npm - @wildo-ai/saas-models - Versions diffs - 1.1.5 → 1.1.7 - Mend

@wildo-ai/saas-models 1.1.5 → 1.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1295) hide show

package/dist/esm/flows-actors/agent-traceability.shared.schemas.d.ts CHANGED Viewed

@@ -113,6 +113,10 @@ export declare const AgentCallTraceSchema: z.ZodObject<{
                 cacheReadTokens: z.ZodOptional<z.ZodNumber>;
                 cacheWriteTokens: z.ZodOptional<z.ZodNumber>;
             }, z.core.$strip>>;
+            outputTokenDetails: z.ZodOptional<z.ZodObject<{
+                textTokens: z.ZodOptional<z.ZodNumber>;
+                reasoningTokens: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
         }, z.core.$strip>>;
         outputTracking: z.ZodOptional<z.ZodObject<{
             toolsUsed: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -203,6 +207,18 @@ export declare const AgentTraceContextSchema: z.ZodObject<{
     label: z.ZodOptional<z.ZodString>;
     attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     levelOverride: z.ZodOptional<z.ZodEnum<typeof AgentTraceabilityLevel>>;
+    attribution: z.ZodOptional<z.ZodObject<{
+        organizationId: z.ZodOptional<z.ZodString>;
+        caseRef: z.ZodOptional<z.ZodObject<{
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+        }, z.core.$strict>>;
+        executionRef: z.ZodOptional<z.ZodObject<{
+            kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./work-attribution.shared.schemas").ExecutionRefKind>>;
+            id: z.ZodString;
+        }, z.core.$strict>>;
+        taskRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strip>;
 export type AgentTraceContext = z.infer<typeof AgentTraceContextSchema>;
 /**

package/dist/esm/flows-actors/agent-traceability.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-traceability.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/flows-actors/agent-traceability.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAGxB~~;;;;;;;;;;GAUG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;IACb,KAAK,UAAU;IACf,aAAa,kBAAkB;CAChC;AAED,wEAAwE;AACxE,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAIjF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,sBAAsB,EACnC,YAAY,EAAE,sBAAsB,GACnC,OAAO,CAET;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,sBAAsB,EACzB,CAAC,EAAE,sBAAsB,GACxB,sBAAsB,CAExB;AAED,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qDAAqD;AACrD,oBAAY,gBAAgB;IAC1B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe;IACzB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBA4B/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB~~;;;;;;iBAWlC~~,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC"}
1	+ {"version":3,"file":"agent-traceability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/agent-traceability.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;GAUG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;IACb,KAAK,UAAU;IACf,aAAa,kBAAkB;CAChC;AAED,wEAAwE;AACxE,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAIjF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,sBAAsB,EACnC,YAAY,EAAE,sBAAsB,GACnC,OAAO,CAET;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,sBAAsB,EACzB,CAAC,EAAE,sBAAsB,GACxB,sBAAsB,CAExB;AAED,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qDAAqD;AACrD,oBAAY,gBAAgB;IAC1B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe;IACzB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4B/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;iBAiBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC"}

package/dist/esm/flows-actors/agent-traceability.shared.schemas.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { LLMProvider_OperationContext_BaseSchema } from '@wildo-ai/external-connectors-models';
+import { ModelCallAttributionInputSchema } from './work-attribution.shared.schemas.js';
 /**
  * Verbosity policy for engine-level agent-call traceability. Promotes the
  * companion's previously-local `WILDO_DEV_COMPANION_TRACEABILITY_LEVEL` to a
@@ -148,5 +149,11 @@ export const AgentTraceContextSchema = z.object({
     attributes: z.record(z.string(), z.unknown()).optional(),
     /** Per-call override of the engine policy level (else the engine default applies). */
     levelOverride: z.enum(AgentTraceabilityLevel).optional(),
+    /**
+     * Explicit work attribution for this call (#1598): tenant, case, execution and task. Wins over the
+     * ambient work frame. Deliberately a typed field and NOT part of `attributes`, which are free-form
+     * caller dimensions for telemetry and never reach the attribution store.
+     */
+    attribution: ModelCallAttributionInputSchema.optional(),
 });
 //# sourceMappingURL=agent-traceability.shared.schemas.js.map

package/dist/esm/flows-actors/agent-traceability.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-traceability.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/agent-traceability.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,uCAAa,CAAA;IACb,yCAAe,CAAA;IACf,yDAA+B,CAAA;AACjC,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAA2C;IACpF,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;IAChC,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;IACjC,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmC,EACnC,YAAoC;IAEpC,OAAO,8BAA8B,CAAC,WAAW,CAAC,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,CAAyB,EACzB,CAAyB;IAEzB,OAAO,8BAA8B,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC;CAC3E,CAAC,CAAC;AAGH,qDAAqD;AACrD,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;AACrB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,6CAAuB,CAAA;AACzB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,0FAA0F;IAC1F,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,8CAA8C;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iEAAiE;IACjE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjC,sFAAsF;IACtF,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,qFAAqF;IACrF,OAAO,EAAE,uCAAuC,CAAC,QAAQ,EAAE;IAC3D,4BAA4B;IAC5B,KAAK,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,6EAA6E;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,oFAAoF;IACpF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { LLMProvider_OperationContext_BaseSchema } from '@wildo-ai/external-connectors-models';\n\n/*\n Verbosity policy for engine-level agent-call traceability. Promotes the\n * companion's previously-local `WILDO_DEV_COMPANION_TRACEABILITY_LEVEL` to a\n * shared engine contract so every agent caller (companion, backend runtime,\n * minions, workers) and every sink (filesystem, logger, OTel) speak the same\n * levels.\n \n - `NONE` — tracing fully off; emitters must no-op before any I/O.\n * - `DEBUG` — per-call metadata + token usage + latency (no payloads).\n * - `DEBUG_VERBOSE` — adds the resolved prompt input + raw output payloads.\n /\nexport enum AgentTraceabilityLevel {\n NONE = 'NONE',\n DEBUG = 'DEBUG',\n DEBUG_VERBOSE = 'DEBUG_VERBOSE',\n}\n\n/* Numeric ordering for `AgentTraceabilityLevel` gating comparisons. /\nexport const AGENT_TRACEABILITY_LEVEL_ORDER: Record<AgentTraceabilityLevel, number> = {\n [AgentTraceabilityLevel.NONE]: 0,\n [AgentTraceabilityLevel.DEBUG]: 1,\n [AgentTraceabilityLevel.DEBUG_VERBOSE]: 2,\n};\n\n/\n True when `activeLevel` is at least `minimumLevel` — the canonical gate every\n * sink/emitter uses so a record is persisted only when the active policy meets\n * the record's minimum verbosity.\n /\nexport function agentTraceabilityLevelAllows(\n activeLevel: AgentTraceabilityLevel,\n minimumLevel: AgentTraceabilityLevel,\n): boolean {\n return AGENT_TRACEABILITY_LEVEL_ORDER[activeLevel] >= AGENT_TRACEABILITY_LEVEL_ORDER[minimumLevel];\n}\n\n/\n The more verbose of two levels — for hosts that COMPOSE traceability\n * concerns behind one policy binding. A host policy must never be LESS\n * verbose than any interested sink: a companion whose filesystem tracing is\n * off (`NONE`) but whose LLM-observability provider is active still needs\n * `DEBUG` so the emission reaches the sinks (each sink then self-gates).\n * Replacing a live policy with a static lower level silently kills every\n * downstream sink — the failure mode that motivated this helper.\n /\nexport function maxAgentTraceabilityLevel(\n a: AgentTraceabilityLevel,\n b: AgentTraceabilityLevel,\n): AgentTraceabilityLevel {\n return AGENT_TRACEABILITY_LEVEL_ORDER[a] >= AGENT_TRACEABILITY_LEVEL_ORDER[b] ? a : b;\n}\n\n/* Engine-resolved traceability policy handed to `AgentsBackendService`. /\nexport const AgentTraceabilityPolicySchema = z.object({\n level: z.enum(AgentTraceabilityLevel).default(AgentTraceabilityLevel.NONE),\n});\nexport type AgentTraceabilityPolicy = z.infer<typeof AgentTraceabilityPolicySchema>;\n\n/* Terminal outcome of a single agent invocation. /\nexport enum AgentCallOutcome {\n SUCCESS = 'success',\n FAILURE = 'failure',\n}\n\n/\n WHAT KIND of model call a trace records — the operation-aware axis observability sinks branch\n * on (RAG plan DL2/H4). The two kinds differ structurally, not cosmetically:\n \n - a GENERATION consumes prompt tokens and produces completion tokens; its usage is complete\n * only when BOTH dimensions are present, and its payload (prompt/completion text) may be\n * forwarded to analytics under an explicit content opt-in;\n * - an EMBEDDING consumes input tokens and produces VECTORS; it has no completion-token\n * dimension (so completeness is judged on input tokens alone), and its output must NEVER\n * reach analytics or logs at any verbosity — a vector is a lossy encoding of the source text,\n * not telemetry. Producers put a `{ vectorCount, dims }` summary in `output`; sinks enforce\n * the exclusion defensively on top.\n \n Absent means GENERATION (every pre-existing producer), so the field is additive.\n /\nexport enum AgentCallTraceKind {\n GENERATION = 'generation',\n EMBEDDING = 'embedding',\n}\n\n/\n Structured, JSON-serializable shape for a failed agent call. (Never the raw\n * `Error` object — it collapses to `{}` under `JSON.stringify`.)\n /\nexport const AgentCallTraceErrorSchema = z.object({\n name: z.string().optional(),\n message: z.string(),\n code: z.string().optional(),\n});\nexport type AgentCallTraceError = z.infer<typeof AgentCallTraceErrorSchema>;\n\n/\n The typed per-call trace record the engine emits to the configured sink, once\n * per `invokeAgent` completion (success or failure). This is the contract that\n * replaces every caller's hand-rolled `response.executionContext as { usage?,\n * executionTime? }` cast + manual artifact write.\n \n - `context` reuses {@link LLMProvider_OperationContext_BaseSchema} — the exact\n * telemetry envelope (`usage` / `executionTime` / `finishedAt` / `finishReason`\n * / `transport` / `outputTracking`) that `invokeAgent` already assembles. No\n * parallel shape, no drift.\n * - `input` / `output` are agent-specific and therefore opaque here; sinks\n * persist them only at `DEBUG_VERBOSE` (payload gating is a sink concern).\n * - `attempt` lets a caller-side retry loop correlate multiple records for one\n * logical generation: the engine traces each physical call; retry orchestration\n * stays caller-side.\n /\nexport const AgentCallTraceSchema = z.object({\n agentRef: z.string(),\n /* See {@link AgentCallTraceKind}. Absent = `GENERATION` (the pre-existing producers). /\n kind: z.enum(AgentCallTraceKind).optional(),\n /\n Resolved LLM vendor ref (e.g. `anthropic`, `openai`). Maps to analytics\n * dimensions like PostHog `$ai_provider`. Optional — non-LLM/uncaptured calls omit it.\n /\n provider: z.string().optional(),\n /\n Resolved model id (e.g. `claude-opus-4-8`). Load-bearing for analytics sinks:\n * PostHog derives `$ai_total_cost_usd` from `$ai_model` + token usage, so without\n * it cost attribution is lost. Optional — populated for model-backed agent calls.\n /\n model: z.string().optional(),\n /* ISO 8601 — when the call was initiated. /\n callTimestamp: z.string(),\n /* 1-based attempt index when the caller drives a retry loop. /\n attempt: z.number().int().positive().optional(),\n outcome: z.enum(AgentCallOutcome),\n /* Resolved agent input (e.g. the prompt). Opaque; sink persists at DEBUG_VERBOSE. /\n input: z.unknown().optional(),\n /* Raw agent output. Opaque; sink persists at DEBUG_VERBOSE. /\n output: z.unknown().optional(),\n /* Telemetry the engine captured — token usage, latency, transport, finishReason. /\n context: LLMProvider_OperationContext_BaseSchema.optional(),\n /* Present on `FAILURE`. /\n error: AgentCallTraceErrorSchema.optional(),\n});\nexport type AgentCallTrace = z.infer<typeof AgentCallTraceSchema>;\n\n/\n Caller-supplied correlation + enrichment, handed to `invokeAgent` so the\n * emitted {@link AgentCallTraceSchema} record can be routed and contextualized\n * by the sink.\n \n The engine does NOT interpret `sessionRef` / `stepRef` — they are opaque\n * handles the sink owns (e.g. the companion filesystem sink's session/step\n * directory ids). `attributes` carry caller domain context (templateRef,\n * locale, bucket, …) for filtering/grouping.\n /\nexport const AgentTraceContextSchema = z.object({\n /* Opaque sink-owned session handle (groups many calls of one operation). /\n sessionRef: z.string().optional(),\n /* Opaque sink-owned step handle (one logical sub-operation within a session). /\n stepRef: z.string().optional(),\n /* Human-readable label (e.g. `email-template-generation:system.welcome_email`). /\n label: z.string().optional(),\n /* Caller domain attributes for filtering/grouping (templateRef, locale, …). /\n attributes: z.record(z.string(), z.unknown()).optional(),\n /* Per-call override of the engine policy level (else the engine default applies). /\n levelOverride: z.enum(AgentTraceabilityLevel).optional(),\n});\nexport type AgentTraceContext = z.infer<typeof AgentTraceContextSchema>;\n\n/\n One agent-call trace emission handed to a sink: the typed per-call record, the\n * engine-resolved active level (never `NONE` — the engine skips emission at `NONE`),\n * and the caller's correlation/enrichment context. Bundled so sinks gain fields\n * without a signature change.\n /\nexport interface AgentCallTraceEmission {\n trace: AgentCallTrace;\n level: AgentTraceabilityLevel;\n context?: AgentTraceContext;\n}\n\n/\n Pluggable destination for engine-level agent-call traces — the swappable output\n * side of `AgentsBackendService.invokeAgent` tracing (filesystem artifacts, structured\n * logs, 3rd-party LLM analytics, OTel spans, …).\n \n The interface lives in `saas-models` (not a backend package) so implementations can\n * live where their dependency belongs WITHOUT a dependency cycle: generic ones in\n * `saas-backend-lib` (NoOp / Logger / Composite), provider-specific ones in\n * `external-connectors-private` (e.g. the PostHog LLM-analytics sink, which owns\n * `posthog-node`), app-specific ones in the app (e.g. the companion filesystem sink).\n \n `recordAgentCall` MUST be best-effort: the engine wraps it so a sink failure never\n * turns a successful agent call into a failed one, and output is byte-identical when\n * traceability is off.\n /\nexport interface AgentCallTraceSink {\n recordAgentCall(emission: AgentCallTraceEmission): void \| Promise<void>;\n /\n Optional flush/cleanup, called best-effort on host shutdown. Implementations\n * that batch + flush asynchronously (e.g. a 3rd-party analytics client) MUST drain\n * here so short-lived processes (CLI / companion / minion) don't lose queued events.\n */\n shutdown?(): void \| Promise<void>;\n}\n"]}
1	+ {"version":3,"file":"agent-traceability.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/agent-traceability.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,uCAAa,CAAA;IACb,yCAAe,CAAA;IACf,yDAA+B,CAAA;AACjC,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAA2C;IACpF,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;IAChC,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;IACjC,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmC,EACnC,YAAoC;IAEpC,OAAO,8BAA8B,CAAC,WAAW,CAAC,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,CAAyB,EACzB,CAAyB;IAEzB,OAAO,8BAA8B,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC;CAC3E,CAAC,CAAC;AAGH,qDAAqD;AACrD,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;AACrB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,6CAAuB,CAAA;AACzB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,0FAA0F;IAC1F,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,8CAA8C;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iEAAiE;IACjE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjC,sFAAsF;IACtF,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,qFAAqF;IACrF,OAAO,EAAE,uCAAuC,CAAC,QAAQ,EAAE;IAC3D,4BAA4B;IAC5B,KAAK,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,6EAA6E;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,oFAAoF;IACpF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD;;;;OAIG;IACH,WAAW,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { LLMProvider_OperationContext_BaseSchema } from '@wildo-ai/external-connectors-models';\nimport { ModelCallAttributionInputSchema } from './work-attribution.shared.schemas';\n\n/*\n Verbosity policy for engine-level agent-call traceability. Promotes the\n * companion's previously-local `WILDO_DEV_COMPANION_TRACEABILITY_LEVEL` to a\n * shared engine contract so every agent caller (companion, backend runtime,\n * minions, workers) and every sink (filesystem, logger, OTel) speak the same\n * levels.\n \n - `NONE` — tracing fully off; emitters must no-op before any I/O.\n * - `DEBUG` — per-call metadata + token usage + latency (no payloads).\n * - `DEBUG_VERBOSE` — adds the resolved prompt input + raw output payloads.\n /\nexport enum AgentTraceabilityLevel {\n NONE = 'NONE',\n DEBUG = 'DEBUG',\n DEBUG_VERBOSE = 'DEBUG_VERBOSE',\n}\n\n/* Numeric ordering for `AgentTraceabilityLevel` gating comparisons. /\nexport const AGENT_TRACEABILITY_LEVEL_ORDER: Record<AgentTraceabilityLevel, number> = {\n [AgentTraceabilityLevel.NONE]: 0,\n [AgentTraceabilityLevel.DEBUG]: 1,\n [AgentTraceabilityLevel.DEBUG_VERBOSE]: 2,\n};\n\n/\n True when `activeLevel` is at least `minimumLevel` — the canonical gate every\n * sink/emitter uses so a record is persisted only when the active policy meets\n * the record's minimum verbosity.\n /\nexport function agentTraceabilityLevelAllows(\n activeLevel: AgentTraceabilityLevel,\n minimumLevel: AgentTraceabilityLevel,\n): boolean {\n return AGENT_TRACEABILITY_LEVEL_ORDER[activeLevel] >= AGENT_TRACEABILITY_LEVEL_ORDER[minimumLevel];\n}\n\n/\n The more verbose of two levels — for hosts that COMPOSE traceability\n * concerns behind one policy binding. A host policy must never be LESS\n * verbose than any interested sink: a companion whose filesystem tracing is\n * off (`NONE`) but whose LLM-observability provider is active still needs\n * `DEBUG` so the emission reaches the sinks (each sink then self-gates).\n * Replacing a live policy with a static lower level silently kills every\n * downstream sink — the failure mode that motivated this helper.\n /\nexport function maxAgentTraceabilityLevel(\n a: AgentTraceabilityLevel,\n b: AgentTraceabilityLevel,\n): AgentTraceabilityLevel {\n return AGENT_TRACEABILITY_LEVEL_ORDER[a] >= AGENT_TRACEABILITY_LEVEL_ORDER[b] ? a : b;\n}\n\n/* Engine-resolved traceability policy handed to `AgentsBackendService`. /\nexport const AgentTraceabilityPolicySchema = z.object({\n level: z.enum(AgentTraceabilityLevel).default(AgentTraceabilityLevel.NONE),\n});\nexport type AgentTraceabilityPolicy = z.infer<typeof AgentTraceabilityPolicySchema>;\n\n/* Terminal outcome of a single agent invocation. /\nexport enum AgentCallOutcome {\n SUCCESS = 'success',\n FAILURE = 'failure',\n}\n\n/\n WHAT KIND of model call a trace records — the operation-aware axis observability sinks branch\n * on (RAG plan DL2/H4). The two kinds differ structurally, not cosmetically:\n \n - a GENERATION consumes prompt tokens and produces completion tokens; its usage is complete\n * only when BOTH dimensions are present, and its payload (prompt/completion text) may be\n * forwarded to analytics under an explicit content opt-in;\n * - an EMBEDDING consumes input tokens and produces VECTORS; it has no completion-token\n * dimension (so completeness is judged on input tokens alone), and its output must NEVER\n * reach analytics or logs at any verbosity — a vector is a lossy encoding of the source text,\n * not telemetry. Producers put a `{ vectorCount, dims }` summary in `output`; sinks enforce\n * the exclusion defensively on top.\n \n Absent means GENERATION (every pre-existing producer), so the field is additive.\n /\nexport enum AgentCallTraceKind {\n GENERATION = 'generation',\n EMBEDDING = 'embedding',\n}\n\n/\n Structured, JSON-serializable shape for a failed agent call. (Never the raw\n * `Error` object — it collapses to `{}` under `JSON.stringify`.)\n /\nexport const AgentCallTraceErrorSchema = z.object({\n name: z.string().optional(),\n message: z.string(),\n code: z.string().optional(),\n});\nexport type AgentCallTraceError = z.infer<typeof AgentCallTraceErrorSchema>;\n\n/\n The typed per-call trace record the engine emits to the configured sink, once\n * per `invokeAgent` completion (success or failure). This is the contract that\n * replaces every caller's hand-rolled `response.executionContext as { usage?,\n * executionTime? }` cast + manual artifact write.\n \n - `context` reuses {@link LLMProvider_OperationContext_BaseSchema} — the exact\n * telemetry envelope (`usage` / `executionTime` / `finishedAt` / `finishReason`\n * / `transport` / `outputTracking`) that `invokeAgent` already assembles. No\n * parallel shape, no drift.\n * - `input` / `output` are agent-specific and therefore opaque here; sinks\n * persist them only at `DEBUG_VERBOSE` (payload gating is a sink concern).\n * - `attempt` lets a caller-side retry loop correlate multiple records for one\n * logical generation: the engine traces each physical call; retry orchestration\n * stays caller-side.\n /\nexport const AgentCallTraceSchema = z.object({\n agentRef: z.string(),\n /* See {@link AgentCallTraceKind}. Absent = `GENERATION` (the pre-existing producers). /\n kind: z.enum(AgentCallTraceKind).optional(),\n /\n Resolved LLM vendor ref (e.g. `anthropic`, `openai`). Maps to analytics\n * dimensions like PostHog `$ai_provider`. Optional — non-LLM/uncaptured calls omit it.\n /\n provider: z.string().optional(),\n /\n Resolved model id (e.g. `claude-opus-4-8`). Load-bearing for analytics sinks:\n * PostHog derives `$ai_total_cost_usd` from `$ai_model` + token usage, so without\n * it cost attribution is lost. Optional — populated for model-backed agent calls.\n /\n model: z.string().optional(),\n /* ISO 8601 — when the call was initiated. /\n callTimestamp: z.string(),\n /* 1-based attempt index when the caller drives a retry loop. /\n attempt: z.number().int().positive().optional(),\n outcome: z.enum(AgentCallOutcome),\n /* Resolved agent input (e.g. the prompt). Opaque; sink persists at DEBUG_VERBOSE. /\n input: z.unknown().optional(),\n /* Raw agent output. Opaque; sink persists at DEBUG_VERBOSE. /\n output: z.unknown().optional(),\n /* Telemetry the engine captured — token usage, latency, transport, finishReason. /\n context: LLMProvider_OperationContext_BaseSchema.optional(),\n /* Present on `FAILURE`. /\n error: AgentCallTraceErrorSchema.optional(),\n});\nexport type AgentCallTrace = z.infer<typeof AgentCallTraceSchema>;\n\n/\n Caller-supplied correlation + enrichment, handed to `invokeAgent` so the\n * emitted {@link AgentCallTraceSchema} record can be routed and contextualized\n * by the sink.\n \n The engine does NOT interpret `sessionRef` / `stepRef` — they are opaque\n * handles the sink owns (e.g. the companion filesystem sink's session/step\n * directory ids). `attributes` carry caller domain context (templateRef,\n * locale, bucket, …) for filtering/grouping.\n /\nexport const AgentTraceContextSchema = z.object({\n /* Opaque sink-owned session handle (groups many calls of one operation). /\n sessionRef: z.string().optional(),\n /* Opaque sink-owned step handle (one logical sub-operation within a session). /\n stepRef: z.string().optional(),\n /* Human-readable label (e.g. `email-template-generation:system.welcome_email`). /\n label: z.string().optional(),\n /* Caller domain attributes for filtering/grouping (templateRef, locale, …). /\n attributes: z.record(z.string(), z.unknown()).optional(),\n /* Per-call override of the engine policy level (else the engine default applies). /\n levelOverride: z.enum(AgentTraceabilityLevel).optional(),\n /\n Explicit work attribution for this call (#1598): tenant, case, execution and task. Wins over the\n * ambient work frame. Deliberately a typed field and NOT part of `attributes`, which are free-form\n * caller dimensions for telemetry and never reach the attribution store.\n /\n attribution: ModelCallAttributionInputSchema.optional(),\n});\nexport type AgentTraceContext = z.infer<typeof AgentTraceContextSchema>;\n\n/\n One agent-call trace emission handed to a sink: the typed per-call record, the\n * engine-resolved active level (never `NONE` — the engine skips emission at `NONE`),\n * and the caller's correlation/enrichment context. Bundled so sinks gain fields\n * without a signature change.\n /\nexport interface AgentCallTraceEmission {\n trace: AgentCallTrace;\n level: AgentTraceabilityLevel;\n context?: AgentTraceContext;\n}\n\n/\n Pluggable destination for engine-level agent-call traces — the swappable output\n * side of `AgentsBackendService.invokeAgent` tracing (filesystem artifacts, structured\n * logs, 3rd-party LLM analytics, OTel spans, …).\n \n The interface lives in `saas-models` (not a backend package) so implementations can\n * live where their dependency belongs WITHOUT a dependency cycle: generic ones in\n * `saas-backend-lib` (NoOp / Logger / Composite), provider-specific ones in\n * `external-connectors-private` (e.g. the PostHog LLM-analytics sink, which owns\n * `posthog-node`), app-specific ones in the app (e.g. the companion filesystem sink).\n \n `recordAgentCall` MUST be best-effort: the engine wraps it so a sink failure never\n * turns a successful agent call into a failed one, and output is byte-identical when\n * traceability is off.\n /\nexport interface AgentCallTraceSink {\n recordAgentCall(emission: AgentCallTraceEmission): void \| Promise<void>;\n /\n Optional flush/cleanup, called best-effort on host shutdown. Implementations\n * that batch + flush asynchronously (e.g. a 3rd-party analytics client) MUST drain\n * here so short-lived processes (CLI / companion / minion) don't lose queued events.\n */\n shutdown?(): void \| Promise<void>;\n}\n"]}

package/dist/esm/flows-actors/agent-work-decisions.shared.resources-config.schemas.d.ts ADDED Viewed

@@ -0,0 +1,68 @@
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { type ResourceRelationship } from '../resources/resources.shared.schemas';
+/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */
+export declare const agentWorkDecisionsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */
+export declare const agentWorkDecisionContentsPolymorphicFactories: Record<string, import("..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+type OrganizationSettingCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;
+/**
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — content capture is off unless the organization turns it on,
+ * with a stated purpose; every change is audited.
+ */
+export declare const agentWorkCaptureSettingsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, OrganizationSettingCoreOperations, import("zod").ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>>>;
+    contentCapture: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("./agent-work-decisions.shared.schemas").CorrectionContentCapture>>>>;
+    purpose: import("zod").ZodOptional<import("zod").ZodString>;
+    contentReaderRole: import("zod").ZodOptional<import("zod").ZodString>;
+    narrowToCaseRefs: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodObject<{
+        resourceType: import("zod").ZodString;
+        resourceId: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>>;
+}, import("zod/v4/core").$strip>>;
+/** assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — no export without a recorded basis; every change audited. */
+export declare const evaluationExportAuthorizationsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, OrganizationSettingCoreOperations, import("zod").ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("./agent-work-decisions.shared.schemas").EvaluationExportAuthorizationStatus>>>>;
+    basis: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("./agent-work-decisions.shared.schemas").EvaluationExportBasis>>>>;
+    basisReference: import("zod").ZodOptional<import("zod").ZodString>;
+    clientConsents: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodObject<{
+        caseRef: import("zod").ZodObject<{
+            resourceType: import("zod").ZodString;
+            resourceId: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+        consentRef: import("zod").ZodString;
+        recordedAt: import("zod").ZodISODateTime;
+    }, import("zod/v4/core").$strict>>>;
+    excludedCaseRefs: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodObject<{
+        resourceType: import("zod").ZodString;
+        resourceId: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>>;
+}, import("zod/v4/core").$strip>>;
+/** The export ledger: written by the engine at each export, read by the organization administrator. */
+export declare const evaluationDatasetExportsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, import("zod").ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>>;
+    exportedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
+    exportedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDate>>;
+    authorizationId: import("zod").ZodString;
+    basis: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("./agent-work-decisions.shared.schemas").EvaluationExportBasis>>;
+    agentRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
+    windowFrom: import("zod").ZodDate;
+    windowTo: import("zod").ZodDate;
+    decisionRefs: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodString>>;
+    caseKeys: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodString>>;
+    recordCount: import("zod").ZodNumber;
+    pseudonymisationVersion: import("zod").ZodString;
+    destination: import("zod").ZodString;
+    invalidatedAt: import("zod").ZodOptional<import("zod").ZodDate>;
+    invalidationReason: import("zod").ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("./agent-work-decisions.shared.schemas").EvaluationDatasetInvalidationReason>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>>;
+}, import("zod/v4/core").$strip>>;
+export {};
+//# sourceMappingURL=agent-work-decisions.shared.resources-config.schemas.d.ts.map

package/dist/esm/flows-actors/agent-work-decisions.shared.resources-config.schemas.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"agent-work-decisions.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/agent-work-decisions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAmC5I,qGAAqG;AACrG,eAAO,MAAM,sCAAsC,qPAgDlD,CAAC;AAEF,0HAA0H;AAC1H,eAAO,MAAM,6CAA6C,qPAmDzD,CAAC;AAGF,KAAK,iCAAiC,GAAG,qBAAqB,CAAC,IAAI,GAAG,qBAAqB,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;AAQjK;;;GAGG;AACH,eAAO,MAAM,mEAAmE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;iCAqC9H,CAAC;AAEL,0HAA0H;AAC1H,eAAO,MAAM,yEAAyE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;iCAiCpI,CAAC;AAEL,uGAAuG;AACvG,eAAO,MAAM,mEAAmE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;iCAmD9H,CAAC"}

package/dist/esm/flows-actors/agent-work-decisions.shared.resources-config.schemas.js ADDED Viewed

@@ -0,0 +1,276 @@
+/**
+ * Agent-work decisions: resource configurations (#1599).
+ *
+ * Five resources, one concern: the record of what experts did with agents' proposals, and what the tenant allowed
+ * to be done with it.
+ *
+ * - `agentWorkDecisions` (polymorphic, the owner scope of the paused work) — the metadata record. Written by the
+ *   engine only (the settlement, the repair sweep, `recordOutputReview`), read by the scope's administrator. Kept
+ *   for the declared AUDIT_LOGS period; an erasure of the decider severs `deciderUserId` and keeps the decision.
+ * - `agentWorkDecisionContents` (polymorphic, same scopes) — the opt-in content. Written by the engine only, under
+ *   the tenant's `WITH_CONTENT` setting. Deleted with its owner scope by the composition cascade, like the tenant's
+ *   other data (a per-row RESOURCE_DATA clock cannot be bound: the user and application variants name no
+ *   organization, which `SCOPE_DELETED` counts from). An erasure scrubs every content field.
+ * - `agentWorkCaptureSettings` / `evaluationExportAuthorizations` (organization singletons) — the organization
+ *   administrator's two decisions; every change is audited by the backend's postfix.
+ * - `evaluationDatasetExports` (organization) — the export ledger, kept for AUDIT_LOGS.
+ */
+import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
+import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { AgentWorkCaptureSettingsSchema, EvaluationDatasetExportSchema, EvaluationExportAuthorizationSchema, agentWorkDecisionContentsPolymorphicDeclaration, agentWorkDecisionsPolymorphicDeclaration, } from './agent-work-decisions.shared.schemas.js';
+/**
+ * Who reads a scope's decisions. A user reads the decisions taken on their OWN threads; an organization's or an
+ * application's are shared scope data, read by its administrator — the `flowActorExecutions` reasoning, since the
+ * records describe work in those threads.
+ */
+const OWNER_READ_ROLES = {
+    [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],
+    [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+    [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+};
+/**
+ * Content is the client's material: its reader is the scope's ADMINISTRATOR, plus — in an organization — the one role
+ * the organization's capture setting names (`contentReaderRole`). The organization route therefore admits members, and
+ * the backend's read gate (`agent-work-decisions.custom-impl.backend.service.ts`) narrows every READ and LIST to an
+ * organization-wide administrator or holder of that role, reading the setting at the moment of the read. A user never
+ * reads content from the generic plane.
+ */
+const CONTENT_READ_ROLES = {
+    [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+    [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_MEMBER],
+    [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+};
+/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */
+export const agentWorkDecisionsPolymorphicFactories = createPolymorphicResourceConfigurations(agentWorkDecisionsPolymorphicDeclaration, {
+    isSystemResource: true,
+    systemAccessPolicy: {
+        // The decider's own decisions belong in their subject export; the backend-only floor still applies.
+        exportSubject: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+    },
+    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /*
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the operator's evidence of supervised agent work, kept for
+     * the declared AUDIT_LOGS period from creation, never a number of this resource's own.
+     */
+    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },
+    /** An erasure severs the decider (`deciderUserId` REMOVE) and keeps the decision: the evidence outlives the person. */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.UPDATE_MANY,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        // The retention writer's door (`retentionPolicy` requires it); route-less.
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+    },
+});
+/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */
+export const agentWorkDecisionContentsPolymorphicFactories = createPolymorphicResourceConfigurations(agentWorkDecisionContentsPolymorphicDeclaration, {
+    isSystemResource: true,
+    systemAccessPolicy: {
+        exportSubject: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+    },
+    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
+    /*
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the content is the client's material, kept for the declared
+     * RESOURCE_DATA period from when it was written (#1599 Q3), and never longer than the evidence beside it. A creation
+     * start point needs no organization, so it binds all three owner scopes alike.
+     */
+    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },
+    /**
+     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure scrubs the proposal, the final version, the
+     * diff and the reason (all REMOVE); the metadata record beside it survives.
+     */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.UPDATE_MANY,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        // The retention writer's door (`retentionPolicy` requires it); route-less.
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.MEDIUM }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+    },
+});
+const ORGANIZATION_SETTING_CORE_OPERATIONS = [
+    CoreResourceOperation.READ,
+    CoreResourceOperation.CREATE,
+    CoreResourceOperation.UPDATE,
+    CoreResourceOperation.DELETE,
+];
+/**
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — content capture is off unless the organization turns it on,
+ * with a stated purpose; every change is audited.
+ */
+export const agentWorkCaptureSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: AgentWorkCaptureSettingsSchema,
+    resourceIdentifier: CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    // The settlement writer reads the organization's setting as the engine; the settings page's first READ creates the
+    // organization's row as the engine (below).
+    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,
+    operationsConfiguration: {
+        /**
+         * The settings page IS this READ (a singleton of the organization, route `/organizations/{id}/agent-work-capture-setting`).
+         * An organization that never chose has no row, so the backend's READ postfix creates it METADATA_ONLY on first
+         * access: the default stated as a row, not a decision, so it is neither audited as a change nor a system-write
+         * audit.
+         */
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },
+                // The READ materialization's door: route-less, and preferred by the service layer, so the engine's write of the
+                // default does not pass through the administrator's guarded and audited CREATE.
+                { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        // The composition cascade's door; route-less.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+    },
+});
+/** assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — no export without a recorded basis; every change audited. */
+export const evaluationExportAuthorizationsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: EvaluationExportAuthorizationSchema,
+    resourceIdentifier: CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,
+    operationsConfiguration: {
+        /**
+         * The authorisation page IS this READ (`/organizations/{id}/evaluation-export-authorization`). An organization that
+         * never granted one has no row, so the READ postfix creates it NOT_GRANTED on first access: nobody decided, so it
+         * is not audited as a change. Granting is the UPDATE that sets ACTIVE with a basis.
+         */
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },
+                // The READ materialization's door (route-less; see the capture setting).
+                { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        // The composition cascade's door; route-less.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+    },
+});
+/** The export ledger: written by the engine at each export, read by the organization administrator. */
+export const evaluationDatasetExportsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: EvaluationDatasetExportSchema,
+    resourceIdentifier: CoreResourceType.EVALUATION_DATASET_EXPORTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_DATASET_EXPORTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: {
+        create: ResourceSystemAccessMode.ALLOWED,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+    },
+    /** assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the ledger is kept for the declared AUDIT_LOGS period. */
+    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.UPDATE_MANY,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        // The retention writer's door (`retentionPolicy` requires it); route-less.
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },
+                { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=agent-work-decisions.shared.resources-config.schemas.js.map

package/dist/esm/flows-actors/agent-work-decisions.shared.resources-config.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"agent-work-decisions.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/agent-work-decisions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,mCAAmC,EACnC,+CAA+C,EAC/C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;IAChE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;IACvF,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAGF,qGAAqG;AACrG,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,oGAAoG;QACpG,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E;;;OAGG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC5G,uHAAuH;IACvH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;KACF;CACF,CACF,CAAC;AAEF,0HAA0H;AAC1H,MAAM,CAAC,MAAM,6CAA6C,GAAG,uCAAuC,CAClG,+CAA+C,EAC/C;IACE,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E;;;;OAIG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,aAAa,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC/G;;;OAGG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC;SACvK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACpK;KACF;CACF,CACF,CAAC;AAIF,MAAM,oCAAoC,GAAwC;IAChF,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAAsF;IAC9H,UAAU,EAAE,8BAA8B;IAC1C,kBAAkB,EAAE,gBAAgB,CAAC,2BAA2B;IAChE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;IACzG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,mHAAmH;IACnH,4CAA4C;IAC5C,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAC3J,cAAc,EAAE,oCAAoC;IACpD,uBAAuB,EAAE;QACvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;gBACtJ,gHAAgH;gBAChH,gFAAgF;gBAChF,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACnK;QACD,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACxK;KACF;CACF,CAAC,CAAC;AAEL,0HAA0H;AAC1H,MAAM,CAAC,MAAM,yEAAyE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC1I,0CAA0C,CAA2F;IACnI,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAAE,gBAAgB,CAAC,gCAAgC;IACrE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gCAAgC,CAAC;IAC9G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAC3J,cAAc,EAAE,oCAAoC;IACpD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;gBACtJ,yEAAyE;gBACzE,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACnK;QACD,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACxK;KACF;CACF,CAAC,CAAC;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAIxC;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IACD,mHAAmH;IACnH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC5G,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;gBACrJ,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Agent-work decisions: resource configurations (#1599).\n *\n * Five resources, one concern: the record of what experts did with agents' proposals, and what the tenant allowed\n * to be done with it.\n *\n * - `agentWorkDecisions` (polymorphic, the owner scope of the paused work) — the metadata record. Written by the\n * engine only (the settlement, the repair sweep, `recordOutputReview`), read by the scope's administrator. Kept\n * for the declared AUDIT_LOGS period; an erasure of the decider severs `deciderUserId` and keeps the decision.\n * - `agentWorkDecisionContents` (polymorphic, same scopes) — the opt-in content. Written by the engine only, under\n * the tenant's `WITH_CONTENT` setting. Deleted with its owner scope by the composition cascade, like the tenant's\n * other data (a per-row RESOURCE_DATA clock cannot be bound: the user and application variants name no\n * organization, which `SCOPE_DELETED` counts from). An erasure scrubs every content field.\n * - `agentWorkCaptureSettings` / `evaluationExportAuthorizations` (organization singletons) — the organization\n * administrator's two decisions; every change is audited by the backend's postfix.\n * - `evaluationDatasetExports` (organization) — the export ledger, kept for AUDIT_LOGS.\n */\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport {\n AgentWorkCaptureSettingsSchema,\n EvaluationDatasetExportSchema,\n EvaluationExportAuthorizationSchema,\n agentWorkDecisionContentsPolymorphicDeclaration,\n agentWorkDecisionsPolymorphicDeclaration,\n} from './agent-work-decisions.shared.schemas';\n\n/**\n * Who reads a scope's decisions. A user reads the decisions taken on their OWN threads; an organization's or an\n * application's are shared scope data, read by its administrator — the `flowActorExecutions` reasoning, since the\n * records describe work in those threads.\n */\nconst OWNER_READ_ROLES = {\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n/**\n * Content is the client's material: its reader is the scope's ADMINISTRATOR, plus — in an organization — the one role\n * the organization's capture setting names (`contentReaderRole`). The organization route therefore admits members, and\n * the backend's read gate (`agent-work-decisions.custom-impl.backend.service.ts`) narrows every READ and LIST to an\n * organization-wide administrator or holder of that role, reading the setting at the moment of the read. A user never\n * reads content from the generic plane.\n */\nconst CONTENT_READ_ROLES = {\n [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_MEMBER],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n\n/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */\nexport const agentWorkDecisionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n agentWorkDecisionsPolymorphicDeclaration,\n {\n isSystemResource: true,\n systemAccessPolicy: {\n // The decider's own decisions belong in their subject export; the backend-only floor still applies.\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n },\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n /*\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the operator's evidence of supervised agent work, kept for\n * the declared AUDIT_LOGS period from creation, never a number of this resource's own.\n */\n retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },\n /** An erasure severs the decider (`deciderUserId` REMOVE) and keeps the decision: the evidence outlives the person. */\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n // The retention writer's door (`retentionPolicy` requires it); route-less.\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n },\n },\n);\n\n/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */\nexport const agentWorkDecisionContentsPolymorphicFactories = createPolymorphicResourceConfigurations(\n agentWorkDecisionContentsPolymorphicDeclaration,\n {\n isSystemResource: true,\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n },\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n /*\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the content is the client's material, kept for the declared\n * RESOURCE_DATA period from when it was written (#1599 Q3), and never longer than the evidence beside it. A creation\n * start point needs no organization, so it binds all three owner scopes alike.\n */\n retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },\n /**\n * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure scrubs the proposal, the final version, the\n * diff and the reason (all REMOVE); the metadata record beside it survives.\n */\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n // The retention writer's door (`retentionPolicy` requires it); route-less.\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.MEDIUM }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n },\n },\n);\n\n\ntype OrganizationSettingCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;\nconst ORGANIZATION_SETTING_CORE_OPERATIONS: OrganizationSettingCoreOperations[] = [\n CoreResourceOperation.READ,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n];\n\n/**\n * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — content capture is off unless the organization turns it on,\n * with a stated purpose; every change is audited.\n */\nexport const agentWorkCaptureSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<undefined, OrganizationSettingCoreOperations, typeof AgentWorkCaptureSettingsSchema>({\n mainSchema: AgentWorkCaptureSettingsSchema,\n resourceIdentifier: CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n // The settlement writer reads the organization's setting as the engine; the settings page's first READ creates the\n // organization's row as the engine (below).\n systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,\n operationsConfiguration: {\n /**\n * The settings page IS this READ (a singleton of the organization, route `/organizations/{id}/agent-work-capture-setting`).\n * An organization that never chose has no row, so the backend's READ postfix creates it METADATA_ONLY on first\n * access: the default stated as a row, not a decision, so it is neither audited as a change nor a system-write\n * audit.\n */\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },\n // The READ materialization's door: route-less, and preferred by the service layer, so the engine's write of the\n // default does not pass through the administrator's guarded and audited CREATE.\n { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n ],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n // The composition cascade's door; route-less.\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n },\n });\n\n/** assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — no export without a recorded basis; every change audited. */\nexport const evaluationExportAuthorizationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<undefined, OrganizationSettingCoreOperations, typeof EvaluationExportAuthorizationSchema>({\n mainSchema: EvaluationExportAuthorizationSchema,\n resourceIdentifier: CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,\n operationsConfiguration: {\n /**\n * The authorisation page IS this READ (`/organizations/{id}/evaluation-export-authorization`). An organization that\n * never granted one has no row, so the READ postfix creates it NOT_GRANTED on first access: nobody decided, so it\n * is not audited as a change. Granting is the UPDATE that sets ACTIVE with a basis.\n */\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },\n // The READ materialization's door (route-less; see the capture setting).\n { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n ],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n // The composition cascade's door; route-less.\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n },\n });\n\n/** The export ledger: written by the engine at each export, read by the organization administrator. */\nexport const evaluationDatasetExportsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<\n undefined,\n CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE,\n typeof EvaluationDatasetExportSchema\n >({\n mainSchema: EvaluationDatasetExportSchema,\n resourceIdentifier: CoreResourceType.EVALUATION_DATASET_EXPORTS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_DATASET_EXPORTS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n systemAccessPolicy: {\n create: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n },\n /** assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the ledger is kept for the declared AUDIT_LOGS period. */\n retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n // The retention writer's door (`retentionPolicy` requires it); route-less.\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n ],\n },\n },\n });\n"]}