NOT_GRANTED or REVOKED: every export is refused. Every change is audited (`EVALUATION_EXPORT_AUTHORIZATION_CHANGED`).
+ *
+ * `basis` and `basisReference` are optional in the shape because a NOT_GRANTED row has neither, and required of every
+ * ACTIVE row: the write that would leave the row ACTIVE without both is refused.
+ */
+export const EvaluationExportAuthorizationSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),
+    status: z.enum(EvaluationExportAuthorizationStatus).systemEnum('EvaluationExportAuthorizationStatus').default(EvaluationExportAuthorizationStatus.ACTIVE).isSummaryField(),
+    /** Required when ACTIVE. */
+    basis: z.enum(EvaluationExportBasis).systemEnum('EvaluationExportBasis').optional().isSummaryField(),
+    /** Where the basis is documented: the controller's instruction, or the compatibility assessment. A reference. Required when ACTIVE. */
+    basisReference: z.string().min(1).max(500).optional(),
+    /**
+     * Per-case client consents. A case of a work-unit resource the application declares PRIVILEGED
+     * (`agentWorkReview.privilegedCaseResourceTypes`) is exported only with its client's consent here.
+     */
+    clientConsents: z.array(EvaluationExportConsentSchema).max(2_000).default([]),
+    /** Ethical walls and client opt-outs: cases never exported, whatever else holds. */
+    excludedCaseRefs: z.array(WorkUnitRefSchema).max(2_000).default([]),
+    createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+    updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+});
+/** @wildo_source:part:end saas.models.evaluation-export-authorization */
+/** One export of a tenant's corrections: the ledger an auditor and an erasure both read (#1599 D7). */
+export const EvaluationDatasetExportSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    exportedByUserId: addImpersonalizeWith(z.string().min(1).optional().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),
+    exportedAt: z.date().isDBIndexed().isSummaryField(),
+    authorizationId: z.string().min(1),
+    basis: z.enum(EvaluationExportBasis).systemEnum('EvaluationExportBasis'),
+    agentRef: z.string().min(1).max(200).isDBIndexed(),
+    windowFrom: z.date(),
+    windowTo: z.date(),
+    /** Every decision record the dataset contains. */
+    decisionRefs: z.array(z.string().min(1).max(200)).default([]),
+    /** The cases the dataset contains (`resourceType:resourceId`), so a case's erasure finds it. */
+    caseKeys: z.array(z.string().min(1).max(400)).default([]),
+    recordCount: z.number().int().min(0),
+    /** The pseudonymisation scheme the identifiers were written under. */
+    pseudonymisationVersion: z.string().min(1).max(40),
+    /** Where the dataset was delivered, as the caller named it. */
+    destination: z.string().min(1).max(500),
+    invalidatedAt: z.date().optional(),
+    invalidationReason: z.enum(EvaluationDatasetInvalidationReason).systemEnum('EvaluationDatasetInvalidationReason').optional(),
+    createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+});
+//===============================================================
+//  Application API contracts
+//===============================================================
+/**
+ * @wildo_source:part:start saas.models.agent-work-output-review facet:layer:shared facet:family:flows-actors facet:audience:app-developer
+ *
+ * `recordOutputReview` — the application tells the engine an expert reviewed output an agent drafted into the
+ * application's own rows (the main case in a service firm: an agent drafts a letter, a lawyer edits it). The
+ * application supplies `decisionRef` (opaque, unique per review), so a retried call records once.
+ */
+export const AgentWorkOutputReviewInputSchema = z.strictObject({
+    decisionRef: z.string().min(1).max(200),
+    outcome: z.enum([HumanDecision_Outcome.ACCEPTED, HumanDecision_Outcome.ACCEPTED_WITH_MODIFICATIONS, HumanDecision_Outcome.REJECTED]),
+    agentRef: z.string().min(1).max(200),
+    agentVersion: z.string().min(1).max(120).optional(),
+    /** The case the output is for. Admitted only if it is a readable row of a `workUnit` resource. */
+    caseRef: WorkUnitRefSchema.optional(),
+    taskRef: z.string().min(1).max(200).optional(),
+    /** The row the reviewed output now lives in. */
+    finalWorkProductRef: AgentWorkProductRefSchema.optional(),
+    /** What the agent proposed, and what the expert kept. Used for the diff; stored only under the tenant's opt-in. */
+    proposal: z.unknown().optional(),
+    final: z.unknown().optional(),
+    reasonCode: AgentWorkReasonCodeSchema.optional(),
+    reasonText: z.string().max(4_000).optional(),
+    /** When the draft was put before the expert (defaults to the review instant when the application does not know). */
+    presentedAt: z.iso.datetime({ offset: true }).optional(),
+});
+/** @wildo_source:part:end saas.models.agent-work-output-review */
+/** The longest window one override-rate summary or export may cover. */
+export const AGENT_WORK_MAX_WINDOW_DAYS = 366;
+const withinWindow = (request) => {
+    const from = Date.parse(request.from);
+    const to = Date.parse(request.to);
+    return from < to && to - from <= AGENT_WORK_MAX_WINDOW_DAYS * 24 * 60 * 60_000;
+};
+/**
+ * @wildo_source:part:start saas.models.agent-work-override-rate facet:layer:shared facet:family:flows-actors facet:audience:app-developer
+ *
+ * The override rate: (ACCEPTED_WITH_MODIFICATIONS + REJECTED) / (ACCEPTED + ACCEPTED_WITH_MODIFICATIONS + REJECTED)
+ * per group, over a window. Lapsed, withdrawn and authority-lapsed decisions are counted apart and never enter the
+ * rate. Computed from metadata only: no export authorisation is needed.
+ */
+export const AgentWorkOverrideRateRequestSchema = z.strictObject({
+    from: z.iso.datetime({ offset: true }),
+    to: z.iso.datetime({ offset: true }),
+    groupBy: z.enum(AgentWorkDecisionGrouping),
+    /** The tenant. Required for an organization administrator; an application administrator may omit it. */
+    organizationId: z.string().min(1).optional(),
+    agentRef: z.string().min(1).optional(),
+}).refine(withinWindow, { message: `from must precede to, within ${AGENT_WORK_MAX_WINDOW_DAYS} days`, path: ['to'] });
+export const AgentWorkOverrideRateGroupSchema = z.object({
+    key: z.object({
+        agentRef: z.string().optional(),
+        toolName: z.string().optional(),
+        caseRef: WorkUnitRefSchema.optional(),
+        deciderUserId: z.string().optional(),
+    }),
+    accepted: z.number().int().min(0),
+    acceptedWithModifications: z.number().int().min(0),
+    rejected: z.number().int().min(0),
+    /** Lapsed, withdrawn and authority-lapsed: not decisions anyone made, never in the rate. */
+    notDecided: z.number().int().min(0),
+    /** `null` when nothing was decided in the group: a rate of zero decisions is not zero. */
+    overrideRate: z.number().min(0).max(1).nullable(),
+});
+export const AgentWorkOverrideRateSchema = z.object({
+    window: z.object({ from: z.string(), to: z.string() }),
+    groupBy: z.enum(AgentWorkDecisionGrouping),
+    groups: z.array(AgentWorkOverrideRateGroupSchema),
+});
+/** @wildo_source:part:end saas.models.agent-work-override-rate */
+/**
+ * @wildo_source:part:start saas.models.evaluation-dataset-export facet:layer:shared facet:family:flows-actors facet:audience:app-developer
+ *
+ * `POST /agent-work/evaluation-exports` — export one tenant's decisions on ONE agent's proposals over a window, as
+ * pseudonymised JSON Lines. Refused (and audited) without an ACTIVE authorisation of that organization. Never pools
+ * tenants: one organization per export.
+ */
+export const EvaluationDatasetExportRequestSchema = z.strictObject({
+    organizationId: z.string().min(1),
+    agentRef: z.string().min(1).max(200),
+    from: z.iso.datetime({ offset: true }),
+    to: z.iso.datetime({ offset: true }),
+    /** Where the dataset goes (an evaluation store, a bucket path): recorded on the ledger. */
+    destination: z.string().min(1).max(500),
+}).refine(withinWindow, { message: `from must precede to, within ${AGENT_WORK_MAX_WINDOW_DAYS} days`, path: ['to'] });
+export const EvaluationDatasetExportResultSchema = z.object({
+    exportId: z.string(),
+    recordCount: z.number().int().min(0),
+    /**
+     * The dataset, one JSON object per line: no decider and no organization. The record's own identifiers are
+     * pseudonymised wherever they appear, including inside kept content; other values in kept content are exported as
+     * the organization kept them.
+     */
+    jsonl: z.string(),
+    pseudonymisationVersion: z.string(),
+});
+/** @wildo_source:part:end saas.models.evaluation-dataset-export */
+/** The override rate of counted outcomes; `null` when nothing was decided. */
+export function agentWorkOverrideRate(counts) {
+    const decided = counts.accepted + counts.acceptedWithModifications + counts.rejected;
+    return decided === 0 ? null : (counts.acceptedWithModifications + counts.rejected) / decided;
+}
+//# sourceMappingURL=agent-work-decisions.shared.schemas.js.map

package/dist/esm/flows-actors/agent-work-decisions.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-work-decisions.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/agent-work-decisions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEnF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7H,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAN,IAAY,6BAQX;AARD,WAAY,6BAA6B;IACvC,qFAAqF;IACrF,0DAAyB,CAAA;IACzB;;;OAGG;IACH,0DAAyB,CAAA;AAC3B,CAAC,EARW,6BAA6B,KAA7B,6BAA6B,QAQxC;AAED,+DAA+D;AAC/D,MAAM,CAAN,IAAY,oCAKX;AALD,WAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,6EAAqC,CAAA;IACrC,mDAAmD;IACnD,uFAA+C,CAAA;AACjD,CAAC,EALW,oCAAoC,KAApC,oCAAoC,QAK/C;AAED,+CAA+C;AAC/C,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,4CAAe,CAAA;IACf,0CAAa,CAAA;IACb,0CAAa,CAAA;IACb,gDAAmB,CAAA;AACrB,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,+GAA+G;IAC/G,2DAA+B,CAAA;IAC/B,wGAAwG;IACxG,yDAA6B,CAAA;AAC/B,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAWX;AAXD,WAAY,qBAAqB;IAC/B;;;OAGG;IACH,8FAAqE,CAAA;IACrE;;;OAGG;IACH,gGAAuE,CAAA;AACzE,CAAC,EAXW,qBAAqB,KAArB,qBAAqB,QAWhC;AAED,kEAAkE;AAClE,MAAM,CAAN,IAAY,mCAWX;AAXD,WAAY,mCAAmC;IAC7C;;;;OAIG;IACH,kEAA2B,CAAA;IAC3B,4DAA4D;IAC5D,wDAAiB,CAAA;IACjB,kGAAkG;IAClG,0DAAmB,CAAA;AACrB,CAAC,EAXW,mCAAmC,KAAnC,mCAAmC,QAW9C;AAED,qDAAqD;AACrD,MAAM,CAAN,IAAY,mCAKX;AALD,WAAY,mCAAmC;IAC7C,qCAAqC;IACrC,0EAAmC,CAAA;IACnC,2DAA2D;IAC3D,8EAAuC,CAAA;AACzC,CAAC,EALW,mCAAmC,KAAnC,mCAAmC,QAK9C;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAqC,MAAM,CAAC,MAAM,CAAC;IAChG,qBAAqB,CAAC,QAAQ;IAC9B,qBAAqB,CAAC,2BAA2B;IACjD,qBAAqB,CAAC,QAAQ;CAC/B,CAAC,CAAC;AACH,mFAAmF;AACnF,MAAM,CAAC,MAAM,qCAAqC,GAAqC,MAAM,CAAC,MAAM,CAAC;IACnG,qBAAqB,CAAC,2BAA2B;IACjD,qBAAqB,CAAC,QAAQ;CAC/B,CAAC,CAAC;AACH,wEAAwE;AAExE,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,+EAA+E,CAAC;IAClI,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,kFAAkF,CAAC;CACpI,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,+GAA+G;IAC/G,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,sGAAsG;IACtG,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACrF,CAAC,CAAC;AAEH,kEAAkE;AAElE,uCAAuC;AACvC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE7D,iEAAiE;AACjE,4CAA4C;AAC5C,iEAAiE;AAEjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,cAAc,EAAE;IACzH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/G,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEzG;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAE9D,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnE,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAE7D,8DAA8D;IAC9D,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAE9C,0FAA0F;IAC1F,mBAAmB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEzD,4DAA4D;IAC5D;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,sHAAsH;IACtH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,sGAAsG;IACtG,cAAc,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC5C,0GAA0G;IAC1G,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEzC,8EAA8E;IAC9E,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEhD;;;OAGG;IACH,aAAa,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;IACnJ,yFAAyF;IACzF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAErD;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAElD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAC/F,2GAA2G;IAC3G,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE3C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,iEAAiE;AACjE,kDAAkD;AAClD,iEAAiE;AAEjE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,uGAAuG;IACvG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,cAAc,EAAE;IACzH,6GAA6G;IAC7G,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,0DAA0D;IAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC9D,uCAAuC;IACvC,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;IAC9I,4CAA4C;IAC5C,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;IAC3I,+EAA+E;IAC/E,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;IAC1I,mDAAmD;IACnD,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;IAC1I,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,iEAAiE;AACjE,iEAAiE;AACjE,iEAAiE;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAmC;IAChF,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvJ,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;CACpK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAExC,qGAAqG;AACrG,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,qBAAqB;IAC1C,WAAW,EAAE,sBAAsB;IACnC,UAAU,EAAE,2BAA2B;IACvC,QAAQ,EAAE,kCAAkC;CAC7C,CAAC,CAAC;AAEH,0HAA0H;AAC1H,MAAM,CAAC,MAAM,+CAA+C,GAAG,yBAAyB,CAAC;IACvF,gBAAgB,EAAE,2BAA2B;IAC7C,mBAAmB,EAAE,4BAA4B;IACjD,WAAW,EAAE,8BAA8B;IAC3C,UAAU,EAAE,kCAAkC;IAC9C,QAAQ,EAAE,kCAAkC;CAC7C,CAAC,CAAC;AAEH,iEAAiE;AACjE,0EAA0E;AAC1E,iEAAiE;AAEjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC9G,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,cAAc,EAAE;IACxJ,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAChD;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACxD,4GAA4G;IAC5G,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAEH,qEAAqE;AAErE,iGAAiG;AACjG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1D,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,mIAAmI,CAAC;IACxK,+GAA+G;IAC/G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,qIAAqI,CAAC;IACtL,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;CACxF,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC9G,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,UAAU,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;IAC1K,4BAA4B;IAC5B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACpG,uIAAuI;IACvI,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,oFAAoF;IACpF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAEH,yEAAyE;AAEzE,uGAAuG;AACvG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;IACxI,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE;IAClB,kDAAkD;IAClD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,gGAAgG;IAChG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,sEAAsE;IACtE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAClD,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,UAAU,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IAC5H,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,iEAAiE;AACjE,6BAA6B;AAC7B,iEAAiE;AAEjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,QAAQ,CAAU,CAAC;IAC7I,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnD,kGAAkG;IAClG,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9C,gDAAgD;IAChD,mBAAmB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACzD,mHAAmH;IACnH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC5C,oHAAoH;IACpH,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAEH,kEAAkE;AAElE,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,YAAY,GAAG,CAAC,OAAqC,EAAW,EAAE;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACjF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAC1C,wGAAwG;IACxG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,gCAAgC,0BAA0B,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAGtH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,4FAA4F;IAC5F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;CAClD,CAAC,CAAC;AAEH,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,2FAA2F;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,gCAAgC,0BAA0B,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAGtH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;CACpC,CAAC,CAAC;AAEH,mEAAmE;AAEnE,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,MAAiF;IACrH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrF,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;AAC/F,CAAC","sourcesContent":["/**\n * # Agent-work decisions: what an expert did with an agent's proposal (#1599)\n *\n * An AI-native service firm's moat is its experts' corrections to agent work. This file is the record of them: one\n * row per decision a person took on something an agent PROPOSED (a tool call, an actor's reviewable output, a drafted\n * row), in two resources split by what the law asks of each half:\n *\n * - `agentWorkDecisions` — the METADATA, always written: who decided what, on which agent's proposal, for which case,\n *   when, and how far the final version is from the proposal (paths, an edit distance, two tenant-keyed digests).\n *   Bound to `AUDIT_LOGS`: it is the operator's evidence of how agent work was supervised, and it must outlive the\n *   content it describes.\n * - `agentWorkDecisionContents` — the CONTENT (proposal, final, the JSON Patch between them, a reason text), written\n *   ONLY when the tenant opted in (`CorrectionContentCapture.WITH_CONTENT`). Bound to `RESOURCE_DATA`: it is the\n *   client's material, kept only as long as the rest of the tenant's data.\n *\n * One resource would have forced one retention period on both halves; the record of a decision must be kept longer\n * than the words it decided on (#1613 binds one class per resource).\n *\n * Two organization settings govern the second half and its reuse: `agentWorkCaptureSettings` (the opt-in, with its\n * stated purpose and the role that may read content) and `evaluationExportAuthorizations` (the basis on which a\n * tenant's decisions may be exported as evaluation data). Every export is recorded in `evaluationDatasetExports`.\n *\n * ## Why not the audit trail\n *\n * The decision is audited once, by #1594's `HUMAN_DECISION_RESOLVED`. The trail replicates to a SIEM and an immutable\n * ledger, so it is metadata-only by design and can never hold a proposal or a final version, nor be scrubbed when the\n * case is erased. These rows can.\n *\n * ## What is never stored here\n *\n * - The FINAL work product: the record POINTS at it (`finalWorkProductRef`); the row lives in the application's own\n *   table, whose erasure and retention already apply.\n * - An unkeyed digest of content: `proposedDigest` / `finalDigest` are HMAC-SHA256 under a key derived per tenant from\n *   the application's primary secret. An unkeyed hash of low-entropy content (a status, a title) is reversed by\n *   enumeration, even in an erasable resource.\n * - Free-text reasons in the metadata: `reasonCode` is a value of the application-declared vocabulary; free text goes\n *   to the opt-in content only.\n */\nimport { z } from 'zod';\nimport { initZodDecorators, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\nimport { AgentWorkDecisionSurface, AgentWorkReasonCodeSchema, HumanDecision_Outcome } from './human-decision.shared.schemas';\nimport { WorkUnitRefSchema } from '../resources/work-unit.shared.schemas';\nimport { ExecutionRefSchema } from './work-attribution.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  optOutPolymorphicAutoBusinessKey,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\n/**\n * @wildo_source:part:start saas.models.agent-work-decision-vocabulary facet:layer:shared facet:family:flows-actors facet:audience:app-developer\n *\n * How a decision record came to be written.\n */\nexport enum AgentWorkDecisionRecordSource {\n  /** Written by the settle that won the decision, right after its compare-and-swap. */\n  SETTLEMENT = 'settlement',\n  /**\n   * Written by the repair sweep from the execution row's resolution columns, because the process died between the\n   * settle and the write. Metadata only: content captured in the lost window is not reconstructed.\n   */\n  ROW_REPAIR = 'row_repair',\n}\n\n/** Why an evaluation-dataset export was refused (#1599 I7). */\nexport enum EvaluationDatasetExportRefusalReason {\n  /** The organization has recorded no export authorisation. */\n  NO_AUTHORIZATION = 'no_authorization',\n  /** The organization's authorisation is revoked. */\n  AUTHORIZATION_REVOKED = 'authorization_revoked',\n}\n\n/** What an override-rate summary groups by. */\nexport enum AgentWorkDecisionGrouping {\n  AGENT = 'agent',\n  TOOL = 'tool',\n  CASE = 'case',\n  DECIDER = 'decider',\n}\n\n/**\n * Whether a tenant keeps the CONTENT of its experts' corrections. OFF by default (GDPR Art. 25(2) data protection by\n * default; the OpenTelemetry GenAI conventions ask instrumentations not to capture content by default): the override\n * rate needs only the outcome.\n */\nexport enum CorrectionContentCapture {\n  /** Outcome, timestamps, paths and digests only. The default, and what an organization with no setting gets. */\n  METADATA_ONLY = 'metadata_only',\n  /** Also the proposal, the final version, the diff and a reason text, in `agentWorkDecisionContents`. */\n  WITH_CONTENT = 'with_content',\n}\n\n/**\n * The legal basis a tenant records for exporting its experts' corrections as evaluation data. There is no third\n * member: an export with no recorded basis is refused.\n */\nexport enum EvaluationExportBasis {\n  /**\n   * The firm acts as PROCESSOR and the controller (its client) documented the instruction to improve the firm's\n   * agents on this data (GDPR Art. 28(3)(a)).\n   */\n  PROCESSOR_DOCUMENTED_INSTRUCTION = 'processor_documented_instruction',\n  /**\n   * The firm acts as CONTROLLER and assessed the further use as compatible with the original purpose (GDPR\n   * Art. 5(1)(b), Art. 6(4)), with pseudonymisation as a safeguard.\n   */\n  CONTROLLER_COMPATIBILITY_ASSESSED = 'controller_compatibility_assessed',\n}\n\n/** Whether an export authorisation currently admits an export. */\nexport enum EvaluationExportAuthorizationStatus {\n  /**\n   * Nobody granted one. The state the organization's row is created in when its settings page is first read (the row\n   * records that no decision was taken; it is not one). Exports are refused. Only a row that was never ACTIVE may hold\n   * it: withdrawing a grant is REVOKED, which marks the datasets built under it.\n   */\n  NOT_GRANTED = 'not_granted',\n  /** Granted, on the recorded basis. Exports are admitted. */\n  ACTIVE = 'active',\n  /** Withdrawn by the organization. Exports are refused, and datasets built under it are marked. */\n  REVOKED = 'revoked',\n}\n\n/** Why an exported dataset may no longer be used. */\nexport enum EvaluationDatasetInvalidationReason {\n  /** A case it contains was erased. */\n  SUBJECT_ERASURE = 'subject_erasure',\n  /** The authorisation it was exported under was revoked. */\n  CONSENT_WITHDRAWN = 'consent_withdrawn',\n}\n\n/**\n * The outcomes a person actually DECIDED. The override rate counts only these: a lapse, a withdrawal or a lapsed\n * authority is nobody's judgement on the proposal, and counting it would move the rate without any expert having\n * looked.\n */\nexport const AGENT_WORK_DECISION_RATED_OUTCOMES: readonly HumanDecision_Outcome[] = Object.freeze([\n  HumanDecision_Outcome.ACCEPTED,\n  HumanDecision_Outcome.ACCEPTED_WITH_MODIFICATIONS,\n  HumanDecision_Outcome.REJECTED,\n]);\n/** The outcomes that OVERRIDE the proposal: the numerator of the override rate. */\nexport const AGENT_WORK_DECISION_OVERRIDE_OUTCOMES: readonly HumanDecision_Outcome[] = Object.freeze([\n  HumanDecision_Outcome.ACCEPTED_WITH_MODIFICATIONS,\n  HumanDecision_Outcome.REJECTED,\n]);\n/** @wildo_source:part:end saas.models.agent-work-decision-vocabulary */\n\n/** A pointer at a row of the application: the final work product, never a copy of it. */\nexport const AgentWorkProductRefSchema = z.strictObject({\n  resourceType: z.string().min(1).max(120).describe('Name of the resource the final work product is a row of, as the API names it.'),\n  resourceId: z.string().min(1).max(200).describe('Id of that row. The decision points at the final version; it never holds a copy.'),\n});\nexport type AgentWorkProductRef = z.infer<typeof AgentWorkProductRefSchema>;\n\n/**\n * @wildo_source:part:start saas.models.agent-work-review-config facet:layer:shared facet:family:flows-actors facet:audience:app-developer\n *\n * `agentWorkReview` in the backend configuration (#1599): the application's reason-code vocabulary for corrections,\n * and the case resources whose work is privileged (an export of such a case needs its client's recorded consent).\n * Optional: absent, reason codes are refused and no case is treated as privileged.\n */\nexport const AgentWorkReviewConfigSchema = z.strictObject({\n  /** The reason codes an expert may give for a correction. A code outside this list is refused, never stored. */\n  reasonCodes: z.array(AgentWorkReasonCodeSchema).max(200).default([]),\n  /** Work-unit resource types whose cases are privileged or confidential (a matter, a patient file). */\n  privilegedCaseResourceTypes: z.array(z.string().min(1).max(120)).max(50).default([]),\n});\nexport type AgentWorkReviewConfig = z.infer<typeof AgentWorkReviewConfigSchema>;\n/** @wildo_source:part:end saas.models.agent-work-review-config */\n\n/** A tenant-keyed HMAC-SHA256, hex. */\nconst KeyedDigestSchema = z.string().regex(/^[0-9a-f]{64}$/);\n\n//===============================================================\n//  agentWorkDecisions — the metadata record\n//===============================================================\n\nexport const AgentWorkDecisionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The ONE decision id (#1594's `pendingDecisionRef` = `HumanDecision_Request.decisionId`), or the id the application\n   * supplied to `recordOutputReview`. Unique, so every writer (the settle, the repair sweep, a retried output review)\n   * records a decision at most once. Uniqueness is per variant store, like every polymorphic business key: a decision\n   * is recorded in the scope of the execution it paused, so one ref never has two candidate stores.\n   */\n  decisionRef: z.string().min(1).max(200).isUnique({ scope: 'global', sparse: false }).excludeFromUpdate().isSummaryField(),\n  surface: z.enum(AgentWorkDecisionSurface).systemEnum('AgentWorkDecisionSurface').isDBIndexed().isSummaryField(),\n  outcome: z.enum(HumanDecision_Outcome).systemEnum('HumanDecision_Outcome').isDBIndexed().isSummaryField(),\n\n  /**\n   * The tenant the work was done for: the case row's organization when there is a case, else the organization the\n   * decision was routed in or the execution belongs to. Absent only for work outside any organization. Stored on\n   * every variant because the override rate and the export are per tenant, whichever principal owned the thread.\n   */\n  workOrganizationId: z.string().min(1).isDBIndexed().optional(),\n\n  /** The actor system (or agent) whose proposal was decided. */\n  agentRef: z.string().min(1).max(200).isDBIndexed().isSummaryField(),\n  /** The agent's declared version when it has one. */\n  agentVersion: z.string().min(1).max(120).optional(),\n  toolName: z.string().min(1).max(200).isDBIndexed().optional(),\n\n  // Work references (#1598): which case, which run, which task.\n  caseRef: WorkUnitRefSchema.optional(),\n  executionRef: ExecutionRefSchema.optional(),\n  taskRef: z.string().min(1).max(200).optional(),\n\n  /** The row the final version lives in. The record points at it rather than copying it. */\n  finalWorkProductRef: AgentWorkProductRefSchema.optional(),\n\n  // Diff statistics — what changed, never what it changed to.\n  /**\n   * The paths the final version changed, added or removed, sorted: an RFC 6901 pointer without its leading `/`, so a\n   * top-level argument reads as its own name (`title`). `[]` when accepted as proposed.\n   */\n  modifiedPaths: z.array(z.string().max(400)).default([]),\n  /** Levenshtein distance between the canonical JSON of the proposal and of the final version, when both were known. */\n  editDistance: z.number().int().min(0).optional(),\n  /** HMAC-SHA256 of the canonical proposal under the tenant's correction key. Never an unkeyed hash. */\n  proposedDigest: KeyedDigestSchema.optional(),\n  /** HMAC-SHA256 of the canonical final version under the same key. Equal digests: accepted as proposed. */\n  finalDigest: KeyedDigestSchema.optional(),\n\n  /** A value of the application-declared reason vocabulary. Never free text. */\n  reasonCode: AgentWorkReasonCodeSchema.optional(),\n\n  /**\n   * Who decided. Severable: an erasure removes it and keeps the decision, which is the operator's evidence that agent\n   * work was supervised.\n   */\n  deciderUserId: addImpersonalizeWith(z.string().min(1).isDBIndexed().optional().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),\n  /** The route role that admitted the decider, when a role route admitted them (#1594). */\n  admittedByRole: z.string().min(1).max(120).optional(),\n\n  /**\n   * When the proposal was PUT BEFORE the decider: #1594's claim instant when the decision was claimed, else the instant\n   * it was requested. Never the time this record was written. `decidedAt − presentedAt` is a proxy for review effort,\n   * and it is labelled as a proxy wherever it is summed.\n   */\n  presentedAt: z.date().isDBIndexed(),\n  decidedAt: z.date().isDBIndexed().isSummaryField(),\n\n  recordSource: z.enum(AgentWorkDecisionRecordSource).systemEnum('AgentWorkDecisionRecordSource'),\n  /** Whether a content row was written beside this record (the tenant's opt-in held when it was decided). */\n  contentRecorded: z.boolean().default(false),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\nexport type AgentWorkDecision = z.infer<typeof AgentWorkDecisionBaseSchema>;\n\n//===============================================================\n//  agentWorkDecisionContents — the opt-in content\n//===============================================================\n\nexport const AgentWorkDecisionContentBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /** The decision this content belongs to; unique, so a retried write cannot store the content twice. */\n  decisionRef: z.string().min(1).max(200).isUnique({ scope: 'global', sparse: false }).excludeFromUpdate().isSummaryField(),\n  /** The case the content is about: an erasure of that row scrubs this content, whatever scope it lives in. */\n  caseRef: WorkUnitRefSchema.optional(),\n  /** The tenant, for the per-tenant reads of the export. */\n  workOrganizationId: z.string().min(1).isDBIndexed().optional(),\n  /** The proposal, as canonical JSON. */\n  proposalJson: addImpersonalizeWith(z.string().max(200_000).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),\n  /** The final version, as canonical JSON. */\n  finalJson: addImpersonalizeWith(z.string().max(200_000).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),\n  /** The RFC 6902 JSON Patch from the proposal to the final version, as JSON. */\n  diffJson: addImpersonalizeWith(z.string().max(200_000).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),\n  /** The decider's own words, when they gave any. */\n  reasonText: addImpersonalizeWith(z.string().max(4_000).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\nexport type AgentWorkDecisionContent = z.infer<typeof AgentWorkDecisionContentBaseSchema>;\n\n//===============================================================\n//  Polymorphic declarations (the owner scope of the paused work)\n//===============================================================\n\n/**\n * The three owner scopes a decision is recorded in: the scope of the execution it paused (a user's own chat, an\n * organization's machine turn, an application's), or the organization of an output review. Multi-row per scope, so\n * the injected owner FK is not a business key.\n */\nexport const AGENT_WORK_DECISION_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },\n].map(optOutPolymorphicAutoBusinessKey);\n\n/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */\nexport const agentWorkDecisionsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'agentWorkDecisions',\n  baseFieldIdentifier: 'agentWorkDecisionId',\n  baseEnumKey: 'AGENT_WORK_DECISIONS',\n  baseSchema: AgentWorkDecisionBaseSchema,\n  variants: AGENT_WORK_DECISION_SCOPE_VARIANTS,\n});\n\n/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */\nexport const agentWorkDecisionContentsPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'agentWorkDecisionContents',\n  baseFieldIdentifier: 'agentWorkDecisionContentId',\n  baseEnumKey: 'AGENT_WORK_DECISION_CONTENTS',\n  baseSchema: AgentWorkDecisionContentBaseSchema,\n  variants: AGENT_WORK_DECISION_SCOPE_VARIANTS,\n});\n\n//===============================================================\n//  The organization's settings: content capture, and export authorisation\n//===============================================================\n\n/**\n * @wildo_source:part:start saas.models.agent-work-capture-settings facet:layer:shared facet:family:flows-actors facet:audience:app-developer\n *\n * One organization's choice to keep the CONTENT of its experts' corrections (#1599 D5). No row means\n * `METADATA_ONLY`. Every change is audited (`CORRECTION_CAPTURE_SETTING_CHANGED`). Keeping content needs a stated\n * purpose; the engine refuses `WITH_CONTENT` without one.\n */\nexport const AgentWorkCaptureSettingsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  contentCapture: z.enum(CorrectionContentCapture).systemEnum('CorrectionContentCapture').default(CorrectionContentCapture.METADATA_ONLY).isSummaryField(),\n  /** Why the content is kept, stated by the organization. Required to turn capture on. */\n  purpose: z.string().min(1).max(2_000).optional(),\n  /**\n   * The organization role that may READ captured content (an organization administrator always may). Content is the\n   * client's material; the role says who among its people may see what the experts changed.\n   */\n  contentReaderRole: z.string().min(1).max(120).optional(),\n  /** Keep content only for these cases (a matter-by-matter opt-in). Empty: every case of the organization. */\n  narrowToCaseRefs: z.array(WorkUnitRefSchema).max(500).default([]),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type AgentWorkCaptureSettings = z.infer<typeof AgentWorkCaptureSettingsSchema>;\n/** @wildo_source:part:end saas.models.agent-work-capture-settings */\n\n/** One client consent an export may rely on, for privileged or confidential work on one case. */\nexport const EvaluationExportConsentSchema = z.strictObject({\n  caseRef: WorkUnitRefSchema.describe('The case the client consented for. A case of a resource the application declares privileged is exported only with such a consent.'),\n  /** Where the consent is recorded (an engagement-letter clause, a signed form): a reference, never the text. */\n  consentRef: z.string().min(1).max(500).describe('Where the client\\'s consent is recorded, such as an engagement-letter clause or a signed form. A reference, never the consent text.'),\n  recordedAt: z.iso.datetime({ offset: true }).describe('When the consent was recorded.'),\n});\nexport type EvaluationExportConsent = z.infer<typeof EvaluationExportConsentSchema>;\n\n/**\n * @wildo_source:part:start saas.models.evaluation-export-authorization facet:layer:shared facet:family:flows-actors facet:audience:app-developer\n *\n * One organization's recorded authorisation to export its experts' corrections as evaluation data (#1599 D7). No row,\n * NOT_GRANTED or REVOKED: every export is refused. Every change is audited (`EVALUATION_EXPORT_AUTHORIZATION_CHANGED`).\n *\n * `basis` and `basisReference` are optional in the shape because a NOT_GRANTED row has neither, and required of every\n * ACTIVE row: the write that would leave the row ACTIVE without both is refused.\n */\nexport const EvaluationExportAuthorizationSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  status: z.enum(EvaluationExportAuthorizationStatus).systemEnum('EvaluationExportAuthorizationStatus').default(EvaluationExportAuthorizationStatus.ACTIVE).isSummaryField(),\n  /** Required when ACTIVE. */\n  basis: z.enum(EvaluationExportBasis).systemEnum('EvaluationExportBasis').optional().isSummaryField(),\n  /** Where the basis is documented: the controller's instruction, or the compatibility assessment. A reference. Required when ACTIVE. */\n  basisReference: z.string().min(1).max(500).optional(),\n  /**\n   * Per-case client consents. A case of a work-unit resource the application declares PRIVILEGED\n   * (`agentWorkReview.privilegedCaseResourceTypes`) is exported only with its client's consent here.\n   */\n  clientConsents: z.array(EvaluationExportConsentSchema).max(2_000).default([]),\n  /** Ethical walls and client opt-outs: cases never exported, whatever else holds. */\n  excludedCaseRefs: z.array(WorkUnitRefSchema).max(2_000).default([]),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type EvaluationExportAuthorization = z.infer<typeof EvaluationExportAuthorizationSchema>;\n/** @wildo_source:part:end saas.models.evaluation-export-authorization */\n\n/** One export of a tenant's corrections: the ledger an auditor and an erasure both read (#1599 D7). */\nexport const EvaluationDatasetExportSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  exportedByUserId: addImpersonalizeWith(z.string().min(1).optional().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),\n  exportedAt: z.date().isDBIndexed().isSummaryField(),\n  authorizationId: z.string().min(1),\n  basis: z.enum(EvaluationExportBasis).systemEnum('EvaluationExportBasis'),\n  agentRef: z.string().min(1).max(200).isDBIndexed(),\n  windowFrom: z.date(),\n  windowTo: z.date(),\n  /** Every decision record the dataset contains. */\n  decisionRefs: z.array(z.string().min(1).max(200)).default([]),\n  /** The cases the dataset contains (`resourceType:resourceId`), so a case's erasure finds it. */\n  caseKeys: z.array(z.string().min(1).max(400)).default([]),\n  recordCount: z.number().int().min(0),\n  /** The pseudonymisation scheme the identifiers were written under. */\n  pseudonymisationVersion: z.string().min(1).max(40),\n  /** Where the dataset was delivered, as the caller named it. */\n  destination: z.string().min(1).max(500),\n  invalidatedAt: z.date().optional(),\n  invalidationReason: z.enum(EvaluationDatasetInvalidationReason).systemEnum('EvaluationDatasetInvalidationReason').optional(),\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type EvaluationDatasetExport = z.infer<typeof EvaluationDatasetExportSchema>;\n\n//===============================================================\n//  Application API contracts\n//===============================================================\n\n/**\n * @wildo_source:part:start saas.models.agent-work-output-review facet:layer:shared facet:family:flows-actors facet:audience:app-developer\n *\n * `recordOutputReview` — the application tells the engine an expert reviewed output an agent drafted into the\n * application's own rows (the main case in a service firm: an agent drafts a letter, a lawyer edits it). The\n * application supplies `decisionRef` (opaque, unique per review), so a retried call records once.\n */\nexport const AgentWorkOutputReviewInputSchema = z.strictObject({\n  decisionRef: z.string().min(1).max(200),\n  outcome: z.enum([HumanDecision_Outcome.ACCEPTED, HumanDecision_Outcome.ACCEPTED_WITH_MODIFICATIONS, HumanDecision_Outcome.REJECTED] as const),\n  agentRef: z.string().min(1).max(200),\n  agentVersion: z.string().min(1).max(120).optional(),\n  /** The case the output is for. Admitted only if it is a readable row of a `workUnit` resource. */\n  caseRef: WorkUnitRefSchema.optional(),\n  taskRef: z.string().min(1).max(200).optional(),\n  /** The row the reviewed output now lives in. */\n  finalWorkProductRef: AgentWorkProductRefSchema.optional(),\n  /** What the agent proposed, and what the expert kept. Used for the diff; stored only under the tenant's opt-in. */\n  proposal: z.unknown().optional(),\n  final: z.unknown().optional(),\n  reasonCode: AgentWorkReasonCodeSchema.optional(),\n  reasonText: z.string().max(4_000).optional(),\n  /** When the draft was put before the expert (defaults to the review instant when the application does not know). */\n  presentedAt: z.iso.datetime({ offset: true }).optional(),\n});\nexport type AgentWorkOutputReviewInput = z.infer<typeof AgentWorkOutputReviewInputSchema>;\n/** @wildo_source:part:end saas.models.agent-work-output-review */\n\n/** The longest window one override-rate summary or export may cover. */\nexport const AGENT_WORK_MAX_WINDOW_DAYS = 366;\nconst withinWindow = (request: { from: string; to: string }): boolean => {\n  const from = Date.parse(request.from);\n  const to = Date.parse(request.to);\n  return from < to && to - from <= AGENT_WORK_MAX_WINDOW_DAYS * 24 * 60 * 60_000;\n};\n\n/**\n * @wildo_source:part:start saas.models.agent-work-override-rate facet:layer:shared facet:family:flows-actors facet:audience:app-developer\n *\n * The override rate: (ACCEPTED_WITH_MODIFICATIONS + REJECTED) / (ACCEPTED + ACCEPTED_WITH_MODIFICATIONS + REJECTED)\n * per group, over a window. Lapsed, withdrawn and authority-lapsed decisions are counted apart and never enter the\n * rate. Computed from metadata only: no export authorisation is needed.\n */\nexport const AgentWorkOverrideRateRequestSchema = z.strictObject({\n  from: z.iso.datetime({ offset: true }),\n  to: z.iso.datetime({ offset: true }),\n  groupBy: z.enum(AgentWorkDecisionGrouping),\n  /** The tenant. Required for an organization administrator; an application administrator may omit it. */\n  organizationId: z.string().min(1).optional(),\n  agentRef: z.string().min(1).optional(),\n}).refine(withinWindow, { message: `from must precede to, within ${AGENT_WORK_MAX_WINDOW_DAYS} days`, path: ['to'] });\nexport type AgentWorkOverrideRateRequest = z.infer<typeof AgentWorkOverrideRateRequestSchema>;\n\nexport const AgentWorkOverrideRateGroupSchema = z.object({\n  key: z.object({\n    agentRef: z.string().optional(),\n    toolName: z.string().optional(),\n    caseRef: WorkUnitRefSchema.optional(),\n    deciderUserId: z.string().optional(),\n  }),\n  accepted: z.number().int().min(0),\n  acceptedWithModifications: z.number().int().min(0),\n  rejected: z.number().int().min(0),\n  /** Lapsed, withdrawn and authority-lapsed: not decisions anyone made, never in the rate. */\n  notDecided: z.number().int().min(0),\n  /** `null` when nothing was decided in the group: a rate of zero decisions is not zero. */\n  overrideRate: z.number().min(0).max(1).nullable(),\n});\nexport type AgentWorkOverrideRateGroup = z.infer<typeof AgentWorkOverrideRateGroupSchema>;\n\nexport const AgentWorkOverrideRateSchema = z.object({\n  window: z.object({ from: z.string(), to: z.string() }),\n  groupBy: z.enum(AgentWorkDecisionGrouping),\n  groups: z.array(AgentWorkOverrideRateGroupSchema),\n});\nexport type AgentWorkOverrideRate = z.infer<typeof AgentWorkOverrideRateSchema>;\n/** @wildo_source:part:end saas.models.agent-work-override-rate */\n\n/**\n * @wildo_source:part:start saas.models.evaluation-dataset-export facet:layer:shared facet:family:flows-actors facet:audience:app-developer\n *\n * `POST /agent-work/evaluation-exports` — export one tenant's decisions on ONE agent's proposals over a window, as\n * pseudonymised JSON Lines. Refused (and audited) without an ACTIVE authorisation of that organization. Never pools\n * tenants: one organization per export.\n */\nexport const EvaluationDatasetExportRequestSchema = z.strictObject({\n  organizationId: z.string().min(1),\n  agentRef: z.string().min(1).max(200),\n  from: z.iso.datetime({ offset: true }),\n  to: z.iso.datetime({ offset: true }),\n  /** Where the dataset goes (an evaluation store, a bucket path): recorded on the ledger. */\n  destination: z.string().min(1).max(500),\n}).refine(withinWindow, { message: `from must precede to, within ${AGENT_WORK_MAX_WINDOW_DAYS} days`, path: ['to'] });\nexport type EvaluationDatasetExportRequest = z.infer<typeof EvaluationDatasetExportRequestSchema>;\n\nexport const EvaluationDatasetExportResultSchema = z.object({\n  exportId: z.string(),\n  recordCount: z.number().int().min(0),\n  /**\n   * The dataset, one JSON object per line: no decider and no organization. The record's own identifiers are\n   * pseudonymised wherever they appear, including inside kept content; other values in kept content are exported as\n   * the organization kept them.\n   */\n  jsonl: z.string(),\n  pseudonymisationVersion: z.string(),\n});\nexport type EvaluationDatasetExportResult = z.infer<typeof EvaluationDatasetExportResultSchema>;\n/** @wildo_source:part:end saas.models.evaluation-dataset-export */\n\n/** The override rate of counted outcomes; `null` when nothing was decided. */\nexport function agentWorkOverrideRate(counts: { accepted: number; acceptedWithModifications: number; rejected: number }): number | null {\n  const decided = counts.accepted + counts.acceptedWithModifications + counts.rejected;\n  return decided === 0 ? null : (counts.acceptedWithModifications + counts.rejected) / decided;\n}\n"]}

package/dist/esm/flows-actors/agents.shared.schemas.d.ts

@@ -4,7 +4,7 @@ import { FlowsActors_IO_PartKind } from "./flows-actors.io.shared.schemas";
 import { ExecutionContext_InitiatorIds } from "../runtime/execution-context.shared.schemas";
 import z from "zod";
 import { FlowsActors_Relationship } from "./flows-actors.commons.shared.schemas";
-import { AppsBlueprint_FileFormat } from "./apps-blueprint/artifacts.apps-blueprint.shared.schemas";
+import { AgentFileFormat } from "@wildo-ai/zod-decorators";
 /** @wildo_source:part:start saas.models.flows-actors.agent-configuration facet:kind:api facet:audience:app-developer
  *
  * Agent execution settings that stay stable across transport changes.
@@ -162,7 +162,7 @@ export declare const FlowsActors_Agent_ConstraintSchema: z.ZodObject<{
 export type FlowsActors_Agent_Constraint = z.infer<typeof FlowsActors_Agent_ConstraintSchema>;
 export declare const FlowsActors_Agent_OutputSpecSchema: z.ZodObject<{
     type: z.ZodOptional<z.ZodEnum<typeof FlowsActors_IO_PartKind>>;
-    fileFormat: z.ZodOptional<z.ZodEnum<typeof AppsBlueprint_FileFormat>>;
+    fileFormat: z.ZodOptional<z.ZodEnum<typeof AgentFileFormat>>;
     lengthGuidance: z.ZodOptional<z.ZodEnum<typeof FlowsActors_Agent_Verbosity>>;
     includeReasoning: z.ZodOptional<z.ZodBoolean>;
     requiredSections: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -209,7 +209,7 @@ export declare const FlowsActors_Agent_PromptSpecSchema: z.ZodObject<{
     goal: z.ZodOptional<z.ZodString>;
     output: z.ZodOptional<z.ZodObject<{
         type: z.ZodOptional<z.ZodEnum<typeof FlowsActors_IO_PartKind>>;
-        fileFormat: z.ZodOptional<z.ZodEnum<typeof AppsBlueprint_FileFormat>>;
+        fileFormat: z.ZodOptional<z.ZodEnum<typeof AgentFileFormat>>;
         lengthGuidance: z.ZodOptional<z.ZodEnum<typeof FlowsActors_Agent_Verbosity>>;
         includeReasoning: z.ZodOptional<z.ZodBoolean>;
         requiredSections: z.ZodOptional<z.ZodArray<z.ZodString>>;