@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAE/E,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;AACnB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExD,qFAAqF;IACrF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE5D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3E;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD,sGAAsG;IACtG,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,iGAAiG;IACjG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,6FAA6F;IAC7F,+FAA+F;IAC/F,qGAAqG;IACrG,yGAAyG;IACzG,iDAAiD;IACjD,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC,EACjE,aAAa,CAAC,MAAM,CACrB;IAED,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,qBAAqB,CAAC;SAC3B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,+FAA+F;IAC/F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,cAAc,EAAE;CACpB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAmC;IAC9E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,WAAW,EAAE,uBAAuB;IACpC,UAAU,EAAE,wBAAwB;IACpC,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/**\n * A2A push-notification delivery log — one row per (task state change × registered webhook).\n *\n * ## Why this is a SIBLING of the M2M webhook delivery log rather than a variant of it\n *\n * The two share a delivery PATTERN — write the row before enqueueing, one queue job per row, the\n * worker classifies the response and either retries or terminates — and that pattern is reused\n * deliberately, down to the transport primitive. What they do not share is a SCOPE SET:\n * `M2MWebhookDeliveryLog` is stamped out for `ORGANIZATIONS` and `APPLICATION`, while an A2A task\n * can be owned by a **USER** as well. A delegated-user A2A caller is the ordinary case, not an edge\n * one, so extending the M2M resource would have meant adding a user-scoped variant — a whole\n * user-facing resource surface — to a shipped feature on behalf of a different subsystem.\n *\n * Keeping them separate also keeps the two producers separable in every query: a resource-operation\n * notification and a task-lifecycle notification are different facts about different things, and an\n * operator filtering one should never have to exclude the other by hand.\n *\n * ## Why the row is written BEFORE the delivery is attempted\n *\n * Copied from the M2M dispatcher's reasoning, because it is the property that makes this table\n * worth having: if the worker created the row on its first attempt, an unreachable queue would\n * leave no trace at all. Writing it up front means an operator always sees an entry per\n * (task transition × webhook), including the deliveries that never got as far as being tried.\n *\n * spec-cite: A2A 1.0 §4.3.3 — *\"Agents MUST attempt delivery at least once for each configured\n * webhook\"* — and §13.2, which asks for retry with exponential backoff and permits giving up after\n * a configured number of consecutive failures. This row is where all three become observable.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts — the pattern this mirrors\n * @see a2a-token-budget-state.shared.schemas.ts — the 3-scope A2A polymorphic precedent\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories, initZodDecorators, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  optOutPolymorphicAutoBusinessKey,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\n/**\n * The delivery lifecycle:\n *   PENDING → IN_FLIGHT → DELIVERED   (acknowledged with 2xx)\n *   PENDING → IN_FLIGHT → PENDING     (transient failure — retry scheduled with backoff)\n *   PENDING → IN_FLIGHT → FAILED      (terminal — non-retryable status, or attempts exhausted)\n *\n * Deliberately its OWN enum rather than a reuse of `M2MWebhookDeliveryLogStatus`, even though the\n * members coincide. That enum is named for, and owned by, the M2M notifications feature; importing\n * it here would couple flows-actors to that subsystem's release cycle for no gain, and would make\n * either feature's future state change a cross-feature edit. If a third outbound-delivery consumer\n * ever appears, the answer is to extract ONE shared vocabulary — not to have the second consumer\n * borrow the first one's.\n */\nexport enum A2APushDeliveryStatus {\n  PENDING = 'pending',\n  IN_FLIGHT = 'in_flight',\n  DELIVERED = 'delivered',\n  FAILED = 'failed',\n}\n\nexport const A2APushDeliveryLogSchema = z.object({\n  /** Document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The stable identity of this delivery, generated once when the row is written and sent with\n   * every attempt so a receiver can deduplicate.\n   *\n   * spec-cite: A2A 1.0 §4.3.3 — *\"Clients SHOULD process notifications idempotently, as duplicate\n   * deliveries may occur\"*. A client can only honour that if duplicates are RECOGNISABLE, which\n   * means the id must be stable across retries — hence generated at row creation, never per attempt.\n   */\n  deliveryId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The task whose transition triggered this notification. */\n  taskId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** Which registered configuration this row delivers to — a task may have several. */\n  pushNotificationConfigId: z.string().min(1).isSummaryField(),\n\n  /**\n   * The agent instance the task belongs to. Carried so an operator can attribute deliveries per\n   * agent, and so a per-instance purge never reaches another agent's rows — the same isolation\n   * axis the task read enforces.\n   */\n  resourceServerInstanceRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The machine credential that owns the task, when one does.\n   *\n   * Carried because the worker must RE-READ the live configuration to obtain the client's\n   * credential (see the worker for why the secret is not copied onto this row), and that read\n   * enforces all four isolation axes. Without this field the read falls back to the \"no credential\"\n   * sentinel and matches nothing for any task a machine client created — which is most A2A tasks,\n   * since client-credentials auth is the ordinary way an agent connects.\n   *\n   * Optional rather than sentinel-defaulted: a delegated-user task genuinely has no machine\n   * credential, and storing a sentinel here would make \"absent\" and \"explicitly none\" the same\n   * value on a row whose whole job is to be evidence.\n   */\n  machineCredentialId: z.string().min(1).optional(),\n\n  /** The destination, captured as it was AT DISPATCH — a later config edit must not rewrite history. */\n  httpUrl: z.url(),\n\n  payloadHash: z.string().min(1),\n  // USER_CONTENT — the delivered payload carries the task's own content, which originated with the\n  // person. The declaration says what the field is FOR; a payload can hold anything a task held.\n  //\n  // `addDataCategories` rather than the fluent form: `z.unknown()` is one of the types that carry NO\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one), so\n  // `.dataCategories(...)` does not type-check on it. The helper is the documented escape hatch.\n  // REMOVE on erasure. The delivered payload carries the task's own content, which originated with the\n  // person — so it is content this row HOLDS. `z.unknown()` accepts null, so REMOVE is clearable here even\n  // though the field is not written `.optional()`.\n  payload: addImpersonalizeWith(\n    addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n\n  status: z\n    .enum(A2APushDeliveryStatus)\n    .default(A2APushDeliveryStatus.PENDING)\n    .isDBIndexed()\n    .isSummaryField(),\n\n  attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n  lastAttemptAt: z.date().optional(),\n  /** When the next retry becomes eligible. Indexed — this is the worker's drain query. */\n  nextAttemptAt: z.date().optional().isDBIndexed(),\n\n  responseStatus: z.number().int().optional(),\n  /** Truncated by the worker before persistence: a webhook may answer with an unbounded body. */\n  responseBodyTruncated: z.string().optional(),\n  failureReason: z.string().optional().isSummaryField(),\n\n  deliveredAt: z.date().optional(),\n  failedAt: z.date().optional(),\n\n  createdAt: z\n    .date()\n    .default(() => new Date())\n    .isDBIndexed()\n    .isSummaryField(),\n});\n\nexport type A2APushDeliveryLogBase = z.infer<typeof A2APushDeliveryLogSchema>;\n\n/**\n * The three owner scopes an A2A task — and therefore its deliveries — can belong to.\n *\n * Mirrors `flowActorTasksPolymorphicDeclaration`'s scope set exactly, and must keep mirroring it: a\n * task owner with no delivery-log variant is a task whose notifications cannot be recorded, which\n * is the audit hole this table exists to close.\n */\nexport const A2A_PUSH_DELIVERY_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Produces 3 variants:\n *   - users         → `userA2aPushDeliveryLog`        (`userId` injected)\n *   - organizations → `organizationA2aPushDeliveryLog` (`organizationId` injected)\n *   - applications  → `applicationA2aPushDeliveryLog`  (`applicationId` injected)\n *\n * Multi-row, so it opts OUT of the singleton auto-business-key: unlike the token-budget\n * accumulator, there are many delivery rows per owner and the owner FK is not their identity.\n */\nexport const a2aPushDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aPushDeliveryLog',\n  baseFieldIdentifier: 'a2aPushDeliveryLogId',\n  baseEnumKey: 'A2A_PUSH_DELIVERY_LOG',\n  baseSchema: A2APushDeliveryLogSchema,\n  variants: A2A_PUSH_DELIVERY_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"a2a-push-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAE/E,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;AACnB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExD,qFAAqF;IACrF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE5D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3E;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD,sGAAsG;IACtG,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,iGAAiG;IACjG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,6FAA6F;IAC7F,+FAA+F;IAC/F,qGAAqG;IACrG,yGAAyG;IACzG,iDAAiD;IACjD,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC,EACjE,aAAa,CAAC,MAAM,CACrB;IAED,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,qBAAqB,CAAC;SAC3B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,+FAA+F;IAC/F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,cAAc,EAAE;CACpB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAmC;IAC9E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,WAAW,EAAE,uBAAuB;IACpC,UAAU,EAAE,wBAAwB;IACpC,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/**\n * A2A push-notification delivery log — one row per (task state change × registered webhook).\n *\n * ## Why this is a SIBLING of the M2M webhook delivery log rather than a variant of it\n *\n * The two share a delivery PATTERN — write the row before enqueueing, one queue job per row, the\n * worker classifies the response and either retries or terminates — and that pattern is reused\n * deliberately, down to the transport primitive. What they do not share is a SCOPE SET:\n * `M2MWebhookDeliveryLog` is stamped out for `ORGANIZATIONS` and `APPLICATION`, while an A2A task\n * can be owned by a **USER** as well. A delegated-user A2A caller is the ordinary case, not an edge\n * one, so extending the M2M resource would have meant adding a user-scoped variant — a whole\n * user-facing resource surface — to a shipped feature on behalf of a different subsystem.\n *\n * Keeping them separate also keeps the two producers separable in every query: a resource-operation\n * notification and a task-lifecycle notification are different facts about different things, and an\n * operator filtering one should never have to exclude the other by hand.\n *\n * ## Why the row is written BEFORE the delivery is attempted\n *\n * Copied from the M2M dispatcher's reasoning, because it is the property that makes this table\n * worth having: if the worker created the row on its first attempt, an unreachable queue would\n * leave no trace at all. Writing it up front means an operator always sees an entry per\n * (task transition × webhook), including the deliveries that never got as far as being tried.\n *\n * spec-cite: A2A 1.0 §4.3.3 — *\"Agents MUST attempt delivery at least once for each configured\n * webhook\"* — and §13.2, which asks for retry with exponential backoff and permits giving up after\n * a configured number of consecutive failures. This row is where all three become observable.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts — the pattern this mirrors\n * @see a2a-token-budget-state.shared.schemas.ts — the 3-scope A2A polymorphic precedent\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories, initZodDecorators, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  optOutPolymorphicAutoBusinessKey,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\n/**\n * The delivery lifecycle:\n *   PENDING → IN_FLIGHT → DELIVERED   (acknowledged with 2xx)\n *   PENDING → IN_FLIGHT → PENDING     (transient failure — retry scheduled with backoff)\n *   PENDING → IN_FLIGHT → FAILED      (terminal — non-retryable status, or attempts exhausted)\n *\n * Deliberately its OWN enum rather than a reuse of `M2MWebhookDeliveryLogStatus`, even though the\n * members coincide. That enum is named for, and owned by, the M2M notifications feature; importing\n * it here would couple flows-actors to that subsystem's release cycle for no gain, and would make\n * either feature's future state change a cross-feature edit. If a third outbound-delivery consumer\n * ever appears, the answer is to extract ONE shared vocabulary — not to have the second consumer\n * borrow the first one's.\n */\nexport enum A2APushDeliveryStatus {\n  PENDING = 'pending',\n  IN_FLIGHT = 'in_flight',\n  DELIVERED = 'delivered',\n  FAILED = 'failed',\n}\n\nexport const A2APushDeliveryLogSchema = z.object({\n  /** Document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The stable identity of this delivery, generated once when the row is written and sent with\n   * every attempt so a receiver can deduplicate.\n   *\n   * spec-cite: A2A 1.0 §4.3.3 — *\"Clients SHOULD process notifications idempotently, as duplicate\n   * deliveries may occur\"*. A client can only honour that if duplicates are RECOGNISABLE, which\n   * means the id must be stable across retries — hence generated at row creation, never per attempt.\n   */\n  deliveryId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The task whose transition triggered this notification. */\n  taskId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** Which registered configuration this row delivers to — a task may have several. */\n  pushNotificationConfigId: z.string().min(1).isSummaryField(),\n\n  /**\n   * The agent instance the task belongs to. Carried so an operator can attribute deliveries per\n   * agent, and so a per-instance purge never reaches another agent's rows — the same isolation\n   * axis the task read enforces.\n   */\n  resourceServerInstanceRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The machine credential that owns the task, when one does.\n   *\n   * Carried because the worker must RE-READ the live configuration to obtain the client's\n   * credential (see the worker for why the secret is not copied onto this row), and that read\n   * enforces all four isolation axes. Without this field the read falls back to the \"no credential\"\n   * sentinel and matches nothing for any task a machine client created — which is most A2A tasks,\n   * since client-credentials auth is the ordinary way an agent connects.\n   *\n   * Optional rather than sentinel-defaulted: a delegated-user task genuinely has no machine\n   * credential, and storing a sentinel here would make \"absent\" and \"explicitly none\" the same\n   * value on a row whose whole job is to be evidence.\n   */\n  machineCredentialId: z.string().min(1).optional(),\n\n  /** The destination, captured as it was AT DISPATCH — a later config edit must not rewrite history. */\n  httpUrl: z.url(),\n\n  payloadHash: z.string().min(1),\n  // USER_CONTENT — the delivered payload carries the task's own content, which originated with the\n  // person. The declaration says what the field is FOR; a payload can hold anything a task held.\n  //\n  // `addDataCategories` rather than the fluent form: `z.unknown()` is one of the types that carry NO\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one), so\n  // `.dataCategories(...)` does not type-check on it. The helper is the documented escape hatch.\n  // REMOVE on erasure. The delivered payload carries the task's own content, which originated with the\n  // person — so it is content this row HOLDS. `z.unknown()` accepts null, so REMOVE is clearable here even\n  // though the field is not written `.optional()`.\n  payload: addImpersonalizeWith(\n    addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n\n  status: z\n    .enum(A2APushDeliveryStatus)\n    .default(A2APushDeliveryStatus.PENDING)\n    .isDBIndexed()\n    .isSummaryField(),\n\n  attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n  lastAttemptAt: z.date().optional(),\n  /** When the next retry becomes eligible. Indexed — this is the worker's drain query. */\n  nextAttemptAt: z.date().optional().isDBIndexed(),\n\n  responseStatus: z.number().int().optional(),\n  /** Truncated by the worker before persistence: a webhook may answer with an unbounded body. */\n  responseBodyTruncated: z.string().optional(),\n  failureReason: z.string().optional().isSummaryField(),\n\n  deliveredAt: z.date().optional(),\n  failedAt: z.date().optional(),\n\n  createdAt: z\n    .date()\n    .default(() => new Date())\n    .isDBIndexed()\n    .isSummaryField(),\n});\n\nexport type A2APushDeliveryLogBase = z.infer<typeof A2APushDeliveryLogSchema>;\n\n/**\n * The three owner scopes an A2A task — and therefore its deliveries — can belong to.\n *\n * Mirrors `flowActorTasksPolymorphicDeclaration`'s scope set exactly, and must keep mirroring it: a\n * task owner with no delivery-log variant is a task whose notifications cannot be recorded, which\n * is the audit hole this table exists to close.\n */\nexport const A2A_PUSH_DELIVERY_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Produces 3 variants:\n *   - users         → `userA2aPushDeliveryLog`        (`userId` injected)\n *   - organizations → `organizationA2aPushDeliveryLog` (`organizationId` injected)\n *   - applications  → `applicationA2aPushDeliveryLog`  (`applicationId` injected)\n *\n * Multi-row, so it opts OUT of the singleton auto-business-key: unlike the token-budget\n * accumulator, there are many delivery rows per owner and the owner FK is not their identity.\n */\nexport const a2aPushDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aPushDeliveryLog',\n  baseFieldIdentifier: 'a2aPushDeliveryLogId',\n  baseEnumKey: 'A2A_PUSH_DELIVERY_LOG',\n  baseSchema: A2APushDeliveryLogSchema,\n  variants: A2A_PUSH_DELIVERY_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AA4BzG;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,qPA8InD,CAAC"}
+{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AA4BzG;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,qPA8InD,CAAC"}

package/dist/esm/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,yCAAyC,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;IAC7D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,uCAAuC,CAC5F,yCAAyC,EACzC;IACE,gBAAgB,EAAE,IAAI;IAEtB,sFAAsF;IACtF,4EAA4E;IAC5E,8FAA8F;IAC9F,uFAAuF;IACvF,kBAAkB,EAAE;QAClB,uSAAuS;QACvS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;OAUG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;;;;;WAYG;QAEH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAE5B,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAE1C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,0FAA0F;QAC1F,0FAA0F;QAC1F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,0FAA0F;QAC1F,oFAAoF;QACpF,2FAA2F;QAC3F,qFAAqF;QACrF,iEAAiE;QACjE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,2FAA2F;QAC3F,yFAAyF;QAEzF,yFAAyF;QACzF,0EAA0E;QAC1E,EAAE;QACF,uFAAuF;QACvF,qFAAqF;QACrF,yFAAyF;QACzF,qFAAqF;QACrF,0DAA0D;QAC1D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * A2A Token Budget State — Resource Configuration (POLYMORPHIC SINGLETON)\n * ======================================================================\n *\n * The per-tenant A2A LLM token-budget accumulator, stamped out as THREE owner-scope\n * singleton variants from one polymorphic declaration (`userA2aTokenBudgetState` /\n * `organizationA2aTokenBudgetState` / `applicationA2aTokenBudgetState`). Spread the\n * produced factories into the registry factory map:\n *   ...a2aTokenBudgetStatePolymorphicFactories\n *\n * Access model — SYSTEM-WRITTEN, OWNER-READABLE:\n *   - This is internal enforcement state, not user-authored data: only the A2A runtime WRITES\n *     it, via `*AsSystem` (governed by `systemAccessPolicy`). The tenant may READ its own row\n *     (a usage view: \"how much of my allowance have I used?\"), but never authors it.\n *   - CREATE (`INTERNAL_CALL` super-admin, no explicit request DTO — it auto-derives per variant so\n *     the injected owner FK is required on the correct variant) opens the singleton on the first\n *     budgeted turn, via `createAsSystem`. `INTERNAL_CALL` (not `REPOSITORY_ONLY`) is mandatory\n *     here: `*AsSystem` dispatches through the service tier and resolves the op via\n *     `getServiceOperationPathDefault`, which only matches INTERNAL_CALL / API_CALL variants.\n *   - There is deliberately NO `UPDATE` operation. Advancing the counter is an ATOMIC increment\n *     (`RepositoriesRegistryHandlerBackendService.atomicIncrementField`) executed at the repository\n *     tier, precisely so concurrent turns cannot lose tokens to a read-modify-write race — a\n *     service-tier UPDATE cannot express that. Declaring an `UPDATE` op (with a DTO and a\n *     `systemAccessPolicy.update` grant) would therefore be dead configuration describing a write\n *     path nothing takes, and would invite a future contributor to route the counter through it and\n *     silently reintroduce the race.\n *   - DELETE is `INTERNAL_CALL` super-admin: it exists to satisfy the composition `onParentDelete`\n *     cascade teardown (which runs at the repository tier and selects the operation-default DELETE,\n *     irrespective of variant type), NOT to offer an HTTP surface. Deliberately NOT `API_CALL`:\n *     zeroing this row zeroes recorded consumption, which is a SPEND-CAP BYPASS, so it gets no URL\n *     at all — strictly stronger than relying on a role floor. (The role floor is nevertheless\n *     platform-only for defence in depth.)\n *   - READ is the ONE `API_CALL`, and it is owner-level on its own merit: a tenant inspecting its\n *     own consumption (\"how much of my allowance have I used?\"). It is read-only, so it cannot\n *     affect the cap.\n *\n * CASCADE NOTE (recorded because it was initially mis-diagnosed): the cascade's requirement is a\n * cardinality-appropriate DISCOVERY op + a DELETE teardown op — for a 1:1 child that is READ, for\n * 1:many it is LIST. It does NOT require a URL-isable variant: `supportsOperation` checks only\n * `isOperationDefault`, and a sole `INTERNAL_CALL` variant is the default within its own group.\n * The guard violation seen while building this resource came from the relationship declaring\n * `childCardinality: MANY` (the helper's default) on a SINGLETON — which demanded LIST, not READ.\n * Fixing the cardinality fixed it; verified by reverting DELETE to `INTERNAL_CALL` with the guard\n * still green.\n *\n * @see a2a-token-budget-state.shared.schemas.ts — the polymorphic declaration + base schema\n * @see flows-actors-execution.shared.resources-config.schemas.ts — the 3-scope polymorphic config precedent\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { a2aTokenBudgetStatePolymorphicDeclaration } from './a2a-token-budget-state.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Per-variant OWNER-READ role map. A tenant may inspect its OWN budget consumption (a\n * read-only usage view: \"how much of my allowance have I used?\"). The scope authorizer +\n * contextual filter isolate rows to the owner; the role is the operation floor.\n *\n * The APPLICATION variant is intentionally `APP_USER`, matching the `flowActorExecutions`\n * precedent: app-scope rows are app-wide state, so any authenticated app user can read the\n * application's aggregate A2A consumption. Tighten to an admin role if that telemetry is ever\n * considered sensitive — it reveals platform usage volume, not tenant content.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_USER],\n};\n\n/**\n * Polymorphic factory map for the A2A token budget state. Spread into\n * `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...a2aTokenBudgetStatePolymorphicFactories\n *\n * Produces entries for:\n *   - userA2aTokenBudgetState\n *   - organizationA2aTokenBudgetState\n *   - applicationA2aTokenBudgetState\n */\nexport const a2aTokenBudgetStatePolymorphicFactories = createPolymorphicResourceConfigurations(\n  a2aTokenBudgetStatePolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    // Opt the A2A runtime (system actor) into scoped writes/reads on the tenant's behalf.\n    // Absent this, every `*AsSystem` verb fails closed. Shared by all variants.\n    // No `update` grant: the counter is advanced by an atomic repository-tier increment, never by\n    // `updateAsSystem` (see the header). Granting it would authorise a path nothing takes.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own token-budget state. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is a\n * token-consumption accumulator: counters, a window boundary and the owner scope key. It declares no\n * personal-data category, and its only link to a person is the scope FK, which the never-scrub floor\n * protects in every mode.\n *\n * The assertion is CHECKED in both directions — the factory refuses `RETAIN_ONLY` if any field carries an\n * impersonalize treatment, and if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR whose\n *  spend it accumulates — and the enum prescribes `NO_PRINCIPAL` for that shape. The subject's own session\n *  ends through the `USERS` row.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n\n       * verb the impersonalize writer uses to stamp the retention markers.\n\n       */\n\n      [CoreResourceOperation.LIST]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.LOW,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      // === CREATE === runtime opens the singleton on the first budgeted turn (createAsSystem).\n      // No explicit request DTO: auto-derives per variant so the injected owner FK is required.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // === READ === the owner inspects its own consumption AND the runtime loads the singleton\n      // for the pre-dispatch budget check (readAsSystem). `API_CALL` on its own merit — a\n      // tenant-facing usage view — and read-only, so owner-level roles cannot affect the cap. It\n      // ALSO serves as the cascade's 1:1 discovery op, though that would be satisfied by a\n      // non-URL variant too (see the CASCADE NOTE in the file header).\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // (No UPDATE operation — the counter is advanced by an atomic repository-tier increment so\n      // concurrent turns cannot lose tokens to a read-modify-write race. See the file header.)\n\n      // === DELETE === teardown for the composition `onParentDelete` cascade (repository tier,\n      // which selects the operation-default DELETE regardless of variant type).\n      //\n      // ⚠️ DELIBERATELY `INTERNAL_CALL` — NO HTTP ROUTE AT ALL. Deleting this row ZEROES the\n      // tenant's recorded consumption, i.e. a SPEND-CAP BYPASS, so the strongest available\n      // protection is to expose no URL rather than to guard one with a role. The platform-only\n      // (`APP_ADMIN_SUPER_ADMIN`) floor is defence in depth on top of that. The cascade is\n      // unaffected: it runs below both routing and role checks.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,yCAAyC,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;IAC7D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,uCAAuC,CAC5F,yCAAyC,EACzC;IACE,gBAAgB,EAAE,IAAI;IAEtB,sFAAsF;IACtF,4EAA4E;IAC5E,8FAA8F;IAC9F,uFAAuF;IACvF,kBAAkB,EAAE;QAClB,uSAAuS;QACvS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;OAUG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;;;;;WAYG;QAEH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAE5B,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAE1C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,0FAA0F;QAC1F,0FAA0F;QAC1F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,0FAA0F;QAC1F,oFAAoF;QACpF,2FAA2F;QAC3F,qFAAqF;QACrF,iEAAiE;QACjE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,2FAA2F;QAC3F,yFAAyF;QAEzF,yFAAyF;QACzF,0EAA0E;QAC1E,EAAE;QACF,uFAAuF;QACvF,qFAAqF;QACrF,yFAAyF;QACzF,qFAAqF;QACrF,0DAA0D;QAC1D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * A2A Token Budget State — Resource Configuration (POLYMORPHIC SINGLETON)\n * ======================================================================\n *\n * The per-tenant A2A LLM token-budget accumulator, stamped out as THREE owner-scope\n * singleton variants from one polymorphic declaration (`userA2aTokenBudgetState` /\n * `organizationA2aTokenBudgetState` / `applicationA2aTokenBudgetState`). Spread the\n * produced factories into the registry factory map:\n *   ...a2aTokenBudgetStatePolymorphicFactories\n *\n * Access model — SYSTEM-WRITTEN, OWNER-READABLE:\n *   - This is internal enforcement state, not user-authored data: only the A2A runtime WRITES\n *     it, via `*AsSystem` (governed by `systemAccessPolicy`). The tenant may READ its own row\n *     (a usage view: \"how much of my allowance have I used?\"), but never authors it.\n *   - CREATE (`INTERNAL_CALL` super-admin, no explicit request DTO — it auto-derives per variant so\n *     the injected owner FK is required on the correct variant) opens the singleton on the first\n *     budgeted turn, via `createAsSystem`. `INTERNAL_CALL` (not `REPOSITORY_ONLY`) is mandatory\n *     here: `*AsSystem` dispatches through the service tier and resolves the op via\n *     `getServiceOperationPathDefault`, which only matches INTERNAL_CALL / API_CALL variants.\n *   - There is deliberately NO `UPDATE` operation. Advancing the counter is an ATOMIC increment\n *     (`RepositoriesRegistryHandlerBackendService.atomicIncrementField`) executed at the repository\n *     tier, precisely so concurrent turns cannot lose tokens to a read-modify-write race — a\n *     service-tier UPDATE cannot express that. Declaring an `UPDATE` op (with a DTO and a\n *     `systemAccessPolicy.update` grant) would therefore be dead configuration describing a write\n *     path nothing takes, and would invite a future contributor to route the counter through it and\n *     silently reintroduce the race.\n *   - DELETE is `INTERNAL_CALL` super-admin: it exists to satisfy the composition `onParentDelete`\n *     cascade teardown (which runs at the repository tier and selects the operation-default DELETE,\n *     irrespective of variant type), NOT to offer an HTTP surface. Deliberately NOT `API_CALL`:\n *     zeroing this row zeroes recorded consumption, which is a SPEND-CAP BYPASS, so it gets no URL\n *     at all — strictly stronger than relying on a role floor. (The role floor is nevertheless\n *     platform-only for defence in depth.)\n *   - READ is the ONE `API_CALL`, and it is owner-level on its own merit: a tenant inspecting its\n *     own consumption (\"how much of my allowance have I used?\"). It is read-only, so it cannot\n *     affect the cap.\n *\n * CASCADE NOTE (recorded because it was initially mis-diagnosed): the cascade's requirement is a\n * cardinality-appropriate DISCOVERY op + a DELETE teardown op — for a 1:1 child that is READ, for\n * 1:many it is LIST. It does NOT require a URL-isable variant: `supportsOperation` checks only\n * `isOperationDefault`, and a sole `INTERNAL_CALL` variant is the default within its own group.\n * The guard violation seen while building this resource came from the relationship declaring\n * `childCardinality: MANY` (the helper's default) on a SINGLETON — which demanded LIST, not READ.\n * Fixing the cardinality fixed it; verified by reverting DELETE to `INTERNAL_CALL` with the guard\n * still green.\n *\n * @see a2a-token-budget-state.shared.schemas.ts — the polymorphic declaration + base schema\n * @see flows-actors-execution.shared.resources-config.schemas.ts — the 3-scope polymorphic config precedent\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { a2aTokenBudgetStatePolymorphicDeclaration } from './a2a-token-budget-state.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Per-variant OWNER-READ role map. A tenant may inspect its OWN budget consumption (a\n * read-only usage view: \"how much of my allowance have I used?\"). The scope authorizer +\n * contextual filter isolate rows to the owner; the role is the operation floor.\n *\n * The APPLICATION variant is intentionally `APP_USER`, matching the `flowActorExecutions`\n * precedent: app-scope rows are app-wide state, so any authenticated app user can read the\n * application's aggregate A2A consumption. Tighten to an admin role if that telemetry is ever\n * considered sensitive — it reveals platform usage volume, not tenant content.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_USER],\n};\n\n/**\n * Polymorphic factory map for the A2A token budget state. Spread into\n * `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...a2aTokenBudgetStatePolymorphicFactories\n *\n * Produces entries for:\n *   - userA2aTokenBudgetState\n *   - organizationA2aTokenBudgetState\n *   - applicationA2aTokenBudgetState\n */\nexport const a2aTokenBudgetStatePolymorphicFactories = createPolymorphicResourceConfigurations(\n  a2aTokenBudgetStatePolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    // Opt the A2A runtime (system actor) into scoped writes/reads on the tenant's behalf.\n    // Absent this, every `*AsSystem` verb fails closed. Shared by all variants.\n    // No `update` grant: the counter is advanced by an atomic repository-tier increment, never by\n    // `updateAsSystem` (see the header). Granting it would authorise a path nothing takes.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own token-budget state. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is a\n * token-consumption accumulator: counters, a window boundary and the owner scope key. It declares no\n * personal-data category, and its only link to a person is the scope FK, which the never-scrub floor\n * protects in every mode.\n *\n * The assertion is CHECKED in both directions — the factory refuses `RETAIN_ONLY` if any field carries an\n * impersonalize treatment, and if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR whose\n *  spend it accumulates — and the enum prescribes `NO_PRINCIPAL` for that shape. The subject's own session\n *  ends through the `USERS` row.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n\n       * verb the impersonalize writer uses to stamp the retention markers.\n\n       */\n\n      [CoreResourceOperation.LIST]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.LOW,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      // === CREATE === runtime opens the singleton on the first budgeted turn (createAsSystem).\n      // No explicit request DTO: auto-derives per variant so the injected owner FK is required.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // === READ === the owner inspects its own consumption AND the runtime loads the singleton\n      // for the pre-dispatch budget check (readAsSystem). `API_CALL` on its own merit — a\n      // tenant-facing usage view — and read-only, so owner-level roles cannot affect the cap. It\n      // ALSO serves as the cascade's 1:1 discovery op, though that would be satisfied by a\n      // non-URL variant too (see the CASCADE NOTE in the file header).\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // (No UPDATE operation — the counter is advanced by an atomic repository-tier increment so\n      // concurrent turns cannot lose tokens to a read-modify-write race. See the file header.)\n\n      // === DELETE === teardown for the composition `onParentDelete` cascade (repository tier,\n      // which selects the operation-default DELETE regardless of variant type).\n      //\n      // ⚠️ DELIBERATELY `INTERNAL_CALL` — NO HTTP ROUTE AT ALL. Deleting this row ZEROES the\n      // tenant's recorded consumption, i.e. a SPEND-CAP BYPASS, so the strongest available\n      // protection is to expose no URL rather than to guard one with a role. The platform-only\n      // (`APP_ADMIN_SUPER_ADMIN`) floor is defence in depth on top of that. The cascade is\n      // unaffected: it runs below both routing and role checks.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/flows-actors/a2a-token-budget-state.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D,eAAO,MAAM,yBAAyB;;;;;;;iBAwBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,EAAE,4BAA4B,EAIzE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;;kBAMpD,CAAC"}
+{"version":3,"file":"a2a-token-budget-state.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/a2a-token-budget-state.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D,eAAO,MAAM,yBAAyB;;;;;;;iBAwBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,EAAE,4BAA4B,EAIzE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;;kBAMpD,CAAC"}

package/dist/esm/flows-actors/a2a-token-budget-state.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,GAE1B,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,kFAAkF;IAClF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IAErC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3D;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE7D,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAEhD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,iEAAiE;AACjE,iEAAiE;AACjE,iEAAiE;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAmC;IAC7E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,yBAAyB,CAAC;IACjF,gBAAgB,EAAE,qBAAqB;IACvC,mBAAmB,EAAE,uBAAuB;IAC5C,WAAW,EAAE,wBAAwB;IACrC,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,+BAA+B;CAC1C,CAAC,CAAC;AAEH,6FAA6F;AAC7F,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,4FAA4F","sourcesContent":["/**\n * A2A Token Budget State — Persisted Resource Schema (POLYMORPHIC SINGLETON)\n * ==========================================================================\n *\n * The durable per-tenant accumulator that enforces a per-period LLM **token budget**\n * on inbound Agent2Agent (A2A) agent turns. Each A2A turn runs the LLM runtime; this\n * record holds how many tokens the tenant has consumed IN THE CURRENT PERIOD, so the\n * A2A transport can fail-closed BEFORE dispatch once the plan allowance is reached.\n *\n * WHY A DEDICATED RESOURCE (not `UsageRecord`, not `CreditPool`): a plan-included token\n * ALLOWANCE is a genuinely distinct concept from metered pay-per-use (`UsageRecord`, which\n * is metered-subscription-gated) and from a prepaid credit pack (`CreditPool`). Conflating\n * them would bend those semantics; this resource owns exactly one concern — period token\n * accounting for enforcement. The plan ALLOWANCE itself is NOT stored here — it is resolved\n * live from the billing plan (`FeatureResolution.resolveForScope(...).limits[featureId]`);\n * this record only accumulates CONSUMPTION.\n *\n * POLYMORPHIC SINGLETON ACROSS OWNER SCOPE. One row per tenant, stamped out as THREE\n * genuine single-scope resources by `declarePolymorphicSchemas()`, one owner FK injected\n * per variant (mirrors the flows-actors-execution / billing-account precedent):\n *   - `userA2aTokenBudgetState`         (USER_SELF     — `userId`)         ← user-delegated A2A\n *   - `organizationA2aTokenBudgetState` (ORGANIZATIONS — `organizationId`) ← org-machine A2A\n *   - `applicationA2aTokenBudgetState`  (APPLICATION   — `applicationId`)  ← app-machine A2A\n *\n * SINGLETON, DELIBERATELY: the injected owner FK is the auto business key (`.isUnique()`,\n * ONE row per tenant) — we do NOT `optOutPolymorphicAutoBusinessKey` (that is for multi-row\n * collections). One row per tenant is what keeps the counter un-splittable (no compound-key\n * engineering), and the period ROLLOVER is a mutation of that single row (reset\n * `consumedTokens` when `periodKey` changes), owned atomically by the accumulator service.\n * Per-period HISTORY and multi-budget-feature accounting are documented follow-ons — v1\n * enforces a single A2A token budget and only needs the current period.\n *\n * ⚠️ ADAPTER CAVEAT — that uniqueness is DB-ENFORCED ONLY ON MONGODB. `.isUnique()` compiles\n * to a Mongo unique index; the SQL planner emits no unique constraint (index creation there is\n * migration-owned). On PostgreSQL two concurrent first-ever turns can therefore each insert a\n * row, after which consumption is SPLIT across them while reads see only one — under-reported\n * spend, and a cap that fires late. The accumulator's create-race fallback repairs the common\n * interleaving (a rejected create falls through to an increment) but cannot repair what the\n * database never rejected. Closing this properly needs a unique constraint on the owner FK in\n * the PostgreSQL migration for each variant table.\n *\n * @see flows-actors-execution.shared.schemas.ts — the 3-scope polymorphic precedent\n * @see billing-account.shared.schemas.ts — the polymorphic-singleton precedent\n */\n\nimport { z } from 'zod';\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\nexport const A2ATokenBudgetStateSchema = z.object({\n  /** MongoDB document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey(),\n\n  /**\n   * The budget PERIOD this counter currently covers — a stable string id for the active\n   * window (e.g. the subscription period id, or a `YYYY-MM` calendar key). The reset\n   * boundary: when the resolved current period differs from this value, the accumulator\n   * service resets `consumedTokens` to the new turn's tokens and advances `periodKey`.\n   */\n  periodKey: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * Tokens (prompt + completion) consumed by this tenant's A2A agent turns IN THE CURRENT\n   * period (`periodKey`). Compared against the plan allowance (resolved live) to fail-closed\n   * before dispatch. Reset to 0 (then incremented) when the period rolls.\n   */\n  consumedTokens: z.number().min(0).default(0).isSummaryField(),\n\n  /** When the last A2A turn was recorded against this budget (observability). */\n  lastTurnAt: z.date().optional().isSummaryField(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type A2ATokenBudgetState = z.infer<typeof A2ATokenBudgetStateSchema>;\n\n//===============================================================\n//  Polymorphic declaration — one owner-scope SINGLETON per scope\n//===============================================================\n\n/**\n * The three owner-scope variants the A2A token budget is stamped out for. Each is\n * `isPrimaryScope: true` and — unlike the multi-row flows-actors executions — does NOT opt\n * out of the singleton auto-business-key: the injected owner FK IS the business key, so there\n * is exactly ONE budget row per tenant (the period lives inside that row).\n */\nexport const A2A_TOKEN_BUDGET_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Polymorphic declaration for the A2A token budget state. Produces 3 singleton variants:\n *   - users        → `userA2aTokenBudgetState`         (`userId` injected)\n *   - organizations→ `organizationA2aTokenBudgetState` (`organizationId` injected)\n *   - applications → `applicationA2aTokenBudgetState`  (`applicationId` injected)\n */\nexport const a2aTokenBudgetStatePolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aTokenBudgetState',\n  baseFieldIdentifier: 'a2aTokenBudgetStateId',\n  baseEnumKey: 'A2A_TOKEN_BUDGET_STATE',\n  baseSchema: A2ATokenBudgetStateSchema,\n  variants: A2A_TOKEN_BUDGET_SCOPE_VARIANTS,\n});\n\n// NOTE: there is deliberately NO update DTO for this resource. The counter is advanced by an\n// ATOMIC repository-tier increment (`atomicIncrementField`) rather than a service-tier UPDATE,\n// precisely so concurrent turns cannot lose tokens to a read-modify-write race. A DTO here would\n// describe a write path nothing takes — and would invite routing the counter through it, silently\n// reintroducing that race. See `a2a-token-budget-state.shared.resources-config.schemas.ts`.\n"]}
+{"version":3,"file":"a2a-token-budget-state.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/a2a-token-budget-state.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,GAE1B,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,kFAAkF;IAClF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IAErC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3D;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE7D,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAEhD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,iEAAiE;AACjE,iEAAiE;AACjE,iEAAiE;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAmC;IAC7E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,yBAAyB,CAAC;IACjF,gBAAgB,EAAE,qBAAqB;IACvC,mBAAmB,EAAE,uBAAuB;IAC5C,WAAW,EAAE,wBAAwB;IACrC,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,+BAA+B;CAC1C,CAAC,CAAC;AAEH,6FAA6F;AAC7F,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,4FAA4F","sourcesContent":["/**\n * A2A Token Budget State — Persisted Resource Schema (POLYMORPHIC SINGLETON)\n * ==========================================================================\n *\n * The durable per-tenant accumulator that enforces a per-period LLM **token budget**\n * on inbound Agent2Agent (A2A) agent turns. Each A2A turn runs the LLM runtime; this\n * record holds how many tokens the tenant has consumed IN THE CURRENT PERIOD, so the\n * A2A transport can fail-closed BEFORE dispatch once the plan allowance is reached.\n *\n * WHY A DEDICATED RESOURCE (not `UsageRecord`, not `CreditPool`): a plan-included token\n * ALLOWANCE is a genuinely distinct concept from metered pay-per-use (`UsageRecord`, which\n * is metered-subscription-gated) and from a prepaid credit pack (`CreditPool`). Conflating\n * them would bend those semantics; this resource owns exactly one concern — period token\n * accounting for enforcement. The plan ALLOWANCE itself is NOT stored here — it is resolved\n * live from the billing plan (`FeatureResolution.resolveForScope(...).limits[featureId]`);\n * this record only accumulates CONSUMPTION.\n *\n * POLYMORPHIC SINGLETON ACROSS OWNER SCOPE. One row per tenant, stamped out as THREE\n * genuine single-scope resources by `declarePolymorphicSchemas()`, one owner FK injected\n * per variant (mirrors the flows-actors-execution / billing-account precedent):\n *   - `userA2aTokenBudgetState`         (USER_SELF     — `userId`)         ← user-delegated A2A\n *   - `organizationA2aTokenBudgetState` (ORGANIZATIONS — `organizationId`) ← org-machine A2A\n *   - `applicationA2aTokenBudgetState`  (APPLICATION   — `applicationId`)  ← app-machine A2A\n *\n * SINGLETON, DELIBERATELY: the injected owner FK is the auto business key (`.isUnique()`,\n * ONE row per tenant) — we do NOT `optOutPolymorphicAutoBusinessKey` (that is for multi-row\n * collections). One row per tenant is what keeps the counter un-splittable (no compound-key\n * engineering), and the period ROLLOVER is a mutation of that single row (reset\n * `consumedTokens` when `periodKey` changes), owned atomically by the accumulator service.\n * Per-period HISTORY and multi-budget-feature accounting are documented follow-ons — v1\n * enforces a single A2A token budget and only needs the current period.\n *\n * ⚠️ ADAPTER CAVEAT — that uniqueness is DB-ENFORCED ONLY ON MONGODB. `.isUnique()` compiles\n * to a Mongo unique index; the SQL planner emits no unique constraint (index creation there is\n * migration-owned). On PostgreSQL two concurrent first-ever turns can therefore each insert a\n * row, after which consumption is SPLIT across them while reads see only one — under-reported\n * spend, and a cap that fires late. The accumulator's create-race fallback repairs the common\n * interleaving (a rejected create falls through to an increment) but cannot repair what the\n * database never rejected. Closing this properly needs a unique constraint on the owner FK in\n * the PostgreSQL migration for each variant table.\n *\n * @see flows-actors-execution.shared.schemas.ts — the 3-scope polymorphic precedent\n * @see billing-account.shared.schemas.ts — the polymorphic-singleton precedent\n */\n\nimport { z } from 'zod';\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\nexport const A2ATokenBudgetStateSchema = z.object({\n  /** MongoDB document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey(),\n\n  /**\n   * The budget PERIOD this counter currently covers — a stable string id for the active\n   * window (e.g. the subscription period id, or a `YYYY-MM` calendar key). The reset\n   * boundary: when the resolved current period differs from this value, the accumulator\n   * service resets `consumedTokens` to the new turn's tokens and advances `periodKey`.\n   */\n  periodKey: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * Tokens (prompt + completion) consumed by this tenant's A2A agent turns IN THE CURRENT\n   * period (`periodKey`). Compared against the plan allowance (resolved live) to fail-closed\n   * before dispatch. Reset to 0 (then incremented) when the period rolls.\n   */\n  consumedTokens: z.number().min(0).default(0).isSummaryField(),\n\n  /** When the last A2A turn was recorded against this budget (observability). */\n  lastTurnAt: z.date().optional().isSummaryField(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type A2ATokenBudgetState = z.infer<typeof A2ATokenBudgetStateSchema>;\n\n//===============================================================\n//  Polymorphic declaration — one owner-scope SINGLETON per scope\n//===============================================================\n\n/**\n * The three owner-scope variants the A2A token budget is stamped out for. Each is\n * `isPrimaryScope: true` and — unlike the multi-row flows-actors executions — does NOT opt\n * out of the singleton auto-business-key: the injected owner FK IS the business key, so there\n * is exactly ONE budget row per tenant (the period lives inside that row).\n */\nexport const A2A_TOKEN_BUDGET_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Polymorphic declaration for the A2A token budget state. Produces 3 singleton variants:\n *   - users        → `userA2aTokenBudgetState`         (`userId` injected)\n *   - organizations→ `organizationA2aTokenBudgetState` (`organizationId` injected)\n *   - applications → `applicationA2aTokenBudgetState`  (`applicationId` injected)\n */\nexport const a2aTokenBudgetStatePolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aTokenBudgetState',\n  baseFieldIdentifier: 'a2aTokenBudgetStateId',\n  baseEnumKey: 'A2A_TOKEN_BUDGET_STATE',\n  baseSchema: A2ATokenBudgetStateSchema,\n  variants: A2A_TOKEN_BUDGET_SCOPE_VARIANTS,\n});\n\n// NOTE: there is deliberately NO update DTO for this resource. The counter is advanced by an\n// ATOMIC repository-tier increment (`atomicIncrementField`) rather than a service-tier UPDATE,\n// precisely so concurrent turns cannot lose tokens to a read-modify-write race. A DTO here would\n// describe a write path nothing takes — and would invite routing the counter through it, silently\n// reintroducing that race. See `a2a-token-budget-state.shared.resources-config.schemas.ts`.\n"]}

package/dist/esm/flows-actors/actors.shared.schemas.d.ts

@@ -67,8 +67,6 @@ export declare const ActorSystemSchema: z.ZodObject<{
             applicationId: z.ZodOptional<z.ZodString>;
             userId: z.ZodOptional<z.ZodString>;
             roles: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CORE_APP_ROLES>, z.ZodEnum<typeof import("..").CORE_ORG_ROLES>, z.ZodString]>>>;
-            requiresApproval: z.ZodDefault<z.ZodBoolean>;
-            approverRoles: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CORE_APP_ROLES>, z.ZodEnum<typeof import("..").CORE_ORG_ROLES>, z.ZodString]>>>;
         }, z.core.$strip>>;
         riskLevel: z.ZodEnum<typeof import("..").ResourceOperationRiskLevel>;
         dataClassification: z.ZodOptional<z.ZodEnum<typeof import("..").Compliance_DataClassification>>;
@@ -78,11 +76,6 @@ export declare const ActorSystemSchema: z.ZodObject<{
             redactionType: z.ZodEnum<typeof import("..").RedactionType>;
             forRoles: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CORE_APP_ROLES>, z.ZodEnum<typeof import("..").CORE_ORG_ROLES>, z.ZodString]>>>;
         }, z.core.$strip>>>;
-        retentionPolicy: z.ZodOptional<z.ZodObject<{
-            retentionDays: z.ZodNumber;
-            autoDelete: z.ZodDefault<z.ZodBoolean>;
-            archiveAfterDays: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$strip>>;
     }, z.core.$strip>;
     version: z.ZodOptional<z.ZodString>;
     createdAt: z.ZodOptional<z.ZodString>;
@@ -134,8 +127,26 @@ export declare const ActorExecution_SuspensionSchema: z.ZodObject<{
         }, z.core.$strip>>;
         requestedAt: z.ZodString;
         expiresAt: z.ZodOptional<z.ZodString>;
+        review: z.ZodOptional<z.ZodObject<{
+            surface: z.ZodEnum<typeof import("./human-decision.shared.schemas").AgentWorkDecisionSurface>;
+        }, z.core.$strict>>;
     }, z.core.$strip>;
     suspendedAt: z.ZodISODateTime;
+    route: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_RouteKind>;
+        eligibleRole: z.ZodOptional<z.ZodString>;
+        organizationId: z.ZodOptional<z.ZodString>;
+        organizationUnitId: z.ZodOptional<z.ZodString>;
+        assigneeUserId: z.ZodOptional<z.ZodString>;
+        claimedAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    requester: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_RequesterKind>;
+        ref: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeVersion: z.ZodOptional<z.ZodNumber>;
+    suspensionId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ActorExecution_Suspension = z.infer<typeof ActorExecution_SuspensionSchema>;
 /**
@@ -173,8 +184,26 @@ export declare const ActorExecution_CheckpointSchema: z.ZodObject<{
             }, z.core.$strip>>;
             requestedAt: z.ZodString;
             expiresAt: z.ZodOptional<z.ZodString>;
+            review: z.ZodOptional<z.ZodObject<{
+                surface: z.ZodEnum<typeof import("./human-decision.shared.schemas").AgentWorkDecisionSurface>;
+            }, z.core.$strict>>;
         }, z.core.$strip>;
         suspendedAt: z.ZodISODateTime;
+        route: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_RouteKind>;
+            eligibleRole: z.ZodOptional<z.ZodString>;
+            organizationId: z.ZodOptional<z.ZodString>;
+            organizationUnitId: z.ZodOptional<z.ZodString>;
+            assigneeUserId: z.ZodOptional<z.ZodString>;
+            claimedAt: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        requester: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_RequesterKind>;
+            ref: z.ZodString;
+            clientId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        routeVersion: z.ZodOptional<z.ZodNumber>;
+        suspensionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     interruptedContinuations: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
@@ -194,10 +223,13 @@ export declare const ActorSystem_ExecutionSchema: z.ZodObject<{
         consumableTokenId: z.ZodOptional<z.ZodString>;
         webhookProviderId: z.ZodOptional<z.ZodString>;
         anonymousUserId: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-    statusChanges: z.ZodArray<z.ZodObject<{
-        status: z.ZodEnum<typeof FlowsActors_Status>;
-        timestamp: z.ZodString;
+        inboundDeliveryId: z.ZodOptional<z.ZodString>;
+        inboundHandlerRef: z.ZodOptional<z.ZodString>;
+        inboundScopeUserId: z.ZodOptional<z.ZodString>;
+        inboundSender: z.ZodOptional<z.ZodObject<{
+            channel: z.ZodEnum<typeof import("..").InboundChannelKind>;
+            assurance: z.ZodEnum<typeof import("..").InboundSenderAssurance>;
+        }, z.core.$strict>>;
     }, z.core.$strip>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
@@ -223,8 +255,26 @@ export declare const ActorSystem_ExecutionSchema: z.ZodObject<{
             }, z.core.$strip>>;
             requestedAt: z.ZodString;
             expiresAt: z.ZodOptional<z.ZodString>;
+            review: z.ZodOptional<z.ZodObject<{
+                surface: z.ZodEnum<typeof import("./human-decision.shared.schemas").AgentWorkDecisionSurface>;
+            }, z.core.$strict>>;
         }, z.core.$strip>;
         suspendedAt: z.ZodISODateTime;
+        route: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_RouteKind>;
+            eligibleRole: z.ZodOptional<z.ZodString>;
+            organizationId: z.ZodOptional<z.ZodString>;
+            organizationUnitId: z.ZodOptional<z.ZodString>;
+            assigneeUserId: z.ZodOptional<z.ZodString>;
+            claimedAt: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        requester: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_RequesterKind>;
+            ref: z.ZodString;
+            clientId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        routeVersion: z.ZodOptional<z.ZodNumber>;
+        suspensionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
     checkpoint: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         context: z.ZodAny;
@@ -249,12 +299,40 @@ export declare const ActorSystem_ExecutionSchema: z.ZodObject<{
                 }, z.core.$strip>>;
                 requestedAt: z.ZodString;
                 expiresAt: z.ZodOptional<z.ZodString>;
+                review: z.ZodOptional<z.ZodObject<{
+                    surface: z.ZodEnum<typeof import("./human-decision.shared.schemas").AgentWorkDecisionSurface>;
+                }, z.core.$strict>>;
             }, z.core.$strip>;
             suspendedAt: z.ZodISODateTime;
+            route: z.ZodOptional<z.ZodObject<{
+                kind: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_RouteKind>;
+                eligibleRole: z.ZodOptional<z.ZodString>;
+                organizationId: z.ZodOptional<z.ZodString>;
+                organizationUnitId: z.ZodOptional<z.ZodString>;
+                assigneeUserId: z.ZodOptional<z.ZodString>;
+                claimedAt: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            requester: z.ZodOptional<z.ZodObject<{
+                kind: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_RequesterKind>;
+                ref: z.ZodString;
+                clientId: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            routeVersion: z.ZodOptional<z.ZodNumber>;
+            suspensionId: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         interruptedContinuations: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>>;
     exclusiveSubject: z.ZodOptional<z.ZodString>;
+    statusChanges: z.ZodArray<z.ZodObject<{
+        status: z.ZodEnum<typeof FlowsActors_Status>;
+        timestamp: z.ZodString;
+        resolution: z.ZodOptional<z.ZodObject<{
+            decisionRef: z.ZodString;
+            outcome: z.ZodEnum<typeof import("./human-decision.shared.schemas").HumanDecision_Outcome>;
+            decidedByUserId: z.ZodOptional<z.ZodString>;
+            decidedAt: z.ZodISODateTime;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     plan: z.ZodOptional<z.ZodObject<{
         _id: z.ZodString;
         goalDescription: z.ZodString;
@@ -270,6 +348,13 @@ export declare const ActorSystem_ExecutionSchema: z.ZodObject<{
             consumableTokenId: z.ZodOptional<z.ZodString>;
             webhookProviderId: z.ZodOptional<z.ZodString>;
             anonymousUserId: z.ZodOptional<z.ZodString>;
+            inboundDeliveryId: z.ZodOptional<z.ZodString>;
+            inboundHandlerRef: z.ZodOptional<z.ZodString>;
+            inboundScopeUserId: z.ZodOptional<z.ZodString>;
+            inboundSender: z.ZodOptional<z.ZodObject<{
+                channel: z.ZodEnum<typeof import("..").InboundChannelKind>;
+                assurance: z.ZodEnum<typeof import("..").InboundSenderAssurance>;
+            }, z.core.$strict>>;
         }, z.core.$strip>;
         relationships: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<import("./flows-actors.commons.shared.schemas").FlowsActors_ElementKind.FLOW>;
@@ -396,12 +481,20 @@ export declare const ActorSystem_ExecutionSchema: z.ZodObject<{
                     consumableTokenId: z.ZodOptional<z.ZodString>;
                     webhookProviderId: z.ZodOptional<z.ZodString>;
                     anonymousUserId: z.ZodOptional<z.ZodString>;
+                    inboundDeliveryId: z.ZodOptional<z.ZodString>;
+                    inboundHandlerRef: z.ZodOptional<z.ZodString>;
+                    inboundScopeUserId: z.ZodOptional<z.ZodString>;
+                    inboundSender: z.ZodOptional<z.ZodObject<{
+                        channel: z.ZodEnum<typeof import("..").InboundChannelKind>;
+                        assurance: z.ZodEnum<typeof import("..").InboundSenderAssurance>;
+                    }, z.core.$strict>>;
                 }, z.core.$strip>>>;
                 executionType: z.ZodOptional<z.ZodEnum<typeof import("..").ExecutionContext_ExecutionType>>;
                 userGuidance: z.ZodOptional<z.ZodObject<{
                     guidanceKey: z.ZodOptional<z.ZodString>;
                     explanation: z.ZodOptional<z.ZodString>;
                     resolution: z.ZodOptional<z.ZodString>;
+                    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
                     completedSteps: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     nextAction: z.ZodOptional<z.ZodObject<{
                         label: z.ZodString;
@@ -481,6 +574,13 @@ export declare const ActorSystem_ExecutionSchema: z.ZodObject<{
             consumableTokenId: z.ZodOptional<z.ZodString>;
             webhookProviderId: z.ZodOptional<z.ZodString>;
             anonymousUserId: z.ZodOptional<z.ZodString>;
+            inboundDeliveryId: z.ZodOptional<z.ZodString>;
+            inboundHandlerRef: z.ZodOptional<z.ZodString>;
+            inboundScopeUserId: z.ZodOptional<z.ZodString>;
+            inboundSender: z.ZodOptional<z.ZodObject<{
+                channel: z.ZodEnum<typeof import("..").InboundChannelKind>;
+                assurance: z.ZodEnum<typeof import("..").InboundSenderAssurance>;
+            }, z.core.$strict>>;
         }, z.core.$strip>;
         relationships: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<import("./flows-actors.commons.shared.schemas").FlowsActors_ElementKind.FLOW>;
@@ -721,12 +821,20 @@ export declare const ActorSystem_ExecutionSchema: z.ZodObject<{
                     consumableTokenId: z.ZodOptional<z.ZodString>;
                     webhookProviderId: z.ZodOptional<z.ZodString>;
                     anonymousUserId: z.ZodOptional<z.ZodString>;
+                    inboundDeliveryId: z.ZodOptional<z.ZodString>;
+                    inboundHandlerRef: z.ZodOptional<z.ZodString>;
+                    inboundScopeUserId: z.ZodOptional<z.ZodString>;
+                    inboundSender: z.ZodOptional<z.ZodObject<{
+                        channel: z.ZodEnum<typeof import("..").InboundChannelKind>;
+                        assurance: z.ZodEnum<typeof import("..").InboundSenderAssurance>;
+                    }, z.core.$strict>>;
                 }, z.core.$strip>>>;
                 executionType: z.ZodOptional<z.ZodEnum<typeof import("..").ExecutionContext_ExecutionType>>;
                 userGuidance: z.ZodOptional<z.ZodObject<{
                     guidanceKey: z.ZodOptional<z.ZodString>;
                     explanation: z.ZodOptional<z.ZodString>;
                     resolution: z.ZodOptional<z.ZodString>;
+                    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
                     completedSteps: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     nextAction: z.ZodOptional<z.ZodObject<{
                         label: z.ZodString;
@@ -858,12 +966,20 @@ export declare const ActorSystem_ExecutionSchema: z.ZodObject<{
                 consumableTokenId: z.ZodOptional<z.ZodString>;
                 webhookProviderId: z.ZodOptional<z.ZodString>;
                 anonymousUserId: z.ZodOptional<z.ZodString>;
+                inboundDeliveryId: z.ZodOptional<z.ZodString>;
+                inboundHandlerRef: z.ZodOptional<z.ZodString>;
+                inboundScopeUserId: z.ZodOptional<z.ZodString>;
+                inboundSender: z.ZodOptional<z.ZodObject<{
+                    channel: z.ZodEnum<typeof import("..").InboundChannelKind>;
+                    assurance: z.ZodEnum<typeof import("..").InboundSenderAssurance>;
+                }, z.core.$strict>>;
             }, z.core.$strip>>>;
             executionType: z.ZodOptional<z.ZodEnum<typeof import("..").ExecutionContext_ExecutionType>>;
             userGuidance: z.ZodOptional<z.ZodObject<{
                 guidanceKey: z.ZodOptional<z.ZodString>;
                 explanation: z.ZodOptional<z.ZodString>;
                 resolution: z.ZodOptional<z.ZodString>;
+                params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
                 completedSteps: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 nextAction: z.ZodOptional<z.ZodObject<{
                     label: z.ZodString;

package/dist/esm/flows-actors/actors.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actors.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/actors.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAA6B,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAmG,oBAAoB,EAAG,MAAM,sCAAsC,CAAC;AAgB9K,oBAAY,mBAAmB;IAC7B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,iBAAiB,sBAAsB;IACvC,cAAc,mBAAmB;CAClC;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,WAAW;;;;;;;iBAOtB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgC1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoDtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"actors.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/actors.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAA6B,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAmG,oBAAoB,EAAG,MAAM,sCAAsC,CAAC;AAgB9K,oBAAY,mBAAmB;IAC7B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,iBAAiB,sBAAsB;IACvC,cAAc,mBAAmB;CAClC;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,WAAW;;;;;;;iBAOtB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgC1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+DtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/flows-actors/actors.shared.schemas.js

@@ -3,7 +3,7 @@ import { WildoError_BackendSchema } from "../errors/errors.shared.schemas.js";
 import { FlowsActors_Status, describeFlowsActorsStatus } from "./flows-actors.commons.shared.schemas.js";
 import { FlowActorSystem_BaseSchema, FlowActorSystem_ErrorStates_Schema, FlowActorSystem_ExecutionSchema, FlowActorSystem_Kind, } from "./flows-actors.system.shared.schemas.js";
 import { Actors_Task_Schema, ActorsSystem_ExecutionPlan_Schema } from "./tasks.actors.shared.schemas.js";
-import { HumanDecision_RequestSchema } from "./human-decision.shared.schemas.js";
+import { HumanDecision_RequestSchema, HumanDecision_RequesterSchema, HumanDecision_ResolutionSchema, HumanDecision_RouteSchema } from "./human-decision.shared.schemas.js";
 //===============================================================
 //  Actor
 // --------
@@ -95,6 +95,27 @@ export const ActorSystemSchema = FlowActorSystem_BaseSchema.extend({
 export const ActorExecution_SuspensionSchema = z.object({
     decision: HumanDecision_RequestSchema,
     suspendedAt: z.iso.datetime(),
+    /**
+     * WHO may settle this decision (#1594 D2) — the same shape the conversational plane stores in columns.
+     * Absent on a suspension whose host routes nothing: its own door is then the only authority over it,
+     * and the engine authorizes nothing it was not given a route for.
+     */
+    route: HumanDecision_RouteSchema.optional(),
+    /** The authority the run was raised under, and resumes under. Stamped beside `route`. */
+    requester: HumanDecision_RequesterSchema.optional(),
+    /**
+     * Bumped by every move of `route` (#1594 I5). The persistence port's compare-and-swap checks it, so an
+     * answer read under an older route loses. Written `0` with a route; absent when there is none.
+     */
+    routeVersion: z.number().int().nonnegative().optional(),
+    /**
+     * THIS suspension's identity, written once when the run suspends (#1581). A run may ask again after
+     * an answer, and its decision id names the RUN (hosts use their run or task id), so neither that nor
+     * an instant tells two questions of one run apart. An answer names the suspension it read, and a
+     * resume refuses one the run has moved past. Absent on a row written before it existed; such a
+     * suspension is named by its instant (`actorExecutionSuspensionRef` in the backend runtime).
+     */
+    suspensionId: z.string().min(1).optional(),
 });
 /**
  * What a run left behind so that whatever runs next can CONTINUE it — the host's resume inputs.
@@ -163,6 +184,16 @@ export const ActorSystem_ExecutionSchema = FlowActorSystem_ExecutionSchema.exten
      * of which a restart — or a second process — could not see.
      */
     exclusiveSubject: z.string().min(1).optional(),
+    /**
+     * The run's history, oldest first — as on every execution, plus the RESOLUTION of the decision a move
+     * ended (#1594 I4). The change that takes a run out of waiting carries how that wait ended, written in
+     * the same statement, so no second write can be lost between them. A decision that won and was then
+     * put back (the tasks could not follow) is followed by a change back to waiting: the history keeps what
+     * happened, and the latest change says where the run stands.
+     */
+    statusChanges: z.array(FlowActorSystem_ExecutionSchema.shape.statusChanges.element.extend({
+        resolution: HumanDecision_ResolutionSchema.optional(),
+    })),
     plan: ActorsSystem_ExecutionPlan_Schema.optional(),
     standaloneTasks: z.array(Actors_Task_Schema),
     standaloneTaskStates: z.object({

package/dist/esm/flows-actors/actors.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"actors.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/actors.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,oBAAoB,GAAG,MAAM,sCAAsC,CAAC;AAC9K,OAAO,EAAE,kBAAkB,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AACtG,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAG9E,iEAAiE;AACjE,SAAS;AACT,WAAW;AACX,gEAAgE;AAChE,kEAAkE;AAClE,iEAAiE;AACjE,sEAAsE;AACtE,mEAAmE;AACnE,iEAAiE;AAGjE,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,kDAA2B,CAAA;IAC3B,oDAA6B,CAAA;IAC7B,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;IACrB,8DAAuC,CAAA;IACvC,wDAAiC,CAAA;AACnC,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,wDAAiC,CAAA;IACjC,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,iEAAiE;AACjE,gBAAgB;AAChB,iEAAiE;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACjE;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;CAC3C,CAAC,CAAC;AAIH,iEAAiE;AACjE,0BAA0B;AAC1B,iEAAiE;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAChC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;OAUG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC,MAAM,CAAC;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAE3C,2GAA2G;IAC3G,UAAU,EAAE,+BAA+B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,+GAA+G;IAC/G,UAAU,EAAE,+BAA+B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEjE;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE9C,IAAI,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAClD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAE5C,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;iBAC/B,QAAQ,CAAC,yBAAyB,CAAC,4FAA4F,CAAC,CAAC;YACpI,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;SAC5B,CAAC,CAAC;KACJ,CAAC,CAAC,KAAK,EAAE;IAEV;;;;;OAKG;IACH,WAAW,EAAG,kCAAkC,CAAC,MAAM,CAAC;QACtD,UAAU,EAAE,wBAAwB,CAAC,MAAM,CAAC;YAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { WildoError_BackendSchema } from \"../errors/errors.shared.schemas\";\nimport { FlowsActors_Status, describeFlowsActorsStatus } from \"./flows-actors.commons.shared.schemas\";\nimport { FlowActorSystem_BaseSchema, FlowActorSystem_ErrorStates_Schema, FlowActorSystem_ExecutionSchema, FlowActorSystem_Kind, } from \"./flows-actors.system.shared.schemas\";\nimport { Actors_Task_Schema, ActorsSystem_ExecutionPlan_Schema } from \"./tasks.actors.shared.schemas\";\nimport { HumanDecision_RequestSchema } from \"./human-decision.shared.schemas\";\n\n\n//===============================================================\n//  Actor\n// --------\n// Actors are reactive components that subscribe to event topics\n// and respond with automated processing. They enable event-driven\n// architecture by processing messages asynchronously, supporting\n// batch processing, filtering, and various error handling strategies.\n// Actors can emit new events, creating event chains and workflows.\n//===============================================================\n\n\nexport enum Actor_Role_Category {\n  COORDINATOR = \"coordinator\",\n  TASK_PLANNER = \"task_planner\",\n  OPERATOR = \"operator\",\n  ANALYZER = \"analyzer\",\n  REVIEWER = \"reviewer\",\n  HUMAN_IN_THE_LOOP = \"human_in_the_loop\",\n  FLOW_EXECUTION = \"flow_execution\"\n}\n\n\n/**\n * HOW an actor does its work when the runtime drives it.\n *\n * `PROGRAMMATIC` (added 2026-09-20, #1358) is the mode of an actor whose behaviour is supplied by the\n * HOST as code rather than by an agent, a flow or a person: the execution driver opens the actor's\n * task, hands the opened identities to a host-supplied executor, and settles on its outcome. An actor\n * is not an agent — a methodology step run by the app-creation companion, or a deterministic check,\n * is an actor with no model behind it, and until this member existed such an actor had to borrow\n * `AGENTIC` without an `agentRef`, which is a lie the registry cannot see.\n *\n * `FLOW_EXECUTION` is a PLANNED member and stays (decided by Paul, 2026-09-21, #1363). The Flow\n * execution model is not implemented yet — `FlowsBackendService.executeFlow` refuses honestly — and\n * it is intended: an actor whose work is a declared flow is part of what this system is for. No\n * driver dispatches on this member today, so a reader sweep reports zero; that is the state of the\n * build, not a verdict on the member. Do not delete it, the Flow model, or `Actor_Role_Category`'s\n * matching member on that measurement.\n */\nexport enum Actor_ExecutionMode {\n  AGENTIC = \"agentic\",\n  FLOW_EXECUTION = \"flow_execution\",\n  HUMAN_INTERACTION = \"human_interaction\",\n  PROGRAMMATIC = \"programmatic\",\n}\n\nexport const ActorSchema = z.object({\n  ref: z.string().min(1),\n  displayName: z.string().min(1),\n  roleCategory: z.enum(Actor_Role_Category),\n  executionMode: z.enum(Actor_ExecutionMode),\n  agentRef: z.string().optional(),\n  flowRef: z.string().optional(),\n});\nexport type Actor = z.infer<typeof ActorSchema>;\n\n//===============================================================\n//  Actor System\n//===============================================================\n\n/**\n * The ACTOR specialization of the system base — the schema that OWNS a system's\n * actor list. `actors` is declared here and in no other system schema: the base\n * cannot declare it, because a FLOW system has no actors. (Unrelated `actors`\n * members exist on the TASK schemas; those point at one actor, they are not a\n * system's roster.)\n *\n * An actor system must therefore be parsed with this schema, or one derived\n * from it. Parsing one with `FlowActorSystem_BaseSchema` strips `actors`\n * silently — see the warning there.\n */\nexport const ActorSystemSchema = FlowActorSystem_BaseSchema.extend({\n  /**\n   * Narrows the inherited `kind` discriminant to ACTOR. The historical shape\n   * added a separate `type` field here while every consumer (backend registry,\n   * execution schemas, flows counterpart) discriminates on `kind` — fixed\n   * 2026-07-02 (meta-workflows Step 0 hygiene; no `.type` consumer existed).\n   */\n  kind: z.literal(FlowActorSystem_Kind.ACTOR),\n  actors: z.array(z.lazy(() => ActorSchema)),\n});\nexport type ActorSystem = z.infer<typeof ActorSystemSchema>;\n\n\n//===============================================================\n//  Actor System Execution\n//===============================================================\n\n/**\n * The human decision an execution is WAITING on — present exactly while its status is\n * `AWAITING_APPROVAL`, and cleared by the resume that answers it.\n *\n * Until #1360 three stores held this for three kinds of question (a checkpoint file for a mid-run\n * clarification, another for an interrupted composite, a task's `output.suspension` for a parked\n * coding question), projecting one `HumanDecision_Request` each — the payload was unified by #1269\n * and the storage was left where it was on the premise that a playbook run had no execution row.\n * #1343 removed that premise. The decision lives on the row the run already has.\n */\nexport const ActorExecution_SuspensionSchema = z.object({\n  decision: HumanDecision_RequestSchema,\n  suspendedAt: z.iso.datetime(),\n});\nexport type ActorExecution_Suspension = z.infer<typeof ActorExecution_SuspensionSchema>;\n\n/**\n * What a run left behind so that whatever runs next can CONTINUE it — the host's resume inputs.\n *\n * `context` is opaque to the engine, exactly as `FlowsActors_Checkpoint.context` is: the engine owns\n * the slot and when it is written and read; the host that executes the work owns the content and\n * validates it at its own boundary. Written while a run progresses (so a run whose process is taken\n * away can be continued) and when a run suspends (so its resume can rebuild what it was doing).\n *\n * A checkpoint outliving its run is the ordinary signal of an INTERRUPTED run: the driver settles a\n * run whose host died `ABORTED` at the next startup and leaves this in place, so \"interrupted and\n * resumable\" is `ABORTED` with a checkpoint — a fact of the row, not a fourth status (#1360).\n */\nexport const ActorExecution_CheckpointSchema = z.object({\n  context: z.any(),\n  checkpointedAt: z.iso.datetime(),\n  /**\n   * The question a RESUMED run was answering, kept until the run moves past it.\n   *\n   * A resume clears `suspension` and moves the row to `PROCESSING`. When the host asked for a failed\n   * continuation to leave the question standing (`restoreSuspensionOnFailure`), a THROWN continuation\n   * is caught and the suspension restored. A continuation whose PROCESS dies throws nothing: the\n   * startup orphan sweep used to settle it `ABORTED`, and the person's answer went with it. Measured\n   * 2026-09-24 on a real domain-plan clarification: answered, resumed, and aborted 85 s later by a\n   * companion restart, which the dev loop performs every few minutes.\n   *\n   * So the resume writes the suspension here, and the sweep puts an orphan that carries one back to\n   * `AWAITING_APPROVAL` on the same question instead of aborting it. It lives on the CHECKPOINT\n   * because it is a resume input with the same lifetime: a host checkpoint written mid-run replaces\n   * the whole checkpoint and drops it (the run has moved past the question), a new suspension\n   * replaces it, and a settle that keeps the checkpoint strips it.\n   */\n  resumedSuspension: ActorExecution_SuspensionSchema.optional(),\n  /**\n   * How many continuations of the pending question DIED WITH THEIR PROCESS before this one (#1507).\n   *\n   * The startup sweep puts such a run back to waiting (see `resumedSuspension`), and nothing else\n   * remembers that a continuation ran: whatever it did and spent went with the process. Counted here so\n   * the host can say so — a playbook run records each as an unobserved part of its spend, so its total\n   * reads as a floor rather than as complete. Cleared once a host has accounted for them in the task's\n   * own record (a restored output after a thrown continuation), and whenever the run moves past the\n   * question: a new suspension replaces the checkpoint, a consuming settle clears it, and a settle that\n   * keeps it drops this count with `resumedSuspension`.\n   */\n  interruptedContinuations: z.number().int().positive().optional(),\n});\nexport type ActorExecution_Checkpoint = z.infer<typeof ActorExecution_CheckpointSchema>;\n\n\nexport const ActorSystem_ExecutionSchema = FlowActorSystem_ExecutionSchema.extend({\n  kind: z.literal(FlowActorSystem_Kind.ACTOR),\n\n  /** See {@link ActorExecution_SuspensionSchema}. `null` once answered; absent on a run that never asked. */\n  suspension: ActorExecution_SuspensionSchema.nullable().optional(),\n  /** See {@link ActorExecution_CheckpointSchema}. `null` once consumed; absent on a run that never wrote one. */\n  checkpoint: ActorExecution_CheckpointSchema.nullable().optional(),\n\n  /**\n   * What this execution runs EXCLUSIVELY — the subject of its single-flight lease (#1361).\n   *\n   * While an execution carrying a subject is `PENDING` or `PROCESSING`, the runtime refuses to open\n   * or resume another execution of the SAME system with the same subject. The lease IS the row: no\n   * second record says \"busy\", so nothing can disagree with what is actually running. A run that is\n   * waiting on a person (`AWAITING_APPROVAL`) does not hold it — it is not running — and a host's\n   * startup orphan sweep is what releases a lease whose holder died.\n   *\n   * Absent on the ordinary run, which excludes nothing. The subject's vocabulary is the opening\n   * domain's: the runtime compares it and never reads it.\n   *\n   * Until #1361 this principle was implemented three times in one consumer as in-memory flags, each\n   * of which a restart — or a second process — could not see.\n   */\n  exclusiveSubject: z.string().min(1).optional(),\n\n  plan: ActorsSystem_ExecutionPlan_Schema.optional(),\n  standaloneTasks: z.array(Actors_Task_Schema),\n\n  standaloneTaskStates: z.object({\n    taskId: z.string(),\n    status: z.enum(FlowsActors_Status),\n    updatedAt: z.iso.datetime(),\n    statusChanges: z.array(z.object({\n      status: z.enum(FlowsActors_Status)\n        .describe(describeFlowsActorsStatus(\"The state this run moved into at `timestamp`. The list is the run's history, oldest first.\")),\n      timestamp: z.iso.datetime(),\n    })),\n  }).array(),\n\n  /**\n   * Overrides the base `errorItems` with the actor-execution-scoped variant\n   * (adds taskId/planStepId locators). Historically this extension used a\n   * divergent `errors` key coexisting with the base `errorItems` — aligned\n   * 2026-07-02 (meta-workflows Step 0 hygiene; the field had no consumers).\n   */\n  errorStates : FlowActorSystem_ErrorStates_Schema.extend({\n    errorItems: WildoError_BackendSchema.extend({\n      systemRef: z.string(),\n      taskId: z.string().optional(),\n      planStepId: z.string().optional(),\n    }).array().optional(),\n  }).optional(),\n});\nexport type ActorSystem_Execution = z.infer<typeof ActorSystem_ExecutionSchema>;\n"]}
+{"version":3,"file":"actors.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/actors.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,oBAAoB,GAAG,MAAM,sCAAsC,CAAC;AAC9K,OAAO,EAAE,kBAAkB,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AACtG,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAGxK,iEAAiE;AACjE,SAAS;AACT,WAAW;AACX,gEAAgE;AAChE,kEAAkE;AAClE,iEAAiE;AACjE,sEAAsE;AACtE,mEAAmE;AACnE,iEAAiE;AAGjE,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,kDAA2B,CAAA;IAC3B,oDAA6B,CAAA;IAC7B,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;IACrB,8DAAuC,CAAA;IACvC,wDAAiC,CAAA;AACnC,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,wDAAiC,CAAA;IACjC,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,iEAAiE;AACjE,gBAAgB;AAChB,iEAAiE;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACjE;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;CAC3C,CAAC,CAAC;AAIH,iEAAiE;AACjE,0BAA0B;AAC1B,iEAAiE;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC7B;;;;OAIG;IACH,KAAK,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3C,yFAAyF;IACzF,SAAS,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACnD;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAChC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;OAUG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC,MAAM,CAAC;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAE3C,2GAA2G;IAC3G,UAAU,EAAE,+BAA+B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,+GAA+G;IAC/G,UAAU,EAAE,+BAA+B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEjE;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE9C;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;QACxF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;KACtD,CAAC,CAAC;IAEH,IAAI,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAClD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAE5C,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;iBAC/B,QAAQ,CAAC,yBAAyB,CAAC,4FAA4F,CAAC,CAAC;YACpI,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;SAC5B,CAAC,CAAC;KACJ,CAAC,CAAC,KAAK,EAAE;IAEV;;;;;OAKG;IACH,WAAW,EAAG,kCAAkC,CAAC,MAAM,CAAC;QACtD,UAAU,EAAE,wBAAwB,CAAC,MAAM,CAAC;YAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { WildoError_BackendSchema } from \"../errors/errors.shared.schemas\";\nimport { FlowsActors_Status, describeFlowsActorsStatus } from \"./flows-actors.commons.shared.schemas\";\nimport { FlowActorSystem_BaseSchema, FlowActorSystem_ErrorStates_Schema, FlowActorSystem_ExecutionSchema, FlowActorSystem_Kind, } from \"./flows-actors.system.shared.schemas\";\nimport { Actors_Task_Schema, ActorsSystem_ExecutionPlan_Schema } from \"./tasks.actors.shared.schemas\";\nimport { HumanDecision_RequestSchema, HumanDecision_RequesterSchema, HumanDecision_ResolutionSchema, HumanDecision_RouteSchema } from \"./human-decision.shared.schemas\";\n\n\n//===============================================================\n//  Actor\n// --------\n// Actors are reactive components that subscribe to event topics\n// and respond with automated processing. They enable event-driven\n// architecture by processing messages asynchronously, supporting\n// batch processing, filtering, and various error handling strategies.\n// Actors can emit new events, creating event chains and workflows.\n//===============================================================\n\n\nexport enum Actor_Role_Category {\n  COORDINATOR = \"coordinator\",\n  TASK_PLANNER = \"task_planner\",\n  OPERATOR = \"operator\",\n  ANALYZER = \"analyzer\",\n  REVIEWER = \"reviewer\",\n  HUMAN_IN_THE_LOOP = \"human_in_the_loop\",\n  FLOW_EXECUTION = \"flow_execution\"\n}\n\n\n/**\n * HOW an actor does its work when the runtime drives it.\n *\n * `PROGRAMMATIC` (added 2026-09-20, #1358) is the mode of an actor whose behaviour is supplied by the\n * HOST as code rather than by an agent, a flow or a person: the execution driver opens the actor's\n * task, hands the opened identities to a host-supplied executor, and settles on its outcome. An actor\n * is not an agent — a methodology step run by the app-creation companion, or a deterministic check,\n * is an actor with no model behind it, and until this member existed such an actor had to borrow\n * `AGENTIC` without an `agentRef`, which is a lie the registry cannot see.\n *\n * `FLOW_EXECUTION` is a PLANNED member and stays (decided by Paul, 2026-09-21, #1363). The Flow\n * execution model is not implemented yet — `FlowsBackendService.executeFlow` refuses honestly — and\n * it is intended: an actor whose work is a declared flow is part of what this system is for. No\n * driver dispatches on this member today, so a reader sweep reports zero; that is the state of the\n * build, not a verdict on the member. Do not delete it, the Flow model, or `Actor_Role_Category`'s\n * matching member on that measurement.\n */\nexport enum Actor_ExecutionMode {\n  AGENTIC = \"agentic\",\n  FLOW_EXECUTION = \"flow_execution\",\n  HUMAN_INTERACTION = \"human_interaction\",\n  PROGRAMMATIC = \"programmatic\",\n}\n\nexport const ActorSchema = z.object({\n  ref: z.string().min(1),\n  displayName: z.string().min(1),\n  roleCategory: z.enum(Actor_Role_Category),\n  executionMode: z.enum(Actor_ExecutionMode),\n  agentRef: z.string().optional(),\n  flowRef: z.string().optional(),\n});\nexport type Actor = z.infer<typeof ActorSchema>;\n\n//===============================================================\n//  Actor System\n//===============================================================\n\n/**\n * The ACTOR specialization of the system base — the schema that OWNS a system's\n * actor list. `actors` is declared here and in no other system schema: the base\n * cannot declare it, because a FLOW system has no actors. (Unrelated `actors`\n * members exist on the TASK schemas; those point at one actor, they are not a\n * system's roster.)\n *\n * An actor system must therefore be parsed with this schema, or one derived\n * from it. Parsing one with `FlowActorSystem_BaseSchema` strips `actors`\n * silently — see the warning there.\n */\nexport const ActorSystemSchema = FlowActorSystem_BaseSchema.extend({\n  /**\n   * Narrows the inherited `kind` discriminant to ACTOR. The historical shape\n   * added a separate `type` field here while every consumer (backend registry,\n   * execution schemas, flows counterpart) discriminates on `kind` — fixed\n   * 2026-07-02 (meta-workflows Step 0 hygiene; no `.type` consumer existed).\n   */\n  kind: z.literal(FlowActorSystem_Kind.ACTOR),\n  actors: z.array(z.lazy(() => ActorSchema)),\n});\nexport type ActorSystem = z.infer<typeof ActorSystemSchema>;\n\n\n//===============================================================\n//  Actor System Execution\n//===============================================================\n\n/**\n * The human decision an execution is WAITING on — present exactly while its status is\n * `AWAITING_APPROVAL`, and cleared by the resume that answers it.\n *\n * Until #1360 three stores held this for three kinds of question (a checkpoint file for a mid-run\n * clarification, another for an interrupted composite, a task's `output.suspension` for a parked\n * coding question), projecting one `HumanDecision_Request` each — the payload was unified by #1269\n * and the storage was left where it was on the premise that a playbook run had no execution row.\n * #1343 removed that premise. The decision lives on the row the run already has.\n */\nexport const ActorExecution_SuspensionSchema = z.object({\n  decision: HumanDecision_RequestSchema,\n  suspendedAt: z.iso.datetime(),\n  /**\n   * WHO may settle this decision (#1594 D2) — the same shape the conversational plane stores in columns.\n   * Absent on a suspension whose host routes nothing: its own door is then the only authority over it,\n   * and the engine authorizes nothing it was not given a route for.\n   */\n  route: HumanDecision_RouteSchema.optional(),\n  /** The authority the run was raised under, and resumes under. Stamped beside `route`. */\n  requester: HumanDecision_RequesterSchema.optional(),\n  /**\n   * Bumped by every move of `route` (#1594 I5). The persistence port's compare-and-swap checks it, so an\n   * answer read under an older route loses. Written `0` with a route; absent when there is none.\n   */\n  routeVersion: z.number().int().nonnegative().optional(),\n  /**\n   * THIS suspension's identity, written once when the run suspends (#1581). A run may ask again after\n   * an answer, and its decision id names the RUN (hosts use their run or task id), so neither that nor\n   * an instant tells two questions of one run apart. An answer names the suspension it read, and a\n   * resume refuses one the run has moved past. Absent on a row written before it existed; such a\n   * suspension is named by its instant (`actorExecutionSuspensionRef` in the backend runtime).\n   */\n  suspensionId: z.string().min(1).optional(),\n});\nexport type ActorExecution_Suspension = z.infer<typeof ActorExecution_SuspensionSchema>;\n\n/**\n * What a run left behind so that whatever runs next can CONTINUE it — the host's resume inputs.\n *\n * `context` is opaque to the engine, exactly as `FlowsActors_Checkpoint.context` is: the engine owns\n * the slot and when it is written and read; the host that executes the work owns the content and\n * validates it at its own boundary. Written while a run progresses (so a run whose process is taken\n * away can be continued) and when a run suspends (so its resume can rebuild what it was doing).\n *\n * A checkpoint outliving its run is the ordinary signal of an INTERRUPTED run: the driver settles a\n * run whose host died `ABORTED` at the next startup and leaves this in place, so \"interrupted and\n * resumable\" is `ABORTED` with a checkpoint — a fact of the row, not a fourth status (#1360).\n */\nexport const ActorExecution_CheckpointSchema = z.object({\n  context: z.any(),\n  checkpointedAt: z.iso.datetime(),\n  /**\n   * The question a RESUMED run was answering, kept until the run moves past it.\n   *\n   * A resume clears `suspension` and moves the row to `PROCESSING`. When the host asked for a failed\n   * continuation to leave the question standing (`restoreSuspensionOnFailure`), a THROWN continuation\n   * is caught and the suspension restored. A continuation whose PROCESS dies throws nothing: the\n   * startup orphan sweep used to settle it `ABORTED`, and the person's answer went with it. Measured\n   * 2026-09-24 on a real domain-plan clarification: answered, resumed, and aborted 85 s later by a\n   * companion restart, which the dev loop performs every few minutes.\n   *\n   * So the resume writes the suspension here, and the sweep puts an orphan that carries one back to\n   * `AWAITING_APPROVAL` on the same question instead of aborting it. It lives on the CHECKPOINT\n   * because it is a resume input with the same lifetime: a host checkpoint written mid-run replaces\n   * the whole checkpoint and drops it (the run has moved past the question), a new suspension\n   * replaces it, and a settle that keeps the checkpoint strips it.\n   */\n  resumedSuspension: ActorExecution_SuspensionSchema.optional(),\n  /**\n   * How many continuations of the pending question DIED WITH THEIR PROCESS before this one (#1507).\n   *\n   * The startup sweep puts such a run back to waiting (see `resumedSuspension`), and nothing else\n   * remembers that a continuation ran: whatever it did and spent went with the process. Counted here so\n   * the host can say so — a playbook run records each as an unobserved part of its spend, so its total\n   * reads as a floor rather than as complete. Cleared once a host has accounted for them in the task's\n   * own record (a restored output after a thrown continuation), and whenever the run moves past the\n   * question: a new suspension replaces the checkpoint, a consuming settle clears it, and a settle that\n   * keeps it drops this count with `resumedSuspension`.\n   */\n  interruptedContinuations: z.number().int().positive().optional(),\n});\nexport type ActorExecution_Checkpoint = z.infer<typeof ActorExecution_CheckpointSchema>;\n\n\nexport const ActorSystem_ExecutionSchema = FlowActorSystem_ExecutionSchema.extend({\n  kind: z.literal(FlowActorSystem_Kind.ACTOR),\n\n  /** See {@link ActorExecution_SuspensionSchema}. `null` once answered; absent on a run that never asked. */\n  suspension: ActorExecution_SuspensionSchema.nullable().optional(),\n  /** See {@link ActorExecution_CheckpointSchema}. `null` once consumed; absent on a run that never wrote one. */\n  checkpoint: ActorExecution_CheckpointSchema.nullable().optional(),\n\n  /**\n   * What this execution runs EXCLUSIVELY — the subject of its single-flight lease (#1361).\n   *\n   * While an execution carrying a subject is `PENDING` or `PROCESSING`, the runtime refuses to open\n   * or resume another execution of the SAME system with the same subject. The lease IS the row: no\n   * second record says \"busy\", so nothing can disagree with what is actually running. A run that is\n   * waiting on a person (`AWAITING_APPROVAL`) does not hold it — it is not running — and a host's\n   * startup orphan sweep is what releases a lease whose holder died.\n   *\n   * Absent on the ordinary run, which excludes nothing. The subject's vocabulary is the opening\n   * domain's: the runtime compares it and never reads it.\n   *\n   * Until #1361 this principle was implemented three times in one consumer as in-memory flags, each\n   * of which a restart — or a second process — could not see.\n   */\n  exclusiveSubject: z.string().min(1).optional(),\n\n  /**\n   * The run's history, oldest first — as on every execution, plus the RESOLUTION of the decision a move\n   * ended (#1594 I4). The change that takes a run out of waiting carries how that wait ended, written in\n   * the same statement, so no second write can be lost between them. A decision that won and was then\n   * put back (the tasks could not follow) is followed by a change back to waiting: the history keeps what\n   * happened, and the latest change says where the run stands.\n   */\n  statusChanges: z.array(FlowActorSystem_ExecutionSchema.shape.statusChanges.element.extend({\n    resolution: HumanDecision_ResolutionSchema.optional(),\n  })),\n\n  plan: ActorsSystem_ExecutionPlan_Schema.optional(),\n  standaloneTasks: z.array(Actors_Task_Schema),\n\n  standaloneTaskStates: z.object({\n    taskId: z.string(),\n    status: z.enum(FlowsActors_Status),\n    updatedAt: z.iso.datetime(),\n    statusChanges: z.array(z.object({\n      status: z.enum(FlowsActors_Status)\n        .describe(describeFlowsActorsStatus(\"The state this run moved into at `timestamp`. The list is the run's history, oldest first.\")),\n      timestamp: z.iso.datetime(),\n    })),\n  }).array(),\n\n  /**\n   * Overrides the base `errorItems` with the actor-execution-scoped variant\n   * (adds taskId/planStepId locators). Historically this extension used a\n   * divergent `errors` key coexisting with the base `errorItems` — aligned\n   * 2026-07-02 (meta-workflows Step 0 hygiene; the field had no consumers).\n   */\n  errorStates : FlowActorSystem_ErrorStates_Schema.extend({\n    errorItems: WildoError_BackendSchema.extend({\n      systemRef: z.string(),\n      taskId: z.string().optional(),\n      planStepId: z.string().optional(),\n    }).array().optional(),\n  }).optional(),\n});\nexport type ActorSystem_Execution = z.infer<typeof ActorSystem_ExecutionSchema>;\n"]}