@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/flows-actors/work-attribution.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-attribution.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/work-attribution.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,wEAAwE;AACxE,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAN,IAAY,gBAYX;AAZD,WAAY,gBAAgB;IAC1B,gHAAgH;IAChH,uDAAmC,CAAA;IACnC;;;OAGG;IACH,yEAAqD,CAAA;IACrD,yGAAyG;IACzG,2CAAuB,CAAA;IACvB,wFAAwF;IACxF,yDAAqC,CAAA;AACvC,CAAC,EAZW,gBAAgB,KAAhB,gBAAgB,QAY3B;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC1G,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CACxF,CAAC,CAAC;AAGH,+DAA+D;AAC/D,MAAM,CAAN,IAAY,0BAOX;AAPD,WAAY,0BAA0B;IACpC,iGAAiG;IACjG,mDAAqB,CAAA;IACrB,0FAA0F;IAC1F,iDAAmB,CAAA;IACnB,oHAAoH;IACpH,2DAA6B,CAAA;AAC/B,CAAC,EAPW,0BAA0B,KAA1B,0BAA0B,QAOrC;AAED,uEAAuE;AACvE,MAAM,CAAN,IAAY,yBAQX;AARD,WAAY,yBAAyB;IACnC,yDAAyD;IACzD,sDAAyB,CAAA;IACzB;;;OAGG;IACH,wFAA2D,CAAA;AAC7D,CAAC,EARW,yBAAyB,KAAzB,yBAAyB,QAQpC;AAED,+DAA+D;AAC/D,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,gGAAgG;IAChG,2CAAiB,CAAA;IACjB,kFAAkF;IAClF,+CAAqB,CAAA;AACvB,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,gDAAqB,CAAA;IACrB,oDAAyB,CAAA;AAC3B,CAAC,EAHW,uBAAuB,KAAvB,uBAAuB,QAGlC;AAED,yCAAyC;AACzC,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,iDAA6B,CAAA;IAC7B,mCAAe,CAAA;IACf,mCAAe,CAAA;AACjB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uDAA6B,CAAA;AAC/B,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wGAAwG,CAAC;IAC/J,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;IAC1H,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACrF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;CAC9G,CAAC,CAAC;AAEH,qEAAqE;AAErE;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA+C,EAC/C,OAA8C;IAE9C,MAAM,MAAM,GAAG,CAAC,KAA4C,EAAW,EAAE,CACvE,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IAChK,MAAM,WAAW,GAA8B;QAC7C,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7H,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,CAAC,CAAC,0BAA0B,CAAC,QAAQ;QACrC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACf,CAAC,CAAC,0BAA0B,CAAC,OAAO;YACpC,CAAC,CAAC,0BAA0B,CAAC,YAAY,CAAC;IAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC","sourcesContent":["/**\n * # Work attribution: which tenant, which case and which execution a model call served\n *\n * The shared vocabulary of cost attribution (#1598) and of the expert-correction record (#1599). A model\n * call is attributed to a unit of work so an AI-native service firm can compute its cost per case:\n * inference plus the expert time spent on the same case.\n *\n * Three references travel together, and each answers a different question:\n *\n * - `organizationId` — WHOSE work it was. Derived by the engine from an authenticated owner field or\n *   from the case row's own scope, never taken from a caller or a model (#1598 §5).\n * - `caseRef` — WHICH case (a {@link WorkUnitRef}: a row of a resource declared `workUnit: true`).\n * - `executionRef` — WHICH run spent it (a conversational turn, an actor execution, a batch run, the\n *   processing of an inbound delivery). `taskRef` optionally narrows it to one actor task.\n *\n * None of these is authority. They are accounting facts: nothing may authorize on them, and the work\n * frame that carries them (`work-attribution.als.backend.ts`) is deliberately separate from the\n * `ExecutionContext`, which IS authority.\n */\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load (#966).\nimport '@wildo-ai/zod-decorators';\n\nimport { WorkUnitRefSchema } from '../resources/work-unit.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.work-attribution-vocabulary facet:layer:shared facet:family:flows-actors facet:audience:app-developer\n *\n * What kind of run spent a model call. One member per engine surface that opens a work frame.\n */\nexport enum ExecutionRefKind {\n  /** An actor-system execution (`runActorExecution` / `resumeActorExecution`). `id` is the actor execution id. */\n  ACTOR_EXECUTION = 'ACTOR_EXECUTION',\n  /**\n   * A conversational turn (WebSocket chat, A2A, or an autonomous agent's turn, which runs through the\n   * same `startConversationalExecution`). `id` is the conversational execution id, which a resume keeps.\n   */\n  CONVERSATIONAL_EXECUTION = 'CONVERSATIONAL_EXECUTION',\n  /** One run of a scheduled or queued batch (the RAG embedding drain, for example). `id` is the run id. */\n  BATCH_RUN = 'BATCH_RUN',\n  /** The processing of one inbound delivery (email, webhook). `id` is the delivery id. */\n  INBOUND_DELIVERY = 'INBOUND_DELIVERY',\n}\n\n/** A reference to the run a model call was made in. */\nexport const ExecutionRefSchema = z.strictObject({\n  kind: z.enum(ExecutionRefKind).systemEnum('ExecutionRefKind').describe('What kind of run spent the call.'),\n  id: z.string().min(1).max(200).describe('Id of that run, in the store the kind names.'),\n});\nexport type ExecutionRef = z.infer<typeof ExecutionRefSchema>;\n\n/** How an attribution row learned which work a call served. */\nexport enum ModelCallAttributionSource {\n  /** The engine call site passed the attribution explicitly with the call. Wins over any frame. */\n  EXPLICIT = 'EXPLICIT',\n  /** The recorder read it from the ambient work frame the engine opened around the call. */\n  AMBIENT = 'AMBIENT',\n  /** Neither: the call ran outside any work frame (platform tooling, the companion). Counted apart, never guessed. */\n  UNATTRIBUTED = 'UNATTRIBUTED',\n}\n\n/** Which part of one provider call an attribution row accounts for. */\nexport enum ModelCallAttributionShare {\n  /** The whole call served one unit of work: share 1/1. */\n  WHOLE_CALL = 'WHOLE_CALL',\n  /**\n   * One call served several source rows of ONE tenant (an embedding batch). Each row gets\n   * `shareNumerator` = its input length over `shareDenominator` = the call's total input length.\n   */\n  APPORTIONED_BY_INPUT_LENGTH = 'APPORTIONED_BY_INPUT_LENGTH',\n}\n\n/** Whether a registered pricing authority matched the call. */\nexport enum ModelCallPricingStatus {\n  /** An application-registered authority for the provider and model was effective at the call. */\n  PRICED = 'PRICED',\n  /** No authority matched. Counted apart by every summary, never priced at zero. */\n  UNPRICED = 'UNPRICED',\n}\n\n/**\n * Whether the provider reported how many of the output tokens were reasoning.\n *\n * OpenAI, Google, xAI and Perplexity report it; Anthropic and Mistral do not. An unreported count is\n * `UNREPORTED`, never 0: zero reasoning tokens is a claim, and the provider did not make it.\n */\nexport enum ReasoningUsageReporting {\n  REPORTED = 'REPORTED',\n  UNREPORTED = 'UNREPORTED',\n}\n\n/** The axis a cost summary groups by. */\nexport enum ModelCostGroupBy {\n  CASE = 'CASE',\n  ORGANIZATION = 'ORGANIZATION',\n  AGENT = 'AGENT',\n  MODEL = 'MODEL',\n}\n\n/**\n * Whether a case's expert time could be joined from the expert-decision records (#1599).\n *\n * `NOT_RECORDED` means no decision record exists to join, which is not the same as zero expert time:\n * a summary never reports 0 for time it cannot see.\n */\nexport enum ExpertTimeAvailability {\n  JOINED = 'JOINED',\n  NOT_RECORDED = 'NOT_RECORDED',\n}\n\n/**\n * Attribution a model call site passes EXPLICITLY (#1598 §4). When present it wins over the ambient work\n * frame, field by field for the fields it sets.\n *\n * Only engine code builds one. A `caseRef` from a client reaches it only after the boundary that accepted\n * it checked that the resource is a work unit and that the caller can READ that row.\n */\nexport const ModelCallAttributionInputSchema = z.strictObject({\n  organizationId: z.string().min(1).optional().describe('The tenant, derived from an authenticated owner field or the case row; never from a caller or a model.'),\n  caseRef: WorkUnitRefSchema.optional().describe('The case the call served: a row of a resource declared `workUnit: true`.'),\n  executionRef: ExecutionRefSchema.optional().describe('The run the call was made in.'),\n  taskRef: z.string().min(1).max(200).optional().describe('The actor task within that run, when there is one.'),\n});\nexport type ModelCallAttributionInput = z.infer<typeof ModelCallAttributionInputSchema>;\n/** @wildo_source:part:end saas.models.work-attribution-vocabulary */\n\n/**\n * Merge an explicit attribution over an ambient one, field by field (#1598 §4: explicit first, then the\n * frame). Returns the merged value and the source it will be recorded under: `EXPLICIT` when the call\n * site set any field, `AMBIENT` when only the frame did, `UNATTRIBUTED` when neither said anything.\n */\nexport function resolveModelCallAttribution(\n  explicit: ModelCallAttributionInput | undefined,\n  ambient: ModelCallAttributionInput | undefined,\n): { attribution: ModelCallAttributionInput; source: ModelCallAttributionSource } {\n  const hasAny = (value: ModelCallAttributionInput | undefined): boolean =>\n    value !== undefined && (value.organizationId !== undefined || value.caseRef !== undefined || value.executionRef !== undefined || value.taskRef !== undefined);\n  const attribution: ModelCallAttributionInput = {\n    ...(explicit?.organizationId ?? ambient?.organizationId ? { organizationId: explicit?.organizationId ?? ambient?.organizationId } : {}),\n    ...(explicit?.caseRef ?? ambient?.caseRef ? { caseRef: explicit?.caseRef ?? ambient?.caseRef } : {}),\n    ...(explicit?.executionRef ?? ambient?.executionRef ? { executionRef: explicit?.executionRef ?? ambient?.executionRef } : {}),\n    ...(explicit?.taskRef ?? ambient?.taskRef ? { taskRef: explicit?.taskRef ?? ambient?.taskRef } : {}),\n  };\n  const source = hasAny(explicit)\n    ? ModelCallAttributionSource.EXPLICIT\n    : hasAny(ambient)\n      ? ModelCallAttributionSource.AMBIENT\n      : ModelCallAttributionSource.UNATTRIBUTED;\n  return { attribution, source };\n}\n"]}

package/dist/esm/frontend-definitions/frontend-notification-custom-message-ref.definitions.d.ts

@@ -1,4 +1,25 @@
+/**
+ * The in-app notifications the ENGINE sends outside any resource operation, each by an identifier whose
+ * words live at `notifications_custom.<identifier>.msg`. The labelling planner derives a key for every
+ * member, so adding one is what gets its words authored; a notice sent with an identifier missing here
+ * would render its raw identifier.
+ */
 export declare enum FrontendNotificationCustomMessageRefs {
-    A_TEMP_REF = "A_TEMP_REF"
+    A_TEMP_REF = "A_TEMP_REF",
+    /** The CLAIM deadline is near and nobody has taken the decision. */
+    HUMAN_DECISION_CLAIM_WARNING = "human_decision_claim_warning",
+    /** The CLAIM deadline passed and nobody has taken the decision. */
+    HUMAN_DECISION_CLAIM_MISSED = "human_decision_claim_missed",
+    /** The DECISION deadline is near and nobody has answered. */
+    HUMAN_DECISION_DECISION_WARNING = "human_decision_decision_warning",
+    /** The DECISION deadline passed and nobody has answered; it still lapses at its original time. */
+    HUMAN_DECISION_DECISION_MISSED = "human_decision_decision_missed",
+    /** A deadline's escalation rule moved the decision to the recipient. */
+    HUMAN_DECISION_REASSIGNED_TO_YOU = "human_decision_reassigned_to_you",
+    /**
+     * Sent to the person whose request is waiting (the gate's owner) at a DECISION stage, when they are not
+     * the one who can answer it: their request is still waiting for a reviewer.
+     */
+    HUMAN_DECISION_YOUR_REQUEST_WAITING = "human_decision_your_request_waiting"
 }
 //# sourceMappingURL=frontend-notification-custom-message-ref.definitions.d.ts.map

package/dist/esm/frontend-definitions/frontend-notification-custom-message-ref.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-notification-custom-message-ref.definitions.d.ts","sourceRoot":"","sources":["../../../../src/frontend-definitions/frontend-notification-custom-message-ref.definitions.ts"],"names":[],"mappings":"AAEA,oBAAY,qCAAqC;IAC/C,UAAU,eAAe;CAC1B"}
+{"version":3,"file":"frontend-notification-custom-message-ref.definitions.d.ts","sourceRoot":"","sources":["../../../src/frontend-definitions/frontend-notification-custom-message-ref.definitions.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AACH,oBAAY,qCAAqC;IAC/C,UAAU,eAAe;IAGzB,oEAAoE;IACpE,4BAA4B,iCAAiC;IAC7D,mEAAmE;IACnE,2BAA2B,gCAAgC;IAC3D,6DAA6D;IAC7D,+BAA+B,oCAAoC;IACnE,kGAAkG;IAClG,8BAA8B,mCAAmC;IACjE,wEAAwE;IACxE,gCAAgC,qCAAqC;IACrE;;;OAGG;IACH,mCAAmC,wCAAwC;CAC5E"}

package/dist/esm/frontend-definitions/frontend-notification-custom-message-ref.definitions.js

@@ -1,5 +1,28 @@
+/**
+ * The in-app notifications the ENGINE sends outside any resource operation, each by an identifier whose
+ * words live at `notifications_custom.<identifier>.msg`. The labelling planner derives a key for every
+ * member, so adding one is what gets its words authored; a notice sent with an identifier missing here
+ * would render its raw identifier.
+ */
 export var FrontendNotificationCustomMessageRefs;
 (function (FrontendNotificationCustomMessageRefs) {
     FrontendNotificationCustomMessageRefs["A_TEMP_REF"] = "A_TEMP_REF";
+    // #1628 — a pending decision's deadline stages, sent to the people who may answer it. Each names the
+    // decision in its `data`; none grants anything, so they are safe to send by default.
+    /** The CLAIM deadline is near and nobody has taken the decision. */
+    FrontendNotificationCustomMessageRefs["HUMAN_DECISION_CLAIM_WARNING"] = "human_decision_claim_warning";
+    /** The CLAIM deadline passed and nobody has taken the decision. */
+    FrontendNotificationCustomMessageRefs["HUMAN_DECISION_CLAIM_MISSED"] = "human_decision_claim_missed";
+    /** The DECISION deadline is near and nobody has answered. */
+    FrontendNotificationCustomMessageRefs["HUMAN_DECISION_DECISION_WARNING"] = "human_decision_decision_warning";
+    /** The DECISION deadline passed and nobody has answered; it still lapses at its original time. */
+    FrontendNotificationCustomMessageRefs["HUMAN_DECISION_DECISION_MISSED"] = "human_decision_decision_missed";
+    /** A deadline's escalation rule moved the decision to the recipient. */
+    FrontendNotificationCustomMessageRefs["HUMAN_DECISION_REASSIGNED_TO_YOU"] = "human_decision_reassigned_to_you";
+    /**
+     * Sent to the person whose request is waiting (the gate's owner) at a DECISION stage, when they are not
+     * the one who can answer it: their request is still waiting for a reviewer.
+     */
+    FrontendNotificationCustomMessageRefs["HUMAN_DECISION_YOUR_REQUEST_WAITING"] = "human_decision_your_request_waiting";
 })(FrontendNotificationCustomMessageRefs || (FrontendNotificationCustomMessageRefs = {}));
 //# sourceMappingURL=frontend-notification-custom-message-ref.definitions.js.map

package/dist/esm/frontend-definitions/frontend-notification-custom-message-ref.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-notification-custom-message-ref.definitions.js","sourceRoot":"","sources":["../../../../src/frontend-definitions/frontend-notification-custom-message-ref.definitions.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,qCAEX;AAFD,WAAY,qCAAqC;IAC/C,kEAAyB,CAAA;AAC3B,CAAC,EAFW,qCAAqC,KAArC,qCAAqC,QAEhD","sourcesContent":["\n\nexport enum FrontendNotificationCustomMessageRefs {\n  A_TEMP_REF = \"A_TEMP_REF\"\n}\n"]}
+{"version":3,"file":"frontend-notification-custom-message-ref.definitions.js","sourceRoot":"","sources":["../../../src/frontend-definitions/frontend-notification-custom-message-ref.definitions.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AACH,MAAM,CAAN,IAAY,qCAmBX;AAnBD,WAAY,qCAAqC;IAC/C,kEAAyB,CAAA;IACzB,qGAAqG;IACrG,qFAAqF;IACrF,oEAAoE;IACpE,sGAA6D,CAAA;IAC7D,mEAAmE;IACnE,oGAA2D,CAAA;IAC3D,6DAA6D;IAC7D,4GAAmE,CAAA;IACnE,kGAAkG;IAClG,0GAAiE,CAAA;IACjE,wEAAwE;IACxE,8GAAqE,CAAA;IACrE;;;OAGG;IACH,oHAA2E,CAAA;AAC7E,CAAC,EAnBW,qCAAqC,KAArC,qCAAqC,QAmBhD","sourcesContent":["\n/**\n * The in-app notifications the ENGINE sends outside any resource operation, each by an identifier whose\n * words live at `notifications_custom.<identifier>.msg`. The labelling planner derives a key for every\n * member, so adding one is what gets its words authored; a notice sent with an identifier missing here\n * would render its raw identifier.\n */\nexport enum FrontendNotificationCustomMessageRefs {\n  A_TEMP_REF = \"A_TEMP_REF\",\n  // #1628 — a pending decision's deadline stages, sent to the people who may answer it. Each names the\n  // decision in its `data`; none grants anything, so they are safe to send by default.\n  /** The CLAIM deadline is near and nobody has taken the decision. */\n  HUMAN_DECISION_CLAIM_WARNING = \"human_decision_claim_warning\",\n  /** The CLAIM deadline passed and nobody has taken the decision. */\n  HUMAN_DECISION_CLAIM_MISSED = \"human_decision_claim_missed\",\n  /** The DECISION deadline is near and nobody has answered. */\n  HUMAN_DECISION_DECISION_WARNING = \"human_decision_decision_warning\",\n  /** The DECISION deadline passed and nobody has answered; it still lapses at its original time. */\n  HUMAN_DECISION_DECISION_MISSED = \"human_decision_decision_missed\",\n  /** A deadline's escalation rule moved the decision to the recipient. */\n  HUMAN_DECISION_REASSIGNED_TO_YOU = \"human_decision_reassigned_to_you\",\n  /**\n   * Sent to the person whose request is waiting (the gate's owner) at a DECISION stage, when they are not\n   * the one who can answer it: their request is still waiting for a reviewer.\n   */\n  HUMAN_DECISION_YOUR_REQUEST_WAITING = \"human_decision_your_request_waiting\",\n}\n"]}

package/dist/esm/frontend-definitions/settings-destination-ref.definitions.d.ts

@@ -69,6 +69,15 @@ export declare enum EngineSettingsDestinationRef {
     BILLING = "billing",
     /** Organization API keys. Org owner/admin only. */
     API_KEYS = "api-keys",
+    /**
+     * OAuth clients the ORGANIZATION registers — the machine credentials it issues for itself, and the ones an
+     * autonomous agent runs as (#1611). Org owner/admin only.
+     *
+     * The sibling of {@link API_KEYS} for the reason {@link APPLICATION_OAUTH_CLIENTS} is the sibling of the
+     * application's keys: under client-credentials both authenticate the organization's machine principal, so they
+     * are two credential types for one identity. Until #1812 this had no screen, and binding an agent was REST only.
+     */
+    ORGANIZATION_OAUTH_CLIENTS = "organization-oauth-clients",
     /**
      * The tenant's OWN credentials toward third parties — its Slack workspace token, its CRM key.
      *
@@ -97,6 +106,22 @@ export declare enum EngineSettingsDestinationRef {
     SIEM = "siem",
     /** Outbound webhook endpoints and delivery log. */
     WEBHOOKS = "webhooks",
+    /**
+     * Messages other systems sent the application that belong to THIS organization (#1596): what
+     * arrived, whether the handler processed it, and REPLAY for one that died. Org owner/admin only.
+     */
+    INBOUND_DELIVERIES = "inbound-deliveries",
+    /**
+     * The outside firms working in THIS organization (#1597): each relationship with its scope and term,
+     * and the verbs that accept, confine, pause and end it. The client's register of third parties with
+     * access to its data. Placed only by an application whose organization types declare `servesAsProvider`.
+     */
+    SERVICE_PROVIDERS = "service-providers",
+    /**
+     * THIS organization's clients, when it is a service firm (#1597): its engagements, and which of its
+     * people serve which client. Placed only by an application whose organization types declare `servesAsProvider`.
+     */
+    SERVICE_CLIENTS = "service-clients",
     /** The organization's audit log. Org owner/admin only. */
     AUDIT_LOGS = "audit-logs",
     /**
@@ -115,6 +140,29 @@ export declare enum EngineSettingsDestinationRef {
     ORGANIZATION_ENTITLEMENTS = "organization-entitlements",
     /** Referral codes and their redemptions. Organization-scoped despite living in the billing domain. */
     ORGANIZATION_REFERRALS = "organization-referrals",
+    /**
+     * The organization's legal holds (#1634): what is held from deletion, on what ground, placed and released by
+     * whom. `ORG_OWNER`, matching the resource's own READ / LIST roles.
+     */
+    ORGANIZATION_LEGAL_HOLDS = "organization-legal-holds",
+    /**
+     * The domains THIS organization receives and sends mail on (#1600): claim one, publish its ownership TXT record
+     * and the provider's DNS records, verify, remove. Org owner/admin only, matching the resource's ORG_ADMIN verbs.
+     */
+    EMAIL_DOMAINS = "email-domains",
+    /**
+     * The addresses THIS organization — a service firm — keeps on its own verified domain for the clients it serves;
+     * each routes its mail into that client's organization (#1600). Org owner/admin only. Placed only by an application
+     * whose organization types declare `servesAsProvider`.
+     */
+    CLIENT_MAILBOXES = "client-mailboxes",
+    /**
+     * What THIS organization's experts decide about its agents' work (#1599): the override rate per agent, tool, case
+     * and reviewer; whether the content of their corrections is kept, why, and who else may read it; the authorisation
+     * to export them as evaluation data; and the ledger of every export. Org owner/admin only, matching the resources'
+     * ORG_ADMIN verbs and the override-rate route's organization-administrator check.
+     */
+    AGENT_WORK_REVIEW = "agent-work-review",
     /** The application's own descriptive record — name, description, the operator's identity. */
     APPLICATION_GENERAL = "application-general",
     /** Released versions of the application. */
@@ -166,6 +214,19 @@ export declare enum EngineSettingsDestinationRef {
     APPLICATION_SIEM = "application-siem",
     /** Application-wide outbound webhooks, and their delivery log. */
     APPLICATION_WEBHOOKS = "application-webhooks",
+    /**
+     * Messages other systems sent the application that resolved to NO organization — application-scope
+     * and unroutable inbound deliveries (#1596) — with REPLAY for a dead one. The inbound mirror of
+     * {@link APPLICATION_WEBHOOKS}'s delivery log, kept separate because it is a different direction,
+     * a different entitlement and a different operator task.
+     */
+    APPLICATION_INBOUND_DELIVERIES = "application-inbound-deliveries",
+    /**
+     * Whether each declared retention period is being enforced (#1636): one record per retention-sweep run and
+     * bound resource — what it deleted under which period, what a hold kept, and how the run ended. Read-only;
+     * the operator's view of the storage-limitation evidence.
+     */
+    APPLICATION_RETENTION_ENFORCEMENT = "application-retention-enforcement",
     /**
      * The billing CATALOGUE the application sells — products, their prices, and promotions.
      *

package/dist/esm/frontend-definitions/settings-destination-ref.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-destination-ref.definitions.d.ts","sourceRoot":"","sources":["../../../../src/frontend-definitions/settings-destination-ref.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,oJAAoJ;AACpJ;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,4BAA4B;IACtC,+CAA+C;IAC/C,OAAO,YAAY;IACnB,wDAAwD;IACxD,QAAQ,aAAa;IACrB,iEAAiE;IACjE,UAAU,eAAe;IACzB,kDAAkD;IAClD,WAAW,gBAAgB;IAC3B,8FAA8F;IAC9F,cAAc,mBAAmB;IACjC,mEAAmE;IACnE,oBAAoB,yBAAyB;IAC7C,kFAAkF;IAClF,OAAO,YAAY;IACnB;;;;;;;OAOG;IACH,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,OAAO,YAAY;IACnB,mDAAmD;IACnD,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;;;;;;OAUG;IACH,uBAAuB,4BAA4B;IACnD,oDAAoD;IACpD,GAAG,QAAQ;IACX,4DAA4D;IAC5D,IAAI,SAAS;IACb,qEAAqE;IACrE,IAAI,SAAS;IACb,mDAAmD;IACnD,QAAQ,aAAa;IACrB,0DAA0D;IAC1D,UAAU,eAAe;IACzB;;;;;;;;;;;;OAYG;IACH,yBAAyB,8BAA8B;IACvD,sGAAsG;IACtG,sBAAsB,2BAA2B;IAejD,6FAA6F;IAC7F,mBAAmB,wBAAwB;IAC3C,4CAA4C;IAC5C,oBAAoB,yBAAyB;IAC7C;;;;;;;OAOG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;;OAQG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IACjD,oFAAoF;IACpF,wBAAwB,6BAA6B;IACrD,+FAA+F;IAC/F,oBAAoB,yBAAyB;IAC7C,yFAAyF;IACzF,eAAe,oBAAoB;IACnC;;;;;;;OAOG;IACH,gBAAgB,qBAAqB;IACrC,8EAA8E;IAC9E,gBAAgB,qBAAqB;IACrC,kEAAkE;IAClE,oBAAoB,yBAAyB;IAC7C;;;;;;OAMG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,4EAA4E;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,EAAE,WAAW,CAAC,MAAM,CAAgE,CAAC"}
+{"version":3,"file":"settings-destination-ref.definitions.d.ts","sourceRoot":"","sources":["../../../src/frontend-definitions/settings-destination-ref.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,oJAAoJ;AACpJ;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,4BAA4B;IACtC,+CAA+C;IAC/C,OAAO,YAAY;IACnB,wDAAwD;IACxD,QAAQ,aAAa;IACrB,iEAAiE;IACjE,UAAU,eAAe;IACzB,kDAAkD;IAClD,WAAW,gBAAgB;IAC3B,8FAA8F;IAC9F,cAAc,mBAAmB;IACjC,mEAAmE;IACnE,oBAAoB,yBAAyB;IAC7C,kFAAkF;IAClF,OAAO,YAAY;IACnB;;;;;;;OAOG;IACH,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,OAAO,YAAY;IACnB,mDAAmD;IACnD,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;OAMG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;;;;;;OAUG;IACH,uBAAuB,4BAA4B;IACnD,oDAAoD;IACpD,GAAG,QAAQ;IACX,4DAA4D;IAC5D,IAAI,SAAS;IACb,qEAAqE;IACrE,IAAI,SAAS;IACb,mDAAmD;IACnD,QAAQ,aAAa;IACrB;;;OAGG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,eAAe,oBAAoB;IACnC,0DAA0D;IAC1D,UAAU,eAAe;IACzB;;;;;;;;;;;;OAYG;IACH,yBAAyB,8BAA8B;IACvD,sGAAsG;IACtG,sBAAsB,2BAA2B;IACjD;;;OAGG;IACH,wBAAwB,6BAA6B;IACrD;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;;OAKG;IACH,iBAAiB,sBAAsB;IAevC,6FAA6F;IAC7F,mBAAmB,wBAAwB;IAC3C,4CAA4C;IAC5C,oBAAoB,yBAAyB;IAC7C;;;;;;;OAOG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;;OAQG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IACjD,oFAAoF;IACpF,wBAAwB,6BAA6B;IACrD,+FAA+F;IAC/F,oBAAoB,yBAAyB;IAC7C,yFAAyF;IACzF,eAAe,oBAAoB;IACnC;;;;;;;OAOG;IACH,gBAAgB,qBAAqB;IACrC,8EAA8E;IAC9E,gBAAgB,qBAAqB;IACrC,kEAAkE;IAClE,oBAAoB,yBAAyB;IAC7C;;;;;OAKG;IACH,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,iCAAiC,sCAAsC;IACvE;;;;;;OAMG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,4EAA4E;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,EAAE,WAAW,CAAC,MAAM,CAAgE,CAAC"}

package/dist/esm/frontend-definitions/settings-destination-ref.definitions.js

@@ -70,6 +70,15 @@ export var EngineSettingsDestinationRef;
     EngineSettingsDestinationRef["BILLING"] = "billing";
     /** Organization API keys. Org owner/admin only. */
     EngineSettingsDestinationRef["API_KEYS"] = "api-keys";
+    /**
+     * OAuth clients the ORGANIZATION registers — the machine credentials it issues for itself, and the ones an
+     * autonomous agent runs as (#1611). Org owner/admin only.
+     *
+     * The sibling of {@link API_KEYS} for the reason {@link APPLICATION_OAUTH_CLIENTS} is the sibling of the
+     * application's keys: under client-credentials both authenticate the organization's machine principal, so they
+     * are two credential types for one identity. Until #1812 this had no screen, and binding an agent was REST only.
+     */
+    EngineSettingsDestinationRef["ORGANIZATION_OAUTH_CLIENTS"] = "organization-oauth-clients";
     /**
      * The tenant's OWN credentials toward third parties — its Slack workspace token, its CRM key.
      *
@@ -98,6 +107,22 @@ export var EngineSettingsDestinationRef;
     EngineSettingsDestinationRef["SIEM"] = "siem";
     /** Outbound webhook endpoints and delivery log. */
     EngineSettingsDestinationRef["WEBHOOKS"] = "webhooks";
+    /**
+     * Messages other systems sent the application that belong to THIS organization (#1596): what
+     * arrived, whether the handler processed it, and REPLAY for one that died. Org owner/admin only.
+     */
+    EngineSettingsDestinationRef["INBOUND_DELIVERIES"] = "inbound-deliveries";
+    /**
+     * The outside firms working in THIS organization (#1597): each relationship with its scope and term,
+     * and the verbs that accept, confine, pause and end it. The client's register of third parties with
+     * access to its data. Placed only by an application whose organization types declare `servesAsProvider`.
+     */
+    EngineSettingsDestinationRef["SERVICE_PROVIDERS"] = "service-providers";
+    /**
+     * THIS organization's clients, when it is a service firm (#1597): its engagements, and which of its
+     * people serve which client. Placed only by an application whose organization types declare `servesAsProvider`.
+     */
+    EngineSettingsDestinationRef["SERVICE_CLIENTS"] = "service-clients";
     /** The organization's audit log. Org owner/admin only. */
     EngineSettingsDestinationRef["AUDIT_LOGS"] = "audit-logs";
     /**
@@ -116,6 +141,29 @@ export var EngineSettingsDestinationRef;
     EngineSettingsDestinationRef["ORGANIZATION_ENTITLEMENTS"] = "organization-entitlements";
     /** Referral codes and their redemptions. Organization-scoped despite living in the billing domain. */
     EngineSettingsDestinationRef["ORGANIZATION_REFERRALS"] = "organization-referrals";
+    /**
+     * The organization's legal holds (#1634): what is held from deletion, on what ground, placed and released by
+     * whom. `ORG_OWNER`, matching the resource's own READ / LIST roles.
+     */
+    EngineSettingsDestinationRef["ORGANIZATION_LEGAL_HOLDS"] = "organization-legal-holds";
+    /**
+     * The domains THIS organization receives and sends mail on (#1600): claim one, publish its ownership TXT record
+     * and the provider's DNS records, verify, remove. Org owner/admin only, matching the resource's ORG_ADMIN verbs.
+     */
+    EngineSettingsDestinationRef["EMAIL_DOMAINS"] = "email-domains";
+    /**
+     * The addresses THIS organization — a service firm — keeps on its own verified domain for the clients it serves;
+     * each routes its mail into that client's organization (#1600). Org owner/admin only. Placed only by an application
+     * whose organization types declare `servesAsProvider`.
+     */
+    EngineSettingsDestinationRef["CLIENT_MAILBOXES"] = "client-mailboxes";
+    /**
+     * What THIS organization's experts decide about its agents' work (#1599): the override rate per agent, tool, case
+     * and reviewer; whether the content of their corrections is kept, why, and who else may read it; the authorisation
+     * to export them as evaluation data; and the ledger of every export. Org owner/admin only, matching the resources'
+     * ORG_ADMIN verbs and the override-rate route's organization-administrator check.
+     */
+    EngineSettingsDestinationRef["AGENT_WORK_REVIEW"] = "agent-work-review";
     // ── Application administration ──────────────────────────────────────────────
     //
     // Everything below is `ResourcePrimaryScope.APPLICATION`: it configures the APPLICATION ITSELF
@@ -179,6 +227,19 @@ export var EngineSettingsDestinationRef;
     EngineSettingsDestinationRef["APPLICATION_SIEM"] = "application-siem";
     /** Application-wide outbound webhooks, and their delivery log. */
     EngineSettingsDestinationRef["APPLICATION_WEBHOOKS"] = "application-webhooks";
+    /**
+     * Messages other systems sent the application that resolved to NO organization — application-scope
+     * and unroutable inbound deliveries (#1596) — with REPLAY for a dead one. The inbound mirror of
+     * {@link APPLICATION_WEBHOOKS}'s delivery log, kept separate because it is a different direction,
+     * a different entitlement and a different operator task.
+     */
+    EngineSettingsDestinationRef["APPLICATION_INBOUND_DELIVERIES"] = "application-inbound-deliveries";
+    /**
+     * Whether each declared retention period is being enforced (#1636): one record per retention-sweep run and
+     * bound resource — what it deleted under which period, what a hold kept, and how the run ended. Read-only;
+     * the operator's view of the storage-limitation evidence.
+     */
+    EngineSettingsDestinationRef["APPLICATION_RETENTION_ENFORCEMENT"] = "application-retention-enforcement";
     /**
      * The billing CATALOGUE the application sells — products, their prices, and promotions.
      *

package/dist/esm/frontend-definitions/settings-destination-ref.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-destination-ref.definitions.js","sourceRoot":"","sources":["../../../../src/frontend-definitions/settings-destination-ref.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,oJAAoJ;AACpJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,4BAmJX;AAnJD,WAAY,4BAA4B;IACtC,+CAA+C;IAC/C,mDAAmB,CAAA;IACnB,wDAAwD;IACxD,qDAAqB,CAAA;IACrB,iEAAiE;IACjE,yDAAyB,CAAA;IACzB,kDAAkD;IAClD,2DAA2B,CAAA;IAC3B,8FAA8F;IAC9F,iEAAiC,CAAA;IACjC,mEAAmE;IACnE,6EAA6C,CAAA;IAC7C,kFAAkF;IAClF,mDAAmB,CAAA;IACnB;;;;;;;OAOG;IACH,yEAAyC,CAAA;IACzC,qGAAqG;IACrG,mDAAmB,CAAA;IACnB,mDAAmD;IACnD,qDAAqB,CAAA;IACrB;;;;;;OAMG;IACH,6EAA6C,CAAA;IAC7C;;;;;;;;;;OAUG;IACH,mFAAmD,CAAA;IACnD,oDAAoD;IACpD,2CAAW,CAAA;IACX,4DAA4D;IAC5D,6CAAa,CAAA;IACb,qEAAqE;IACrE,6CAAa,CAAA;IACb,mDAAmD;IACnD,qDAAqB,CAAA;IACrB,0DAA0D;IAC1D,yDAAyB,CAAA;IACzB;;;;;;;;;;;;OAYG;IACH,uFAAuD,CAAA;IACvD,sGAAsG;IACtG,iFAAiD,CAAA;IAEjD,+EAA+E;IAC/E,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,2EAA2E;IAC3E,4FAA4F;IAC5F,4FAA4F;IAC5F,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,+FAA+F;IAC/F,0EAA0E;IAE1E,6FAA6F;IAC7F,2EAA2C,CAAA;IAC3C,4CAA4C;IAC5C,6EAA6C,CAAA;IAC7C;;;;;;;OAOG;IACH,uFAAuD,CAAA;IACvD;;;;;;;;OAQG;IACH,uFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,iFAAiD,CAAA;IACjD,oFAAoF;IACpF,qFAAqD,CAAA;IACrD,+FAA+F;IAC/F,6EAA6C,CAAA;IAC7C,yFAAyF;IACzF,mEAAmC,CAAA;IACnC;;;;;;;OAOG;IACH,qEAAqC,CAAA;IACrC,8EAA8E;IAC9E,qEAAqC,CAAA;IACrC,kEAAkE;IAClE,6EAA6C,CAAA;IAC7C;;;;;;OAMG;IACH,mEAAmC,CAAA;AACrC,CAAC,EAnJW,4BAA4B,KAA5B,4BAA4B,QAmJvC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,4EAA4E;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAwB,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAC","sourcesContent":["/**\n * The IDENTITY half of the engine's settings-hub catalogue — the refs, and nothing else.\n *\n * ## Why the identity lives here and the catalogue does not\n *\n * A settings destination has two halves, and only one of them is a rendering concern:\n *\n * - **What a destination IS** — its `target` (a resource operation, a bespoke engine panel, a set\n *   of sub-tabs), its role gating, its runtime-capability gating. That half names components and\n *   panel refs, so it belongs to `@wildo-ai/saas-frontend-lib`, where `ENGINE_SETTINGS_DESTINATIONS`\n *   declares it.\n * - **WHICH destinations exist** — a closed set of ids. That half names nothing renderable. It is\n *   the vocabulary an application's `SettingsHubConfig` addresses by string, the vocabulary the\n *   app-creation placement plan names in a `PlacementSubject`, and the vocabulary engine code\n *   addresses by enum member. It is declared here.\n *\n * The split was made 2026-09-09 because the second half had a consumer the first half's package\n * could never serve. `validatePlacementPlan`'s `UNKNOWN_SUBJECT` finding is a HARD FLOOR — it\n * refuses a landing — and it can only fire when a caller supplies the universe of subjects that\n * exist. Its one production caller is the app-creation semantic authority, a backend-side package\n * that must not depend on `saas-frontend-lib`. So a declared refusal had no holder, for no reason\n * other than where a list of sixteen strings was written down.\n *\n * Nothing is re-exported across the boundary: `saas-frontend-lib` imports the enum from here and\n * declares only the catalogue.\n */\n\n/** @wildo_source:part:start saas.frontend.settings-hub.engine-destinations facet:layer:frontend facet:family:config facet:audience:app-developer */\n/**\n * Every settings destination the engine ships, as a named vocabulary.\n *\n * Imported from `@wildo-ai/saas-models`. Exists because these refs are a CLOSED\n * vocabulary that engine code addresses by name — the billing command-menu entry\n * opens `/settings/billing`, and any future engine launcher will do the same.\n * Before this enum, `'billing'` was a bare literal in `billing-launcher.ts` with\n * nothing tying it to the catalog entry it names: rename the destination and the\n * command silently resolves to the hub's DEFAULT section instead of failing, so a\n * menu item labelled \"Billing\" would open Profile.\n *\n * **Engine code must address a destination through this enum. Application\n * config addresses one by string**, deliberately: a placement is authored data,\n * an application should not import an engine enum to write its own rail, and a\n * typo there is caught at DEV startup by `verifySettingsHubContent`.\n */\nexport enum EngineSettingsDestinationRef {\n  /** The signed-in user's own profile record. */\n  PROFILE = 'profile',\n  /** Password, MFA, sessions — a bespoke engine panel. */\n  SECURITY = 'security',\n  /** Theme and appearance preferences — a bespoke engine panel. */\n  APPEARANCE = 'appearance',\n  /** The signed-in user's own preference record. */\n  PREFERENCES = 'preferences',\n  /** Invitations addressed TO the signed-in user, across organizations they have not joined. */\n  MY_INVITATIONS = 'my-invitations',\n  /** The current organization's own record. Org owner/admin only. */\n  ORGANIZATION_GENERAL = 'organization-general',\n  /** Organization membership list, including INVITED rows. Org owner/admin only. */\n  MEMBERS = 'members',\n  /**\n   * The organization's internal structure — teams, departments, the hierarchy under the tenant.\n   *\n   * Its own rail entry rather than a tab inside {@link ORGANIZATION_GENERAL}. The general pane is a\n   * record — a column of decisions about the tenant itself — and a unit hierarchy is a population\n   * you navigate, which is a different kind of surface and a different task. Nesting it there also\n   * put it behind a pane a reader had no other reason to open.\n   */\n  ORGANIZATION_UNITS = 'organization-units',\n  /** Billing home — subscription, plans, usage, invoices. Gated on the `billingEnabled` capability. */\n  BILLING = 'billing',\n  /** Organization API keys. Org owner/admin only. */\n  API_KEYS = 'api-keys',\n  /**\n   * The tenant's OWN credentials toward third parties — its Slack workspace token, its CRM key.\n   *\n   * The mirror image of {@link API_KEYS} and easy to confuse with it: an API key is a credential\n   * somebody uses to reach THIS application, and one of these is a credential this application uses\n   * to reach somebody else ON THIS TENANT'S BEHALF. Same administrator, opposite direction.\n   */\n  PROVIDER_CREDENTIALS = 'provider-credentials',\n  /**\n   * The signed-in person's OWN credentials toward third parties — their personal API key, the\n   * account they connected themselves.\n   *\n   * Distinct from {@link PROVIDER_CREDENTIALS} by OWNER, not by feature, and the two must never be\n   * merged into one screen. A tenant's credential is a shared integration an administrator\n   * configures for everyone; this one is an individual's own account, which nobody else may see,\n   * spend or remove. Putting them on one page would put a colleague's personal vendor token in an\n   * administrator's view — and the resource's authorization refuses that, so the screen would show\n   * an empty list nobody could explain.\n   */\n  MY_PROVIDER_CREDENTIALS = 'my-provider-credentials',\n  /** Single sign-on configuration and connections. */\n  SSO = 'sso',\n  /** SCIM directory provisioning configuration and tokens. */\n  SCIM = 'scim',\n  /** Audit-event streaming configuration and failed-delivery queue. */\n  SIEM = 'siem',\n  /** Outbound webhook endpoints and delivery log. */\n  WEBHOOKS = 'webhooks',\n  /** The organization's audit log. Org owner/admin only. */\n  AUDIT_LOGS = 'audit-logs',\n  /**\n   * What THIS organization is currently entitled to — its features, its numeric limits, and the\n   * application-administrator exceptions laid over them.\n   *\n   * Readable by any organization member (`organizationFeatures` READ is `ORG_MEMBER`), which is why\n   * it carries no `requiredRoles`: a member who is told a surface needs an upgrade should be able to\n   * see what their organization actually has. The operations that CHANGE it — enable, disable, reset\n   * — are `APP_ADMIN_SUPER_ADMIN` on the resource itself, so the same screen is a read-only summary\n   * for a member and the grant/withdraw console for a platform administrator.\n   *\n   * Until this existed there was no way to reach the entitlement state from anywhere in the product:\n   * the resource had a table, an admin UI behaviour and three custom operations, and no door.\n   */\n  ORGANIZATION_ENTITLEMENTS = 'organization-entitlements',\n  /** Referral codes and their redemptions. Organization-scoped despite living in the billing domain. */\n  ORGANIZATION_REFERRALS = 'organization-referrals',\n\n  // ── Application administration ──────────────────────────────────────────────\n  //\n  // Everything below is `ResourcePrimaryScope.APPLICATION`: it configures the APPLICATION ITSELF\n  // rather than one tenant inside it, and it is the operator's surface, not a customer's. The\n  // category an application places these in is what supplies that scope, and\n  // `useVisibleSettingsHubConfig` resolves the application id from `appIdentity` — the access\n  // token does not carry one, so a category scoped this way was unreachable until 2026-09-17.\n  //\n  // Each mirrors an organization-scope sibling above, and the pairs are NOT redundant: an\n  // application-wide SSO connection authenticates everybody who is not covered by a tenant's own,\n  // and an application-wide SIEM export carries the operator's own security events rather than a\n  // customer's. Same mechanism, different principal, different consequence.\n\n  /** The application's own descriptive record — name, description, the operator's identity. */\n  APPLICATION_GENERAL = 'application-general',\n  /** Released versions of the application. */\n  APPLICATION_VERSIONS = 'application-versions',\n  /**\n   * OAuth clients registered against the APPLICATION — the credential a machine presents for a\n   * client-credentials or authorization-code exchange.\n   *\n   * The sibling of {@link APPLICATION_API_KEYS} rather than a duplicate of it: under\n   * client-credentials both authenticate the same `APPLICATION_MACHINE` principal, so they are two\n   * credential TYPES for one identity and belong side by side.\n   */\n  APPLICATION_OAUTH_CLIENTS = 'application-oauth-clients',\n  /**\n   * The two-person rule, made reviewable — requested, signed, time-bound elevations over the\n   * application-wide reads.\n   *\n   * Placed because a control of this kind is justified by VISIBILITY rather than by prevention:\n   * it does not stop an operator reading across tenants, it makes a second administrator sign for\n   * it and leaves a record. An elevation nobody can read makes nothing visible, so the mechanism\n   * ran without its own justification until this had a door.\n   */\n  APPLICATION_ACCESS_GRANTS = 'application-access-grants',\n  /**\n   * The application-wide audit trail — every tenant's events plus the ones belonging to no tenant.\n   *\n   * Distinct from the organization {@link AUDIT_LOGS} by the question it answers, not by scope\n   * alone: the tenant door answers \"what happened in my organization\", this one answers \"what\n   * happened at all\", and only the second can support a deployment-level attestation. Every read\n   * through it is a declared crossing and emits one event into each tenant it reached.\n   */\n  APPLICATION_AUDIT_LOGS = 'application-audit-logs',\n  /** The application-scope feature and limit state, with administrator exceptions. */\n  APPLICATION_ENTITLEMENTS = 'application-entitlements',\n  /** API keys that authenticate a machine to the APPLICATION rather than to one organization. */\n  APPLICATION_API_KEYS = 'application-api-keys',\n  /** Application-wide single sign-on: the configuration, and the connections it admits. */\n  APPLICATION_SSO = 'application-sso',\n  /**\n   * Application-wide SCIM directory provisioning.\n   *\n   * One target rather than the organization sibling's two tabs, and that asymmetry is real rather\n   * than an omission: there is no `APPLICATION_SCIM_TOKENS` resource — only\n   * `ORGANIZATION_SCIM_TOKENS` exists — so the application scope has a provisioning configuration\n   * and nothing to tab to.\n   */\n  APPLICATION_SCIM = 'application-scim',\n  /** Application-wide audit-event streaming, and the deliveries that failed. */\n  APPLICATION_SIEM = 'application-siem',\n  /** Application-wide outbound webhooks, and their delivery log. */\n  APPLICATION_WEBHOOKS = 'application-webhooks',\n  /**\n   * The billing CATALOGUE the application sells — products, their prices, and promotions.\n   *\n   * Distinct from the organization `BILLING` destination, which is one tenant's subscription and\n   * invoices. This is the operator editing what is on sale; that is a customer reading what they\n   * bought.\n   */\n  BILLING_CATALOG = 'billing-catalog',\n}\n\n/**\n * ## Two administration surfaces that are DELIBERATELY absent, so neither is re-proposed\n *\n * **A tenant directory.** `organizations` LIST looks like one and is not: it is confined by\n * `assignScopeRootCollectionConfinementToFilter` to the tenants the caller holds an\n * organization-wide role entry for, so a platform super-administrator sees THEIR OWN organizations\n * and not every tenant. That confinement is deliberate — the resource's own banner says so, and\n * says explicitly that an operator who \"cannot find the tenant id\" should stop rather than widen\n * the operation, because widening it hands the full customer list to every platform administrator\n * as a standing privilege. A destination named \"Organizations\" under Administration would promise\n * the directory and deliver the memberships, which is worse than having no entry: the reader\n * cannot tell the difference, and the number looks authoritative.\n *\n * **A user directory.** Same shape one level down. The application-wide user read is gated on a\n * two-person `applicationAccessGrants` window precisely so that it is not a standing privilege, so\n * a permanently-placed rail entry would either sit there refusing or quietly bypass the control it\n * is supposed to pass through.\n *\n * Both become placeable when a governed cross-tenant read exists — an operation that requires the\n * grant and says so. Neither becomes placeable by widening the operation that is already there.\n */\n/** @wildo_source:part:end saas.frontend.settings-hub.engine-destinations */\n\n/**\n * Every destination ref the engine ships — the set an authored placement is validated against.\n *\n * **Derived from the enum, not from the catalogue, and that is the point.** It used to be\n * `ENGINE_SETTINGS_DESTINATIONS.map(d => d.ref)`, which made the set a statement about how many\n * catalogue entries had been written rather than about what the vocabulary contains: a member added\n * to the enum and not yet given a catalogue entry would have been silently absent from the universe\n * a hard floor is measured against, so a placement naming it would have been refused as UNKNOWN.\n * Deriving from the enum is TOTAL over the vocabulary — a member added tomorrow is in this set the\n * same day — and the reverse obligation (every ref has a catalogue entry) is pinned in\n * `saas-frontend-lib`, where the catalogue lives and where an omission is a rendering defect.\n *\n * Values are bare ids, the shape `placementSubjectLocalKey` publishes for\n * `ENGINE_SETTINGS_DESTINATION` subjects, so this set can be handed to `validatePlacementPlan`\n * without being re-spelled.\n */\nexport const ENGINE_SETTINGS_DESTINATION_REFS: ReadonlySet<string> = new Set<string>(Object.values(EngineSettingsDestinationRef));\n"]}
+{"version":3,"file":"settings-destination-ref.definitions.js","sourceRoot":"","sources":["../../../src/frontend-definitions/settings-destination-ref.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,oJAAoJ;AACpJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,4BAgNX;AAhND,WAAY,4BAA4B;IACtC,+CAA+C;IAC/C,mDAAmB,CAAA;IACnB,wDAAwD;IACxD,qDAAqB,CAAA;IACrB,iEAAiE;IACjE,yDAAyB,CAAA;IACzB,kDAAkD;IAClD,2DAA2B,CAAA;IAC3B,8FAA8F;IAC9F,iEAAiC,CAAA;IACjC,mEAAmE;IACnE,6EAA6C,CAAA;IAC7C,kFAAkF;IAClF,mDAAmB,CAAA;IACnB;;;;;;;OAOG;IACH,yEAAyC,CAAA;IACzC,qGAAqG;IACrG,mDAAmB,CAAA;IACnB,mDAAmD;IACnD,qDAAqB,CAAA;IACrB;;;;;;;OAOG;IACH,yFAAyD,CAAA;IACzD;;;;;;OAMG;IACH,6EAA6C,CAAA;IAC7C;;;;;;;;;;OAUG;IACH,mFAAmD,CAAA;IACnD,oDAAoD;IACpD,2CAAW,CAAA;IACX,4DAA4D;IAC5D,6CAAa,CAAA;IACb,qEAAqE;IACrE,6CAAa,CAAA;IACb,mDAAmD;IACnD,qDAAqB,CAAA;IACrB;;;OAGG;IACH,yEAAyC,CAAA;IACzC;;;;OAIG;IACH,uEAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAmC,CAAA;IACnC,0DAA0D;IAC1D,yDAAyB,CAAA;IACzB;;;;;;;;;;;;OAYG;IACH,uFAAuD,CAAA;IACvD,sGAAsG;IACtG,iFAAiD,CAAA;IACjD;;;OAGG;IACH,qFAAqD,CAAA;IACrD;;;OAGG;IACH,+DAA+B,CAAA;IAC/B;;;;OAIG;IACH,qEAAqC,CAAA;IACrC;;;;;OAKG;IACH,uEAAuC,CAAA;IAEvC,+EAA+E;IAC/E,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,2EAA2E;IAC3E,4FAA4F;IAC5F,4FAA4F;IAC5F,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,+FAA+F;IAC/F,0EAA0E;IAE1E,6FAA6F;IAC7F,2EAA2C,CAAA;IAC3C,4CAA4C;IAC5C,6EAA6C,CAAA;IAC7C;;;;;;;OAOG;IACH,uFAAuD,CAAA;IACvD;;;;;;;;OAQG;IACH,uFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,iFAAiD,CAAA;IACjD,oFAAoF;IACpF,qFAAqD,CAAA;IACrD,+FAA+F;IAC/F,6EAA6C,CAAA;IAC7C,yFAAyF;IACzF,mEAAmC,CAAA;IACnC;;;;;;;OAOG;IACH,qEAAqC,CAAA;IACrC,8EAA8E;IAC9E,qEAAqC,CAAA;IACrC,kEAAkE;IAClE,6EAA6C,CAAA;IAC7C;;;;;OAKG;IACH,iGAAiE,CAAA;IACjE;;;;OAIG;IACH,uGAAuE,CAAA;IACvE;;;;;;OAMG;IACH,mEAAmC,CAAA;AACrC,CAAC,EAhNW,4BAA4B,KAA5B,4BAA4B,QAgNvC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,4EAA4E;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAwB,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAC","sourcesContent":["/**\n * The IDENTITY half of the engine's settings-hub catalogue — the refs, and nothing else.\n *\n * ## Why the identity lives here and the catalogue does not\n *\n * A settings destination has two halves, and only one of them is a rendering concern:\n *\n * - **What a destination IS** — its `target` (a resource operation, a bespoke engine panel, a set\n *   of sub-tabs), its role gating, its runtime-capability gating. That half names components and\n *   panel refs, so it belongs to `@wildo-ai/saas-frontend-lib`, where `ENGINE_SETTINGS_DESTINATIONS`\n *   declares it.\n * - **WHICH destinations exist** — a closed set of ids. That half names nothing renderable. It is\n *   the vocabulary an application's `SettingsHubConfig` addresses by string, the vocabulary the\n *   app-creation placement plan names in a `PlacementSubject`, and the vocabulary engine code\n *   addresses by enum member. It is declared here.\n *\n * The split was made 2026-09-09 because the second half had a consumer the first half's package\n * could never serve. `validatePlacementPlan`'s `UNKNOWN_SUBJECT` finding is a HARD FLOOR — it\n * refuses a landing — and it can only fire when a caller supplies the universe of subjects that\n * exist. Its one production caller is the app-creation semantic authority, a backend-side package\n * that must not depend on `saas-frontend-lib`. So a declared refusal had no holder, for no reason\n * other than where a list of sixteen strings was written down.\n *\n * Nothing is re-exported across the boundary: `saas-frontend-lib` imports the enum from here and\n * declares only the catalogue.\n */\n\n/** @wildo_source:part:start saas.frontend.settings-hub.engine-destinations facet:layer:frontend facet:family:config facet:audience:app-developer */\n/**\n * Every settings destination the engine ships, as a named vocabulary.\n *\n * Imported from `@wildo-ai/saas-models`. Exists because these refs are a CLOSED\n * vocabulary that engine code addresses by name — the billing command-menu entry\n * opens `/settings/billing`, and any future engine launcher will do the same.\n * Before this enum, `'billing'` was a bare literal in `billing-launcher.ts` with\n * nothing tying it to the catalog entry it names: rename the destination and the\n * command silently resolves to the hub's DEFAULT section instead of failing, so a\n * menu item labelled \"Billing\" would open Profile.\n *\n * **Engine code must address a destination through this enum. Application\n * config addresses one by string**, deliberately: a placement is authored data,\n * an application should not import an engine enum to write its own rail, and a\n * typo there is caught at DEV startup by `verifySettingsHubContent`.\n */\nexport enum EngineSettingsDestinationRef {\n  /** The signed-in user's own profile record. */\n  PROFILE = 'profile',\n  /** Password, MFA, sessions — a bespoke engine panel. */\n  SECURITY = 'security',\n  /** Theme and appearance preferences — a bespoke engine panel. */\n  APPEARANCE = 'appearance',\n  /** The signed-in user's own preference record. */\n  PREFERENCES = 'preferences',\n  /** Invitations addressed TO the signed-in user, across organizations they have not joined. */\n  MY_INVITATIONS = 'my-invitations',\n  /** The current organization's own record. Org owner/admin only. */\n  ORGANIZATION_GENERAL = 'organization-general',\n  /** Organization membership list, including INVITED rows. Org owner/admin only. */\n  MEMBERS = 'members',\n  /**\n   * The organization's internal structure — teams, departments, the hierarchy under the tenant.\n   *\n   * Its own rail entry rather than a tab inside {@link ORGANIZATION_GENERAL}. The general pane is a\n   * record — a column of decisions about the tenant itself — and a unit hierarchy is a population\n   * you navigate, which is a different kind of surface and a different task. Nesting it there also\n   * put it behind a pane a reader had no other reason to open.\n   */\n  ORGANIZATION_UNITS = 'organization-units',\n  /** Billing home — subscription, plans, usage, invoices. Gated on the `billingEnabled` capability. */\n  BILLING = 'billing',\n  /** Organization API keys. Org owner/admin only. */\n  API_KEYS = 'api-keys',\n  /**\n   * OAuth clients the ORGANIZATION registers — the machine credentials it issues for itself, and the ones an\n   * autonomous agent runs as (#1611). Org owner/admin only.\n   *\n   * The sibling of {@link API_KEYS} for the reason {@link APPLICATION_OAUTH_CLIENTS} is the sibling of the\n   * application's keys: under client-credentials both authenticate the organization's machine principal, so they\n   * are two credential types for one identity. Until #1812 this had no screen, and binding an agent was REST only.\n   */\n  ORGANIZATION_OAUTH_CLIENTS = 'organization-oauth-clients',\n  /**\n   * The tenant's OWN credentials toward third parties — its Slack workspace token, its CRM key.\n   *\n   * The mirror image of {@link API_KEYS} and easy to confuse with it: an API key is a credential\n   * somebody uses to reach THIS application, and one of these is a credential this application uses\n   * to reach somebody else ON THIS TENANT'S BEHALF. Same administrator, opposite direction.\n   */\n  PROVIDER_CREDENTIALS = 'provider-credentials',\n  /**\n   * The signed-in person's OWN credentials toward third parties — their personal API key, the\n   * account they connected themselves.\n   *\n   * Distinct from {@link PROVIDER_CREDENTIALS} by OWNER, not by feature, and the two must never be\n   * merged into one screen. A tenant's credential is a shared integration an administrator\n   * configures for everyone; this one is an individual's own account, which nobody else may see,\n   * spend or remove. Putting them on one page would put a colleague's personal vendor token in an\n   * administrator's view — and the resource's authorization refuses that, so the screen would show\n   * an empty list nobody could explain.\n   */\n  MY_PROVIDER_CREDENTIALS = 'my-provider-credentials',\n  /** Single sign-on configuration and connections. */\n  SSO = 'sso',\n  /** SCIM directory provisioning configuration and tokens. */\n  SCIM = 'scim',\n  /** Audit-event streaming configuration and failed-delivery queue. */\n  SIEM = 'siem',\n  /** Outbound webhook endpoints and delivery log. */\n  WEBHOOKS = 'webhooks',\n  /**\n   * Messages other systems sent the application that belong to THIS organization (#1596): what\n   * arrived, whether the handler processed it, and REPLAY for one that died. Org owner/admin only.\n   */\n  INBOUND_DELIVERIES = 'inbound-deliveries',\n  /**\n   * The outside firms working in THIS organization (#1597): each relationship with its scope and term,\n   * and the verbs that accept, confine, pause and end it. The client's register of third parties with\n   * access to its data. Placed only by an application whose organization types declare `servesAsProvider`.\n   */\n  SERVICE_PROVIDERS = 'service-providers',\n  /**\n   * THIS organization's clients, when it is a service firm (#1597): its engagements, and which of its\n   * people serve which client. Placed only by an application whose organization types declare `servesAsProvider`.\n   */\n  SERVICE_CLIENTS = 'service-clients',\n  /** The organization's audit log. Org owner/admin only. */\n  AUDIT_LOGS = 'audit-logs',\n  /**\n   * What THIS organization is currently entitled to — its features, its numeric limits, and the\n   * application-administrator exceptions laid over them.\n   *\n   * Readable by any organization member (`organizationFeatures` READ is `ORG_MEMBER`), which is why\n   * it carries no `requiredRoles`: a member who is told a surface needs an upgrade should be able to\n   * see what their organization actually has. The operations that CHANGE it — enable, disable, reset\n   * — are `APP_ADMIN_SUPER_ADMIN` on the resource itself, so the same screen is a read-only summary\n   * for a member and the grant/withdraw console for a platform administrator.\n   *\n   * Until this existed there was no way to reach the entitlement state from anywhere in the product:\n   * the resource had a table, an admin UI behaviour and three custom operations, and no door.\n   */\n  ORGANIZATION_ENTITLEMENTS = 'organization-entitlements',\n  /** Referral codes and their redemptions. Organization-scoped despite living in the billing domain. */\n  ORGANIZATION_REFERRALS = 'organization-referrals',\n  /**\n   * The organization's legal holds (#1634): what is held from deletion, on what ground, placed and released by\n   * whom. `ORG_OWNER`, matching the resource's own READ / LIST roles.\n   */\n  ORGANIZATION_LEGAL_HOLDS = 'organization-legal-holds',\n  /**\n   * The domains THIS organization receives and sends mail on (#1600): claim one, publish its ownership TXT record\n   * and the provider's DNS records, verify, remove. Org owner/admin only, matching the resource's ORG_ADMIN verbs.\n   */\n  EMAIL_DOMAINS = 'email-domains',\n  /**\n   * The addresses THIS organization — a service firm — keeps on its own verified domain for the clients it serves;\n   * each routes its mail into that client's organization (#1600). Org owner/admin only. Placed only by an application\n   * whose organization types declare `servesAsProvider`.\n   */\n  CLIENT_MAILBOXES = 'client-mailboxes',\n  /**\n   * What THIS organization's experts decide about its agents' work (#1599): the override rate per agent, tool, case\n   * and reviewer; whether the content of their corrections is kept, why, and who else may read it; the authorisation\n   * to export them as evaluation data; and the ledger of every export. Org owner/admin only, matching the resources'\n   * ORG_ADMIN verbs and the override-rate route's organization-administrator check.\n   */\n  AGENT_WORK_REVIEW = 'agent-work-review',\n\n  // ── Application administration ──────────────────────────────────────────────\n  //\n  // Everything below is `ResourcePrimaryScope.APPLICATION`: it configures the APPLICATION ITSELF\n  // rather than one tenant inside it, and it is the operator's surface, not a customer's. The\n  // category an application places these in is what supplies that scope, and\n  // `useVisibleSettingsHubConfig` resolves the application id from `appIdentity` — the access\n  // token does not carry one, so a category scoped this way was unreachable until 2026-09-17.\n  //\n  // Each mirrors an organization-scope sibling above, and the pairs are NOT redundant: an\n  // application-wide SSO connection authenticates everybody who is not covered by a tenant's own,\n  // and an application-wide SIEM export carries the operator's own security events rather than a\n  // customer's. Same mechanism, different principal, different consequence.\n\n  /** The application's own descriptive record — name, description, the operator's identity. */\n  APPLICATION_GENERAL = 'application-general',\n  /** Released versions of the application. */\n  APPLICATION_VERSIONS = 'application-versions',\n  /**\n   * OAuth clients registered against the APPLICATION — the credential a machine presents for a\n   * client-credentials or authorization-code exchange.\n   *\n   * The sibling of {@link APPLICATION_API_KEYS} rather than a duplicate of it: under\n   * client-credentials both authenticate the same `APPLICATION_MACHINE` principal, so they are two\n   * credential TYPES for one identity and belong side by side.\n   */\n  APPLICATION_OAUTH_CLIENTS = 'application-oauth-clients',\n  /**\n   * The two-person rule, made reviewable — requested, signed, time-bound elevations over the\n   * application-wide reads.\n   *\n   * Placed because a control of this kind is justified by VISIBILITY rather than by prevention:\n   * it does not stop an operator reading across tenants, it makes a second administrator sign for\n   * it and leaves a record. An elevation nobody can read makes nothing visible, so the mechanism\n   * ran without its own justification until this had a door.\n   */\n  APPLICATION_ACCESS_GRANTS = 'application-access-grants',\n  /**\n   * The application-wide audit trail — every tenant's events plus the ones belonging to no tenant.\n   *\n   * Distinct from the organization {@link AUDIT_LOGS} by the question it answers, not by scope\n   * alone: the tenant door answers \"what happened in my organization\", this one answers \"what\n   * happened at all\", and only the second can support a deployment-level attestation. Every read\n   * through it is a declared crossing and emits one event into each tenant it reached.\n   */\n  APPLICATION_AUDIT_LOGS = 'application-audit-logs',\n  /** The application-scope feature and limit state, with administrator exceptions. */\n  APPLICATION_ENTITLEMENTS = 'application-entitlements',\n  /** API keys that authenticate a machine to the APPLICATION rather than to one organization. */\n  APPLICATION_API_KEYS = 'application-api-keys',\n  /** Application-wide single sign-on: the configuration, and the connections it admits. */\n  APPLICATION_SSO = 'application-sso',\n  /**\n   * Application-wide SCIM directory provisioning.\n   *\n   * One target rather than the organization sibling's two tabs, and that asymmetry is real rather\n   * than an omission: there is no `APPLICATION_SCIM_TOKENS` resource — only\n   * `ORGANIZATION_SCIM_TOKENS` exists — so the application scope has a provisioning configuration\n   * and nothing to tab to.\n   */\n  APPLICATION_SCIM = 'application-scim',\n  /** Application-wide audit-event streaming, and the deliveries that failed. */\n  APPLICATION_SIEM = 'application-siem',\n  /** Application-wide outbound webhooks, and their delivery log. */\n  APPLICATION_WEBHOOKS = 'application-webhooks',\n  /**\n   * Messages other systems sent the application that resolved to NO organization — application-scope\n   * and unroutable inbound deliveries (#1596) — with REPLAY for a dead one. The inbound mirror of\n   * {@link APPLICATION_WEBHOOKS}'s delivery log, kept separate because it is a different direction,\n   * a different entitlement and a different operator task.\n   */\n  APPLICATION_INBOUND_DELIVERIES = 'application-inbound-deliveries',\n  /**\n   * Whether each declared retention period is being enforced (#1636): one record per retention-sweep run and\n   * bound resource — what it deleted under which period, what a hold kept, and how the run ended. Read-only;\n   * the operator's view of the storage-limitation evidence.\n   */\n  APPLICATION_RETENTION_ENFORCEMENT = 'application-retention-enforcement',\n  /**\n   * The billing CATALOGUE the application sells — products, their prices, and promotions.\n   *\n   * Distinct from the organization `BILLING` destination, which is one tenant's subscription and\n   * invoices. This is the operator editing what is on sale; that is a customer reading what they\n   * bought.\n   */\n  BILLING_CATALOG = 'billing-catalog',\n}\n\n/**\n * ## Two administration surfaces that are DELIBERATELY absent, so neither is re-proposed\n *\n * **A tenant directory.** `organizations` LIST looks like one and is not: it is confined by\n * `assignScopeRootCollectionConfinementToFilter` to the tenants the caller holds an\n * organization-wide role entry for, so a platform super-administrator sees THEIR OWN organizations\n * and not every tenant. That confinement is deliberate — the resource's own banner says so, and\n * says explicitly that an operator who \"cannot find the tenant id\" should stop rather than widen\n * the operation, because widening it hands the full customer list to every platform administrator\n * as a standing privilege. A destination named \"Organizations\" under Administration would promise\n * the directory and deliver the memberships, which is worse than having no entry: the reader\n * cannot tell the difference, and the number looks authoritative.\n *\n * **A user directory.** Same shape one level down. The application-wide user read is gated on a\n * two-person `applicationAccessGrants` window precisely so that it is not a standing privilege, so\n * a permanently-placed rail entry would either sit there refusing or quietly bypass the control it\n * is supposed to pass through.\n *\n * Both become placeable when a governed cross-tenant read exists — an operation that requires the\n * grant and says so. Neither becomes placeable by widening the operation that is already there.\n */\n/** @wildo_source:part:end saas.frontend.settings-hub.engine-destinations */\n\n/**\n * Every destination ref the engine ships — the set an authored placement is validated against.\n *\n * **Derived from the enum, not from the catalogue, and that is the point.** It used to be\n * `ENGINE_SETTINGS_DESTINATIONS.map(d => d.ref)`, which made the set a statement about how many\n * catalogue entries had been written rather than about what the vocabulary contains: a member added\n * to the enum and not yet given a catalogue entry would have been silently absent from the universe\n * a hard floor is measured against, so a placement naming it would have been refused as UNKNOWN.\n * Deriving from the enum is TOTAL over the vocabulary — a member added tomorrow is in this set the\n * same day — and the reverse obligation (every ref has a catalogue entry) is pinned in\n * `saas-frontend-lib`, where the catalogue lives and where an omission is a rendering defect.\n *\n * Values are bare ids, the shape `placementSubjectLocalKey` publishes for\n * `ENGINE_SETTINGS_DESTINATION` subjects, so this set can be handed to `validatePlacementPlan`\n * without being re-spelled.\n */\nexport const ENGINE_SETTINGS_DESTINATION_REFS: ReadonlySet<string> = new Set<string>(Object.values(EngineSettingsDestinationRef));\n"]}

package/dist/esm/guidance/guidance-flow.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guidance-flow.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/guidance/guidance-flow.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAoD,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACvI,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAElF;;oEAEoE;AAEpE;;;;;;;;;;;;GAYG;AAEH,oBAAY,kBAAkB;IAC5B,wEAAwE;IACxE,OAAO,YAAY;IACnB,wEAAwE;IACxE,MAAM,WAAW;IACjB,2DAA2D;IAC3D,SAAS,cAAc;CACxB;AAED;;oEAEoE;AAEpE,oDAAoD;AACpD,oBAAY,iBAAiB;IAC3B,qEAAqE;IACrE,IAAI,SAAS;IACb,sGAAsG;IACtG,YAAY,iBAAiB;CAC9B;AAED;;oEAEoE;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkDjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;oEAEoE;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,uDAAuD;AAYvD;;oEAEoE;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAG3F,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAGvF,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAGlF,CAAC;AAEF;;oEAEoE;AAEpE;8FAC8F;AAC9F,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAW3E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yCAAyC,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAU9F"}
+{"version":3,"file":"guidance-flow.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/guidance/guidance-flow.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAoD,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACvI,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAElF;;oEAEoE;AAEpE;;;;;;;;;;;;GAYG;AAEH,oBAAY,kBAAkB;IAC5B,wEAAwE;IACxE,OAAO,YAAY;IACnB,wEAAwE;IACxE,MAAM,WAAW;IACjB,2DAA2D;IAC3D,SAAS,cAAc;CACxB;AAED;;oEAEoE;AAEpE,oDAAoD;AACpD,oBAAY,iBAAiB;IAC3B,qEAAqE;IACrE,IAAI,SAAS;IACb,sGAAsG;IACtG,YAAY,iBAAiB;CAC9B;AAED;;oEAEoE;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkDjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;oEAEoE;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,uDAAuD;AAYvD;;oEAEoE;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAG3F,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAGvF,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAGlF,CAAC;AAEF;;oEAEoE;AAEpE;8FAC8F;AAC9F,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAW3E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yCAAyC,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAU9F"}

package/dist/esm/guidance/guidance-flow.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"guidance-flow.shared.schemas.js","sourceRoot":"","sources":["../../../../src/guidance/guidance-flow.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAEvI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAElF;;oEAEoE;AAEpE;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,wEAAwE;IACxE,yCAAmB,CAAA;IACnB,wEAAwE;IACxE,uCAAiB,CAAA;IACjB,2DAA2D;IAC3D,6CAAuB,CAAA;AACzB,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED;;oEAEoE;AAEpE,oDAAoD;AACpD,MAAM,CAAN,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAC3B,qEAAqE;IACrE,kCAAa,CAAA;IACb,sGAAsG;IACtG,kDAA6B,CAAA;AAC/B,CAAC,EALW,iBAAiB,KAAjB,iBAAiB,QAK5B;AAED;;oEAEoE;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,6EAA6E;IAC7E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,6EAA6E;IAC7E,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IACzD,2EAA2E;IAC3E,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD;;;;;;;OAOG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,gGAAgG;IAChG,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE;;;;;;OAMG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACvD,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd,sEAAsE;IACtE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;oEAEoE;AAEpE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,uEAAuE;IACvE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;sEAEkE;IAClE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;IAChE,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACtC,qCAAqC;IACrC,OAAO,EAAE,uBAAuB;IAChC,yBAAyB;IACzB,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC3C,uFAAuF;IACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC1C;;;;OAIG;IACH,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,uDAAuD;AAEvD;;;;;;;;GAQG;AAEH;;oEAEoE;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAgD;IAC9F,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,IAAI;IAC/C,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,YAAY;CAChE,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAA8C;IAC1F,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,IAAI;IAC7C,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,YAAY;CAC9D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAgD;IACrF,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IAC9D,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,2BAA2B;CAC/E,CAAC;AAEF;;oEAEoE;AAEpE;8FAC8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAA4C;IAC9E,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAO,CAAC,OAAO,EAAE,aAAa,CAAC;IAChE,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC;IAC/E,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAY,CAAC,OAAO,EAAE,aAAa,CAAC;IAChE,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAS,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC;IAC3E,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAW,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;IAC1F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAU,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;IAC1F,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAI,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;IAC1F,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAW,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAY,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;IAC1F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAU,CAAC,OAAO,EAAE,aAAa,CAAC;CACjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAA0B;IAClF,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAa,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,cAAc,GAClB,CAAC,WAAW,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9F,CAAC,WAAW,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvG,IAAI,cAAc,IAAI,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { z } from 'zod';\nimport { OnboardingTriggerSchema, OnboardingElementSchema, OnboardingElementType } from '../config/frontend/onboarding.shared.schemas';\nimport type { OnboardingElement } from '../config/frontend/onboarding.shared.schemas';\nimport { LifecycleScope, LifecycleStage } from './lifecycle-state.shared.schemas';\nimport { ProgressionScope } from './milestone-definition.shared.schemas';\nimport { RequiredFeaturesConfigSchema } from '../features/feature-definition.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance Flow — Render Modes\n * ────────────────────────────────────────────────────────────── */\n\n/**\n * @wildo_source:part:start saas.models.guidance-flow facet:layer:shared facet:family:guidance facet:audience:app-developer\n *\n * A guidance flow is triggered chrome — a banner, a modal, a tour, a survey — that appears over\n * whatever the person is looking at when an event fires, remembers whether they finished with it,\n * and does not come back. Declare flows as `GuidanceFlowDefinition[]` on a frontend module's\n * `guidanceFlows`. Import from `@wildo-ai/saas-models`.\n *\n * Only ONE `OVERLAY` flow is shown at a time: of the active ones, the lowest `priority` number is\n * shown. The others WAIT — each appears once the one in front of it is completed, skipped or\n * dismissed in the same session. A flow that never got shown is not saved as started, so a page\n * reload drops it until its trigger fires again.\n */\n\nexport enum GuidanceRenderMode {\n  /** Modal, banner, announcement — rendered on top of the current view */\n  OVERLAY = 'overlay',\n  /** Tooltip, spotlight — attached to DOM elements in the current view */\n  INLINE = 'inline',\n  /** Floating checklist panel — persistent sidebar/widget */\n  CHECKLIST = 'checklist',\n}\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance Flow — Scope\n * ────────────────────────────────────────────────────────────── */\n\n/** Which scope resource stores this flow's state */\nexport enum GuidanceFlowScope {\n  /** State stored in USER_GUIDANCE_STATE — personal flows (default) */\n  USER = 'user',\n  /** State stored in ORGANIZATION_GUIDANCE_STATE — org-wide flows (completion shared across members) */\n  ORGANIZATION = 'organization',\n}\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance Flow — Audience\n * ────────────────────────────────────────────────────────────── */\n\n/**\n * Audience targeting — who sees this flow.\n *\n * ## What it may read, and why that boundary is where it is\n *\n * Everything here is answered from state the GUIDANCE CONTEXT ALREADY HOLDS: the subject's roles,\n * their resolved features, the flow states it loaded, and the progression and\n * lifecycle documents it loads beside them. No criterion reads an arbitrary resource row, and that\n * is the deliberate line: eligibility is computed on the frontend, synchronously, every time the\n * eligible set is recomputed. A criterion needing a row nobody has loaded would turn that into a\n * fetch, and an eligibility question that can be SLOW or FAIL is a different mechanism.\n *\n * ## Scope\n *\n * The progression and lifecycle criteria read the scope the FLOW declares — a USER flow asks about\n * the user's own milestones and stage, an ORGANIZATION flow about the organization's. Anything else\n * would make an org-wide flow gate on whichever member happened to load it.\n *\n * ## ANY vs ALL, stated per field because the two readings are both defensible\n *\n * A field answering \"who are you\" is ANY-of (`roles`, the two lifecycle fields): one match is\n * enough. A field answering \"what must already be true\" is ALL-of (`requireIfCompleted`,\n * `requiredMilestones`, `requiredSurveyAnswers`): a prerequisite list with one unmet entry is unmet.\n * `excludeIfCompleted` is ANY-of because it is a veto — one reason to suppress is enough.\n */\nexport const GuidanceAudienceSchema = z.object({\n  /** Required user roles (any match = eligible). Empty/omitted = all roles. */\n  roles: z.array(z.string()).optional(),\n  /** Required features using the shared `RequiredFeaturesConfig` semantics. */\n  requiredFeatures: RequiredFeaturesConfigSchema.optional(),\n  /** Exclude users who have completed these flows (ANY match suppresses). */\n  excludeIfCompleted: z.array(z.string()).optional(),\n  /**\n   * Show only once ALL of these flows have been COMPLETED — the positive counterpart of\n   * `excludeIfCompleted`, and how a second flow follows a first.\n   *\n   * COMPLETED only. A flow that was dismissed or skipped has not met a prerequisite — the person\n   * declined it — and treating those as satisfaction would show a follow-up to exactly the people\n   * who opted out of its lead-in.\n   */\n  requireIfCompleted: z.array(z.string()).optional(),\n  /** Show only once ALL of these milestones are achieved, in the flow's own progression scope. */\n  requiredMilestones: z.array(z.string()).optional(),\n  /**\n   * Show only while the subject's CURRENT lifecycle stage is one of these.\n   *\n   * Distinct from `lifecycleStagesReached` on purpose, because the two answer opposite questions and\n   * confusing them is the likeliest authoring mistake here. This one is \"who are you NOW\" — it stops\n   * matching the moment the subject moves on, which is what a dormancy nudge wants and what an\n   * \"already activated\" tip does not.\n   */\n  currentLifecycleStages: z.array(z.enum(LifecycleStage)).optional(),\n  /**\n   * Show once the subject has EVER been in one of these stages.\n   *\n   * Reads `stagesVisited`, which exists precisely so this question survives the stage-history cap.\n   * This is what an onboarding tip usually wants: \"once they have activated\" stays true after they\n   * go on to ENGAGED, where `currentLifecycleStages: [ACTIVATED]` would silently stop matching.\n   */\n  lifecycleStagesReached: z.array(z.enum(LifecycleStage)).optional(),\n  /**\n   * Show only when ALL of these recorded survey answers match.\n   *\n   * The answer is read from the guidance state the context already holds, so it addresses a\n   * question by the flow, element and question that asked it. Equality only, against the scalar\n   * kinds an answer can be — the point is branching on what somebody said, not a query language.\n   */\n  requiredSurveyAnswers: z.array(z.object({\n    flowRef: z.string().min(1),\n    elementRef: z.string().min(1),\n    questionId: z.string().min(1),\n    equals: z.union([z.string(), z.number(), z.boolean()]),\n  })).optional(),\n  /** Only show to users created after this date (for new-user flows) */\n  createdAfter: z.coerce.date().optional(),\n});\nexport type GuidanceAudience = z.infer<typeof GuidanceAudienceSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance Flow — Definition\n * ────────────────────────────────────────────────────────────── */\n\n/** GuidanceFlowDefinition — declarative flow configuration */\nexport const GuidanceFlowDefinitionSchema = z.object({\n  /** Unique flow reference (e.g., 'welcome-tour', 'org-setup-wizard') */\n  ref: z.string().min(1),\n  /** State scope — determines which resource stores this flow's state.\n   *  USER (default): personal guidance, each user has their own state.\n   *  ORGANIZATION: org-wide guidance, shared across all members. */\n  scope: z.enum(GuidanceFlowScope).default(GuidanceFlowScope.USER),\n  /** Rendering mode */\n  renderMode: z.enum(GuidanceRenderMode),\n  /** When/how to activate this flow */\n  trigger: OnboardingTriggerSchema,\n  /** Audience targeting */\n  audience: GuidanceAudienceSchema.optional(),\n  /** Priority for ordering when multiple flows are eligible (lower = higher priority) */\n  priority: z.number().int().default(100),\n  /** Elements in this flow — reuses existing OnboardingElement discriminated union */\n  elements: z.array(OnboardingElementSchema),\n  /*\n   * There is no flow-level options block: dismissing, skipping and progress display are set on each\n   * ELEMENT (`dismissible` on banner / modal / announcement / card, `allowSkip` on tour and survey,\n   * `showProgress` on checklist), where the element's renderer reads them.\n   */\n  /** i18n: label configuration */\n  labels: z.object({\n    description: z.boolean().default(false),\n  }).optional(),\n});\nexport type GuidanceFlowDefinition = z.infer<typeof GuidanceFlowDefinitionSchema>;\n/** @wildo_source:part:end saas.models.guidance-flow */\n\n/*\n * Maintainer note — kept OUTSIDE the anchor above because it is history, not guidance an application\n * needs. A flow-level `options` block (`OnboardingViewOptionsSchema`) was REMOVED rather than wired\n * (#1368): the guidance renderer read none of it. Three of its six members were a second spelling of\n * a per-element control already enforced where it is read (`dismissible`, `allowSkip`,\n * `showProgress`), so wiring them would have created two places to say one thing plus a precedence\n * rule; `persistState: false` named a mode that does not exist; `className` is the theme's; and\n * `autoStart` is read at neither level. Do not reintroduce it without a renderer that reads it.\n */\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance — Scope to Resource Mapping\n * ────────────────────────────────────────────────────────────── */\n\n/**\n * The progression scope a flow of this scope asks about (#1373).\n *\n * Written as an explicit total map rather than a cast, even though the three scope enums currently\n * share their wire values. They are DISTINCT vocabularies — a guidance flow's storage scope, a\n * milestone's accrual scope and a subject's lifecycle scope — and collapsing them because the\n * strings line up today is what this repository's \"never merge semantically distinct concepts\n * merely because their wire values overlap\" rule exists to stop. Being total, a member added to\n * `GuidanceFlowScope` is a compile error here rather than a silent `undefined` lookup.\n */\nexport const GUIDANCE_SCOPE_TO_PROGRESSION_SCOPE: Record<GuidanceFlowScope, ProgressionScope> = {\n  [GuidanceFlowScope.USER]: ProgressionScope.USER,\n  [GuidanceFlowScope.ORGANIZATION]: ProgressionScope.ORGANIZATION,\n};\n\n/** The lifecycle scope a flow of this scope asks about. Total, for the reason above. */\nexport const GUIDANCE_SCOPE_TO_LIFECYCLE_SCOPE: Record<GuidanceFlowScope, LifecycleScope> = {\n  [GuidanceFlowScope.USER]: LifecycleScope.USER,\n  [GuidanceFlowScope.ORGANIZATION]: LifecycleScope.ORGANIZATION,\n};\n\n/** Maps GuidanceFlowScope to the CoreResourceType that stores its state */\nexport const GUIDANCE_SCOPE_TO_RESOURCE: Record<GuidanceFlowScope, CoreResourceType> = {\n  [GuidanceFlowScope.USER]: CoreResourceType.USER_GUIDANCE_STATE,\n  [GuidanceFlowScope.ORGANIZATION]: CoreResourceType.ORGANIZATION_GUIDANCE_STATE,\n};\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance — Per-Element-Type i18n Field Map\n * ────────────────────────────────────────────────────────────── */\n\n/** Controls which i18n keys are generated per element type.\n *  Follows the ERROR_GUIDANCE_REFS pattern — avoids wasteful cartesian product generation. */\nexport const GUIDANCE_ELEMENT_FIELDS: Record<OnboardingElementType, string[]> = {\n  [OnboardingElementType.CHECKLIST]:      ['title', 'description'],\n  [OnboardingElementType.CHECKLIST_ITEM]: ['title', 'description', 'actionLabel'],\n  [OnboardingElementType.TOUR]:           ['title', 'description'],\n  [OnboardingElementType.TOOLTIP]:        ['title', 'description', 'content'],\n  [OnboardingElementType.MODAL]:          ['title', 'description', 'content', 'actionLabel'],\n  [OnboardingElementType.BANNER]:         ['title', 'description', 'content', 'actionLabel'],\n  [OnboardingElementType.ANNOUNCEMENT]:   ['title', 'description', 'content', 'actionLabel'],\n  [OnboardingElementType.BADGE]:          ['title', 'content'],\n  [OnboardingElementType.CARD]:           ['title', 'description', 'content', 'actionLabel'],\n  [OnboardingElementType.SURVEY]:         ['title', 'description'],\n};\n\n/**\n * The label fields an element CANNOT be presented without — the subset of\n * {@link GUIDANCE_ELEMENT_FIELDS} whose absence means the element's copy does not\n * exist yet, rather than that its author chose to omit an optional slot.\n *\n * - **`title`, for every element type.** The labelling pipeline generates EVERY\n *   field `GUIDANCE_ELEMENT_FIELDS` lists, so a missing title is never an\n *   authoring choice: it means copy has not been generated for this element at all.\n * - **`actionLabel`, only when the element declares an ACTION** (`actionRef`, or a\n *   modal's `ctaAction`) and its type lists the field. A banner offering\n *   navigation with no label renders no button, so the action the flow exists to\n *   offer silently disappears (#539).\n *\n * `description` and `content` stay optional: an element with no body is legitimate.\n *\n * Two consumers act on the answer, and neither may re-derive it:\n * - the element translator renders the raw KEY for a required field, so a missing\n *   label LOOKS missing (`.claude/rules/display-text-comes-from-i18n.md`) instead of\n *   collapsing to an invisible card;\n * - the guidance renderer records a flow as PRESENTED — which is what spends its\n *   once-per-user occasion — only when every required label of every element\n *   resolves.\n *\n * Derived from the element's own type and declared action rather than listed per\n * type, so a new element type is covered the day it joins `GUIDANCE_ELEMENT_FIELDS`.\n */\nexport function resolveGuidanceElementRequiredLabelFields(element: OnboardingElement): string[] {\n  const declaredFields = GUIDANCE_ELEMENT_FIELDS[element.type] ?? [];\n  const required: string[] = declaredFields.includes('title') ? ['title'] : [];\n  const declaresAction =\n    ('actionRef' in element && typeof element.actionRef === 'string' && element.actionRef.length > 0)\n    || ('ctaAction' in element && typeof element.ctaAction === 'string' && element.ctaAction.length > 0);\n  if (declaresAction && declaredFields.includes('actionLabel')) {\n    required.push('actionLabel');\n  }\n  return required;\n}\n"]}
+{"version":3,"file":"guidance-flow.shared.schemas.js","sourceRoot":"","sources":["../../../src/guidance/guidance-flow.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAEvI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAElF;;oEAEoE;AAEpE;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,wEAAwE;IACxE,yCAAmB,CAAA;IACnB,wEAAwE;IACxE,uCAAiB,CAAA;IACjB,2DAA2D;IAC3D,6CAAuB,CAAA;AACzB,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED;;oEAEoE;AAEpE,oDAAoD;AACpD,MAAM,CAAN,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAC3B,qEAAqE;IACrE,kCAAa,CAAA;IACb,sGAAsG;IACtG,kDAA6B,CAAA;AAC/B,CAAC,EALW,iBAAiB,KAAjB,iBAAiB,QAK5B;AAED;;oEAEoE;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,6EAA6E;IAC7E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,6EAA6E;IAC7E,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IACzD,2EAA2E;IAC3E,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD;;;;;;;OAOG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,gGAAgG;IAChG,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE;;;;;;OAMG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACvD,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd,sEAAsE;IACtE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;oEAEoE;AAEpE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,uEAAuE;IACvE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;sEAEkE;IAClE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;IAChE,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACtC,qCAAqC;IACrC,OAAO,EAAE,uBAAuB;IAChC,yBAAyB;IACzB,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC3C,uFAAuF;IACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC1C;;;;OAIG;IACH,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,uDAAuD;AAEvD;;;;;;;;GAQG;AAEH;;oEAEoE;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAgD;IAC9F,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,IAAI;IAC/C,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,YAAY;CAChE,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAA8C;IAC1F,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,IAAI;IAC7C,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,YAAY;CAC9D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAgD;IACrF,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IAC9D,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,2BAA2B;CAC/E,CAAC;AAEF;;oEAEoE;AAEpE;8FAC8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAA4C;IAC9E,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAO,CAAC,OAAO,EAAE,aAAa,CAAC;IAChE,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC;IAC/E,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAY,CAAC,OAAO,EAAE,aAAa,CAAC;IAChE,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAS,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC;IAC3E,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAW,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;IAC1F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAU,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;IAC1F,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAI,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;IAC1F,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAW,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAY,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;IAC1F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAU,CAAC,OAAO,EAAE,aAAa,CAAC;CACjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAA0B;IAClF,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAa,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,cAAc,GAClB,CAAC,WAAW,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9F,CAAC,WAAW,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvG,IAAI,cAAc,IAAI,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { z } from 'zod';\nimport { OnboardingTriggerSchema, OnboardingElementSchema, OnboardingElementType } from '../config/frontend/onboarding.shared.schemas';\nimport type { OnboardingElement } from '../config/frontend/onboarding.shared.schemas';\nimport { LifecycleScope, LifecycleStage } from './lifecycle-state.shared.schemas';\nimport { ProgressionScope } from './milestone-definition.shared.schemas';\nimport { RequiredFeaturesConfigSchema } from '../features/feature-definition.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance Flow — Render Modes\n * ────────────────────────────────────────────────────────────── */\n\n/**\n * @wildo_source:part:start saas.models.guidance-flow facet:layer:shared facet:family:guidance facet:audience:app-developer\n *\n * A guidance flow is triggered chrome — a banner, a modal, a tour, a survey — that appears over\n * whatever the person is looking at when an event fires, remembers whether they finished with it,\n * and does not come back. Declare flows as `GuidanceFlowDefinition[]` on a frontend module's\n * `guidanceFlows`. Import from `@wildo-ai/saas-models`.\n *\n * Only ONE `OVERLAY` flow is shown at a time: of the active ones, the lowest `priority` number is\n * shown. The others WAIT — each appears once the one in front of it is completed, skipped or\n * dismissed in the same session. A flow that never got shown is not saved as started, so a page\n * reload drops it until its trigger fires again.\n */\n\nexport enum GuidanceRenderMode {\n  /** Modal, banner, announcement — rendered on top of the current view */\n  OVERLAY = 'overlay',\n  /** Tooltip, spotlight — attached to DOM elements in the current view */\n  INLINE = 'inline',\n  /** Floating checklist panel — persistent sidebar/widget */\n  CHECKLIST = 'checklist',\n}\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance Flow — Scope\n * ────────────────────────────────────────────────────────────── */\n\n/** Which scope resource stores this flow's state */\nexport enum GuidanceFlowScope {\n  /** State stored in USER_GUIDANCE_STATE — personal flows (default) */\n  USER = 'user',\n  /** State stored in ORGANIZATION_GUIDANCE_STATE — org-wide flows (completion shared across members) */\n  ORGANIZATION = 'organization',\n}\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance Flow — Audience\n * ────────────────────────────────────────────────────────────── */\n\n/**\n * Audience targeting — who sees this flow.\n *\n * ## What it may read, and why that boundary is where it is\n *\n * Everything here is answered from state the GUIDANCE CONTEXT ALREADY HOLDS: the subject's roles,\n * their resolved features, the flow states it loaded, and the progression and\n * lifecycle documents it loads beside them. No criterion reads an arbitrary resource row, and that\n * is the deliberate line: eligibility is computed on the frontend, synchronously, every time the\n * eligible set is recomputed. A criterion needing a row nobody has loaded would turn that into a\n * fetch, and an eligibility question that can be SLOW or FAIL is a different mechanism.\n *\n * ## Scope\n *\n * The progression and lifecycle criteria read the scope the FLOW declares — a USER flow asks about\n * the user's own milestones and stage, an ORGANIZATION flow about the organization's. Anything else\n * would make an org-wide flow gate on whichever member happened to load it.\n *\n * ## ANY vs ALL, stated per field because the two readings are both defensible\n *\n * A field answering \"who are you\" is ANY-of (`roles`, the two lifecycle fields): one match is\n * enough. A field answering \"what must already be true\" is ALL-of (`requireIfCompleted`,\n * `requiredMilestones`, `requiredSurveyAnswers`): a prerequisite list with one unmet entry is unmet.\n * `excludeIfCompleted` is ANY-of because it is a veto — one reason to suppress is enough.\n */\nexport const GuidanceAudienceSchema = z.object({\n  /** Required user roles (any match = eligible). Empty/omitted = all roles. */\n  roles: z.array(z.string()).optional(),\n  /** Required features using the shared `RequiredFeaturesConfig` semantics. */\n  requiredFeatures: RequiredFeaturesConfigSchema.optional(),\n  /** Exclude users who have completed these flows (ANY match suppresses). */\n  excludeIfCompleted: z.array(z.string()).optional(),\n  /**\n   * Show only once ALL of these flows have been COMPLETED — the positive counterpart of\n   * `excludeIfCompleted`, and how a second flow follows a first.\n   *\n   * COMPLETED only. A flow that was dismissed or skipped has not met a prerequisite — the person\n   * declined it — and treating those as satisfaction would show a follow-up to exactly the people\n   * who opted out of its lead-in.\n   */\n  requireIfCompleted: z.array(z.string()).optional(),\n  /** Show only once ALL of these milestones are achieved, in the flow's own progression scope. */\n  requiredMilestones: z.array(z.string()).optional(),\n  /**\n   * Show only while the subject's CURRENT lifecycle stage is one of these.\n   *\n   * Distinct from `lifecycleStagesReached` on purpose, because the two answer opposite questions and\n   * confusing them is the likeliest authoring mistake here. This one is \"who are you NOW\" — it stops\n   * matching the moment the subject moves on, which is what a dormancy nudge wants and what an\n   * \"already activated\" tip does not.\n   */\n  currentLifecycleStages: z.array(z.enum(LifecycleStage)).optional(),\n  /**\n   * Show once the subject has EVER been in one of these stages.\n   *\n   * Reads `stagesVisited`, which exists precisely so this question survives the stage-history cap.\n   * This is what an onboarding tip usually wants: \"once they have activated\" stays true after they\n   * go on to ENGAGED, where `currentLifecycleStages: [ACTIVATED]` would silently stop matching.\n   */\n  lifecycleStagesReached: z.array(z.enum(LifecycleStage)).optional(),\n  /**\n   * Show only when ALL of these recorded survey answers match.\n   *\n   * The answer is read from the guidance state the context already holds, so it addresses a\n   * question by the flow, element and question that asked it. Equality only, against the scalar\n   * kinds an answer can be — the point is branching on what somebody said, not a query language.\n   */\n  requiredSurveyAnswers: z.array(z.object({\n    flowRef: z.string().min(1),\n    elementRef: z.string().min(1),\n    questionId: z.string().min(1),\n    equals: z.union([z.string(), z.number(), z.boolean()]),\n  })).optional(),\n  /** Only show to users created after this date (for new-user flows) */\n  createdAfter: z.coerce.date().optional(),\n});\nexport type GuidanceAudience = z.infer<typeof GuidanceAudienceSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance Flow — Definition\n * ────────────────────────────────────────────────────────────── */\n\n/** GuidanceFlowDefinition — declarative flow configuration */\nexport const GuidanceFlowDefinitionSchema = z.object({\n  /** Unique flow reference (e.g., 'welcome-tour', 'org-setup-wizard') */\n  ref: z.string().min(1),\n  /** State scope — determines which resource stores this flow's state.\n   *  USER (default): personal guidance, each user has their own state.\n   *  ORGANIZATION: org-wide guidance, shared across all members. */\n  scope: z.enum(GuidanceFlowScope).default(GuidanceFlowScope.USER),\n  /** Rendering mode */\n  renderMode: z.enum(GuidanceRenderMode),\n  /** When/how to activate this flow */\n  trigger: OnboardingTriggerSchema,\n  /** Audience targeting */\n  audience: GuidanceAudienceSchema.optional(),\n  /** Priority for ordering when multiple flows are eligible (lower = higher priority) */\n  priority: z.number().int().default(100),\n  /** Elements in this flow — reuses existing OnboardingElement discriminated union */\n  elements: z.array(OnboardingElementSchema),\n  /*\n   * There is no flow-level options block: dismissing, skipping and progress display are set on each\n   * ELEMENT (`dismissible` on banner / modal / announcement / card, `allowSkip` on tour and survey,\n   * `showProgress` on checklist), where the element's renderer reads them.\n   */\n  /** i18n: label configuration */\n  labels: z.object({\n    description: z.boolean().default(false),\n  }).optional(),\n});\nexport type GuidanceFlowDefinition = z.infer<typeof GuidanceFlowDefinitionSchema>;\n/** @wildo_source:part:end saas.models.guidance-flow */\n\n/*\n * Maintainer note — kept OUTSIDE the anchor above because it is history, not guidance an application\n * needs. A flow-level `options` block (`OnboardingViewOptionsSchema`) was REMOVED rather than wired\n * (#1368): the guidance renderer read none of it. Three of its six members were a second spelling of\n * a per-element control already enforced where it is read (`dismissible`, `allowSkip`,\n * `showProgress`), so wiring them would have created two places to say one thing plus a precedence\n * rule; `persistState: false` named a mode that does not exist; `className` is the theme's; and\n * `autoStart` is read at neither level. Do not reintroduce it without a renderer that reads it.\n */\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance — Scope to Resource Mapping\n * ────────────────────────────────────────────────────────────── */\n\n/**\n * The progression scope a flow of this scope asks about (#1373).\n *\n * Written as an explicit total map rather than a cast, even though the three scope enums currently\n * share their wire values. They are DISTINCT vocabularies — a guidance flow's storage scope, a\n * milestone's accrual scope and a subject's lifecycle scope — and collapsing them because the\n * strings line up today is what this repository's \"never merge semantically distinct concepts\n * merely because their wire values overlap\" rule exists to stop. Being total, a member added to\n * `GuidanceFlowScope` is a compile error here rather than a silent `undefined` lookup.\n */\nexport const GUIDANCE_SCOPE_TO_PROGRESSION_SCOPE: Record<GuidanceFlowScope, ProgressionScope> = {\n  [GuidanceFlowScope.USER]: ProgressionScope.USER,\n  [GuidanceFlowScope.ORGANIZATION]: ProgressionScope.ORGANIZATION,\n};\n\n/** The lifecycle scope a flow of this scope asks about. Total, for the reason above. */\nexport const GUIDANCE_SCOPE_TO_LIFECYCLE_SCOPE: Record<GuidanceFlowScope, LifecycleScope> = {\n  [GuidanceFlowScope.USER]: LifecycleScope.USER,\n  [GuidanceFlowScope.ORGANIZATION]: LifecycleScope.ORGANIZATION,\n};\n\n/** Maps GuidanceFlowScope to the CoreResourceType that stores its state */\nexport const GUIDANCE_SCOPE_TO_RESOURCE: Record<GuidanceFlowScope, CoreResourceType> = {\n  [GuidanceFlowScope.USER]: CoreResourceType.USER_GUIDANCE_STATE,\n  [GuidanceFlowScope.ORGANIZATION]: CoreResourceType.ORGANIZATION_GUIDANCE_STATE,\n};\n\n/** ──────────────────────────────────────────────────────────────\n * Guidance — Per-Element-Type i18n Field Map\n * ────────────────────────────────────────────────────────────── */\n\n/** Controls which i18n keys are generated per element type.\n *  Follows the ERROR_GUIDANCE_REFS pattern — avoids wasteful cartesian product generation. */\nexport const GUIDANCE_ELEMENT_FIELDS: Record<OnboardingElementType, string[]> = {\n  [OnboardingElementType.CHECKLIST]:      ['title', 'description'],\n  [OnboardingElementType.CHECKLIST_ITEM]: ['title', 'description', 'actionLabel'],\n  [OnboardingElementType.TOUR]:           ['title', 'description'],\n  [OnboardingElementType.TOOLTIP]:        ['title', 'description', 'content'],\n  [OnboardingElementType.MODAL]:          ['title', 'description', 'content', 'actionLabel'],\n  [OnboardingElementType.BANNER]:         ['title', 'description', 'content', 'actionLabel'],\n  [OnboardingElementType.ANNOUNCEMENT]:   ['title', 'description', 'content', 'actionLabel'],\n  [OnboardingElementType.BADGE]:          ['title', 'content'],\n  [OnboardingElementType.CARD]:           ['title', 'description', 'content', 'actionLabel'],\n  [OnboardingElementType.SURVEY]:         ['title', 'description'],\n};\n\n/**\n * The label fields an element CANNOT be presented without — the subset of\n * {@link GUIDANCE_ELEMENT_FIELDS} whose absence means the element's copy does not\n * exist yet, rather than that its author chose to omit an optional slot.\n *\n * - **`title`, for every element type.** The labelling pipeline generates EVERY\n *   field `GUIDANCE_ELEMENT_FIELDS` lists, so a missing title is never an\n *   authoring choice: it means copy has not been generated for this element at all.\n * - **`actionLabel`, only when the element declares an ACTION** (`actionRef`, or a\n *   modal's `ctaAction`) and its type lists the field. A banner offering\n *   navigation with no label renders no button, so the action the flow exists to\n *   offer silently disappears (#539).\n *\n * `description` and `content` stay optional: an element with no body is legitimate.\n *\n * Two consumers act on the answer, and neither may re-derive it:\n * - the element translator renders the raw KEY for a required field, so a missing\n *   label LOOKS missing (`.claude/rules/display-text-comes-from-i18n.md`) instead of\n *   collapsing to an invisible card;\n * - the guidance renderer records a flow as PRESENTED — which is what spends its\n *   once-per-user occasion — only when every required label of every element\n *   resolves.\n *\n * Derived from the element's own type and declared action rather than listed per\n * type, so a new element type is covered the day it joins `GUIDANCE_ELEMENT_FIELDS`.\n */\nexport function resolveGuidanceElementRequiredLabelFields(element: OnboardingElement): string[] {\n  const declaredFields = GUIDANCE_ELEMENT_FIELDS[element.type] ?? [];\n  const required: string[] = declaredFields.includes('title') ? ['title'] : [];\n  const declaresAction =\n    ('actionRef' in element && typeof element.actionRef === 'string' && element.actionRef.length > 0)\n    || ('ctaAction' in element && typeof element.ctaAction === 'string' && element.ctaAction.length > 0);\n  if (declaresAction && declaredFields.includes('actionLabel')) {\n    required.push('actionLabel');\n  }\n  return required;\n}\n"]}

package/dist/esm/guidance/guidance-state.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guidance-state.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/guidance/guidance-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAWzG,KAAK,+BAA+B,GAChC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,4DAA4D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;iCAyKzH,CAAC;AAIH,KAAK,uCAAuC,GACxC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,oEAAoE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;iCAiGjI,CAAC"}
+{"version":3,"file":"guidance-state.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/guidance/guidance-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAWzG,KAAK,+BAA+B,GAChC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,4DAA4D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;iCAyKzH,CAAC;AAIH,KAAK,uCAAuC,GACxC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,oEAAoE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;iCAiGjI,CAAC"}

package/dist/esm/guidance/guidance-state.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"guidance-state.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/guidance/guidance-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAcvH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIxK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;IACxD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;IACjG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAC7F,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,kEAAkE;QAClE,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;QAC5B,oFAAoF;QACpF,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAE5B,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAE1C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,UAAU,EAAE,mBAAmB;iBAChC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,mEAAmE;QACnE,4EAA4E;QAC5E,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC;AAWH,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIhL;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,gBAAgB,CAAC,2BAA2B;IAChE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;IACzG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,kEAAkE;QAClE,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,UAAU,EAAE,mBAAmB;iBAChC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,iEAAiE;QACjE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Guidance State Shared Resource Configurations\n *\n * Resource configurations for dual-scope guidance state management (USER / ORGANIZATION).\n * Each scope stores flow-level and element-level guidance progress.\n * The shared payload schema stays scope-agnostic, while the schema file also owns\n * the scope-aware persisted variants used by these resource configurations.\n */\n\nimport {\n  GuidanceStateSchema,\n  UserGuidanceStateSchema,\n  OrganizationGuidanceStateSchema,\n} from './guidance-state.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ─── USER GUIDANCE STATE ─────────────────────────────────────────────────────\n\ntype UserGuidanceStateCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const userGuidanceStateResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  UserGuidanceStateCoreOperations,\n  typeof UserGuidanceStateSchema\n>({\n  mainSchema: UserGuidanceStateSchema,\n  resourceIdentifier: CoreResourceType.USER_GUIDANCE_STATE,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_GUIDANCE_STATE],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n  /**\n   * Subject erasure RETAINS this row and RESETS the per-flow guidance progress map to the schema's own defaults.\n   *\n   * The USAGE categories on this resource are accurate — these are observations the product made about a\n   * named person — so `RETAIN_ONLY` would be a false assertion and the factory refuses it. Until\n   * `RedactionType.RESET` existed no treatment could reach these fields at all: they are non-nullable WITH\n   * a `.default()`, so REMOVE (needs clearable) and MASK (needs a string) both refuse. RESET returns each\n   * to what it is when nobody has set it, which for a behavioural record is exactly what erasure should\n   * leave behind.\n   *\n   * The primary scope FK is preserved — severing it is refused outright, because it would leave the\n   * retained row with no tenant anchor, unreachable even to the audited see-through read.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Erasing one of these rows revokes NO session. The row is state ABOUT a person rather than the person,\n *  and its primary scope FK anchors it — the enum prescribes `NO_PRINCIPAL` for that shape. The subject's\n *  own session ends through the `USERS` row.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the self-healing state row is physically removed\n    // when its owning scope is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any scope that has a materialized row.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY (READ is above).\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n\n    /*\n\n     * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY:\n\n     * the retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n     * INTERNAL_CALL / API_CALL. UPDATE_MANY is the verb the impersonalize writer uses.\n\n     */\n\n    [CoreResourceOperation.LIST]: {\n\n      variants: [{\n\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n        isDefault: true,\n\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n        riskLevel: ResourceOperationRiskLevel.LOW,\n\n      }],\n\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n\n      variants: [{\n\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n        isDefault: true,\n\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n        riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n      }],\n\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          requestDto: GuidanceStateSchema.partial(),\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          requestDto: GuidanceStateSchema,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_USER],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this self-healing state row is physically removed\n    // when its owning user is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any user that\n    // has a materialized row — these rows self-heal on first READ, so most active\n    // users have one. Super-admin/HIGH: a privileged teardown, not the APP_USER\n    // self-write. See composition-oncreate-lifecycle plan (systemic DELETE gap).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n  },\n});\n\n// ─── ORGANIZATION GUIDANCE STATE ─────────────────────────────────────────────\n\ntype OrganizationGuidanceStateCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\nexport const organizationGuidanceStateResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  OrganizationGuidanceStateCoreOperations,\n  typeof OrganizationGuidanceStateSchema\n>({\n  mainSchema: OrganizationGuidanceStateSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_GUIDANCE_STATE,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_GUIDANCE_STATE],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the self-healing state row is physically removed\n    // when its owning scope is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any scope that has a materialized row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          requestDto: GuidanceStateSchema.partial(),\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          requestDto: GuidanceStateSchema,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_ORG_ROLES.ORG_MEMBER],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this self-healing state row is physically removed\n    // when its owning organization is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any org that has\n    // a materialized row — these rows self-heal on first READ, so most active orgs\n    // have one. ORG_ADMIN/HIGH: the org-scope admin tier for a privileged teardown.\n    // See composition-oncreate-lifecycle plan (systemic DELETE gap).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"guidance-state.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/guidance/guidance-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAcvH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIxK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;IACxD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;IACjG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAC7F,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,kEAAkE;QAClE,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;QAC5B,oFAAoF;QACpF,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAE5B,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAE1C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,UAAU,EAAE,mBAAmB;iBAChC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,mEAAmE;QACnE,4EAA4E;QAC5E,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC;AAWH,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIhL;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,gBAAgB,CAAC,2BAA2B;IAChE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;IACzG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,kEAAkE;QAClE,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,UAAU,EAAE,mBAAmB;iBAChC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,iEAAiE;QACjE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Guidance State Shared Resource Configurations\n *\n * Resource configurations for dual-scope guidance state management (USER / ORGANIZATION).\n * Each scope stores flow-level and element-level guidance progress.\n * The shared payload schema stays scope-agnostic, while the schema file also owns\n * the scope-aware persisted variants used by these resource configurations.\n */\n\nimport {\n  GuidanceStateSchema,\n  UserGuidanceStateSchema,\n  OrganizationGuidanceStateSchema,\n} from './guidance-state.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ─── USER GUIDANCE STATE ─────────────────────────────────────────────────────\n\ntype UserGuidanceStateCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const userGuidanceStateResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  UserGuidanceStateCoreOperations,\n  typeof UserGuidanceStateSchema\n>({\n  mainSchema: UserGuidanceStateSchema,\n  resourceIdentifier: CoreResourceType.USER_GUIDANCE_STATE,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_GUIDANCE_STATE],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n  /**\n   * Subject erasure RETAINS this row and RESETS the per-flow guidance progress map to the schema's own defaults.\n   *\n   * The USAGE categories on this resource are accurate — these are observations the product made about a\n   * named person — so `RETAIN_ONLY` would be a false assertion and the factory refuses it. Until\n   * `RedactionType.RESET` existed no treatment could reach these fields at all: they are non-nullable WITH\n   * a `.default()`, so REMOVE (needs clearable) and MASK (needs a string) both refuse. RESET returns each\n   * to what it is when nobody has set it, which for a behavioural record is exactly what erasure should\n   * leave behind.\n   *\n   * The primary scope FK is preserved — severing it is refused outright, because it would leave the\n   * retained row with no tenant anchor, unreachable even to the audited see-through read.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Erasing one of these rows revokes NO session. The row is state ABOUT a person rather than the person,\n *  and its primary scope FK anchors it — the enum prescribes `NO_PRINCIPAL` for that shape. The subject's\n *  own session ends through the `USERS` row.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the self-healing state row is physically removed\n    // when its owning scope is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any scope that has a materialized row.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY (READ is above).\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n\n    /*\n\n     * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY:\n\n     * the retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n     * INTERNAL_CALL / API_CALL. UPDATE_MANY is the verb the impersonalize writer uses.\n\n     */\n\n    [CoreResourceOperation.LIST]: {\n\n      variants: [{\n\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n        isDefault: true,\n\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n        riskLevel: ResourceOperationRiskLevel.LOW,\n\n      }],\n\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n\n      variants: [{\n\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n        isDefault: true,\n\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n        riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n      }],\n\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          requestDto: GuidanceStateSchema.partial(),\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          requestDto: GuidanceStateSchema,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_USER],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this self-healing state row is physically removed\n    // when its owning user is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any user that\n    // has a materialized row — these rows self-heal on first READ, so most active\n    // users have one. Super-admin/HIGH: a privileged teardown, not the APP_USER\n    // self-write. See composition-oncreate-lifecycle plan (systemic DELETE gap).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n  },\n});\n\n// ─── ORGANIZATION GUIDANCE STATE ─────────────────────────────────────────────\n\ntype OrganizationGuidanceStateCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\nexport const organizationGuidanceStateResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  OrganizationGuidanceStateCoreOperations,\n  typeof OrganizationGuidanceStateSchema\n>({\n  mainSchema: OrganizationGuidanceStateSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_GUIDANCE_STATE,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_GUIDANCE_STATE],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the self-healing state row is physically removed\n    // when its owning scope is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any scope that has a materialized row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          requestDto: GuidanceStateSchema.partial(),\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          requestDto: GuidanceStateSchema,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_ORG_ROLES.ORG_MEMBER],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this self-healing state row is physically removed\n    // when its owning organization is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any org that has\n    // a materialized row — these rows self-heal on first READ, so most active orgs\n    // have one. ORG_ADMIN/HIGH: the org-scope admin tier for a privileged teardown.\n    // See composition-oncreate-lifecycle plan (systemic DELETE gap).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/guidance/guidance-state.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guidance-state.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/guidance/guidance-state.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAIhF;;oEAEoE;AAEpE,mCAAmC;AACnC,eAAO,MAAM,0BAA0B;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;oEAEoE;AAEpE,qBAAqB;AACrB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBASlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;oEAEoE;AAEpE;;wDAEwD;AACxD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAa9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;iBAElC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAE1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"guidance-state.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/guidance/guidance-state.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAIhF;;oEAEoE;AAEpE,mCAAmC;AACnC,eAAO,MAAM,0BAA0B;;;;;iBAUrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;oEAEoE;AAEpE,qBAAqB;AACrB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBASlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;oEAEoE;AAEpE;;wDAEwD;AACxD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAa9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;iBAElC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAE1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,yBAAyB,CAAC"}