@wildo-ai/saas-models 1.1.6 → 1.1.7

package/dist/esm/files/file-upload-grant.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-upload-grant.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/files/file-upload-grant.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC;AACpD,eAAO,MAAM,sCAAsC,KAAK,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uEAAwE,CAAC;AAClH,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AACrF,uHAAuH;AACvH,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,OAAO,CAAC;KAAG,CAAC,IAAI,wBAAwB,GAAG,CAAC;CAAE,CAAwC,CAAC;AAEtI;;;GAGG;AACH,oBAAY,oBAAoB;IAC9B,kFAAkF;IAClF,OAAO,YAAY;IACnB,mGAAmG;IACnG,QAAQ,aAAa;IACrB,+DAA+D;IAC/D,OAAO,YAAY;IACnB,mEAAmE;IACnE,OAAO,YAAY;CACpB;AACD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,SAAS,CAAC;IACtD,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;SAAG,CAAC,IAAI,wBAAwB,GAAG,CAAC;KAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,sBAAsB,CAAC,CAAC;QAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAA;KAAE,CAAC,CAAC;IAC/F,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,cAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAC5C,CAsCC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAClB,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;aAAG,CAAC,IAAI,wBAAwB,GAAG,CAAC;SAAE,CAAC,CAAC;QAC7D,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KACxC,CAAC,CAAC;IACH,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;QACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;QACtB,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KAC3C,CAAC,CAAC;IACH,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;QAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAA;KAAE,CAAC,CAAC;IACrE,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC;IAC3B,uBAAuB,EAAE,CAAC,CAAC,SAAS,CAAC;IACrC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;CACnB,CA4BC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAClB,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;aAAG,CAAC,IAAI,wBAAwB,GAAG,CAAC;SAAE,CAAC,CAAC;QAC7D,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KACxC,CAAC,CAAC;IACH,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;QAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/F,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,gBAAgB,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,UAAU,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;CACjG,CAgBC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzD,gBAAgB,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAClC,CAQU,CAAC;AACZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,2DAA2D"}
+{"version":3,"file":"file-upload-grant.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/files/file-upload-grant.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC;AACpD,eAAO,MAAM,sCAAsC,KAAK,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uEAAwE,CAAC;AAClH,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AACrF,uHAAuH;AACvH,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,OAAO,CAAC;KAAG,CAAC,IAAI,wBAAwB,GAAG,CAAC;CAAE,CAAwC,CAAC;AAEtI;;;GAGG;AACH,oBAAY,oBAAoB;IAC9B,kFAAkF;IAClF,OAAO,YAAY;IACnB,mGAAmG;IACnG,QAAQ,aAAa;IACrB,+DAA+D;IAC/D,OAAO,YAAY;IACnB,mEAAmE;IACnE,OAAO,YAAY;CACpB;AACD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,SAAS,CAAC;IACtD,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;SAAG,CAAC,IAAI,wBAAwB,GAAG,CAAC;KAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,sBAAsB,CAAC,CAAC;QAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAA;KAAE,CAAC,CAAC;IAC/F,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,cAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAC5C,CAsCC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAClB,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;aAAG,CAAC,IAAI,wBAAwB,GAAG,CAAC;SAAE,CAAC,CAAC;QAC7D,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KACxC,CAAC,CAAC;IACH,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;QACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;QACtB,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KAC3C,CAAC,CAAC;IACH,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;QAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAA;KAAE,CAAC,CAAC;IACrE,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC;IAC3B,uBAAuB,EAAE,CAAC,CAAC,SAAS,CAAC;IACrC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;CACnB,CA4BC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAClB,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;aAAG,CAAC,IAAI,wBAAwB,GAAG,CAAC;SAAE,CAAC,CAAC;QAC7D,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KACxC,CAAC,CAAC;IACH,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;QAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/F,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,gBAAgB,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,UAAU,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;CACjG,CAgBC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzD,gBAAgB,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAClC,CAQU,CAAC;AACZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,2DAA2D"}

package/dist/esm/files/file-upload-grant.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-upload-grant.shared.schemas.js","sourceRoot":"","sources":["../../../../src/files/file-upload-grant.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AACpD,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAU,CAAC;AAElH,uHAAuH;AACvH,MAAM,CAAC,MAAM,8BAA8B,GAAsD,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;AAEtI;;;GAGG;AACH,MAAM,CAAN,IAAY,oBASX;AATD,WAAY,oBAAoB;IAC9B,kFAAkF;IAClF,2CAAmB,CAAA;IACnB,mGAAmG;IACnG,6CAAqB,CAAA;IACrB,+DAA+D;IAC/D,2CAAmB,CAAA;IACnB,mEAAmE;IACnE,2CAAmB,CAAA;AACrB,CAAC,EATW,oBAAoB,KAApB,oBAAoB,QAS/B;AACD,MAAM,CAAC,MAAM,0BAA0B,GAA2C,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAE/G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAMrC,CAAC,CAAC,MAAM,CAAC;IACZ,wFAAwF;IACxF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,8BAA8B;IACzC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,gEAAgE;IAChE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAsB7B,CAAC,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,SAAS,EAAE,8BAA8B;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;IACF,+GAA+G;IAC/G,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACrC,0CAA0C;QAC1C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,6GAA6G;IAC7G,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,6FAA6F;IAC7F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,qHAAqH;IACrH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6GAA6G;IAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAcnC,CAAC,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,SAAS,EAAE,8BAA8B;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IACvG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,iFAAiF;IACjF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,2GAA2G;IAC3G,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAKxC,CAAC,CAAC,MAAM,CAAC;IACZ,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE;IAChG,8GAA8G;IAC9G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,8EAA8E;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,2DAA2D","sourcesContent":["import { z } from 'zod';\nimport { FileUploaderEntityType } from '@wildo-ai/zod-decorators';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { FileStatus } from './files.shared.schemas';\n\n/**\n * File upload grant — the shared contract between the two mint doors (REST, MCP), the upload route,\n * the status read, and the browser drop page (issue #312).\n *\n * A grant is a single-use consumable token. Nothing durable is created at mint but the token: an\n * abandoned grant leaves a dead token and nothing else. The upload itself goes through the resource's\n * EXISTING file-upload route, authenticated by the grant alone, and the ordinary authorizer decides.\n */\n\n/**\n * Public frontend route the browser drop page lives on; the token follows as the next path segment\n * (`/upload-grant/<token>`). Declared HERE so the backend (which builds `uploadPageUrl`) and the\n * frontend (which mounts the route) read one source — the backend cannot import frontend route\n * constants.\n */\nexport const FILE_UPLOAD_GRANT_PAGE_PATH = '/upload-grant';\n\n/** @wildo_source:part:start saas.models.file-upload-grant facet:layer:shared facet:family:files\n *\n * Lifetime bounds of an upload grant, in minutes. The ceiling is fixed by the framework and enforced\n * when the grant is minted — a request above it is REFUSED, never clamped, so a caller that asked for\n * two hours learns from an error that the bound is sixty minutes rather than from an expiry it did not\n * expect. The bound is the framework's to own because the grant is designed to leave the trust\n * boundary: it lands in an AI agent's transcript, a model provider's logs, a shell history.\n */\nexport const FILE_UPLOAD_GRANT_DEFAULT_MINUTES = 15;\nexport const FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES = 60;\n\n/**\n * Which write the grant is for. A grant minted on the CREATE upload route uploads a file that a\n * later CREATE will reference; one minted on the UPDATE route (`…/{resourceId}/files/<field>`) is\n * bound to that row. The two routes authorize differently, so a grant may not cross from one to the\n * other — the upload middleware checks this against the route it is presented on.\n */\nexport const FILE_UPLOAD_GRANT_OPERATIONS = [CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE] as const;\nexport type FileUploadGrantOperation = (typeof FILE_UPLOAD_GRANT_OPERATIONS)[number];\n/** Derived from `CoreResourceOperation` — the named source — rather than a second enum spelling the same two words. */\nexport const FileUploadGrantOperationSchema: z.ZodEnum<{ [K in FileUploadGrantOperation]: K }> = z.enum(FILE_UPLOAD_GRANT_OPERATIONS);\n\n/**\n * Lifecycle of a grant as the status read reports it. Derived from the token row — `isConsumed`,\n * `expiresAt`, `revokedAt` — never stored, so it cannot drift from the row.\n */\nexport enum FileUploadGrantState {\n  /** Minted, unexpired, unrevoked, not yet redeemed: an upload will be accepted. */\n  PENDING = 'pending',\n  /** Redeemed by exactly one upload. `file` names what it produced when the write-back succeeded. */\n  REDEEMED = 'redeemed',\n  /** Past `expiresAt` without being redeemed. Mint a new one. */\n  EXPIRED = 'expired',\n  /** Revoked by the minter or an administrator before redemption. */\n  REVOKED = 'revoked',\n}\nexport const FileUploadGrantStateSchema: z.ZodEnum<typeof FileUploadGrantState> = z.enum(FileUploadGrantState);\n\n/**\n * The `metadata` a FILE_UPLOAD_GRANT token carries — the ROUTE binding, as opposed to the identity\n * the typed token fields carry. The upload middleware reads this; the execution-context creator\n * deliberately does not.\n */\nexport const FileUploadGrantMetadataSchema: z.ZodObject<{\n  fieldName: z.ZodString;\n  operation: z.ZodEnum<{ [K in FileUploadGrantOperation]: K }>;\n  minter: z.ZodObject<{ entityType: z.ZodEnum<typeof FileUploaderEntityType>; id: z.ZodString }>;\n  uploadUrl: z.ZodString;\n  producedFileId: z.ZodOptional<z.ZodString>;\n}> = z.object({\n  /** The `z_file()` field the upload lands on, as authored (dotted for nested fields). */\n  fieldName: z.string().min(1),\n  operation: FileUploadGrantOperationSchema,\n  /**\n   * Who minted — recorded so the uploaded file is attributed to a PERSON or MACHINE, not to the\n   * grant.\n   *\n   * `entityType` is the ENUM, not a string. It was `z.string().min(1)` until 2026-09-08, with the\n   * stated reason that \"the uploader enum lives in `zod-decorators`, upstream of this package\" —\n   * which is exactly backwards: upstream is what a package MAY import, and this one already does.\n   * `files.shared.schemas.ts` in this very directory imports `FileUploaderEntityType` from\n   * `@wildo-ai/zod-decorators`, re-exports it, and writes `z.enum(FileUploaderEntityType)` on the\n   * FILES row's own `uploadedByEntityType`. So the vocabulary was one import away the whole time and\n   * the metadata's copy of the same field was the only one left open.\n   *\n   * What the enum buys: `metadata` is an UNTYPED bag on the token row, so nothing between the write\n   * and the read guarantees its shape — the read is the only place that can. Every reader here goes\n   * through `FileUploadGrantMetadataSchema.safeParse`, so an out-of-vocabulary entity type now makes\n   * the whole metadata unparseable and the redemption path refuses the grant instead of casting the\n   * value into `FileUploaderPrincipal` and carrying it three layers to `validateUploadedByEntityType`.\n   *\n   * NOT narrowed to the three values `mint` can actually produce (mint refuses an anonymous and a\n   * token-borne minter, so `ANONYMOUS_USER` is unreachable): that refusal is a MINT policy, enforced\n   * and explained at mint, and re-encoding it here would put half a policy in a schema that cannot\n   * say why. The vocabulary of this field is the vocabulary of the principal it names.\n   */\n  minter: z.object({ entityType: z.enum(FileUploaderEntityType), id: z.string().min(1) }),\n  /**\n   * The concrete upload URL the grant was minted for. Two jobs, and the second one is why it must be\n   * absolute: the status read hands it to the drop page, AND the redemption path compares its PATH\n   * against the route the token is presented on (`assertGrantMatchesRoute`). Until 2026-09-08 it was\n   * recorded and never read back, so a grant bound to one concrete route could be redeemed on any\n   * other route reaching the same (resource, field, operation, row).\n   */\n  uploadUrl: z.string().url(),\n  /** Written after a successful redemption; absent until then. */\n  producedFileId: z.string().min(1).optional(),\n});\nexport type FileUploadGrantMetadata = z.infer<typeof FileUploadGrantMetadataSchema>;\n\n/**\n * What a mint returns — identical on the REST door and the MCP tool. Two affordances for one\n * token: `uploadCommand` for a caller that can execute, `uploadPageUrl` for one that must hand a\n * human a link. The token appears in `uploadHeader.value` and inside both commands and the page URL;\n * it is the credential and cannot be omitted. It never appears in any audit row.\n */\nexport const FileUploadGrantSchema: z.ZodObject<{\n  grantId: z.ZodString;\n  state: z.ZodEnum<typeof FileUploadGrantState>;\n  expiresAt: z.ZodString;\n  singleUse: z.ZodLiteral<true>;\n  target: z.ZodObject<{\n    resourceType: z.ZodString;\n    fieldName: z.ZodString;\n    operation: z.ZodEnum<{ [K in FileUploadGrantOperation]: K }>;\n    resourceId: z.ZodNullable<z.ZodString>;\n  }>;\n  constraints: z.ZodObject<{\n    maxBytes: z.ZodNumber;\n    allowedMimeTypes: z.ZodArray<z.ZodString>;\n  }>;\n  uploadUrl: z.ZodString;\n  uploadHeader: z.ZodObject<{ name: z.ZodString; value: z.ZodString }>;\n  uploadCommand: z.ZodString;\n  uploadCommandPowerShell: z.ZodString;\n  uploadPageUrl: z.ZodNullable<z.ZodString>;\n  statusUrl: z.ZodString;\n  note: z.ZodString;\n}> = z.object({\n  grantId: z.string().min(1),\n  state: FileUploadGrantStateSchema,\n  expiresAt: z.string().datetime(),\n  singleUse: z.literal(true),\n  target: z.object({\n    resourceType: z.string().min(1),\n    fieldName: z.string().min(1),\n    operation: FileUploadGrantOperationSchema,\n    resourceId: z.string().min(1).nullable(),\n  }),\n  /** From the field's own constraint resolver — the same one the upload enforces, so the two cannot disagree. */\n  constraints: z.object({\n    maxBytes: z.number().int().positive(),\n    /** Empty means every type is accepted. */\n    allowedMimeTypes: z.array(z.string()),\n  }),\n  uploadUrl: z.string().url(),\n  /** The credential travels in a HEADER on the curl form: paths are logged by every proxy, headers are not. */\n  uploadHeader: z.object({ name: z.string().min(1), value: z.string().min(1) }),\n  /** No `-f`: on a refusal the JSON error body is the only thing that tells the caller why. */\n  uploadCommand: z.string().min(1),\n  /** In PowerShell `curl` aliases Invoke-WebRequest, which does not understand `-F`; the real binary is `curl.exe`. */\n  uploadCommandPowerShell: z.string().min(1),\n  /** `null` when the application declares no frontend service — a headless API has no page to hand a human. */\n  uploadPageUrl: z.string().url().nullable(),\n  statusUrl: z.string().url(),\n  note: z.string().min(1),\n});\nexport type FileUploadGrant = z.infer<typeof FileUploadGrantSchema>;\n\n/**\n * What the public status read returns. The token is the credential, so the read is unauthenticated\n * and returns only what the drop page needs to render and the agent needs to learn the `fileId`:\n * never the file's name (the status URL may be pasted around).\n */\nexport const FileUploadGrantStatusSchema: z.ZodObject<{\n  grantId: z.ZodString;\n  state: z.ZodEnum<typeof FileUploadGrantState>;\n  expiresAt: z.ZodString;\n  target: z.ZodObject<{\n    resourceType: z.ZodString;\n    fieldName: z.ZodString;\n    operation: z.ZodEnum<{ [K in FileUploadGrantOperation]: K }>;\n    resourceId: z.ZodNullable<z.ZodString>;\n  }>;\n  constraints: z.ZodObject<{ maxBytes: z.ZodNumber; allowedMimeTypes: z.ZodArray<z.ZodString> }>;\n  uploadUrl: z.ZodString;\n  uploadHeaderName: z.ZodString;\n  file: z.ZodNullable<z.ZodObject<{ fileId: z.ZodString; status: z.ZodEnum<typeof FileStatus> }>>;\n}> = z.object({\n  grantId: z.string().min(1),\n  state: FileUploadGrantStateSchema,\n  expiresAt: z.string().datetime(),\n  target: z.object({\n    resourceType: z.string().min(1),\n    fieldName: z.string().min(1),\n    operation: FileUploadGrantOperationSchema,\n    resourceId: z.string().min(1).nullable(),\n  }),\n  constraints: z.object({ maxBytes: z.number().int().positive(), allowedMimeTypes: z.array(z.string()) }),\n  uploadUrl: z.string().url(),\n  /** The page sets this header itself; the token it already holds is the value. */\n  uploadHeaderName: z.string().min(1),\n  /** `null` until redeemed, or when the post-redemption write-back failed (re-read the resource instead). */\n  file: z.object({ fileId: z.string().min(1), status: z.enum(FileStatus) }).nullable(),\n});\nexport type FileUploadGrantStatus = z.infer<typeof FileUploadGrantStatusSchema>;\n\n/**\n * Body accepted by both mint doors.\n *\n * The three optional file facts mirror what the MCP File Objects proposal has a client declare when\n * it asks to upload (`name`, `mimeType`, `size`): declaring them lets the server refuse a file the\n * field would never accept BEFORE handing out a link, instead of at redemption when the link is\n * already spent. They are advisory for the upload itself — the bytes are validated on receipt\n * regardless — and a declaration that later disagrees with the bytes is refused on receipt too.\n */\nexport const FileUploadGrantMintRequestSchema: z.ZodObject<{\n  expiresInMinutes: z.ZodOptional<z.ZodNumber>;\n  name: z.ZodOptional<z.ZodString>;\n  mimeType: z.ZodOptional<z.ZodString>;\n  size: z.ZodOptional<z.ZodNumber>;\n}> = z.object({\n  expiresInMinutes: z.number().int().min(1).max(FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES).optional(),\n  /** The file name the caller intends to upload; used for the curl example and checked against nothing else. */\n  name: z.string().min(1).max(255).optional(),\n  /** Declared MIME type; refused at mint when the field does not accept it. */\n  mimeType: z.string().min(1).max(255).optional(),\n  /** Declared size in bytes; refused at mint when above the field's maximum. */\n  size: z.number().int().positive().optional(),\n}).strict();\nexport type FileUploadGrantMintRequest = z.infer<typeof FileUploadGrantMintRequestSchema>;\n/** @wildo_source:part:end saas.models.file-upload-grant */\n"]}
+{"version":3,"file":"file-upload-grant.shared.schemas.js","sourceRoot":"","sources":["../../../src/files/file-upload-grant.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AACpD,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAU,CAAC;AAElH,uHAAuH;AACvH,MAAM,CAAC,MAAM,8BAA8B,GAAsD,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;AAEtI;;;GAGG;AACH,MAAM,CAAN,IAAY,oBASX;AATD,WAAY,oBAAoB;IAC9B,kFAAkF;IAClF,2CAAmB,CAAA;IACnB,mGAAmG;IACnG,6CAAqB,CAAA;IACrB,+DAA+D;IAC/D,2CAAmB,CAAA;IACnB,mEAAmE;IACnE,2CAAmB,CAAA;AACrB,CAAC,EATW,oBAAoB,KAApB,oBAAoB,QAS/B;AACD,MAAM,CAAC,MAAM,0BAA0B,GAA2C,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAE/G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAMrC,CAAC,CAAC,MAAM,CAAC;IACZ,wFAAwF;IACxF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,8BAA8B;IACzC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,gEAAgE;IAChE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAsB7B,CAAC,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,SAAS,EAAE,8BAA8B;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;IACF,+GAA+G;IAC/G,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACrC,0CAA0C;QAC1C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,6GAA6G;IAC7G,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,6FAA6F;IAC7F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,qHAAqH;IACrH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6GAA6G;IAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAcnC,CAAC,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,SAAS,EAAE,8BAA8B;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IACvG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,iFAAiF;IACjF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,2GAA2G;IAC3G,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAKxC,CAAC,CAAC,MAAM,CAAC;IACZ,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE;IAChG,8GAA8G;IAC9G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,8EAA8E;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,2DAA2D","sourcesContent":["import { z } from 'zod';\nimport { FileUploaderEntityType } from '@wildo-ai/zod-decorators';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { FileStatus } from './files.shared.schemas';\n\n/**\n * File upload grant — the shared contract between the two mint doors (REST, MCP), the upload route,\n * the status read, and the browser drop page (issue #312).\n *\n * A grant is a single-use consumable token. Nothing durable is created at mint but the token: an\n * abandoned grant leaves a dead token and nothing else. The upload itself goes through the resource's\n * EXISTING file-upload route, authenticated by the grant alone, and the ordinary authorizer decides.\n */\n\n/**\n * Public frontend route the browser drop page lives on; the token follows as the next path segment\n * (`/upload-grant/<token>`). Declared HERE so the backend (which builds `uploadPageUrl`) and the\n * frontend (which mounts the route) read one source — the backend cannot import frontend route\n * constants.\n */\nexport const FILE_UPLOAD_GRANT_PAGE_PATH = '/upload-grant';\n\n/** @wildo_source:part:start saas.models.file-upload-grant facet:layer:shared facet:family:files\n *\n * Lifetime bounds of an upload grant, in minutes. The ceiling is fixed by the framework and enforced\n * when the grant is minted — a request above it is REFUSED, never clamped, so a caller that asked for\n * two hours learns from an error that the bound is sixty minutes rather than from an expiry it did not\n * expect. The bound is the framework's to own because the grant is designed to leave the trust\n * boundary: it lands in an AI agent's transcript, a model provider's logs, a shell history.\n */\nexport const FILE_UPLOAD_GRANT_DEFAULT_MINUTES = 15;\nexport const FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES = 60;\n\n/**\n * Which write the grant is for. A grant minted on the CREATE upload route uploads a file that a\n * later CREATE will reference; one minted on the UPDATE route (`…/{resourceId}/files/<field>`) is\n * bound to that row. The two routes authorize differently, so a grant may not cross from one to the\n * other — the upload middleware checks this against the route it is presented on.\n */\nexport const FILE_UPLOAD_GRANT_OPERATIONS = [CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE] as const;\nexport type FileUploadGrantOperation = (typeof FILE_UPLOAD_GRANT_OPERATIONS)[number];\n/** Derived from `CoreResourceOperation` — the named source — rather than a second enum spelling the same two words. */\nexport const FileUploadGrantOperationSchema: z.ZodEnum<{ [K in FileUploadGrantOperation]: K }> = z.enum(FILE_UPLOAD_GRANT_OPERATIONS);\n\n/**\n * Lifecycle of a grant as the status read reports it. Derived from the token row — `isConsumed`,\n * `expiresAt`, `revokedAt` — never stored, so it cannot drift from the row.\n */\nexport enum FileUploadGrantState {\n  /** Minted, unexpired, unrevoked, not yet redeemed: an upload will be accepted. */\n  PENDING = 'pending',\n  /** Redeemed by exactly one upload. `file` names what it produced when the write-back succeeded. */\n  REDEEMED = 'redeemed',\n  /** Past `expiresAt` without being redeemed. Mint a new one. */\n  EXPIRED = 'expired',\n  /** Revoked by the minter or an administrator before redemption. */\n  REVOKED = 'revoked',\n}\nexport const FileUploadGrantStateSchema: z.ZodEnum<typeof FileUploadGrantState> = z.enum(FileUploadGrantState);\n\n/**\n * The `metadata` a FILE_UPLOAD_GRANT token carries — the ROUTE binding, as opposed to the identity\n * the typed token fields carry. The upload middleware reads this; the execution-context creator\n * deliberately does not.\n */\nexport const FileUploadGrantMetadataSchema: z.ZodObject<{\n  fieldName: z.ZodString;\n  operation: z.ZodEnum<{ [K in FileUploadGrantOperation]: K }>;\n  minter: z.ZodObject<{ entityType: z.ZodEnum<typeof FileUploaderEntityType>; id: z.ZodString }>;\n  uploadUrl: z.ZodString;\n  producedFileId: z.ZodOptional<z.ZodString>;\n}> = z.object({\n  /** The `z_file()` field the upload lands on, as authored (dotted for nested fields). */\n  fieldName: z.string().min(1),\n  operation: FileUploadGrantOperationSchema,\n  /**\n   * Who minted — recorded so the uploaded file is attributed to a PERSON or MACHINE, not to the\n   * grant.\n   *\n   * `entityType` is the ENUM, not a string. It was `z.string().min(1)` until 2026-09-08, with the\n   * stated reason that \"the uploader enum lives in `zod-decorators`, upstream of this package\" —\n   * which is exactly backwards: upstream is what a package MAY import, and this one already does.\n   * `files.shared.schemas.ts` in this very directory imports `FileUploaderEntityType` from\n   * `@wildo-ai/zod-decorators`, re-exports it, and writes `z.enum(FileUploaderEntityType)` on the\n   * FILES row's own `uploadedByEntityType`. So the vocabulary was one import away the whole time and\n   * the metadata's copy of the same field was the only one left open.\n   *\n   * What the enum buys: `metadata` is an UNTYPED bag on the token row, so nothing between the write\n   * and the read guarantees its shape — the read is the only place that can. Every reader here goes\n   * through `FileUploadGrantMetadataSchema.safeParse`, so an out-of-vocabulary entity type now makes\n   * the whole metadata unparseable and the redemption path refuses the grant instead of casting the\n   * value into `FileUploaderPrincipal` and carrying it three layers to `validateUploadedByEntityType`.\n   *\n   * NOT narrowed to the three values `mint` can actually produce (mint refuses an anonymous and a\n   * token-borne minter, so `ANONYMOUS_USER` is unreachable): that refusal is a MINT policy, enforced\n   * and explained at mint, and re-encoding it here would put half a policy in a schema that cannot\n   * say why. The vocabulary of this field is the vocabulary of the principal it names.\n   */\n  minter: z.object({ entityType: z.enum(FileUploaderEntityType), id: z.string().min(1) }),\n  /**\n   * The concrete upload URL the grant was minted for. Two jobs, and the second one is why it must be\n   * absolute: the status read hands it to the drop page, AND the redemption path compares its PATH\n   * against the route the token is presented on (`assertGrantMatchesRoute`). Until 2026-09-08 it was\n   * recorded and never read back, so a grant bound to one concrete route could be redeemed on any\n   * other route reaching the same (resource, field, operation, row).\n   */\n  uploadUrl: z.string().url(),\n  /** Written after a successful redemption; absent until then. */\n  producedFileId: z.string().min(1).optional(),\n});\nexport type FileUploadGrantMetadata = z.infer<typeof FileUploadGrantMetadataSchema>;\n\n/**\n * What a mint returns — identical on the REST door and the MCP tool. Two affordances for one\n * token: `uploadCommand` for a caller that can execute, `uploadPageUrl` for one that must hand a\n * human a link. The token appears in `uploadHeader.value` and inside both commands and the page URL;\n * it is the credential and cannot be omitted. It never appears in any audit row.\n */\nexport const FileUploadGrantSchema: z.ZodObject<{\n  grantId: z.ZodString;\n  state: z.ZodEnum<typeof FileUploadGrantState>;\n  expiresAt: z.ZodString;\n  singleUse: z.ZodLiteral<true>;\n  target: z.ZodObject<{\n    resourceType: z.ZodString;\n    fieldName: z.ZodString;\n    operation: z.ZodEnum<{ [K in FileUploadGrantOperation]: K }>;\n    resourceId: z.ZodNullable<z.ZodString>;\n  }>;\n  constraints: z.ZodObject<{\n    maxBytes: z.ZodNumber;\n    allowedMimeTypes: z.ZodArray<z.ZodString>;\n  }>;\n  uploadUrl: z.ZodString;\n  uploadHeader: z.ZodObject<{ name: z.ZodString; value: z.ZodString }>;\n  uploadCommand: z.ZodString;\n  uploadCommandPowerShell: z.ZodString;\n  uploadPageUrl: z.ZodNullable<z.ZodString>;\n  statusUrl: z.ZodString;\n  note: z.ZodString;\n}> = z.object({\n  grantId: z.string().min(1),\n  state: FileUploadGrantStateSchema,\n  expiresAt: z.string().datetime(),\n  singleUse: z.literal(true),\n  target: z.object({\n    resourceType: z.string().min(1),\n    fieldName: z.string().min(1),\n    operation: FileUploadGrantOperationSchema,\n    resourceId: z.string().min(1).nullable(),\n  }),\n  /** From the field's own constraint resolver — the same one the upload enforces, so the two cannot disagree. */\n  constraints: z.object({\n    maxBytes: z.number().int().positive(),\n    /** Empty means every type is accepted. */\n    allowedMimeTypes: z.array(z.string()),\n  }),\n  uploadUrl: z.string().url(),\n  /** The credential travels in a HEADER on the curl form: paths are logged by every proxy, headers are not. */\n  uploadHeader: z.object({ name: z.string().min(1), value: z.string().min(1) }),\n  /** No `-f`: on a refusal the JSON error body is the only thing that tells the caller why. */\n  uploadCommand: z.string().min(1),\n  /** In PowerShell `curl` aliases Invoke-WebRequest, which does not understand `-F`; the real binary is `curl.exe`. */\n  uploadCommandPowerShell: z.string().min(1),\n  /** `null` when the application declares no frontend service — a headless API has no page to hand a human. */\n  uploadPageUrl: z.string().url().nullable(),\n  statusUrl: z.string().url(),\n  note: z.string().min(1),\n});\nexport type FileUploadGrant = z.infer<typeof FileUploadGrantSchema>;\n\n/**\n * What the public status read returns. The token is the credential, so the read is unauthenticated\n * and returns only what the drop page needs to render and the agent needs to learn the `fileId`:\n * never the file's name (the status URL may be pasted around).\n */\nexport const FileUploadGrantStatusSchema: z.ZodObject<{\n  grantId: z.ZodString;\n  state: z.ZodEnum<typeof FileUploadGrantState>;\n  expiresAt: z.ZodString;\n  target: z.ZodObject<{\n    resourceType: z.ZodString;\n    fieldName: z.ZodString;\n    operation: z.ZodEnum<{ [K in FileUploadGrantOperation]: K }>;\n    resourceId: z.ZodNullable<z.ZodString>;\n  }>;\n  constraints: z.ZodObject<{ maxBytes: z.ZodNumber; allowedMimeTypes: z.ZodArray<z.ZodString> }>;\n  uploadUrl: z.ZodString;\n  uploadHeaderName: z.ZodString;\n  file: z.ZodNullable<z.ZodObject<{ fileId: z.ZodString; status: z.ZodEnum<typeof FileStatus> }>>;\n}> = z.object({\n  grantId: z.string().min(1),\n  state: FileUploadGrantStateSchema,\n  expiresAt: z.string().datetime(),\n  target: z.object({\n    resourceType: z.string().min(1),\n    fieldName: z.string().min(1),\n    operation: FileUploadGrantOperationSchema,\n    resourceId: z.string().min(1).nullable(),\n  }),\n  constraints: z.object({ maxBytes: z.number().int().positive(), allowedMimeTypes: z.array(z.string()) }),\n  uploadUrl: z.string().url(),\n  /** The page sets this header itself; the token it already holds is the value. */\n  uploadHeaderName: z.string().min(1),\n  /** `null` until redeemed, or when the post-redemption write-back failed (re-read the resource instead). */\n  file: z.object({ fileId: z.string().min(1), status: z.enum(FileStatus) }).nullable(),\n});\nexport type FileUploadGrantStatus = z.infer<typeof FileUploadGrantStatusSchema>;\n\n/**\n * Body accepted by both mint doors.\n *\n * The three optional file facts mirror what the MCP File Objects proposal has a client declare when\n * it asks to upload (`name`, `mimeType`, `size`): declaring them lets the server refuse a file the\n * field would never accept BEFORE handing out a link, instead of at redemption when the link is\n * already spent. They are advisory for the upload itself — the bytes are validated on receipt\n * regardless — and a declaration that later disagrees with the bytes is refused on receipt too.\n */\nexport const FileUploadGrantMintRequestSchema: z.ZodObject<{\n  expiresInMinutes: z.ZodOptional<z.ZodNumber>;\n  name: z.ZodOptional<z.ZodString>;\n  mimeType: z.ZodOptional<z.ZodString>;\n  size: z.ZodOptional<z.ZodNumber>;\n}> = z.object({\n  expiresInMinutes: z.number().int().min(1).max(FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES).optional(),\n  /** The file name the caller intends to upload; used for the curl example and checked against nothing else. */\n  name: z.string().min(1).max(255).optional(),\n  /** Declared MIME type; refused at mint when the field does not accept it. */\n  mimeType: z.string().min(1).max(255).optional(),\n  /** Declared size in bytes; refused at mint when above the field's maximum. */\n  size: z.number().int().positive().optional(),\n}).strict();\nexport type FileUploadGrantMintRequest = z.infer<typeof FileUploadGrantMintRequestSchema>;\n/** @wildo_source:part:end saas.models.file-upload-grant */\n"]}

package/dist/esm/files/files.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/files/files.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7J,KAAK,mBAAmB,GACpB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,gDAAgD,GAC3D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsE9C,CAAC"}
+{"version":3,"file":"files.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/files/files.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7J,KAAK,mBAAmB,GACpB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,gDAAgD,GAC3D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsE9C,CAAC"}

package/dist/esm/files/files.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/files/files.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA8C,MAAM,uCAAuC,CAAC;AAC7J,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AASpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAC9D,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;IAC1C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Files Resource Configuration (Repository-only)\n * \n * Provides repository operations for file metadata management.\n * Files are managed internally by the file upload system.\n * \n * ## Scope Model\n * \n * Files use a **dynamic scope** that is derived from the parent resource's\n * resourcePrimaryScope when linked. The canonical FILES registry relationship gives it\n * APPLICATION as its repository primaryScope, but individual file records\n * store their actual scope in the `primaryScope` field.\n * \n * This allows files to be correctly scoped to:\n * - APPLICATION: App-level shared files\n * - ORGANIZATIONS: Org-scoped files\n * - USER_SELF: User-private files\n *\n */\n\nimport { z } from 'zod';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship, ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { FileSchema } from './files.shared.schemas';\n\ntype FilesCoreOperations = \n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/**\n * Files Resource Configuration Factory\n * \n * Creates a REPOSITORY_ONLY resource configuration for file metadata.\n * Files are managed internally by the file upload system and not exposed\n * as standard REST API endpoints. Repository operations are used internally\n * by FilesBackendService.\n *\n * ## Persistence\n *\n * There is deliberately NO `persistenceAdapter` here: FILES FOLLOWS the application's default\n * adapter. It used to be pinned to MongoDB, on the grounds that \"file metadata relies on\n * Mongo-backed transactional/link semantics throughout the upload/link/unlink/cleanup pipeline\".\n * Measured rather than trusted, that was substantially true when written and is no longer:\n *\n * - the upload/link transaction opened on `MongoDBService` BY NAME; it now opens on whichever\n *   store FILES resolves to;\n * - the cleanup batch cleared link metadata through a raw-MongoDB `$unset`; it now uses the\n *   adapter-neutral guarded set-and-clear on the repository contract;\n * - the file-id validation was believed to require an ObjectId shape. It never did —\n *   `Resources_SharedUtils.isValidResourceId` has always accepted ObjectId AND UUID, and only the\n *   comment claimed otherwise.\n *\n * Blobs were never the issue: there is no GridFS. They live in object storage, and MongoDB held\n * only this metadata row.\n *\n * **The pin was also what forced file metadata into a SECOND store**, which is why removing it\n * closes more than it opens: a resource and its file metadata on one adapter share ONE native\n * transaction, so generated-document materialization (PDFs) stops being refused as a cross-adapter\n * boundary, and no saga or outbox is needed to make it atomic.\n *\n * An application is expected to be wholly one adapter (plan Wave 4.5). Following the default is\n * what makes that true for FILES instead of quietly exempting it.\n */\nexport const filesResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<\n  undefined,\n  FilesCoreOperations,\n  typeof FileSchema\n>({\n  mainSchema: FileSchema,\n  resourceIdentifier: CoreResourceType.FILES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.FILES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"files.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/files/files.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA8C,MAAM,uCAAuC,CAAC;AAC7J,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AASpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAC9D,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;IAC1C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Files Resource Configuration (Repository-only)\n * \n * Provides repository operations for file metadata management.\n * Files are managed internally by the file upload system.\n * \n * ## Scope Model\n * \n * Files use a **dynamic scope** that is derived from the parent resource's\n * resourcePrimaryScope when linked. The canonical FILES registry relationship gives it\n * APPLICATION as its repository primaryScope, but individual file records\n * store their actual scope in the `primaryScope` field.\n * \n * This allows files to be correctly scoped to:\n * - APPLICATION: App-level shared files\n * - ORGANIZATIONS: Org-scoped files\n * - USER_SELF: User-private files\n *\n */\n\nimport { z } from 'zod';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship, ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { FileSchema } from './files.shared.schemas';\n\ntype FilesCoreOperations = \n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/**\n * Files Resource Configuration Factory\n * \n * Creates a REPOSITORY_ONLY resource configuration for file metadata.\n * Files are managed internally by the file upload system and not exposed\n * as standard REST API endpoints. Repository operations are used internally\n * by FilesBackendService.\n *\n * ## Persistence\n *\n * There is deliberately NO `persistenceAdapter` here: FILES FOLLOWS the application's default\n * adapter. It used to be pinned to MongoDB, on the grounds that \"file metadata relies on\n * Mongo-backed transactional/link semantics throughout the upload/link/unlink/cleanup pipeline\".\n * Measured rather than trusted, that was substantially true when written and is no longer:\n *\n * - the upload/link transaction opened on `MongoDBService` BY NAME; it now opens on whichever\n *   store FILES resolves to;\n * - the cleanup batch cleared link metadata through a raw-MongoDB `$unset`; it now uses the\n *   adapter-neutral guarded set-and-clear on the repository contract;\n * - the file-id validation was believed to require an ObjectId shape. It never did —\n *   `Resources_SharedUtils.isValidResourceId` has always accepted ObjectId AND UUID, and only the\n *   comment claimed otherwise.\n *\n * Blobs were never the issue: there is no GridFS. They live in object storage, and MongoDB held\n * only this metadata row.\n *\n * **The pin was also what forced file metadata into a SECOND store**, which is why removing it\n * closes more than it opens: a resource and its file metadata on one adapter share ONE native\n * transaction, so generated-document materialization (PDFs) stops being refused as a cross-adapter\n * boundary, and no saga or outbox is needed to make it atomic.\n *\n * An application is expected to be wholly one adapter (plan Wave 4.5). Following the default is\n * what makes that true for FILES instead of quietly exempting it.\n */\nexport const filesResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<\n  undefined,\n  FilesCoreOperations,\n  typeof FileSchema\n>({\n  mainSchema: FileSchema,\n  resourceIdentifier: CoreResourceType.FILES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.FILES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/files/files.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/files/files.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAG7E,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IAEjB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,oBAAY,gBAAgB;IAC1B,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAIpE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,UAAU,CAK7D,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CAAC,UAAU,CAElE,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,aAAa,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,UAAU,CAOxD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC,CAWvF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,UAAU,CAGzD,CAAC;AAGH,eAAO,MAAM,mBAAmB,iHAItB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAyBpE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,YAAY,EAAE,gBAAgB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAqBV;AAuGD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,GAAG,qBAAqB,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"files.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/files/files.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAG7E,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IAEjB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,oBAAY,gBAAgB;IAC1B,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAIpE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,UAAU,CAK7D,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CAAC,UAAU,CAElE,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,aAAa,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,UAAU,CAOxD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC,CAWvF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,UAAU,CAGzD,CAAC;AAGH,eAAO,MAAM,mBAAmB,iHAItB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAyBpE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,YAAY,EAAE,gBAAgB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAqBV;AAuGD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,GAAG,qBAAqB,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/esm/files/files.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.shared.schemas.js","sourceRoot":"","sources":["../../../../src/files/files.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAA8B,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7E,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGvF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,UAYX;AAZD,WAAY,UAAU;IACpB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;IACrB,+BAAiB,CAAA;IACjB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;IACrB,+BAAiB,CAAA;IAEjB,mCAAqB,CAAA;IACrB,6BAAe,CAAA;IACf,mCAAqB,CAAA;IACrB,yCAA2B,CAAA;AAC7B,CAAC,EAZW,UAAU,KAAV,UAAU,QAYrB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,yCAAqB,CAAA;IACrB,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,OAAO,GAAG,KAAK,gBAAgB,CAAC,SAAS;QACvC,CAAC,CAAC,gBAAgB,CAAC,SAAS;QAC5B,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA4B,IAAI,GAAG,CAAC;IACzE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,KAAK;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA4B,IAAI,GAAG,CAAC;IAC9E,UAAU,CAAC,OAAO;CACnB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA4B,IAAI,GAAG,CAAC;IACpE,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,WAAW;CACvB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwD;IAC1F,CAAC,UAAU,CAAC,OAAO,CAAC,EAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;IACnE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;IAC/H,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;IACrF,CAAC,UAAU,CAAC,KAAK,CAAC,EAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACvF,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC;IACvE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAG,CAAC,UAAU,CAAC,OAAO,CAAC;IAC/C,CAAC,UAAU,CAAC,MAAM,CAAC,EAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACpE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;IAClE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAO,EAAE;IAC7B,CAAC,UAAU,CAAC,MAAM,CAAC,EAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;CAChD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA4B,IAAI,GAAG,CAAC;IACrE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,KAAK;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,oBAAoB,CAAC,WAAW;IAChC,oBAAoB,CAAC,aAAa;IAClC,oBAAoB,CAAC,SAAS;CACtB,CAAC;AAIX,SAAS,2BAA2B,CAAC,KAAyB;IAC5D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAGC,EACD,GAAoB;IAEpB,MAAM,aAAa,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,uBAAuB,GAAG,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC;IAExE,IAAI,aAAa,KAAK,uBAAuB,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAC/D,OAAO,EAAE,gFAAgF;SAC1F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5D,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC;QAC3B,KAAK,oBAAoB,CAAC,WAAW;YACnC,OAAO,gBAAgB,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC;QAC9D,KAAK,oBAAoB,CAAC,aAAa;YACrC,kGAAkG;YAClG,OAAO,gBAAgB,IAAI,iBAAiB,IAAI,CAAC,SAAS,CAAC;QAC7D,KAAK,oBAAoB,CAAC,SAAS;YACjC,8EAA8E;YAC9E,4EAA4E;YAC5E,+EAA+E;YAC/E,gFAAgF;YAChF,yCAAyC;YACzC,OAAO,gBAAgB,IAAI,SAAS,IAAI,CAAC,iBAAiB,CAAC;QAC7D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEzD,sCAAsC;IACtC,+FAA+F;IAC/F,8FAA8F;IAC9F,oGAAoG;IACpG,sDAAsD;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAC5G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IACtG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE7C,gCAAgC;IAChC,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACtD,uFAAuF;IACvF,wFAAwF;IACxF,wFAAwF;IACxF,0FAA0F;IAC1F,gBAAgB;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACtD,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IAEzD,2CAA2C;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAErF,iDAAiD;IACjD,8DAA8D;IAC9D,kGAAkG;IAClG,sGAAsG;IACtG,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC1D,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IAClE,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,yCAAyC;IACzC,4EAA4E;IAC5E,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACvD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,sCAAsC;IACtC,mEAAmE;IACnE,6CAA6C;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAElE,0CAA0C;IAC1C,oFAAoF;IACpF,4FAA4F;IAC5F,2FAA2F;IAE3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAEvC,mFAAmF;IACnF,oFAAoF;IACpF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEnD,uFAAuF;IACvF,sFAAsF;IACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE3C,wCAAwC;IACxC,oEAAoE;IACpE,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC7D,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE7E,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;CACjE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACjE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,+FAA+F;QAC/F,kFAAkF;QAClF,IAAI,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,cAAc,CAAC;gBACtB,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,4BAA4B,CAAC;QAChC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,EAAE,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;AAEH,CAAC,CAAC,CAAC","sourcesContent":["/**\n * Files Shared Schemas\n *\n * Reusable schemas for file uploads and file handling.\n *\n * ## Scope Model\n *\n * Files use a **segregated scope model** where scope identifiers are separate fields\n * (not hierarchical). A file belongs to exactly one primary scope:\n * - APPLICATION: App-level shared files (e.g., branding assets)\n * - ORGANIZATIONS: Org-scoped files (e.g., org documents)\n * - USER_SELF: User-private files owned by a single user (NO org — USER_SELF and\n *   ORGANIZATIONS are independent primary-scope axes; `applicationId` is the bucket anchor)\n *\n * `ANONYMOUS` is intentionally excluded from the file contract for now. The\n * file layer does not yet define anonymous upload, storage, and access semantics\n * end to end, so file resources fail closed instead of pretending support.\n *\n * Scope is **derived from the parent resource's resourcePrimaryScope** when linking.\n * Access rights are **inherited from the z_file() field** on the parent resource.\n *\n * Note: FileMetadata is defined in @wildo-ai/zod-decorators\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { FileDisplayNature, FileStorageAccepted, FileUploaderEntityType, type FileUploaderOwnership } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\n\n// Re-export FileMetadata from zod-decorators for convenience\nexport type { FileMetadata } from '@wildo-ai/zod-decorators';\nexport { FileUploaderEntityType, FileStorageAccepted } from '@wildo-ai/zod-decorators';\nexport type { FileUploaderOwnership } from '@wildo-ai/zod-decorators';\n\n/**\n * File status lifecycle enum\n *\n * NOTE — no extraction/indexing members. `EXTRACTING` / `EXTRACTED` / `INDEXED` were removed\n * 2026-08-26 with the resource-native RAG reshape (plan `resource-rag-capability`, Phase 1):\n * text extraction and embedding state are per-FIELD, per-CHUNK facts, and the RAG chunk rows\n * (Phase 2's derived-data tier, keyed `(resourceType, resourceId, fieldName, chunkIndex)` with a\n * NULLABLE `vector` as the \"needs embedding\" ledger) carry them. A single file-level status could\n * never say WHICH field's corpus was current — it was the wrong shape, not merely unused — and\n * `INDEXED` had already shipped one false claim (written to mean \"text was copied\", read as\n * \"searchable\": https://github.com/wildo-ai/wildo-ai/issues/46). The file lifecycle now ends at\n * upload/scan/link/erasure concerns, which really are per-file.\n */\nexport enum FileStatus {\n  PENDING = 'pending',\n  UPLOADED = 'uploaded',\n  LINKED = 'linked',\n  DELETED = 'deleted',\n  ORPHANED = 'orphaned',\n  FAILED = 'failed',\n\n  SCANNING = 'scanning',\n  CLEAN = 'clean',\n  INFECTED = 'infected',\n  QUARANTINED = 'quarantined',\n}\n\n/**\n * Rendition of a file's bytes requested from the serve route via `?variant=`.\n *\n * - `ORIGINAL` — the stored bytes, unchanged (the default when the param is absent).\n * - `THUMBNAIL` — a small, downscaled `webp` derived on the fly for preview surfaces\n *   (nav avatar, list/card image) so a preview never pulls a multi-MB original. Only\n *   raster images are eligible; for any other file the serve route transparently\n *   falls back to the original bytes.\n *\n * This is the WIRE CONTRACT for the serve route's `variant` query parameter — shared\n * by the frontend (which builds `?variant=thumbnail` preview URLs) and the backend\n * serve route (which parses it). Keep the string values stable across releases.\n */\nexport enum FileServeVariant {\n  ORIGINAL = 'original',\n  THUMBNAIL = 'thumbnail',\n}\n\n/**\n * Parse an untrusted `?variant=` query value into a {@link FileServeVariant}.\n * Absent or unrecognized values fall back to `ORIGINAL` (fail-safe: an unknown\n * variant serves the untransformed bytes rather than erroring).\n */\nexport function parseFileServeVariant(raw: unknown): FileServeVariant {\n  return raw === FileServeVariant.THUMBNAIL\n    ? FileServeVariant.THUMBNAIL\n    : FileServeVariant.ORIGINAL;\n}\n\n/**\n * Statuses in which a file's bytes are safe to serve for download.\n *\n * AV scanning IS wired: `FileScanningBackendService` is bound in the container and the resource\n * upload handler calls `shouldScan` then `initiateScan`, so a scanned file moves through SCANNING\n * to CLEAN / INFECTED / QUARANTINED. `SCANNING`, `INFECTED` and `QUARANTINED` are absent from this\n * set and therefore blocked, which is the post-scan half of the original Wave 1 note.\n *\n * `UPLOADED` IS admitted, and that is correct rather than a leftover — but only because of where\n * the scan gate now sits. Scanning is opt-in per field (`shouldScan` reads the field's\n * `fileMetadata`), so an unscanned file legitimately terminates at UPLOADED and removing it from\n * this set would make every such field undownloadable.\n *\n * The window that used to sit behind that reasoning is CLOSED (#433, 2026-09-08). A file whose\n * field requires a scan never sits at UPLOADED at all: `resource-file-upload-handler` now AWAITS\n * `initiateScan` — which awaits the UPLOADED -> SCANNING transition and only then fires the scan\n * pipeline — BEFORE the upload response is sent. Previously it was fired afterwards without being\n * awaited, so the bytes were servable for the gap between the upload committing and the transition\n * landing.\n *\n * So the invariant this set relies on is external to it: **a required scan reaches SCANNING before\n * anyone learns the upload succeeded.** Do not restore a fire-and-forget scan initiation, and do\n * not add UPLOADED-adjacent statuses here without asking which side of that gate they fall on.\n */\nexport const FILE_DOWNLOADABLE_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.UPLOADED,\n  FileStatus.LINKED,\n  FileStatus.ORPHANED,\n  FileStatus.CLEAN,\n]);\n\n/**\n * Statuses in which a file's own METADATA must no longer be disclosed on the GLOBAL\n * `GET /files/:fileId/metadata` route (gate **G-FILE**).\n *\n * Blocking the BYTES is not enough. A privacy erasure marks the file `DELETED`, but physical cleanup\n * is a batch that runs much later — so between the two, `originalFilename` (`passport-jane-doe.pdf`)\n * and `uploadedBy` stayed readable by any member of the file's scope. \"Erased\" that leaves the\n * filename readable for weeks is not erased.\n *\n * DELIBERATELY NARROWER than {@link FILE_BLOCKED_STATUSES}: `PENDING`, `SCANNING`, `FAILED` and\n * `INFECTED` files are not servable either, but their metadata IS the diagnostic surface an uploader\n * legitimately polls (\"upload failed\", \"scan in progress\"). Withholding those would break upload UX\n * while protecting nothing — none of them is an erasure outcome. `DELETED` is the terminal state (it\n * has no outgoing transition in {@link FILE_STATUS_TRANSITIONS}) and the one an erasure produces.\n */\nexport const FILE_METADATA_WITHHELD_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.DELETED,\n]);\n\n/**\n * Value written over a file's `filename` / `originalFilename` when the file is erased for privacy.\n *\n * Both fields are REQUIRED (`z.string().min(1)`), so an erasure cannot null them without a schema\n * reshape; overwriting with one shared, non-identifying constant erases the personal data while\n * keeping the row valid, greppable and obviously-erased in logs and admin surfaces. Deliberately a\n * fixed constant rather than a per-file token: two erased files must not be distinguishable by name.\n */\nexport const ERASED_FILE_NAME_PLACEHOLDER = '[erased]';\n\n/**\n * Statuses that represent terminal or non-servable states.\n * Files in these states must not be served for download.\n */\nexport const FILE_BLOCKED_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.PENDING,\n  FileStatus.DELETED,\n  FileStatus.FAILED,\n  FileStatus.SCANNING,\n  FileStatus.INFECTED,\n  FileStatus.QUARANTINED,\n]);\n\n/**\n * Valid lifecycle transitions.\n *\n * Each key is a source status; the value is the set of statuses it can\n * transition to. Any transition not listed here is invalid.\n */\nexport const FILE_STATUS_TRANSITIONS: Readonly<Record<FileStatus, readonly FileStatus[]>> = {\n  [FileStatus.PENDING]:      [FileStatus.UPLOADED, FileStatus.FAILED],\n  [FileStatus.UPLOADED]:     [FileStatus.LINKED, FileStatus.SCANNING, FileStatus.ORPHANED, FileStatus.DELETED, FileStatus.FAILED],\n  [FileStatus.SCANNING]:     [FileStatus.CLEAN, FileStatus.INFECTED, FileStatus.FAILED],\n  [FileStatus.CLEAN]:        [FileStatus.LINKED, FileStatus.ORPHANED, FileStatus.DELETED],\n  [FileStatus.INFECTED]:     [FileStatus.QUARANTINED, FileStatus.DELETED],\n  [FileStatus.QUARANTINED]:  [FileStatus.DELETED],\n  [FileStatus.LINKED]:       [FileStatus.ORPHANED, FileStatus.DELETED],\n  [FileStatus.ORPHANED]:     [FileStatus.LINKED, FileStatus.DELETED],\n  [FileStatus.DELETED]:      [],\n  [FileStatus.FAILED]:       [FileStatus.DELETED],\n};\n\n/**\n * Statuses from which a file may be LINKED to a resource field — the set the link-time checks\n * (`FileOperationHandlerBackendService.validateFileFieldsForCreate/Update`,\n * `FilesBackendService.linkFileToResource`) consult.\n *\n * ## Why this set exists (issue #320)\n *\n * Those checks used to compare against the literal `FileStatus.UPLOADED`, while\n * {@link FILE_STATUS_TRANSITIONS} — the authority on what a status MEANS — already allowed\n * `CLEAN → LINKED`. So a file the scanner had just certified safe was refused at the one moment it was\n * needed, with an error naming `UPLOADED` as the expected state, and whether a scanned file could be\n * attached at all depended on how fast the caller was relative to the scanner. Two `$in` queries in\n * `FilesBackendService` had meanwhile grown their own `[UPLOADED, CLEAN]` pairs — three copies of one\n * answer, one of them wrong. This is the single copy.\n *\n * ## Derived-CHECKED against the map, not computed from it\n *\n * Every member here has `LINKED` among its outgoing transitions (pinned by\n * `files.shared.status-sets.test.ts`), so this set can never admit a transition the map forbids.\n * It is nonetheless written out rather than computed, because the map is a superset of what linking\n * should admit today:\n *\n * - `ORPHANED → LINKED` is legal in the map (a re-link after the parent was deleted with the file\n *   kept) and is DELIBERATELY NOT admitted here. Re-linking an orphan is a distinct capability with\n *   its own questions — whose scope does the file re-enter, what happens to its old key — and\n *   admitting it as a side effect of fixing the `CLEAN` refusal would decide those questions by\n *   accident. The pin asserts this exclusion by name so widening it is a choice, not drift.\n * - `SCANNING` is absent because the map forbids `SCANNING → LINKED`: a file whose scan is in\n *   flight is not yet known to be safe. The link path names that case with\n *   `FILE_SCAN_IN_PROGRESS` so the caller learns to retry, rather than the generic refusal.\n */\nexport const FILE_LINKABLE_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.UPLOADED,\n  FileStatus.CLEAN,\n]);\n\n\nexport const FILE_PRIMARY_SCOPES = [\n  ResourcePrimaryScope.APPLICATION,\n  ResourcePrimaryScope.ORGANIZATIONS,\n  ResourcePrimaryScope.USER_SELF,\n] as const;\n\nexport type FilePrimaryScope = (typeof FILE_PRIMARY_SCOPES)[number];\n\nfunction hasFileScopeIdentifierValue(value: string | undefined): boolean {\n  return typeof value === 'string' && value.trim() !== '';\n}\n\nfunction validateUploaderPair(\n  file: {\n    uploadedBy?: string;\n    uploadedByEntityType?: FileUploaderEntityType;\n  },\n  ctx: z.RefinementCtx,\n): void {\n  const hasUploadedBy = hasFileScopeIdentifierValue(file.uploadedBy);\n  const hasUploadedByEntityType = file.uploadedByEntityType !== undefined;\n\n  if (hasUploadedBy !== hasUploadedByEntityType) {\n    ctx.addIssue({\n      code: 'custom',\n      path: hasUploadedBy ? ['uploadedByEntityType'] : ['uploadedBy'],\n      message: 'uploadedBy and uploadedByEntityType must either both be set or both be omitted',\n    });\n  }\n}\n\nexport function validateFileScopeIdentifiers(scope: {\n  primaryScope: FilePrimaryScope;\n  applicationId: string;\n  organizationId?: string;\n  userId?: string;\n}): boolean {\n  const hasApplicationId = hasFileScopeIdentifierValue(scope.applicationId);\n  const hasOrganizationId = hasFileScopeIdentifierValue(scope.organizationId);\n  const hasUserId = hasFileScopeIdentifierValue(scope.userId);\n\n  switch (scope.primaryScope) {\n    case ResourcePrimaryScope.APPLICATION:\n      return hasApplicationId && !hasOrganizationId && !hasUserId;\n    case ResourcePrimaryScope.ORGANIZATIONS:\n      // applicationId is always required (tenant isolation); organizationId is the scope discriminator.\n      return hasApplicationId && hasOrganizationId && !hasUserId;\n    case ResourcePrimaryScope.USER_SELF:\n      // Primary scopes are a SEPARATION OF CONCERN: USER_SELF and ORGANIZATIONS are\n      // independent axes. A user's self-owned file is user-owned, NOT org-owned —\n      // `userId` is the scope discriminator and `applicationId` is the tenant/bucket\n      // anchor. `organizationId` MUST be absent (a present org would conflate the two\n      // scopes). Fail closed on any org value.\n      return hasApplicationId && hasUserId && !hasOrganizationId;\n    default:\n      return false;\n  }\n}\n\n/**\n * File resource schema\n *\n * Stores file metadata and links files to resources.\n * Files are stored via app-managed storage providers (MinIO/S3, local directory, etc.),\n * this schema tracks metadata only.\n *\n * ## Storage Identity Convention\n * `storageProvider` + `storageRef` are the persisted routing truth used to\n * reach the active storage backend. `storageKey` remains framework metadata\n * that captures the file's derived scope path for bookkeeping, diagnostics,\n * and future storage contract evolution.\n *\n * `storageKey` includes scope path derived from primaryScope:\n * - APPLICATION: `app/{applicationId}/{fileId}`\n * - ORGANIZATIONS: `org/{organizationId}/{fileId}`\n * - USER_SELF: `user/{userId}/{fileId}` (owner is the user; no org segment)\n */\nconst FileSchemaBase = z.object({\n  fileId: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ========== File Metadata ==========\n  // USER_CONTENT on both names. A filename is chosen by the person and routinely IS the personal\n  // datum — \"scan-2026-medical.pdf\" discloses a special category before the file is opened. The\n  // file's BYTES are not a field here (this resource is metadata over object storage), so this is the\n  // only place the content axis can be declared at all.\n  filename: z.string().min(1).isDBIndexed().isSummaryField().dataCategories(PersonalDataCategory.USER_CONTENT),\n  originalFilename: z.string().min(1).isSummaryField().dataCategories(PersonalDataCategory.USER_CONTENT),\n  mimeType: z.string().min(1).isDBIndexed().isSummaryField(),\n  size: z.number().min(0).isSummaryField(),\n  extension: z.string().optional(),\n  checksum: z.string().optional().isDBIndexed(),\n\n  // ========== Storage ==========\n  // `storageProvider` + `storageRef` are the persisted backend-routing truth.\n  storageProvider: z.enum(FileStorageAccepted).optional().isDBIndexed(),\n  storageRef: z.string().min(1).optional().isDBIndexed(),\n  // `storageKey` is still scoped metadata, not the storage backend handle. It embeds the\n  // file identity (`_id`, surfaced as the `fileId` virtual), so it is derived + persisted\n  // AFTER the row is created (insert-first) — hence optional at create time. `createFile`\n  // sets it once `_id` exists, and `linkFileToResource` re-derives it when the file's scope\n  // is finalized.\n  storageKey: z.string().min(1).optional().isDBIndexed(),\n  url: z.url().optional(), // Cached URL (may be presigned)\n\n  // ========== Status & Lifecycle ==========\n  status: z.enum(FileStatus).default(FileStatus.PENDING).isDBIndexed().isSummaryField(),\n\n  // ========== Nature-specific Metadata ==========\n  // Inferred from MIME type or set by analysis services (F4-03)\n  // Resolved display nature (IMAGE/VIDEO/AUDIO/DOCUMENT/GENERIC) — NOT the schema-level FileNature.\n  // Set by resolveFileDisplayNature() during upload or inferred from MIME type in toMetadataResponse().\n  // Schema declares FileNature (e.g., PDF, OFFICE), but the DB stores the resolved FileDisplayNature.\n  nature: z.enum(FileDisplayNature).optional().isDBIndexed(),\n  // Image-specific\n  width: z.number().positive().optional(),\n  height: z.number().positive().optional(),\n  thumbnailUrl: z.url().optional(),\n  // Video/Audio-specific (populated by IFileVideoAnalyzer / IFileAudioAnalyzer)\n  duration: z.number().positive().optional(), // Duration in seconds\n  // Document-specific (populated by IFileDocumentAnalyzer)\n  pageCount: z.number().positive().optional(),\n\n  // ========== Resource Linking ==========\n  // When linked, scope is derived from parent resource's resourcePrimaryScope\n  linkedResourceType: z.string().optional().isDBIndexed(),\n  linkedResourceId: z.string().optional().isDBIndexed(),\n  linkedFieldName: z.string().optional(),\n\n  // ========== Primary Scope ==========\n  // Derived from parent resource's resourcePrimaryScope when linking\n  // Determines access control and storage path\n  primaryScope: z.enum(FILE_PRIMARY_SCOPES).optional().isDBIndexed(),\n\n  // ========== Scope Identifiers ==========\n  // applicationId is ALWAYS set (from execution context at creation time) — it is the\n  // top-level tenant isolation field present on every file record regardless of primaryScope.\n  // organizationId and userId are populated only when the file's primaryScope requires them.\n\n  applicationId: z.string().isDBIndexed(),\n\n  // ORGANIZATIONS scope: org-scoped files. Set ONLY for ORGANIZATIONS-scoped files —\n  // never for USER_SELF (the two scopes are independent axes, separation of concern).\n  organizationId: z.string().optional().isDBIndexed(),\n\n  // USER_SELF scope: user-private files owned by one user. Set ONLY for USER_SELF-scoped\n  // files; the owner is the user (no org). `applicationId` is the tenant/bucket anchor.\n  userId: z.string().optional().isDBIndexed(),\n\n  // ========== Upload Metadata ==========\n  // The uploader principal is persisted as a raw id + type pair only.\n  // Any richer label/entity hydration is intentionally client-driven.\n  uploadedBy: z.string().trim().min(1).optional().isDBIndexed(),\n  uploadedByEntityType: z.enum(FileUploaderEntityType).optional().isDBIndexed(),\n\n  // ========== Timestamps ==========\n  uploadedAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  deletedAt: z.date().optional().isDBIndexed().excludeFromCreate(),\n});\n\nexport const FileSchema = FileSchemaBase.superRefine((file, ctx) => {\n  validateUploaderPair(file, ctx);\n\n  if (!file.primaryScope) {\n    // Pre-link state: applicationId is always present (set from execution context at upload time),\n    // but organizationId/userId must not be set without a primaryScope discriminator.\n    if (hasFileScopeIdentifierValue(file.organizationId) || hasFileScopeIdentifierValue(file.userId)) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['primaryScope'],\n        message: 'primaryScope is required when organizationId or userId are present',\n      });\n    }\n    return;\n  }\n\n  if (!validateFileScopeIdentifiers({\n    primaryScope: file.primaryScope,\n    applicationId: file.applicationId,\n    organizationId: file.organizationId,\n    userId: file.userId,\n  })) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['primaryScope'],\n      message: 'File scope identifiers must match the declared primaryScope',\n    });\n  }\n\n});\nexport type File = z.infer<typeof FileSchema> & FileUploaderOwnership;\n\n/**\n * Scope identifiers for file access control.\n * Populated based on primaryScope when file is created/linked.\n */\nexport interface FileScopeIdentifiers {\n  primaryScope: FilePrimaryScope;\n  /** Always required — top-level tenant isolation key, set from execution context at file creation. */\n  applicationId: string;\n  organizationId?: string;\n  userId?: string;\n}\n"]}
+{"version":3,"file":"files.shared.schemas.js","sourceRoot":"","sources":["../../../src/files/files.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAA8B,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7E,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGvF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,UAYX;AAZD,WAAY,UAAU;IACpB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;IACrB,+BAAiB,CAAA;IACjB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;IACrB,+BAAiB,CAAA;IAEjB,mCAAqB,CAAA;IACrB,6BAAe,CAAA;IACf,mCAAqB,CAAA;IACrB,yCAA2B,CAAA;AAC7B,CAAC,EAZW,UAAU,KAAV,UAAU,QAYrB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,yCAAqB,CAAA;IACrB,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,OAAO,GAAG,KAAK,gBAAgB,CAAC,SAAS;QACvC,CAAC,CAAC,gBAAgB,CAAC,SAAS;QAC5B,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA4B,IAAI,GAAG,CAAC;IACzE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,KAAK;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA4B,IAAI,GAAG,CAAC;IAC9E,UAAU,CAAC,OAAO;CACnB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA4B,IAAI,GAAG,CAAC;IACpE,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,WAAW;CACvB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwD;IAC1F,CAAC,UAAU,CAAC,OAAO,CAAC,EAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;IACnE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;IAC/H,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;IACrF,CAAC,UAAU,CAAC,KAAK,CAAC,EAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACvF,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC;IACvE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAG,CAAC,UAAU,CAAC,OAAO,CAAC;IAC/C,CAAC,UAAU,CAAC,MAAM,CAAC,EAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACpE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;IAClE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAO,EAAE;IAC7B,CAAC,UAAU,CAAC,MAAM,CAAC,EAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;CAChD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA4B,IAAI,GAAG,CAAC;IACrE,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,KAAK;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,oBAAoB,CAAC,WAAW;IAChC,oBAAoB,CAAC,aAAa;IAClC,oBAAoB,CAAC,SAAS;CACtB,CAAC;AAIX,SAAS,2BAA2B,CAAC,KAAyB;IAC5D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAGC,EACD,GAAoB;IAEpB,MAAM,aAAa,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,uBAAuB,GAAG,IAAI,CAAC,oBAAoB,KAAK,SAAS,CAAC;IAExE,IAAI,aAAa,KAAK,uBAAuB,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAC/D,OAAO,EAAE,gFAAgF;SAC1F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5D,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC;QAC3B,KAAK,oBAAoB,CAAC,WAAW;YACnC,OAAO,gBAAgB,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC;QAC9D,KAAK,oBAAoB,CAAC,aAAa;YACrC,kGAAkG;YAClG,OAAO,gBAAgB,IAAI,iBAAiB,IAAI,CAAC,SAAS,CAAC;QAC7D,KAAK,oBAAoB,CAAC,SAAS;YACjC,8EAA8E;YAC9E,4EAA4E;YAC5E,+EAA+E;YAC/E,gFAAgF;YAChF,yCAAyC;YACzC,OAAO,gBAAgB,IAAI,SAAS,IAAI,CAAC,iBAAiB,CAAC;QAC7D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEzD,sCAAsC;IACtC,+FAA+F;IAC/F,8FAA8F;IAC9F,oGAAoG;IACpG,sDAAsD;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAC5G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IACtG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE7C,gCAAgC;IAChC,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACtD,uFAAuF;IACvF,wFAAwF;IACxF,wFAAwF;IACxF,0FAA0F;IAC1F,gBAAgB;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACtD,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IAEzD,2CAA2C;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAErF,iDAAiD;IACjD,8DAA8D;IAC9D,kGAAkG;IAClG,sGAAsG;IACtG,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC1D,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IAClE,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,yCAAyC;IACzC,4EAA4E;IAC5E,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACvD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,sCAAsC;IACtC,mEAAmE;IACnE,6CAA6C;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAElE,0CAA0C;IAC1C,oFAAoF;IACpF,4FAA4F;IAC5F,2FAA2F;IAE3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAEvC,mFAAmF;IACnF,oFAAoF;IACpF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEnD,uFAAuF;IACvF,sFAAsF;IACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE3C,wCAAwC;IACxC,oEAAoE;IACpE,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC7D,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE7E,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;CACjE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACjE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,+FAA+F;QAC/F,kFAAkF;QAClF,IAAI,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,cAAc,CAAC;gBACtB,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,4BAA4B,CAAC;QAChC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,EAAE,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;AAEH,CAAC,CAAC,CAAC","sourcesContent":["/**\n * Files Shared Schemas\n *\n * Reusable schemas for file uploads and file handling.\n *\n * ## Scope Model\n *\n * Files use a **segregated scope model** where scope identifiers are separate fields\n * (not hierarchical). A file belongs to exactly one primary scope:\n * - APPLICATION: App-level shared files (e.g., branding assets)\n * - ORGANIZATIONS: Org-scoped files (e.g., org documents)\n * - USER_SELF: User-private files owned by a single user (NO org — USER_SELF and\n *   ORGANIZATIONS are independent primary-scope axes; `applicationId` is the bucket anchor)\n *\n * `ANONYMOUS` is intentionally excluded from the file contract for now. The\n * file layer does not yet define anonymous upload, storage, and access semantics\n * end to end, so file resources fail closed instead of pretending support.\n *\n * Scope is **derived from the parent resource's resourcePrimaryScope** when linking.\n * Access rights are **inherited from the z_file() field** on the parent resource.\n *\n * Note: FileMetadata is defined in @wildo-ai/zod-decorators\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { FileDisplayNature, FileStorageAccepted, FileUploaderEntityType, type FileUploaderOwnership } from '@wildo-ai/zod-decorators';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\n\n// Re-export FileMetadata from zod-decorators for convenience\nexport type { FileMetadata } from '@wildo-ai/zod-decorators';\nexport { FileUploaderEntityType, FileStorageAccepted } from '@wildo-ai/zod-decorators';\nexport type { FileUploaderOwnership } from '@wildo-ai/zod-decorators';\n\n/**\n * File status lifecycle enum\n *\n * NOTE — no extraction/indexing members. `EXTRACTING` / `EXTRACTED` / `INDEXED` were removed\n * 2026-08-26 with the resource-native RAG reshape (plan `resource-rag-capability`, Phase 1):\n * text extraction and embedding state are per-FIELD, per-CHUNK facts, and the RAG chunk rows\n * (Phase 2's derived-data tier, keyed `(resourceType, resourceId, fieldName, chunkIndex)` with a\n * NULLABLE `vector` as the \"needs embedding\" ledger) carry them. A single file-level status could\n * never say WHICH field's corpus was current — it was the wrong shape, not merely unused — and\n * `INDEXED` had already shipped one false claim (written to mean \"text was copied\", read as\n * \"searchable\": https://github.com/wildo-ai/wildo-ai/issues/46). The file lifecycle now ends at\n * upload/scan/link/erasure concerns, which really are per-file.\n */\nexport enum FileStatus {\n  PENDING = 'pending',\n  UPLOADED = 'uploaded',\n  LINKED = 'linked',\n  DELETED = 'deleted',\n  ORPHANED = 'orphaned',\n  FAILED = 'failed',\n\n  SCANNING = 'scanning',\n  CLEAN = 'clean',\n  INFECTED = 'infected',\n  QUARANTINED = 'quarantined',\n}\n\n/**\n * Rendition of a file's bytes requested from the serve route via `?variant=`.\n *\n * - `ORIGINAL` — the stored bytes, unchanged (the default when the param is absent).\n * - `THUMBNAIL` — a small, downscaled `webp` derived on the fly for preview surfaces\n *   (nav avatar, list/card image) so a preview never pulls a multi-MB original. Only\n *   raster images are eligible; for any other file the serve route transparently\n *   falls back to the original bytes.\n *\n * This is the WIRE CONTRACT for the serve route's `variant` query parameter — shared\n * by the frontend (which builds `?variant=thumbnail` preview URLs) and the backend\n * serve route (which parses it). Keep the string values stable across releases.\n */\nexport enum FileServeVariant {\n  ORIGINAL = 'original',\n  THUMBNAIL = 'thumbnail',\n}\n\n/**\n * Parse an untrusted `?variant=` query value into a {@link FileServeVariant}.\n * Absent or unrecognized values fall back to `ORIGINAL` (fail-safe: an unknown\n * variant serves the untransformed bytes rather than erroring).\n */\nexport function parseFileServeVariant(raw: unknown): FileServeVariant {\n  return raw === FileServeVariant.THUMBNAIL\n    ? FileServeVariant.THUMBNAIL\n    : FileServeVariant.ORIGINAL;\n}\n\n/**\n * Statuses in which a file's bytes are safe to serve for download.\n *\n * AV scanning IS wired: `FileScanningBackendService` is bound in the container and the resource\n * upload handler calls `shouldScan` then `initiateScan`, so a scanned file moves through SCANNING\n * to CLEAN / INFECTED / QUARANTINED. `SCANNING`, `INFECTED` and `QUARANTINED` are absent from this\n * set and therefore blocked, which is the post-scan half of the original Wave 1 note.\n *\n * `UPLOADED` IS admitted, and that is correct rather than a leftover — but only because of where\n * the scan gate now sits. Scanning is opt-in per field (`shouldScan` reads the field's\n * `fileMetadata`), so an unscanned file legitimately terminates at UPLOADED and removing it from\n * this set would make every such field undownloadable.\n *\n * The window that used to sit behind that reasoning is CLOSED (#433, 2026-09-08). A file whose\n * field requires a scan never sits at UPLOADED at all: `resource-file-upload-handler` now AWAITS\n * `initiateScan` — which awaits the UPLOADED -> SCANNING transition and only then fires the scan\n * pipeline — BEFORE the upload response is sent. Previously it was fired afterwards without being\n * awaited, so the bytes were servable for the gap between the upload committing and the transition\n * landing.\n *\n * So the invariant this set relies on is external to it: **a required scan reaches SCANNING before\n * anyone learns the upload succeeded.** Do not restore a fire-and-forget scan initiation, and do\n * not add UPLOADED-adjacent statuses here without asking which side of that gate they fall on.\n */\nexport const FILE_DOWNLOADABLE_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.UPLOADED,\n  FileStatus.LINKED,\n  FileStatus.ORPHANED,\n  FileStatus.CLEAN,\n]);\n\n/**\n * Statuses in which a file's own METADATA must no longer be disclosed on the GLOBAL\n * `GET /files/:fileId/metadata` route (gate **G-FILE**).\n *\n * Blocking the BYTES is not enough. A privacy erasure marks the file `DELETED`, but physical cleanup\n * is a batch that runs much later — so between the two, `originalFilename` (`passport-jane-doe.pdf`)\n * and `uploadedBy` stayed readable by any member of the file's scope. \"Erased\" that leaves the\n * filename readable for weeks is not erased.\n *\n * DELIBERATELY NARROWER than {@link FILE_BLOCKED_STATUSES}: `PENDING`, `SCANNING`, `FAILED` and\n * `INFECTED` files are not servable either, but their metadata IS the diagnostic surface an uploader\n * legitimately polls (\"upload failed\", \"scan in progress\"). Withholding those would break upload UX\n * while protecting nothing — none of them is an erasure outcome. `DELETED` is the terminal state (it\n * has no outgoing transition in {@link FILE_STATUS_TRANSITIONS}) and the one an erasure produces.\n */\nexport const FILE_METADATA_WITHHELD_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.DELETED,\n]);\n\n/**\n * Value written over a file's `filename` / `originalFilename` when the file is erased for privacy.\n *\n * Both fields are REQUIRED (`z.string().min(1)`), so an erasure cannot null them without a schema\n * reshape; overwriting with one shared, non-identifying constant erases the personal data while\n * keeping the row valid, greppable and obviously-erased in logs and admin surfaces. Deliberately a\n * fixed constant rather than a per-file token: two erased files must not be distinguishable by name.\n */\nexport const ERASED_FILE_NAME_PLACEHOLDER = '[erased]';\n\n/**\n * Statuses that represent terminal or non-servable states.\n * Files in these states must not be served for download.\n */\nexport const FILE_BLOCKED_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.PENDING,\n  FileStatus.DELETED,\n  FileStatus.FAILED,\n  FileStatus.SCANNING,\n  FileStatus.INFECTED,\n  FileStatus.QUARANTINED,\n]);\n\n/**\n * Valid lifecycle transitions.\n *\n * Each key is a source status; the value is the set of statuses it can\n * transition to. Any transition not listed here is invalid.\n */\nexport const FILE_STATUS_TRANSITIONS: Readonly<Record<FileStatus, readonly FileStatus[]>> = {\n  [FileStatus.PENDING]:      [FileStatus.UPLOADED, FileStatus.FAILED],\n  [FileStatus.UPLOADED]:     [FileStatus.LINKED, FileStatus.SCANNING, FileStatus.ORPHANED, FileStatus.DELETED, FileStatus.FAILED],\n  [FileStatus.SCANNING]:     [FileStatus.CLEAN, FileStatus.INFECTED, FileStatus.FAILED],\n  [FileStatus.CLEAN]:        [FileStatus.LINKED, FileStatus.ORPHANED, FileStatus.DELETED],\n  [FileStatus.INFECTED]:     [FileStatus.QUARANTINED, FileStatus.DELETED],\n  [FileStatus.QUARANTINED]:  [FileStatus.DELETED],\n  [FileStatus.LINKED]:       [FileStatus.ORPHANED, FileStatus.DELETED],\n  [FileStatus.ORPHANED]:     [FileStatus.LINKED, FileStatus.DELETED],\n  [FileStatus.DELETED]:      [],\n  [FileStatus.FAILED]:       [FileStatus.DELETED],\n};\n\n/**\n * Statuses from which a file may be LINKED to a resource field — the set the link-time checks\n * (`FileOperationHandlerBackendService.validateFileFieldsForCreate/Update`,\n * `FilesBackendService.linkFileToResource`) consult.\n *\n * ## Why this set exists (issue #320)\n *\n * Those checks used to compare against the literal `FileStatus.UPLOADED`, while\n * {@link FILE_STATUS_TRANSITIONS} — the authority on what a status MEANS — already allowed\n * `CLEAN → LINKED`. So a file the scanner had just certified safe was refused at the one moment it was\n * needed, with an error naming `UPLOADED` as the expected state, and whether a scanned file could be\n * attached at all depended on how fast the caller was relative to the scanner. Two `$in` queries in\n * `FilesBackendService` had meanwhile grown their own `[UPLOADED, CLEAN]` pairs — three copies of one\n * answer, one of them wrong. This is the single copy.\n *\n * ## Derived-CHECKED against the map, not computed from it\n *\n * Every member here has `LINKED` among its outgoing transitions (pinned by\n * `files.shared.status-sets.test.ts`), so this set can never admit a transition the map forbids.\n * It is nonetheless written out rather than computed, because the map is a superset of what linking\n * should admit today:\n *\n * - `ORPHANED → LINKED` is legal in the map (a re-link after the parent was deleted with the file\n *   kept) and is DELIBERATELY NOT admitted here. Re-linking an orphan is a distinct capability with\n *   its own questions — whose scope does the file re-enter, what happens to its old key — and\n *   admitting it as a side effect of fixing the `CLEAN` refusal would decide those questions by\n *   accident. The pin asserts this exclusion by name so widening it is a choice, not drift.\n * - `SCANNING` is absent because the map forbids `SCANNING → LINKED`: a file whose scan is in\n *   flight is not yet known to be safe. The link path names that case with\n *   `FILE_SCAN_IN_PROGRESS` so the caller learns to retry, rather than the generic refusal.\n */\nexport const FILE_LINKABLE_STATUSES: ReadonlySet<FileStatus> = new Set([\n  FileStatus.UPLOADED,\n  FileStatus.CLEAN,\n]);\n\n\nexport const FILE_PRIMARY_SCOPES = [\n  ResourcePrimaryScope.APPLICATION,\n  ResourcePrimaryScope.ORGANIZATIONS,\n  ResourcePrimaryScope.USER_SELF,\n] as const;\n\nexport type FilePrimaryScope = (typeof FILE_PRIMARY_SCOPES)[number];\n\nfunction hasFileScopeIdentifierValue(value: string | undefined): boolean {\n  return typeof value === 'string' && value.trim() !== '';\n}\n\nfunction validateUploaderPair(\n  file: {\n    uploadedBy?: string;\n    uploadedByEntityType?: FileUploaderEntityType;\n  },\n  ctx: z.RefinementCtx,\n): void {\n  const hasUploadedBy = hasFileScopeIdentifierValue(file.uploadedBy);\n  const hasUploadedByEntityType = file.uploadedByEntityType !== undefined;\n\n  if (hasUploadedBy !== hasUploadedByEntityType) {\n    ctx.addIssue({\n      code: 'custom',\n      path: hasUploadedBy ? ['uploadedByEntityType'] : ['uploadedBy'],\n      message: 'uploadedBy and uploadedByEntityType must either both be set or both be omitted',\n    });\n  }\n}\n\nexport function validateFileScopeIdentifiers(scope: {\n  primaryScope: FilePrimaryScope;\n  applicationId: string;\n  organizationId?: string;\n  userId?: string;\n}): boolean {\n  const hasApplicationId = hasFileScopeIdentifierValue(scope.applicationId);\n  const hasOrganizationId = hasFileScopeIdentifierValue(scope.organizationId);\n  const hasUserId = hasFileScopeIdentifierValue(scope.userId);\n\n  switch (scope.primaryScope) {\n    case ResourcePrimaryScope.APPLICATION:\n      return hasApplicationId && !hasOrganizationId && !hasUserId;\n    case ResourcePrimaryScope.ORGANIZATIONS:\n      // applicationId is always required (tenant isolation); organizationId is the scope discriminator.\n      return hasApplicationId && hasOrganizationId && !hasUserId;\n    case ResourcePrimaryScope.USER_SELF:\n      // Primary scopes are a SEPARATION OF CONCERN: USER_SELF and ORGANIZATIONS are\n      // independent axes. A user's self-owned file is user-owned, NOT org-owned —\n      // `userId` is the scope discriminator and `applicationId` is the tenant/bucket\n      // anchor. `organizationId` MUST be absent (a present org would conflate the two\n      // scopes). Fail closed on any org value.\n      return hasApplicationId && hasUserId && !hasOrganizationId;\n    default:\n      return false;\n  }\n}\n\n/**\n * File resource schema\n *\n * Stores file metadata and links files to resources.\n * Files are stored via app-managed storage providers (MinIO/S3, local directory, etc.),\n * this schema tracks metadata only.\n *\n * ## Storage Identity Convention\n * `storageProvider` + `storageRef` are the persisted routing truth used to\n * reach the active storage backend. `storageKey` remains framework metadata\n * that captures the file's derived scope path for bookkeeping, diagnostics,\n * and future storage contract evolution.\n *\n * `storageKey` includes scope path derived from primaryScope:\n * - APPLICATION: `app/{applicationId}/{fileId}`\n * - ORGANIZATIONS: `org/{organizationId}/{fileId}`\n * - USER_SELF: `user/{userId}/{fileId}` (owner is the user; no org segment)\n */\nconst FileSchemaBase = z.object({\n  fileId: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ========== File Metadata ==========\n  // USER_CONTENT on both names. A filename is chosen by the person and routinely IS the personal\n  // datum — \"scan-2026-medical.pdf\" discloses a special category before the file is opened. The\n  // file's BYTES are not a field here (this resource is metadata over object storage), so this is the\n  // only place the content axis can be declared at all.\n  filename: z.string().min(1).isDBIndexed().isSummaryField().dataCategories(PersonalDataCategory.USER_CONTENT),\n  originalFilename: z.string().min(1).isSummaryField().dataCategories(PersonalDataCategory.USER_CONTENT),\n  mimeType: z.string().min(1).isDBIndexed().isSummaryField(),\n  size: z.number().min(0).isSummaryField(),\n  extension: z.string().optional(),\n  checksum: z.string().optional().isDBIndexed(),\n\n  // ========== Storage ==========\n  // `storageProvider` + `storageRef` are the persisted backend-routing truth.\n  storageProvider: z.enum(FileStorageAccepted).optional().isDBIndexed(),\n  storageRef: z.string().min(1).optional().isDBIndexed(),\n  // `storageKey` is still scoped metadata, not the storage backend handle. It embeds the\n  // file identity (`_id`, surfaced as the `fileId` virtual), so it is derived + persisted\n  // AFTER the row is created (insert-first) — hence optional at create time. `createFile`\n  // sets it once `_id` exists, and `linkFileToResource` re-derives it when the file's scope\n  // is finalized.\n  storageKey: z.string().min(1).optional().isDBIndexed(),\n  url: z.url().optional(), // Cached URL (may be presigned)\n\n  // ========== Status & Lifecycle ==========\n  status: z.enum(FileStatus).default(FileStatus.PENDING).isDBIndexed().isSummaryField(),\n\n  // ========== Nature-specific Metadata ==========\n  // Inferred from MIME type or set by analysis services (F4-03)\n  // Resolved display nature (IMAGE/VIDEO/AUDIO/DOCUMENT/GENERIC) — NOT the schema-level FileNature.\n  // Set by resolveFileDisplayNature() during upload or inferred from MIME type in toMetadataResponse().\n  // Schema declares FileNature (e.g., PDF, OFFICE), but the DB stores the resolved FileDisplayNature.\n  nature: z.enum(FileDisplayNature).optional().isDBIndexed(),\n  // Image-specific\n  width: z.number().positive().optional(),\n  height: z.number().positive().optional(),\n  thumbnailUrl: z.url().optional(),\n  // Video/Audio-specific (populated by IFileVideoAnalyzer / IFileAudioAnalyzer)\n  duration: z.number().positive().optional(), // Duration in seconds\n  // Document-specific (populated by IFileDocumentAnalyzer)\n  pageCount: z.number().positive().optional(),\n\n  // ========== Resource Linking ==========\n  // When linked, scope is derived from parent resource's resourcePrimaryScope\n  linkedResourceType: z.string().optional().isDBIndexed(),\n  linkedResourceId: z.string().optional().isDBIndexed(),\n  linkedFieldName: z.string().optional(),\n\n  // ========== Primary Scope ==========\n  // Derived from parent resource's resourcePrimaryScope when linking\n  // Determines access control and storage path\n  primaryScope: z.enum(FILE_PRIMARY_SCOPES).optional().isDBIndexed(),\n\n  // ========== Scope Identifiers ==========\n  // applicationId is ALWAYS set (from execution context at creation time) — it is the\n  // top-level tenant isolation field present on every file record regardless of primaryScope.\n  // organizationId and userId are populated only when the file's primaryScope requires them.\n\n  applicationId: z.string().isDBIndexed(),\n\n  // ORGANIZATIONS scope: org-scoped files. Set ONLY for ORGANIZATIONS-scoped files —\n  // never for USER_SELF (the two scopes are independent axes, separation of concern).\n  organizationId: z.string().optional().isDBIndexed(),\n\n  // USER_SELF scope: user-private files owned by one user. Set ONLY for USER_SELF-scoped\n  // files; the owner is the user (no org). `applicationId` is the tenant/bucket anchor.\n  userId: z.string().optional().isDBIndexed(),\n\n  // ========== Upload Metadata ==========\n  // The uploader principal is persisted as a raw id + type pair only.\n  // Any richer label/entity hydration is intentionally client-driven.\n  uploadedBy: z.string().trim().min(1).optional().isDBIndexed(),\n  uploadedByEntityType: z.enum(FileUploaderEntityType).optional().isDBIndexed(),\n\n  // ========== Timestamps ==========\n  uploadedAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  deletedAt: z.date().optional().isDBIndexed().excludeFromCreate(),\n});\n\nexport const FileSchema = FileSchemaBase.superRefine((file, ctx) => {\n  validateUploaderPair(file, ctx);\n\n  if (!file.primaryScope) {\n    // Pre-link state: applicationId is always present (set from execution context at upload time),\n    // but organizationId/userId must not be set without a primaryScope discriminator.\n    if (hasFileScopeIdentifierValue(file.organizationId) || hasFileScopeIdentifierValue(file.userId)) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['primaryScope'],\n        message: 'primaryScope is required when organizationId or userId are present',\n      });\n    }\n    return;\n  }\n\n  if (!validateFileScopeIdentifiers({\n    primaryScope: file.primaryScope,\n    applicationId: file.applicationId,\n    organizationId: file.organizationId,\n    userId: file.userId,\n  })) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['primaryScope'],\n      message: 'File scope identifiers must match the declared primaryScope',\n    });\n  }\n\n});\nexport type File = z.infer<typeof FileSchema> & FileUploaderOwnership;\n\n/**\n * Scope identifiers for file access control.\n * Populated based on primaryScope when file is created/linked.\n */\nexport interface FileScopeIdentifiers {\n  primaryScope: FilePrimaryScope;\n  /** Always required — top-level tenant isolation key, set from execution context at file creation. */\n  applicationId: string;\n  organizationId?: string;\n  userId?: string;\n}\n"]}

package/dist/esm/files/files.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/files/files.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAEL,KAAK,IAAI,EACT,KAAK,oBAAoB,EAC1B,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,qBAAa,cAAc;IACzB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO;IAIrD;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAiB5E;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,oBAAoB,GAAG,IAAI;CAahE"}
+{"version":3,"file":"files.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/files/files.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAEL,KAAK,IAAI,EACT,KAAK,oBAAoB,EAC1B,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,qBAAa,cAAc;IACzB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO;IAIrD;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAiB5E;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,oBAAoB,GAAG,IAAI;CAahE"}

package/dist/esm/files/files.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.shared.utils.js","sourceRoot":"","sources":["../../../../src/files/files.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,4BAA4B,GAG7B,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,OAAO,cAAc;IACzB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,KAA2B;QACzC,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAA2B,EAAE,MAAc;QACjE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC;YAC3B,KAAK,oBAAoB,CAAC,WAAW;gBACnC,OAAO,OAAO,KAAK,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;YAChD,KAAK,oBAAoB,CAAC,aAAa;gBACrC,OAAO,OAAO,KAAK,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YACjD,KAAK,oBAAoB,CAAC,SAAS;gBACjC,OAAO,QAAQ,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;YAC1C;gBACE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAU;QAC/B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG;YACZ,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;CACF","sourcesContent":["/**\n * File Scope Utilities\n * \n * Utility class for file scope operations including validation, \n * storage path construction, and scope extraction.\n */\n\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  validateFileScopeIdentifiers,\n  type File,\n  type FileScopeIdentifiers,\n} from './files.shared.schemas';\n\n/**\n * Utility class for file scope operations.\n * All methods are static and can be called without instantiation.\n */\nexport class FileScopeUtils {\n  /**\n   * Validates that scope identifiers are consistent with primaryScope.\n   *\n   * applicationId is always required for all scope types — it is the tenant isolation field\n   * set from the execution context at file creation time, regardless of primaryScope.\n   *\n   * Rules:\n   * - APPLICATION: requires applicationId only (no organizationId, no userId)\n   * - ORGANIZATIONS: requires applicationId + organizationId (no userId)\n   * - USER_SELF: requires applicationId + userId, and NO organizationId (USER_SELF and\n   *   ORGANIZATIONS are independent primary-scope axes — a self-owned file is never org-scoped)\n   *\n   * ANONYMOUS is intentionally not supported for files yet. The file layer\n   * fails closed until anonymous file semantics are defined end to end.\n   *\n   * @param scope - The scope identifiers to validate\n   * @returns true if valid, false otherwise\n   */\n  static validate(scope: FileScopeIdentifiers): boolean {\n    return validateFileScopeIdentifiers(scope);\n  }\n\n  /**\n   * Builds storage path suffix based on scope identifiers.\n   * Full path is constructed by gateway as: applications/{appId}/environments/{appEnv}/files/{scopePath}\n   * \n   * @param scope - The scope identifiers\n   * @param fileId - The file identifier\n   * @returns Path suffix like \"org/{orgId}/{fileId}\" or \"user/{userId}/{fileId}\"\n   * @throws Error if primaryScope is unsupported or unknown\n   */\n  static buildStoragePath(scope: FileScopeIdentifiers, fileId: string): string {\n    if (!this.validate(scope)) {\n      throw new Error(`Invalid scope identifiers for primaryScope: ${scope.primaryScope}`);\n    }\n\n    switch (scope.primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        return `app/${scope.applicationId}/${fileId}`;\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        return `org/${scope.organizationId}/${fileId}`;\n      case ResourcePrimaryScope.USER_SELF:\n        return `user/${scope.userId}/${fileId}`;\n      default:\n        throw new Error(`Unknown primaryScope: ${scope.primaryScope}`);\n    }\n  }\n\n  /**\n   * Extracts scope identifiers from a File record.\n   * \n   * @param file - The file record to extract scope from\n   * @returns FileScopeIdentifiers if primaryScope is set, null otherwise\n   */\n  static extractFromFile(file: File): FileScopeIdentifiers | null {\n    if (!file.primaryScope) {\n      return null;\n    }\n    const scope = {\n      primaryScope: file.primaryScope,\n      applicationId: file.applicationId,\n      organizationId: file.organizationId,\n      userId: file.userId,\n    };\n\n    return this.validate(scope) ? scope : null;\n  }\n}\n"]}
+{"version":3,"file":"files.shared.utils.js","sourceRoot":"","sources":["../../../src/files/files.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,4BAA4B,GAG7B,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,OAAO,cAAc;IACzB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,KAA2B;QACzC,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAA2B,EAAE,MAAc;QACjE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC;YAC3B,KAAK,oBAAoB,CAAC,WAAW;gBACnC,OAAO,OAAO,KAAK,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;YAChD,KAAK,oBAAoB,CAAC,aAAa;gBACrC,OAAO,OAAO,KAAK,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YACjD,KAAK,oBAAoB,CAAC,SAAS;gBACjC,OAAO,QAAQ,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;YAC1C;gBACE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAU;QAC/B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG;YACZ,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;CACF","sourcesContent":["/**\n * File Scope Utilities\n * \n * Utility class for file scope operations including validation, \n * storage path construction, and scope extraction.\n */\n\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport {\n  validateFileScopeIdentifiers,\n  type File,\n  type FileScopeIdentifiers,\n} from './files.shared.schemas';\n\n/**\n * Utility class for file scope operations.\n * All methods are static and can be called without instantiation.\n */\nexport class FileScopeUtils {\n  /**\n   * Validates that scope identifiers are consistent with primaryScope.\n   *\n   * applicationId is always required for all scope types — it is the tenant isolation field\n   * set from the execution context at file creation time, regardless of primaryScope.\n   *\n   * Rules:\n   * - APPLICATION: requires applicationId only (no organizationId, no userId)\n   * - ORGANIZATIONS: requires applicationId + organizationId (no userId)\n   * - USER_SELF: requires applicationId + userId, and NO organizationId (USER_SELF and\n   *   ORGANIZATIONS are independent primary-scope axes — a self-owned file is never org-scoped)\n   *\n   * ANONYMOUS is intentionally not supported for files yet. The file layer\n   * fails closed until anonymous file semantics are defined end to end.\n   *\n   * @param scope - The scope identifiers to validate\n   * @returns true if valid, false otherwise\n   */\n  static validate(scope: FileScopeIdentifiers): boolean {\n    return validateFileScopeIdentifiers(scope);\n  }\n\n  /**\n   * Builds storage path suffix based on scope identifiers.\n   * Full path is constructed by gateway as: applications/{appId}/environments/{appEnv}/files/{scopePath}\n   * \n   * @param scope - The scope identifiers\n   * @param fileId - The file identifier\n   * @returns Path suffix like \"org/{orgId}/{fileId}\" or \"user/{userId}/{fileId}\"\n   * @throws Error if primaryScope is unsupported or unknown\n   */\n  static buildStoragePath(scope: FileScopeIdentifiers, fileId: string): string {\n    if (!this.validate(scope)) {\n      throw new Error(`Invalid scope identifiers for primaryScope: ${scope.primaryScope}`);\n    }\n\n    switch (scope.primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        return `app/${scope.applicationId}/${fileId}`;\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        return `org/${scope.organizationId}/${fileId}`;\n      case ResourcePrimaryScope.USER_SELF:\n        return `user/${scope.userId}/${fileId}`;\n      default:\n        throw new Error(`Unknown primaryScope: ${scope.primaryScope}`);\n    }\n  }\n\n  /**\n   * Extracts scope identifiers from a File record.\n   * \n   * @param file - The file record to extract scope from\n   * @returns FileScopeIdentifiers if primaryScope is set, null otherwise\n   */\n  static extractFromFile(file: File): FileScopeIdentifiers | null {\n    if (!file.primaryScope) {\n      return null;\n    }\n    const scope = {\n      primaryScope: file.primaryScope,\n      applicationId: file.applicationId,\n      organizationId: file.organizationId,\n      userId: file.userId,\n    };\n\n    return this.validate(scope) ? scope : null;\n  }\n}\n"]}

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,EACL,qBAAqB,EAEtB,MAAM,gDAAgD,CAAC;AAuCxD,eAAO,MAAM,sCAAsC,uVA+KlD,CAAC"}
+{"version":3,"file":"a2a-push-delivery-log.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,EACL,qBAAqB,EAEtB,MAAM,gDAAgD,CAAC;AAuCxD,eAAO,MAAM,sCAAsC,uVA+KlD,CAAC"}

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;IAC7D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;CAC1D,CAAC;AAEF,qGAAqG;AACrG,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;IAChE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,EAAE;QAClB,4FAA4F;QAC5F,8FAA8F;QAC9F,iFAAiF;QACjF,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,0FAA0F;IAC1F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,0EAA0E;IAC1E,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;OAMG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,0FAA0F;oBAC1F,yFAAyF;oBACzF,yFAAyF;oBACzF,gBAAgB,EAAE,CAAC,QAAQ,EAAE,0BAA0B,EAAE,eAAe,CAAC;oBACzE,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAU;iBAC7D,CAAC;SACH;QACD,2FAA2F;QAC3F,kFAAkF;QAClF,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,wFAAwF;QACxF,0FAA0F;QAC1F,+FAA+F;QAC/F,0FAA0F;QAC1F,+FAA+F;QAC/F,iGAAiG;QACjG,kGAAkG;QAClG,qCAAqC;QACrC,EAAE;QACF,6FAA6F;QAC7F,mGAAmG;QACnG,kGAAkG;QAClG,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,gGAAgG;QAChG,iGAAiG;QACjG,uFAAuF;QACvF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8FAA8F;QAC9F,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * A2A Push Delivery Log Resource Configuration — polymorphic across the three A2A owner scopes.\n *\n * Produces 3 factory functions (USER + ORG + APP). Spread into the registry factory map:\n *   ...a2aPushDeliveryLogPolymorphicFactories\n *\n * Operation set, and why each one is shaped the way it is:\n *   - READ / LIST / SEARCH (API)             : an owner inspects what was delivered on its behalf\n *   - CREATE               (INTERNAL_CALL)   : dispatcher-only — a delivery row is EVIDENCE, and a\n *                                              client that could author one could fabricate proof\n *                                              that a notification was sent\n *   - UPDATE               (INTERNAL_CALL)   : the worker's lifecycle transitions\n *                                              (PENDING → IN_FLIGHT → DELIVERED/FAILED)\n *   - DELETE / DELETE_MANY (REPOSITORY_ONLY) : reserved for retention purging. Deliberately NO\n *                                              external single-row delete — a trail an owner can\n *                                              selectively erase is not a trail\n *\n * **Route-lessness and TIER are two different questions, and conflating them broke this resource.**\n * `INTERNAL_CALL` and `REPOSITORY_ONLY` are both route-less — neither exposes an HTTP surface, so the\n * \"never a public mutation\" property above holds identically under either. What they differ on is which\n * tier can REACH them. CREATE and UPDATE are written by `A2APushDeliveryLogRepository` through\n * `*AsSystem` (the service tier), which resolves via `getServiceOperationPathDefault` and matches only\n * `INTERNAL_CALL` / `API_CALL`; they were authored `REPOSITORY_ONLY` and therefore threw on every write\n * until 2026-08-11. DELETE / DELETE_MANY correctly STAY `REPOSITORY_ONLY`: nothing calls them through\n * `*AsSystem` — retention purging and the owner-scope composition cascade both run at the repository\n * tier, which is exactly the tier `REPOSITORY_ONLY` serves. Enumerated deliberately rather than swept:\n * changing a variant nothing calls would have been churn, and leaving one a caller DOES reach was the bug.\n *\n * Deliberately NO `RETRY` custom operation, unlike the M2M delivery log. Retry there is an admin\n * repairing a tenant's own integration; here the caller is an external agent client, and letting it\n * re-fire deliveries on demand would hand it an amplifier pointed at a URL it also chose. Retries\n * are the worker's, on its own backoff schedule. If an operator-driven retry is ever wanted it\n * belongs on an admin surface, not on this resource.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts — the pattern\n * @see a2a-token-budget-state.shared.resources-config.schemas.ts — the 3-scope role precedent\n */\n\nimport { z } from 'zod';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport {\n  a2aPushDeliveryLogPolymorphicDeclaration,\n  A2APushDeliveryStatus,\n} from './a2a-push-delivery-log.shared.schemas';\n\n/**\n * Who may read a delivery row.\n *\n * A row names a webhook URL the owner itself registered and the outcome of contacting it. It\n * carries no message content by construction (the payload is a `statusUpdate`, never a `Task` — see\n * `a2a-push-notification-delivery.backend.utils.ts`), so owner-level read is the right bar rather\n * than an admin one: the party that configured the delivery is the party that needs to see whether\n * it worked, and forcing them to an admin to diagnose their own webhook helps nobody.\n *\n * Follows the token-budget precedent for the same three scopes.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_USER],\n};\n\n/** Writes are the dispatcher's and the worker's; the role here gates nothing reachable over HTTP. */\nconst SYSTEM_WRITE_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\nexport const a2aPushDeliveryLogPolymorphicFactories = createPolymorphicResourceConfigurations(\n  a2aPushDeliveryLogPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    /**\n     * Opt the runtime into scoped writes on the owner's behalf. Absent this, every `*AsSystem` verb\n     * fails closed.\n     *\n     * This resource follows the TASK service's pattern rather than the M2M delivery log's, and the\n     * difference is not stylistic: the M2M dispatcher runs inside the resource operation that\n     * triggered the webhook and therefore holds that operation's `ExecutionContext`, whereas a push\n     * notification is triggered by `advanceTask` — a system-owned transition with no caller context\n     * to borrow. Synthesising one at the call site would fabricate an authority nobody granted;\n     * `*AsSystem` is the door built for exactly this.\n     *\n     * No `delete` mode: nothing system-deletes a delivery row. Removal is retention purging or the\n     * owner-scope cascade, both of which run through their own paths.\n     */\n    systemAccessPolicy: {\n      // The subject's own delivery evidence — including the webhook URLs they registered. Granted\n      // because the owner can already READ/LIST/SEARCH these rows over the API, so withholding them\n      // from a subject export would make the export narrower than the product surface.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    // Art. 20 portability provenance for the field sweep this user-DEPENDENT resource enters.\n    // Every field on a delivery row is delivery mechanics the SYSTEM observed while attempting the\n    // webhook (attempt counts, timestamps, response status, the destination recorded at send time)\n    // — none of it is content the subject provided on THIS row, so the blanket default is OBSERVED,\n    // matching the A2A siblings (task, execution, token-budget state). Without this declaration the\n    // fail-closed subject-export authority refuses the whole runtime graph at companion bootstrap\n    // (\"no effective portability provenance … (undeclared)\" for every field).\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the delivered payload.\n *\n * The delivery record — what was sent, when, to which endpoint, and whether it succeeded — is the\n * operational evidence this resource exists to keep. The `payload` is not: it carries the task's own\n * content, which originated with the person, and a payload can hold anything a task held.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is work performed for a person, not the person;\n *  its owner FK names the scope the work ran in. The subject's session ends through the `USERS` row.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      CoreResourceOperation.DELETE_MANY,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `failureReason` is searchable because \"why did my webhook stop working\" is the question\n          // this resource exists to answer. `httpUrl` is NOT: it would let a caller enumerate rows\n          // by destination, and the owner already knows its own URLs from the configuration plane.\n          searchableFields: ['taskId', 'pushNotificationConfigId', 'failureReason'],\n          filterFields: {\n            status: z.enum(A2APushDeliveryStatus),\n            taskId: z.string(),\n            resourceServerInstanceRef: z.string(),\n            createdAt: z.date(),\n          },\n          sortFields: ['createdAt', 'status', 'attemptCount'] as const,\n        }],\n      },\n      // A delivery row is EVIDENCE that a notification was attempted. Authoring one from outside\n      // would let a caller fabricate that evidence — so CREATE carries NO HTTP surface.\n      //\n      // ⚠️ `INTERNAL_CALL`, not `REPOSITORY_ONLY`, and the distinction is load-bearing rather than\n      // stylistic. Both are route-less, so both withhold the surface equally; what differs is which\n      // TIER can reach them. `A2APushDeliveryLogRepository` writes through `*AsSystem`, which\n      // dispatches via the service tier and resolves through `getServiceOperationPathDefault` —\n      // matching only `INTERNAL_CALL` / `API_CALL`. This op was authored `REPOSITORY_ONLY`, so every\n      // `open()` threw `resources_registry_operation_path_not_found`, the dispatcher's no-throw\n      // contract swallowed it at WARN, and the whole push-delivery feature was inert for eleven days\n      // while the agent card advertised it (measured 2026-08-11 by the live lane; the config was green\n      // at boot throughout, because a variant satisfies every \"the op exists\" check and fails only when\n      // a service-tier caller invokes it).\n      //\n      // The sibling `flows-actors-task` config states the same rule for the same reason and is the\n      // pattern this follows: \"INTERNAL_CALL (not REPOSITORY_ONLY) is mandatory\". Keep the two in step —\n      // both are written by the A2A runtime through `*AsSystem`, governed by `systemAccessPolicy` above\n      // rather than by the op RBAC (`SYSTEM_WRITE_ROLES` gates nothing reachable here).\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // The worker's lifecycle transitions, reached through `updateAsSystem` — so `INTERNAL_CALL` for\n      // exactly the reason CREATE is, and broken the same way while it was not. Still no HTTP surface:\n      // exposing UPDATE would let a caller mark its own undelivered notifications DELIVERED.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Retention purging. Bulk twin of DELETE, and REPOSITORY_ONLY for the same reason: a trail an\n      // owner can selectively erase is not a trail.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"a2a-push-delivery-log.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;IAC7D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;CAC1D,CAAC;AAEF,qGAAqG;AACrG,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;IAChE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,EAAE;QAClB,4FAA4F;QAC5F,8FAA8F;QAC9F,iFAAiF;QACjF,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,0FAA0F;IAC1F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,0EAA0E;IAC1E,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;OAMG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,0FAA0F;oBAC1F,yFAAyF;oBACzF,yFAAyF;oBACzF,gBAAgB,EAAE,CAAC,QAAQ,EAAE,0BAA0B,EAAE,eAAe,CAAC;oBACzE,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAU;iBAC7D,CAAC;SACH;QACD,2FAA2F;QAC3F,kFAAkF;QAClF,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,wFAAwF;QACxF,0FAA0F;QAC1F,+FAA+F;QAC/F,0FAA0F;QAC1F,+FAA+F;QAC/F,iGAAiG;QACjG,kGAAkG;QAClG,qCAAqC;QACrC,EAAE;QACF,6FAA6F;QAC7F,mGAAmG;QACnG,kGAAkG;QAClG,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,gGAAgG;QAChG,iGAAiG;QACjG,uFAAuF;QACvF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8FAA8F;QAC9F,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,kBAAkB;oBACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * A2A Push Delivery Log Resource Configuration — polymorphic across the three A2A owner scopes.\n *\n * Produces 3 factory functions (USER + ORG + APP). Spread into the registry factory map:\n *   ...a2aPushDeliveryLogPolymorphicFactories\n *\n * Operation set, and why each one is shaped the way it is:\n *   - READ / LIST / SEARCH (API)             : an owner inspects what was delivered on its behalf\n *   - CREATE               (INTERNAL_CALL)   : dispatcher-only — a delivery row is EVIDENCE, and a\n *                                              client that could author one could fabricate proof\n *                                              that a notification was sent\n *   - UPDATE               (INTERNAL_CALL)   : the worker's lifecycle transitions\n *                                              (PENDING → IN_FLIGHT → DELIVERED/FAILED)\n *   - DELETE / DELETE_MANY (REPOSITORY_ONLY) : reserved for retention purging. Deliberately NO\n *                                              external single-row delete — a trail an owner can\n *                                              selectively erase is not a trail\n *\n * **Route-lessness and TIER are two different questions, and conflating them broke this resource.**\n * `INTERNAL_CALL` and `REPOSITORY_ONLY` are both route-less — neither exposes an HTTP surface, so the\n * \"never a public mutation\" property above holds identically under either. What they differ on is which\n * tier can REACH them. CREATE and UPDATE are written by `A2APushDeliveryLogRepository` through\n * `*AsSystem` (the service tier), which resolves via `getServiceOperationPathDefault` and matches only\n * `INTERNAL_CALL` / `API_CALL`; they were authored `REPOSITORY_ONLY` and therefore threw on every write\n * until 2026-08-11. DELETE / DELETE_MANY correctly STAY `REPOSITORY_ONLY`: nothing calls them through\n * `*AsSystem` — retention purging and the owner-scope composition cascade both run at the repository\n * tier, which is exactly the tier `REPOSITORY_ONLY` serves. Enumerated deliberately rather than swept:\n * changing a variant nothing calls would have been churn, and leaving one a caller DOES reach was the bug.\n *\n * Deliberately NO `RETRY` custom operation, unlike the M2M delivery log. Retry there is an admin\n * repairing a tenant's own integration; here the caller is an external agent client, and letting it\n * re-fire deliveries on demand would hand it an amplifier pointed at a URL it also chose. Retries\n * are the worker's, on its own backoff schedule. If an operator-driven retry is ever wanted it\n * belongs on an admin surface, not on this resource.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.ts — the pattern\n * @see a2a-token-budget-state.shared.resources-config.schemas.ts — the 3-scope role precedent\n */\n\nimport { z } from 'zod';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport {\n  a2aPushDeliveryLogPolymorphicDeclaration,\n  A2APushDeliveryStatus,\n} from './a2a-push-delivery-log.shared.schemas';\n\n/**\n * Who may read a delivery row.\n *\n * A row names a webhook URL the owner itself registered and the outcome of contacting it. It\n * carries no message content by construction (the payload is a `statusUpdate`, never a `Task` — see\n * `a2a-push-notification-delivery.backend.utils.ts`), so owner-level read is the right bar rather\n * than an admin one: the party that configured the delivery is the party that needs to see whether\n * it worked, and forcing them to an admin to diagnose their own webhook helps nobody.\n *\n * Follows the token-budget precedent for the same three scopes.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_USER],\n};\n\n/** Writes are the dispatcher's and the worker's; the role here gates nothing reachable over HTTP. */\nconst SYSTEM_WRITE_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\nexport const a2aPushDeliveryLogPolymorphicFactories = createPolymorphicResourceConfigurations(\n  a2aPushDeliveryLogPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    /**\n     * Opt the runtime into scoped writes on the owner's behalf. Absent this, every `*AsSystem` verb\n     * fails closed.\n     *\n     * This resource follows the TASK service's pattern rather than the M2M delivery log's, and the\n     * difference is not stylistic: the M2M dispatcher runs inside the resource operation that\n     * triggered the webhook and therefore holds that operation's `ExecutionContext`, whereas a push\n     * notification is triggered by `advanceTask` — a system-owned transition with no caller context\n     * to borrow. Synthesising one at the call site would fabricate an authority nobody granted;\n     * `*AsSystem` is the door built for exactly this.\n     *\n     * No `delete` mode: nothing system-deletes a delivery row. Removal is retention purging or the\n     * owner-scope cascade, both of which run through their own paths.\n     */\n    systemAccessPolicy: {\n      // The subject's own delivery evidence — including the webhook URLs they registered. Granted\n      // because the owner can already READ/LIST/SEARCH these rows over the API, so withholding them\n      // from a subject export would make the export narrower than the product surface.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    // Art. 20 portability provenance for the field sweep this user-DEPENDENT resource enters.\n    // Every field on a delivery row is delivery mechanics the SYSTEM observed while attempting the\n    // webhook (attempt counts, timestamps, response status, the destination recorded at send time)\n    // — none of it is content the subject provided on THIS row, so the blanket default is OBSERVED,\n    // matching the A2A siblings (task, execution, token-budget state). Without this declaration the\n    // fail-closed subject-export authority refuses the whole runtime graph at companion bootstrap\n    // (\"no effective portability provenance … (undeclared)\" for every field).\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs the delivered payload.\n *\n * The delivery record — what was sent, when, to which endpoint, and whether it succeeded — is the\n * operational evidence this resource exists to keep. The `payload` is not: it carries the task's own\n * content, which originated with the person, and a payload can hold anything a task held.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is work performed for a person, not the person;\n *  its owner FK names the scope the work ran in. The subject's session ends through the `USERS` row.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.SEARCH,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n      CoreResourceOperation.DELETE_MANY,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n    operationsConfiguration: {\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n       * verb the impersonalize writer uses to stamp the retention markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.SEARCH]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `failureReason` is searchable because \"why did my webhook stop working\" is the question\n          // this resource exists to answer. `httpUrl` is NOT: it would let a caller enumerate rows\n          // by destination, and the owner already knows its own URLs from the configuration plane.\n          searchableFields: ['taskId', 'pushNotificationConfigId', 'failureReason'],\n          filterFields: {\n            status: z.enum(A2APushDeliveryStatus),\n            taskId: z.string(),\n            resourceServerInstanceRef: z.string(),\n            createdAt: z.date(),\n          },\n          sortFields: ['createdAt', 'status', 'attemptCount'] as const,\n        }],\n      },\n      // A delivery row is EVIDENCE that a notification was attempted. Authoring one from outside\n      // would let a caller fabricate that evidence — so CREATE carries NO HTTP surface.\n      //\n      // ⚠️ `INTERNAL_CALL`, not `REPOSITORY_ONLY`, and the distinction is load-bearing rather than\n      // stylistic. Both are route-less, so both withhold the surface equally; what differs is which\n      // TIER can reach them. `A2APushDeliveryLogRepository` writes through `*AsSystem`, which\n      // dispatches via the service tier and resolves through `getServiceOperationPathDefault` —\n      // matching only `INTERNAL_CALL` / `API_CALL`. This op was authored `REPOSITORY_ONLY`, so every\n      // `open()` threw `resources_registry_operation_path_not_found`, the dispatcher's no-throw\n      // contract swallowed it at WARN, and the whole push-delivery feature was inert for eleven days\n      // while the agent card advertised it (measured 2026-08-11 by the live lane; the config was green\n      // at boot throughout, because a variant satisfies every \"the op exists\" check and fails only when\n      // a service-tier caller invokes it).\n      //\n      // The sibling `flows-actors-task` config states the same rule for the same reason and is the\n      // pattern this follows: \"INTERNAL_CALL (not REPOSITORY_ONLY) is mandatory\". Keep the two in step —\n      // both are written by the A2A runtime through `*AsSystem`, governed by `systemAccessPolicy` above\n      // rather than by the op RBAC (`SYSTEM_WRITE_ROLES` gates nothing reachable here).\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // The worker's lifecycle transitions, reached through `updateAsSystem` — so `INTERNAL_CALL` for\n      // exactly the reason CREATE is, and broken the same way while it was not. Still no HTTP surface:\n      // exposing UPDATE would let a caller mark its own undelivered notifications DELIVERED.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Retention purging. Bulk twin of DELETE, and REPOSITORY_ONLY for the same reason: a trail an\n      // owner can selectively erase is not a trail.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SYSTEM_WRITE_ROLES,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;iBAqFnC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,EAAE,4BAA4B,EAI1E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;kBAMnD,CAAC"}
+{"version":3,"file":"a2a-push-delivery-log.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;iBAqFnC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,EAAE,4BAA4B,EAI1E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;kBAMnD,CAAC"}

package/dist/esm/flows-actors/a2a-push-delivery-log.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAE/E,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;AACnB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExD,qFAAqF;IACrF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE5D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3E;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD,sGAAsG;IACtG,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,iGAAiG;IACjG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,6FAA6F;IAC7F,+FAA+F;IAC/F,qGAAqG;IACrG,yGAAyG;IACzG,iDAAiD;IACjD,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC,EACjE,aAAa,CAAC,MAAM,CACrB;IAED,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,qBAAqB,CAAC;SAC3B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,+FAA+F;IAC/F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,cAAc,EAAE;CACpB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAmC;IAC9E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,WAAW,EAAE,uBAAuB;IACpC,UAAU,EAAE,wBAAwB;IACpC,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/**\n * A2A push-notification delivery log — one row per (task state change × registered webhook).\n *\n * ## Why this is a SIBLING of the M2M webhook delivery log rather than a variant of it\n *\n * The two share a delivery PATTERN — write the row before enqueueing, one queue job per row, the\n * worker classifies the response and either retries or terminates — and that pattern is reused\n * deliberately, down to the transport primitive. What they do not share is a SCOPE SET:\n * `M2MWebhookDeliveryLog` is stamped out for `ORGANIZATIONS` and `APPLICATION`, while an A2A task\n * can be owned by a **USER** as well. A delegated-user A2A caller is the ordinary case, not an edge\n * one, so extending the M2M resource would have meant adding a user-scoped variant — a whole\n * user-facing resource surface — to a shipped feature on behalf of a different subsystem.\n *\n * Keeping them separate also keeps the two producers separable in every query: a resource-operation\n * notification and a task-lifecycle notification are different facts about different things, and an\n * operator filtering one should never have to exclude the other by hand.\n *\n * ## Why the row is written BEFORE the delivery is attempted\n *\n * Copied from the M2M dispatcher's reasoning, because it is the property that makes this table\n * worth having: if the worker created the row on its first attempt, an unreachable queue would\n * leave no trace at all. Writing it up front means an operator always sees an entry per\n * (task transition × webhook), including the deliveries that never got as far as being tried.\n *\n * spec-cite: A2A 1.0 §4.3.3 — *\"Agents MUST attempt delivery at least once for each configured\n * webhook\"* — and §13.2, which asks for retry with exponential backoff and permits giving up after\n * a configured number of consecutive failures. This row is where all three become observable.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts — the pattern this mirrors\n * @see a2a-token-budget-state.shared.schemas.ts — the 3-scope A2A polymorphic precedent\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories, initZodDecorators, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  optOutPolymorphicAutoBusinessKey,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\n/**\n * The delivery lifecycle:\n *   PENDING → IN_FLIGHT → DELIVERED   (acknowledged with 2xx)\n *   PENDING → IN_FLIGHT → PENDING     (transient failure — retry scheduled with backoff)\n *   PENDING → IN_FLIGHT → FAILED      (terminal — non-retryable status, or attempts exhausted)\n *\n * Deliberately its OWN enum rather than a reuse of `M2MWebhookDeliveryLogStatus`, even though the\n * members coincide. That enum is named for, and owned by, the M2M notifications feature; importing\n * it here would couple flows-actors to that subsystem's release cycle for no gain, and would make\n * either feature's future state change a cross-feature edit. If a third outbound-delivery consumer\n * ever appears, the answer is to extract ONE shared vocabulary — not to have the second consumer\n * borrow the first one's.\n */\nexport enum A2APushDeliveryStatus {\n  PENDING = 'pending',\n  IN_FLIGHT = 'in_flight',\n  DELIVERED = 'delivered',\n  FAILED = 'failed',\n}\n\nexport const A2APushDeliveryLogSchema = z.object({\n  /** Document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The stable identity of this delivery, generated once when the row is written and sent with\n   * every attempt so a receiver can deduplicate.\n   *\n   * spec-cite: A2A 1.0 §4.3.3 — *\"Clients SHOULD process notifications idempotently, as duplicate\n   * deliveries may occur\"*. A client can only honour that if duplicates are RECOGNISABLE, which\n   * means the id must be stable across retries — hence generated at row creation, never per attempt.\n   */\n  deliveryId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The task whose transition triggered this notification. */\n  taskId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** Which registered configuration this row delivers to — a task may have several. */\n  pushNotificationConfigId: z.string().min(1).isSummaryField(),\n\n  /**\n   * The agent instance the task belongs to. Carried so an operator can attribute deliveries per\n   * agent, and so a per-instance purge never reaches another agent's rows — the same isolation\n   * axis the task read enforces.\n   */\n  resourceServerInstanceRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The machine credential that owns the task, when one does.\n   *\n   * Carried because the worker must RE-READ the live configuration to obtain the client's\n   * credential (see the worker for why the secret is not copied onto this row), and that read\n   * enforces all four isolation axes. Without this field the read falls back to the \"no credential\"\n   * sentinel and matches nothing for any task a machine client created — which is most A2A tasks,\n   * since client-credentials auth is the ordinary way an agent connects.\n   *\n   * Optional rather than sentinel-defaulted: a delegated-user task genuinely has no machine\n   * credential, and storing a sentinel here would make \"absent\" and \"explicitly none\" the same\n   * value on a row whose whole job is to be evidence.\n   */\n  machineCredentialId: z.string().min(1).optional(),\n\n  /** The destination, captured as it was AT DISPATCH — a later config edit must not rewrite history. */\n  httpUrl: z.url(),\n\n  payloadHash: z.string().min(1),\n  // USER_CONTENT — the delivered payload carries the task's own content, which originated with the\n  // person. The declaration says what the field is FOR; a payload can hold anything a task held.\n  //\n  // `addDataCategories` rather than the fluent form: `z.unknown()` is one of the types that carry NO\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one), so\n  // `.dataCategories(...)` does not type-check on it. The helper is the documented escape hatch.\n  // REMOVE on erasure. The delivered payload carries the task's own content, which originated with the\n  // person — so it is content this row HOLDS. `z.unknown()` accepts null, so REMOVE is clearable here even\n  // though the field is not written `.optional()`.\n  payload: addImpersonalizeWith(\n    addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n\n  status: z\n    .enum(A2APushDeliveryStatus)\n    .default(A2APushDeliveryStatus.PENDING)\n    .isDBIndexed()\n    .isSummaryField(),\n\n  attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n  lastAttemptAt: z.date().optional(),\n  /** When the next retry becomes eligible. Indexed — this is the worker's drain query. */\n  nextAttemptAt: z.date().optional().isDBIndexed(),\n\n  responseStatus: z.number().int().optional(),\n  /** Truncated by the worker before persistence: a webhook may answer with an unbounded body. */\n  responseBodyTruncated: z.string().optional(),\n  failureReason: z.string().optional().isSummaryField(),\n\n  deliveredAt: z.date().optional(),\n  failedAt: z.date().optional(),\n\n  createdAt: z\n    .date()\n    .default(() => new Date())\n    .isDBIndexed()\n    .isSummaryField(),\n});\n\nexport type A2APushDeliveryLogBase = z.infer<typeof A2APushDeliveryLogSchema>;\n\n/**\n * The three owner scopes an A2A task — and therefore its deliveries — can belong to.\n *\n * Mirrors `flowActorTasksPolymorphicDeclaration`'s scope set exactly, and must keep mirroring it: a\n * task owner with no delivery-log variant is a task whose notifications cannot be recorded, which\n * is the audit hole this table exists to close.\n */\nexport const A2A_PUSH_DELIVERY_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Produces 3 variants:\n *   - users         → `userA2aPushDeliveryLog`        (`userId` injected)\n *   - organizations → `organizationA2aPushDeliveryLog` (`organizationId` injected)\n *   - applications  → `applicationA2aPushDeliveryLog`  (`applicationId` injected)\n *\n * Multi-row, so it opts OUT of the singleton auto-business-key: unlike the token-budget\n * accumulator, there are many delivery rows per owner and the owner FK is not their identity.\n */\nexport const a2aPushDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aPushDeliveryLog',\n  baseFieldIdentifier: 'a2aPushDeliveryLogId',\n  baseEnumKey: 'A2A_PUSH_DELIVERY_LOG',\n  baseSchema: A2APushDeliveryLogSchema,\n  variants: A2A_PUSH_DELIVERY_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"a2a-push-delivery-log.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/a2a-push-delivery-log.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAE/E,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;AACnB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE5D,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExD,qFAAqF;IACrF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE5D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3E;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD,sGAAsG;IACtG,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAEhB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,iGAAiG;IACjG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,6FAA6F;IAC7F,+FAA+F;IAC/F,qGAAqG;IACrG,yGAAyG;IACzG,iDAAiD;IACjD,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC,EACjE,aAAa,CAAC,MAAM,CACrB;IAED,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,qBAAqB,CAAC;SAC3B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,cAAc,EAAE;IAEnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAExE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,+FAA+F;IAC/F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAErD,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE7B,SAAS,EAAE,CAAC;SACT,IAAI,EAAE;SACN,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,cAAc,EAAE;CACpB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAmC;IAC9E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,WAAW,EAAE,uBAAuB;IACpC,UAAU,EAAE,wBAAwB;IACpC,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACjF,CAAC,CAAC","sourcesContent":["/**\n * A2A push-notification delivery log — one row per (task state change × registered webhook).\n *\n * ## Why this is a SIBLING of the M2M webhook delivery log rather than a variant of it\n *\n * The two share a delivery PATTERN — write the row before enqueueing, one queue job per row, the\n * worker classifies the response and either retries or terminates — and that pattern is reused\n * deliberately, down to the transport primitive. What they do not share is a SCOPE SET:\n * `M2MWebhookDeliveryLog` is stamped out for `ORGANIZATIONS` and `APPLICATION`, while an A2A task\n * can be owned by a **USER** as well. A delegated-user A2A caller is the ordinary case, not an edge\n * one, so extending the M2M resource would have meant adding a user-scoped variant — a whole\n * user-facing resource surface — to a shipped feature on behalf of a different subsystem.\n *\n * Keeping them separate also keeps the two producers separable in every query: a resource-operation\n * notification and a task-lifecycle notification are different facts about different things, and an\n * operator filtering one should never have to exclude the other by hand.\n *\n * ## Why the row is written BEFORE the delivery is attempted\n *\n * Copied from the M2M dispatcher's reasoning, because it is the property that makes this table\n * worth having: if the worker created the row on its first attempt, an unreachable queue would\n * leave no trace at all. Writing it up front means an operator always sees an entry per\n * (task transition × webhook), including the deliveries that never got as far as being tried.\n *\n * spec-cite: A2A 1.0 §4.3.3 — *\"Agents MUST attempt delivery at least once for each configured\n * webhook\"* — and §13.2, which asks for retry with exponential backoff and permits giving up after\n * a configured number of consecutive failures. This row is where all three become observable.\n *\n * @see notifications/m2m/m2m-webhook-delivery-log.shared.schemas.ts — the pattern this mirrors\n * @see a2a-token-budget-state.shared.schemas.ts — the 3-scope A2A polymorphic precedent\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories, initZodDecorators, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  optOutPolymorphicAutoBusinessKey,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\n/**\n * The delivery lifecycle:\n *   PENDING → IN_FLIGHT → DELIVERED   (acknowledged with 2xx)\n *   PENDING → IN_FLIGHT → PENDING     (transient failure — retry scheduled with backoff)\n *   PENDING → IN_FLIGHT → FAILED      (terminal — non-retryable status, or attempts exhausted)\n *\n * Deliberately its OWN enum rather than a reuse of `M2MWebhookDeliveryLogStatus`, even though the\n * members coincide. That enum is named for, and owned by, the M2M notifications feature; importing\n * it here would couple flows-actors to that subsystem's release cycle for no gain, and would make\n * either feature's future state change a cross-feature edit. If a third outbound-delivery consumer\n * ever appears, the answer is to extract ONE shared vocabulary — not to have the second consumer\n * borrow the first one's.\n */\nexport enum A2APushDeliveryStatus {\n  PENDING = 'pending',\n  IN_FLIGHT = 'in_flight',\n  DELIVERED = 'delivered',\n  FAILED = 'failed',\n}\n\nexport const A2APushDeliveryLogSchema = z.object({\n  /** Document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The stable identity of this delivery, generated once when the row is written and sent with\n   * every attempt so a receiver can deduplicate.\n   *\n   * spec-cite: A2A 1.0 §4.3.3 — *\"Clients SHOULD process notifications idempotently, as duplicate\n   * deliveries may occur\"*. A client can only honour that if duplicates are RECOGNISABLE, which\n   * means the id must be stable across retries — hence generated at row creation, never per attempt.\n   */\n  deliveryId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The task whose transition triggered this notification. */\n  taskId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** Which registered configuration this row delivers to — a task may have several. */\n  pushNotificationConfigId: z.string().min(1).isSummaryField(),\n\n  /**\n   * The agent instance the task belongs to. Carried so an operator can attribute deliveries per\n   * agent, and so a per-instance purge never reaches another agent's rows — the same isolation\n   * axis the task read enforces.\n   */\n  resourceServerInstanceRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The machine credential that owns the task, when one does.\n   *\n   * Carried because the worker must RE-READ the live configuration to obtain the client's\n   * credential (see the worker for why the secret is not copied onto this row), and that read\n   * enforces all four isolation axes. Without this field the read falls back to the \"no credential\"\n   * sentinel and matches nothing for any task a machine client created — which is most A2A tasks,\n   * since client-credentials auth is the ordinary way an agent connects.\n   *\n   * Optional rather than sentinel-defaulted: a delegated-user task genuinely has no machine\n   * credential, and storing a sentinel here would make \"absent\" and \"explicitly none\" the same\n   * value on a row whose whole job is to be evidence.\n   */\n  machineCredentialId: z.string().min(1).optional(),\n\n  /** The destination, captured as it was AT DISPATCH — a later config edit must not rewrite history. */\n  httpUrl: z.url(),\n\n  payloadHash: z.string().min(1),\n  // USER_CONTENT — the delivered payload carries the task's own content, which originated with the\n  // person. The declaration says what the field is FOR; a payload can hold anything a task held.\n  //\n  // `addDataCategories` rather than the fluent form: `z.unknown()` is one of the types that carry NO\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one), so\n  // `.dataCategories(...)` does not type-check on it. The helper is the documented escape hatch.\n  // REMOVE on erasure. The delivered payload carries the task's own content, which originated with the\n  // person — so it is content this row HOLDS. `z.unknown()` accepts null, so REMOVE is clearable here even\n  // though the field is not written `.optional()`.\n  payload: addImpersonalizeWith(\n    addDataCategories(z.unknown(), PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n\n  status: z\n    .enum(A2APushDeliveryStatus)\n    .default(A2APushDeliveryStatus.PENDING)\n    .isDBIndexed()\n    .isSummaryField(),\n\n  attemptCount: z.number().int().nonnegative().default(0).isSummaryField(),\n\n  lastAttemptAt: z.date().optional(),\n  /** When the next retry becomes eligible. Indexed — this is the worker's drain query. */\n  nextAttemptAt: z.date().optional().isDBIndexed(),\n\n  responseStatus: z.number().int().optional(),\n  /** Truncated by the worker before persistence: a webhook may answer with an unbounded body. */\n  responseBodyTruncated: z.string().optional(),\n  failureReason: z.string().optional().isSummaryField(),\n\n  deliveredAt: z.date().optional(),\n  failedAt: z.date().optional(),\n\n  createdAt: z\n    .date()\n    .default(() => new Date())\n    .isDBIndexed()\n    .isSummaryField(),\n});\n\nexport type A2APushDeliveryLogBase = z.infer<typeof A2APushDeliveryLogSchema>;\n\n/**\n * The three owner scopes an A2A task — and therefore its deliveries — can belong to.\n *\n * Mirrors `flowActorTasksPolymorphicDeclaration`'s scope set exactly, and must keep mirroring it: a\n * task owner with no delivery-log variant is a task whose notifications cannot be recorded, which\n * is the audit hole this table exists to close.\n */\nexport const A2A_PUSH_DELIVERY_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Produces 3 variants:\n *   - users         → `userA2aPushDeliveryLog`        (`userId` injected)\n *   - organizations → `organizationA2aPushDeliveryLog` (`organizationId` injected)\n *   - applications  → `applicationA2aPushDeliveryLog`  (`applicationId` injected)\n *\n * Multi-row, so it opts OUT of the singleton auto-business-key: unlike the token-budget\n * accumulator, there are many delivery rows per owner and the owner FK is not their identity.\n */\nexport const a2aPushDeliveryLogPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aPushDeliveryLog',\n  baseFieldIdentifier: 'a2aPushDeliveryLogId',\n  baseEnumKey: 'A2A_PUSH_DELIVERY_LOG',\n  baseSchema: A2APushDeliveryLogSchema,\n  variants: A2A_PUSH_DELIVERY_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AA4BzG;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,qPA8InD,CAAC"}
+{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gDAAgD,CAAC;AA4BzG;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,qPA8InD,CAAC"}