@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/flows-actors/agent-work-decisions.shared.resources-config.schemas.js

@@ -0,0 +1,276 @@
+/**
+ * Agent-work decisions: resource configurations (#1599).
+ *
+ * Five resources, one concern: the record of what experts did with agents' proposals, and what the tenant allowed
+ * to be done with it.
+ *
+ * - `agentWorkDecisions` (polymorphic, the owner scope of the paused work) — the metadata record. Written by the
+ *   engine only (the settlement, the repair sweep, `recordOutputReview`), read by the scope's administrator. Kept
+ *   for the declared AUDIT_LOGS period; an erasure of the decider severs `deciderUserId` and keeps the decision.
+ * - `agentWorkDecisionContents` (polymorphic, same scopes) — the opt-in content. Written by the engine only, under
+ *   the tenant's `WITH_CONTENT` setting. Deleted with its owner scope by the composition cascade, like the tenant's
+ *   other data (a per-row RESOURCE_DATA clock cannot be bound: the user and application variants name no
+ *   organization, which `SCOPE_DELETED` counts from). An erasure scrubs every content field.
+ * - `agentWorkCaptureSettings` / `evaluationExportAuthorizations` (organization singletons) — the organization
+ *   administrator's two decisions; every change is audited by the backend's postfix.
+ * - `evaluationDatasetExports` (organization) — the export ledger, kept for AUDIT_LOGS.
+ */
+import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
+import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { AgentWorkCaptureSettingsSchema, EvaluationDatasetExportSchema, EvaluationExportAuthorizationSchema, agentWorkDecisionContentsPolymorphicDeclaration, agentWorkDecisionsPolymorphicDeclaration, } from './agent-work-decisions.shared.schemas.js';
+/**
+ * Who reads a scope's decisions. A user reads the decisions taken on their OWN threads; an organization's or an
+ * application's are shared scope data, read by its administrator — the `flowActorExecutions` reasoning, since the
+ * records describe work in those threads.
+ */
+const OWNER_READ_ROLES = {
+    [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],
+    [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+    [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+};
+/**
+ * Content is the client's material: its reader is the scope's ADMINISTRATOR, plus — in an organization — the one role
+ * the organization's capture setting names (`contentReaderRole`). The organization route therefore admits members, and
+ * the backend's read gate (`agent-work-decisions.custom-impl.backend.service.ts`) narrows every READ and LIST to an
+ * organization-wide administrator or holder of that role, reading the setting at the moment of the read. A user never
+ * reads content from the generic plane.
+ */
+const CONTENT_READ_ROLES = {
+    [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+    [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_MEMBER],
+    [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+};
+/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */
+export const agentWorkDecisionsPolymorphicFactories = createPolymorphicResourceConfigurations(agentWorkDecisionsPolymorphicDeclaration, {
+    isSystemResource: true,
+    systemAccessPolicy: {
+        // The decider's own decisions belong in their subject export; the backend-only floor still applies.
+        exportSubject: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+    },
+    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /*
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the operator's evidence of supervised agent work, kept for
+     * the declared AUDIT_LOGS period from creation, never a number of this resource's own.
+     */
+    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },
+    /** An erasure severs the decider (`deciderUserId` REMOVE) and keeps the decision: the evidence outlives the person. */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.UPDATE_MANY,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        // The retention writer's door (`retentionPolicy` requires it); route-less.
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+    },
+});
+/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */
+export const agentWorkDecisionContentsPolymorphicFactories = createPolymorphicResourceConfigurations(agentWorkDecisionContentsPolymorphicDeclaration, {
+    isSystemResource: true,
+    systemAccessPolicy: {
+        exportSubject: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+    },
+    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /*
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the content is the client's material, kept for the declared
+     * RESOURCE_DATA period from when it was written (#1599 Q3), and never longer than the evidence beside it. A creation
+     * start point needs no organization, so it binds all three owner scopes alike.
+     */
+    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },
+    /**
+     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure scrubs the proposal, the final version, the
+     * diff and the reason (all REMOVE); the metadata record beside it survives.
+     */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.UPDATE_MANY,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        // The retention writer's door (`retentionPolicy` requires it); route-less.
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.MEDIUM }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+    },
+});
+const ORGANIZATION_SETTING_CORE_OPERATIONS = [
+    CoreResourceOperation.READ,
+    CoreResourceOperation.CREATE,
+    CoreResourceOperation.UPDATE,
+    CoreResourceOperation.DELETE,
+];
+/**
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — content capture is off unless the organization turns it on,
+ * with a stated purpose; every change is audited.
+ */
+export const agentWorkCaptureSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: AgentWorkCaptureSettingsSchema,
+    resourceIdentifier: CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    // The settlement writer reads the organization's setting as the engine; the settings page's first READ creates the
+    // organization's row as the engine (below).
+    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,
+    operationsConfiguration: {
+        /**
+         * The settings page IS this READ (a singleton of the organization, route `/organizations/{id}/agent-work-capture-setting`).
+         * An organization that never chose has no row, so the backend's READ postfix creates it METADATA_ONLY on first
+         * access: the default stated as a row, not a decision, so it is neither audited as a change nor a system-write
+         * audit.
+         */
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },
+                // The READ materialization's door: route-less, and preferred by the service layer, so the engine's write of the
+                // default does not pass through the administrator's guarded and audited CREATE.
+                { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        // The composition cascade's door; route-less.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+    },
+});
+/** assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — no export without a recorded basis; every change audited. */
+export const evaluationExportAuthorizationsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: EvaluationExportAuthorizationSchema,
+    resourceIdentifier: CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,
+    operationsConfiguration: {
+        /**
+         * The authorisation page IS this READ (`/organizations/{id}/evaluation-export-authorization`). An organization that
+         * never granted one has no row, so the READ postfix creates it NOT_GRANTED on first access: nobody decided, so it
+         * is not audited as a change. Granting is the UPDATE that sets ACTIVE with a basis.
+         */
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },
+                // The READ materialization's door (route-less; see the capture setting).
+                { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        // The composition cascade's door; route-less.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+    },
+});
+/** The export ledger: written by the engine at each export, read by the organization administrator. */
+export const evaluationDatasetExportsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: EvaluationDatasetExportSchema,
+    resourceIdentifier: CoreResourceType.EVALUATION_DATASET_EXPORTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_DATASET_EXPORTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: {
+        create: ResourceSystemAccessMode.ALLOWED,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+    },
+    /** assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the ledger is kept for the declared AUDIT_LOGS period. */
+    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.UPDATE_MANY,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        // The retention writer's door (`retentionPolicy` requires it); route-less.
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },
+                { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=agent-work-decisions.shared.resources-config.schemas.js.map

package/dist/esm/flows-actors/agent-work-decisions.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-work-decisions.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/agent-work-decisions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,mCAAmC,EACnC,+CAA+C,EAC/C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;IAChE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;IACvF,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAGF,qGAAqG;AACrG,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,oGAAoG;QACpG,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E;;;OAGG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC5G,uHAAuH;IACvH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;KACF;CACF,CACF,CAAC;AAEF,0HAA0H;AAC1H,MAAM,CAAC,MAAM,6CAA6C,GAAG,uCAAuC,CAClG,+CAA+C,EAC/C;IACE,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E;;;;OAIG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,aAAa,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC/G;;;OAGG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC;SACvK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACpK;KACF;CACF,CACF,CAAC;AAIF,MAAM,oCAAoC,GAAwC;IAChF,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAAsF;IAC9H,UAAU,EAAE,8BAA8B;IAC1C,kBAAkB,EAAE,gBAAgB,CAAC,2BAA2B;IAChE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;IACzG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,mHAAmH;IACnH,4CAA4C;IAC5C,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAC3J,cAAc,EAAE,oCAAoC;IACpD,uBAAuB,EAAE;QACvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;gBACtJ,gHAAgH;gBAChH,gFAAgF;gBAChF,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACnK;QACD,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACxK;KACF;CACF,CAAC,CAAC;AAEL,0HAA0H;AAC1H,MAAM,CAAC,MAAM,yEAAyE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC1I,0CAA0C,CAA2F;IACnI,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAAE,gBAAgB,CAAC,gCAAgC;IACrE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gCAAgC,CAAC;IAC9G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAC3J,cAAc,EAAE,oCAAoC;IACpD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;gBACtJ,yEAAyE;gBACzE,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACnK;QACD,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACxK;KACF;CACF,CAAC,CAAC;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAIxC;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IACD,mHAAmH;IACnH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC5G,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;gBACrJ,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Agent-work decisions: resource configurations (#1599).\n *\n * Five resources, one concern: the record of what experts did with agents' proposals, and what the tenant allowed\n * to be done with it.\n *\n * - `agentWorkDecisions` (polymorphic, the owner scope of the paused work) — the metadata record. Written by the\n *   engine only (the settlement, the repair sweep, `recordOutputReview`), read by the scope's administrator. Kept\n *   for the declared AUDIT_LOGS period; an erasure of the decider severs `deciderUserId` and keeps the decision.\n * - `agentWorkDecisionContents` (polymorphic, same scopes) — the opt-in content. Written by the engine only, under\n *   the tenant's `WITH_CONTENT` setting. Deleted with its owner scope by the composition cascade, like the tenant's\n *   other data (a per-row RESOURCE_DATA clock cannot be bound: the user and application variants name no\n *   organization, which `SCOPE_DELETED` counts from). An erasure scrubs every content field.\n * - `agentWorkCaptureSettings` / `evaluationExportAuthorizations` (organization singletons) — the organization\n *   administrator's two decisions; every change is audited by the backend's postfix.\n * - `evaluationDatasetExports` (organization) — the export ledger, kept for AUDIT_LOGS.\n */\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport {\n  AgentWorkCaptureSettingsSchema,\n  EvaluationDatasetExportSchema,\n  EvaluationExportAuthorizationSchema,\n  agentWorkDecisionContentsPolymorphicDeclaration,\n  agentWorkDecisionsPolymorphicDeclaration,\n} from './agent-work-decisions.shared.schemas';\n\n/**\n * Who reads a scope's decisions. A user reads the decisions taken on their OWN threads; an organization's or an\n * application's are shared scope data, read by its administrator — the `flowActorExecutions` reasoning, since the\n * records describe work in those threads.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n/**\n * Content is the client's material: its reader is the scope's ADMINISTRATOR, plus — in an organization — the one role\n * the organization's capture setting names (`contentReaderRole`). The organization route therefore admits members, and\n * the backend's read gate (`agent-work-decisions.custom-impl.backend.service.ts`) narrows every READ and LIST to an\n * organization-wide administrator or holder of that role, reading the setting at the moment of the read. A user never\n * reads content from the generic plane.\n */\nconst CONTENT_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n\n/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */\nexport const agentWorkDecisionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  agentWorkDecisionsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    systemAccessPolicy: {\n      // The decider's own decisions belong in their subject export; the backend-only floor still applies.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n    /*\n     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the operator's evidence of supervised agent work, kept for\n     * the declared AUDIT_LOGS period from creation, never a number of this resource's own.\n     */\n    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },\n    /** An erasure severs the decider (`deciderUserId` REMOVE) and keeps the decision: the evidence outlives the person. */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n    },\n  },\n);\n\n/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */\nexport const agentWorkDecisionContentsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  agentWorkDecisionContentsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    systemAccessPolicy: {\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n    /*\n     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the content is the client's material, kept for the declared\n     * RESOURCE_DATA period from when it was written (#1599 Q3), and never longer than the evidence beside it. A creation\n     * start point needs no organization, so it binds all three owner scopes alike.\n     */\n    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },\n    /**\n     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure scrubs the proposal, the final version, the\n     * diff and the reason (all REMOVE); the metadata record beside it survives.\n     */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.MEDIUM }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n    },\n  },\n);\n\n\ntype OrganizationSettingCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;\nconst ORGANIZATION_SETTING_CORE_OPERATIONS: OrganizationSettingCoreOperations[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.DELETE,\n];\n\n/**\n * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — content capture is off unless the organization turns it on,\n * with a stated purpose; every change is audited.\n */\nexport const agentWorkCaptureSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<undefined, OrganizationSettingCoreOperations, typeof AgentWorkCaptureSettingsSchema>({\n    mainSchema: AgentWorkCaptureSettingsSchema,\n    resourceIdentifier: CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    // The settlement writer reads the organization's setting as the engine; the settings page's first READ creates the\n    // organization's row as the engine (below).\n    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,\n    operationsConfiguration: {\n      /**\n       * The settings page IS this READ (a singleton of the organization, route `/organizations/{id}/agent-work-capture-setting`).\n       * An organization that never chose has no row, so the backend's READ postfix creates it METADATA_ONLY on first\n       * access: the default stated as a row, not a decision, so it is neither audited as a change nor a system-write\n       * audit.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },\n          // The READ materialization's door: route-less, and preferred by the service layer, so the engine's write of the\n          // default does not pass through the administrator's guarded and audited CREATE.\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      // The composition cascade's door; route-less.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n    },\n  });\n\n/** assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — no export without a recorded basis; every change audited. */\nexport const evaluationExportAuthorizationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<undefined, OrganizationSettingCoreOperations, typeof EvaluationExportAuthorizationSchema>({\n    mainSchema: EvaluationExportAuthorizationSchema,\n    resourceIdentifier: CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,\n    operationsConfiguration: {\n      /**\n       * The authorisation page IS this READ (`/organizations/{id}/evaluation-export-authorization`). An organization that\n       * never granted one has no row, so the READ postfix creates it NOT_GRANTED on first access: nobody decided, so it\n       * is not audited as a change. Granting is the UPDATE that sets ACTIVE with a basis.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },\n          // The READ materialization's door (route-less; see the capture setting).\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      // The composition cascade's door; route-less.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n    },\n  });\n\n/** The export ledger: written by the engine at each export, read by the organization administrator. */\nexport const evaluationDatasetExportsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    undefined,\n    CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE,\n    typeof EvaluationDatasetExportSchema\n  >({\n    mainSchema: EvaluationDatasetExportSchema,\n    resourceIdentifier: CoreResourceType.EVALUATION_DATASET_EXPORTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_DATASET_EXPORTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: {\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n    /** assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the ledger is kept for the declared AUDIT_LOGS period. */\n    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n    },\n  });\n"]}