@wildo-ai/saas-models 1.1.9 → 1.1.10

package/dist/esm/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,yCAAyC,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;IAC7D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,uCAAuC,CAC5F,yCAAyC,EACzC;IACE,gBAAgB,EAAE,IAAI;IAEtB,sFAAsF;IACtF,4EAA4E;IAC5E,8FAA8F;IAC9F,uFAAuF;IACvF,kBAAkB,EAAE;QAClB,uSAAuS;QACvS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;OAUG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;;;;;WAYG;QAEH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAE5B,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAE1C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,0FAA0F;QAC1F,0FAA0F;QAC1F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,0FAA0F;QAC1F,oFAAoF;QACpF,2FAA2F;QAC3F,qFAAqF;QACrF,iEAAiE;QACjE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,2FAA2F;QAC3F,yFAAyF;QAEzF,yFAAyF;QACzF,0EAA0E;QAC1E,EAAE;QACF,uFAAuF;QACvF,qFAAqF;QACrF,yFAAyF;QACzF,qFAAqF;QACrF,0DAA0D;QAC1D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * A2A Token Budget State — Resource Configuration (POLYMORPHIC SINGLETON)\n * ======================================================================\n *\n * The per-tenant A2A LLM token-budget accumulator, stamped out as THREE owner-scope\n * singleton variants from one polymorphic declaration (`userA2aTokenBudgetState` /\n * `organizationA2aTokenBudgetState` / `applicationA2aTokenBudgetState`). Spread the\n * produced factories into the registry factory map:\n *   ...a2aTokenBudgetStatePolymorphicFactories\n *\n * Access model — SYSTEM-WRITTEN, OWNER-READABLE:\n *   - This is internal enforcement state, not user-authored data: only the A2A runtime WRITES\n *     it, via `*AsSystem` (governed by `systemAccessPolicy`). The tenant may READ its own row\n *     (a usage view: \"how much of my allowance have I used?\"), but never authors it.\n *   - CREATE (`INTERNAL_CALL` super-admin, no explicit request DTO — it auto-derives per variant so\n *     the injected owner FK is required on the correct variant) opens the singleton on the first\n *     budgeted turn, via `createAsSystem`. `INTERNAL_CALL` (not `REPOSITORY_ONLY`) is mandatory\n *     here: `*AsSystem` dispatches through the service tier and resolves the op via\n *     `getServiceOperationPathDefault`, which only matches INTERNAL_CALL / API_CALL variants.\n *   - There is deliberately NO `UPDATE` operation. Advancing the counter is an ATOMIC increment\n *     (`RepositoriesRegistryHandlerBackendService.atomicIncrementField`) executed at the repository\n *     tier, precisely so concurrent turns cannot lose tokens to a read-modify-write race — a\n *     service-tier UPDATE cannot express that. Declaring an `UPDATE` op (with a DTO and a\n *     `systemAccessPolicy.update` grant) would therefore be dead configuration describing a write\n *     path nothing takes, and would invite a future contributor to route the counter through it and\n *     silently reintroduce the race.\n *   - DELETE is `INTERNAL_CALL` super-admin: it exists to satisfy the composition `onParentDelete`\n *     cascade teardown (which runs at the repository tier and selects the operation-default DELETE,\n *     irrespective of variant type), NOT to offer an HTTP surface. Deliberately NOT `API_CALL`:\n *     zeroing this row zeroes recorded consumption, which is a SPEND-CAP BYPASS, so it gets no URL\n *     at all — strictly stronger than relying on a role floor. (The role floor is nevertheless\n *     platform-only for defence in depth.)\n *   - READ is the ONE `API_CALL`, and it is owner-level on its own merit: a tenant inspecting its\n *     own consumption (\"how much of my allowance have I used?\"). It is read-only, so it cannot\n *     affect the cap.\n *\n * CASCADE NOTE (recorded because it was initially mis-diagnosed): the cascade's requirement is a\n * cardinality-appropriate DISCOVERY op + a DELETE teardown op — for a 1:1 child that is READ, for\n * 1:many it is LIST. It does NOT require a URL-isable variant: `supportsOperation` checks only\n * `isOperationDefault`, and a sole `INTERNAL_CALL` variant is the default within its own group.\n * The guard violation seen while building this resource came from the relationship declaring\n * `childCardinality: MANY` (the helper's default) on a SINGLETON — which demanded LIST, not READ.\n * Fixing the cardinality fixed it; verified by reverting DELETE to `INTERNAL_CALL` with the guard\n * still green.\n *\n * @see a2a-token-budget-state.shared.schemas.ts — the polymorphic declaration + base schema\n * @see flows-actors-execution.shared.resources-config.schemas.ts — the 3-scope polymorphic config precedent\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { a2aTokenBudgetStatePolymorphicDeclaration } from './a2a-token-budget-state.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Per-variant OWNER-READ role map. A tenant may inspect its OWN budget consumption (a\n * read-only usage view: \"how much of my allowance have I used?\"). The scope authorizer +\n * contextual filter isolate rows to the owner; the role is the operation floor.\n *\n * The APPLICATION variant is intentionally `APP_USER`, matching the `flowActorExecutions`\n * precedent: app-scope rows are app-wide state, so any authenticated app user can read the\n * application's aggregate A2A consumption. Tighten to an admin role if that telemetry is ever\n * considered sensitive — it reveals platform usage volume, not tenant content.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_USER],\n};\n\n/**\n * Polymorphic factory map for the A2A token budget state. Spread into\n * `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...a2aTokenBudgetStatePolymorphicFactories\n *\n * Produces entries for:\n *   - userA2aTokenBudgetState\n *   - organizationA2aTokenBudgetState\n *   - applicationA2aTokenBudgetState\n */\nexport const a2aTokenBudgetStatePolymorphicFactories = createPolymorphicResourceConfigurations(\n  a2aTokenBudgetStatePolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    // Opt the A2A runtime (system actor) into scoped writes/reads on the tenant's behalf.\n    // Absent this, every `*AsSystem` verb fails closed. Shared by all variants.\n    // No `update` grant: the counter is advanced by an atomic repository-tier increment, never by\n    // `updateAsSystem` (see the header). Granting it would authorise a path nothing takes.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own token-budget state. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is a\n * token-consumption accumulator: counters, a window boundary and the owner scope key. It declares no\n * personal-data category, and its only link to a person is the scope FK, which the never-scrub floor\n * protects in every mode.\n *\n * The assertion is CHECKED in both directions — the factory refuses `RETAIN_ONLY` if any field carries an\n * impersonalize treatment, and if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR whose\n *  spend it accumulates — and the enum prescribes `NO_PRINCIPAL` for that shape. The subject's own session\n *  ends through the `USERS` row.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n\n       * verb the impersonalize writer uses to stamp the retention markers.\n\n       */\n\n      [CoreResourceOperation.LIST]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.LOW,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      // === CREATE === runtime opens the singleton on the first budgeted turn (createAsSystem).\n      // No explicit request DTO: auto-derives per variant so the injected owner FK is required.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // === READ === the owner inspects its own consumption AND the runtime loads the singleton\n      // for the pre-dispatch budget check (readAsSystem). `API_CALL` on its own merit — a\n      // tenant-facing usage view — and read-only, so owner-level roles cannot affect the cap. It\n      // ALSO serves as the cascade's 1:1 discovery op, though that would be satisfied by a\n      // non-URL variant too (see the CASCADE NOTE in the file header).\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // (No UPDATE operation — the counter is advanced by an atomic repository-tier increment so\n      // concurrent turns cannot lose tokens to a read-modify-write race. See the file header.)\n\n      // === DELETE === teardown for the composition `onParentDelete` cascade (repository tier,\n      // which selects the operation-default DELETE regardless of variant type).\n      //\n      // ⚠️ DELIBERATELY `INTERNAL_CALL` — NO HTTP ROUTE AT ALL. Deleting this row ZEROES the\n      // tenant's recorded consumption, i.e. a SPEND-CAP BYPASS, so the strongest available\n      // protection is to expose no URL rather than to guard one with a role. The platform-only\n      // (`APP_ADMIN_SUPER_ADMIN`) floor is defence in depth on top of that. The cascade is\n      // unaffected: it runs below both routing and role checks.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"a2a-token-budget-state.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,yCAAyC,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;IAC7D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,uCAAuC,CAC5F,yCAAyC,EACzC;IACE,gBAAgB,EAAE,IAAI;IAEtB,sFAAsF;IACtF,4EAA4E;IAC5E,8FAA8F;IAC9F,uFAAuF;IACvF,kBAAkB,EAAE;QAClB,uSAAuS;QACvS,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;OAUG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;;;;;WAYG;QAEH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAE5B,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAE1C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,0FAA0F;QAC1F,0FAA0F;QAC1F,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,0FAA0F;QAC1F,oFAAoF;QACpF,2FAA2F;QAC3F,qFAAqF;QACrF,iEAAiE;QACjE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QAED,2FAA2F;QAC3F,yFAAyF;QAEzF,yFAAyF;QACzF,0EAA0E;QAC1E,EAAE;QACF,uFAAuF;QACvF,qFAAqF;QACrF,yFAAyF;QACzF,qFAAqF;QACrF,0DAA0D;QAC1D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * A2A Token Budget State — Resource Configuration (POLYMORPHIC SINGLETON)\n * ======================================================================\n *\n * The per-tenant A2A LLM token-budget accumulator, stamped out as THREE owner-scope\n * singleton variants from one polymorphic declaration (`userA2aTokenBudgetState` /\n * `organizationA2aTokenBudgetState` / `applicationA2aTokenBudgetState`). Spread the\n * produced factories into the registry factory map:\n *   ...a2aTokenBudgetStatePolymorphicFactories\n *\n * Access model — SYSTEM-WRITTEN, OWNER-READABLE:\n *   - This is internal enforcement state, not user-authored data: only the A2A runtime WRITES\n *     it, via `*AsSystem` (governed by `systemAccessPolicy`). The tenant may READ its own row\n *     (a usage view: \"how much of my allowance have I used?\"), but never authors it.\n *   - CREATE (`INTERNAL_CALL` super-admin, no explicit request DTO — it auto-derives per variant so\n *     the injected owner FK is required on the correct variant) opens the singleton on the first\n *     budgeted turn, via `createAsSystem`. `INTERNAL_CALL` (not `REPOSITORY_ONLY`) is mandatory\n *     here: `*AsSystem` dispatches through the service tier and resolves the op via\n *     `getServiceOperationPathDefault`, which only matches INTERNAL_CALL / API_CALL variants.\n *   - There is deliberately NO `UPDATE` operation. Advancing the counter is an ATOMIC increment\n *     (`RepositoriesRegistryHandlerBackendService.atomicIncrementField`) executed at the repository\n *     tier, precisely so concurrent turns cannot lose tokens to a read-modify-write race — a\n *     service-tier UPDATE cannot express that. Declaring an `UPDATE` op (with a DTO and a\n *     `systemAccessPolicy.update` grant) would therefore be dead configuration describing a write\n *     path nothing takes, and would invite a future contributor to route the counter through it and\n *     silently reintroduce the race.\n *   - DELETE is `INTERNAL_CALL` super-admin: it exists to satisfy the composition `onParentDelete`\n *     cascade teardown (which runs at the repository tier and selects the operation-default DELETE,\n *     irrespective of variant type), NOT to offer an HTTP surface. Deliberately NOT `API_CALL`:\n *     zeroing this row zeroes recorded consumption, which is a SPEND-CAP BYPASS, so it gets no URL\n *     at all — strictly stronger than relying on a role floor. (The role floor is nevertheless\n *     platform-only for defence in depth.)\n *   - READ is the ONE `API_CALL`, and it is owner-level on its own merit: a tenant inspecting its\n *     own consumption (\"how much of my allowance have I used?\"). It is read-only, so it cannot\n *     affect the cap.\n *\n * CASCADE NOTE (recorded because it was initially mis-diagnosed): the cascade's requirement is a\n * cardinality-appropriate DISCOVERY op + a DELETE teardown op — for a 1:1 child that is READ, for\n * 1:many it is LIST. It does NOT require a URL-isable variant: `supportsOperation` checks only\n * `isOperationDefault`, and a sole `INTERNAL_CALL` variant is the default within its own group.\n * The guard violation seen while building this resource came from the relationship declaring\n * `childCardinality: MANY` (the helper's default) on a SINGLETON — which demanded LIST, not READ.\n * Fixing the cardinality fixed it; verified by reverting DELETE to `INTERNAL_CALL` with the guard\n * still green.\n *\n * @see a2a-token-budget-state.shared.schemas.ts — the polymorphic declaration + base schema\n * @see flows-actors-execution.shared.resources-config.schemas.ts — the 3-scope polymorphic config precedent\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { a2aTokenBudgetStatePolymorphicDeclaration } from './a2a-token-budget-state.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n/**\n * Per-variant OWNER-READ role map. A tenant may inspect its OWN budget consumption (a\n * read-only usage view: \"how much of my allowance have I used?\"). The scope authorizer +\n * contextual filter isolate rows to the owner; the role is the operation floor.\n *\n * The APPLICATION variant is intentionally `APP_USER`, matching the `flowActorExecutions`\n * precedent: app-scope rows are app-wide state, so any authenticated app user can read the\n * application's aggregate A2A consumption. Tighten to an admin role if that telemetry is ever\n * considered sensitive — it reveals platform usage volume, not tenant content.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_USER],\n};\n\n/**\n * Polymorphic factory map for the A2A token budget state. Spread into\n * `coreShared_ResourcesConfigurations_FactoryMap`:\n *   ...a2aTokenBudgetStatePolymorphicFactories\n *\n * Produces entries for:\n *   - userA2aTokenBudgetState\n *   - organizationA2aTokenBudgetState\n *   - applicationA2aTokenBudgetState\n */\nexport const a2aTokenBudgetStatePolymorphicFactories = createPolymorphicResourceConfigurations(\n  a2aTokenBudgetStatePolymorphicDeclaration,\n  {\n    isSystemResource: true,\n\n    // Opt the A2A runtime (system actor) into scoped writes/reads on the tenant's behalf.\n    // Absent this, every `*AsSystem` verb fails closed. Shared by all variants.\n    // No `update` grant: the counter is advanced by an atomic repository-tier increment, never by\n    // `updateAsSystem` (see the header). Granting it would authorise a path nothing takes.\n    systemAccessPolicy: {\n      // Subject-export disclosure. The subject's own token-budget state. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here to scrub.\n *\n * `RETAIN_ONLY` is a positive ASSERTION that this resource holds no personal data of its own. The row is a\n * token-consumption accumulator: counters, a window boundary and the owner scope key. It declares no\n * personal-data category, and its only link to a person is the scope FK, which the never-scrub floor\n * protects in every mode.\n *\n * The assertion is CHECKED in both directions — the factory refuses `RETAIN_ONLY` if any field carries an\n * impersonalize treatment, and if any non-floor field declares `.dataCategories()`.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_ONLY,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The row is not a person — its owner FK names the ACTOR whose\n *  spend it accumulates — and the enum prescribes `NO_PRINCIPAL` for that shape. The subject's own session\n *  ends through the `USERS` row.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n\n       * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n\n       * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n\n       * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n\n       * verb the impersonalize writer uses to stamp the retention markers.\n\n       */\n\n      [CoreResourceOperation.LIST]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.LOW,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      // === CREATE === runtime opens the singleton on the first budgeted turn (createAsSystem).\n      // No explicit request DTO: auto-derives per variant so the injected owner FK is required.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // === READ === the owner inspects its own consumption AND the runtime loads the singleton\n      // for the pre-dispatch budget check (readAsSystem). `API_CALL` on its own merit — a\n      // tenant-facing usage view — and read-only, so owner-level roles cannot affect the cap. It\n      // ALSO serves as the cascade's 1:1 discovery op, though that would be satisfied by a\n      // non-URL variant too (see the CASCADE NOTE in the file header).\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: OWNER_READ_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n\n      // (No UPDATE operation — the counter is advanced by an atomic repository-tier increment so\n      // concurrent turns cannot lose tokens to a read-modify-write race. See the file header.)\n\n      // === DELETE === teardown for the composition `onParentDelete` cascade (repository tier,\n      // which selects the operation-default DELETE regardless of variant type).\n      //\n      // ⚠️ DELIBERATELY `INTERNAL_CALL` — NO HTTP ROUTE AT ALL. Deleting this row ZEROES the\n      // tenant's recorded consumption, i.e. a SPEND-CAP BYPASS, so the strongest available\n      // protection is to expose no URL rather than to guard one with a role. The platform-only\n      // (`APP_ADMIN_SUPER_ADMIN`) floor is defence in depth on top of that. The cascade is\n      // unaffected: it runs below both routing and role checks.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/flows-actors/a2a-token-budget-state.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D,eAAO,MAAM,yBAAyB;;;;;;;iBAwBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,EAAE,4BAA4B,EAIzE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;;kBAMpD,CAAC"}
+{"version":3,"file":"a2a-token-budget-state.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/a2a-token-budget-state.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D,eAAO,MAAM,yBAAyB;;;;;;;iBAwBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,EAAE,4BAA4B,EAIzE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;;kBAMpD,CAAC"}

package/dist/esm/flows-actors/a2a-token-budget-state.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-token-budget-state.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/a2a-token-budget-state.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,GAE1B,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,kFAAkF;IAClF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IAErC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3D;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE7D,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAEhD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,iEAAiE;AACjE,iEAAiE;AACjE,iEAAiE;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAmC;IAC7E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,yBAAyB,CAAC;IACjF,gBAAgB,EAAE,qBAAqB;IACvC,mBAAmB,EAAE,uBAAuB;IAC5C,WAAW,EAAE,wBAAwB;IACrC,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,+BAA+B;CAC1C,CAAC,CAAC;AAEH,6FAA6F;AAC7F,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,4FAA4F","sourcesContent":["/**\n * A2A Token Budget State — Persisted Resource Schema (POLYMORPHIC SINGLETON)\n * ==========================================================================\n *\n * The durable per-tenant accumulator that enforces a per-period LLM **token budget**\n * on inbound Agent2Agent (A2A) agent turns. Each A2A turn runs the LLM runtime; this\n * record holds how many tokens the tenant has consumed IN THE CURRENT PERIOD, so the\n * A2A transport can fail-closed BEFORE dispatch once the plan allowance is reached.\n *\n * WHY A DEDICATED RESOURCE (not `UsageRecord`, not `CreditPool`): a plan-included token\n * ALLOWANCE is a genuinely distinct concept from metered pay-per-use (`UsageRecord`, which\n * is metered-subscription-gated) and from a prepaid credit pack (`CreditPool`). Conflating\n * them would bend those semantics; this resource owns exactly one concern — period token\n * accounting for enforcement. The plan ALLOWANCE itself is NOT stored here — it is resolved\n * live from the billing plan (`FeatureResolution.resolveForScope(...).limits[featureId]`);\n * this record only accumulates CONSUMPTION.\n *\n * POLYMORPHIC SINGLETON ACROSS OWNER SCOPE. One row per tenant, stamped out as THREE\n * genuine single-scope resources by `declarePolymorphicSchemas()`, one owner FK injected\n * per variant (mirrors the flows-actors-execution / billing-account precedent):\n *   - `userA2aTokenBudgetState`         (USER_SELF     — `userId`)         ← user-delegated A2A\n *   - `organizationA2aTokenBudgetState` (ORGANIZATIONS — `organizationId`) ← org-machine A2A\n *   - `applicationA2aTokenBudgetState`  (APPLICATION   — `applicationId`)  ← app-machine A2A\n *\n * SINGLETON, DELIBERATELY: the injected owner FK is the auto business key (`.isUnique()`,\n * ONE row per tenant) — we do NOT `optOutPolymorphicAutoBusinessKey` (that is for multi-row\n * collections). One row per tenant is what keeps the counter un-splittable (no compound-key\n * engineering), and the period ROLLOVER is a mutation of that single row (reset\n * `consumedTokens` when `periodKey` changes), owned atomically by the accumulator service.\n * Per-period HISTORY and multi-budget-feature accounting are documented follow-ons — v1\n * enforces a single A2A token budget and only needs the current period.\n *\n * ⚠️ ADAPTER CAVEAT — that uniqueness is DB-ENFORCED ONLY ON MONGODB. `.isUnique()` compiles\n * to a Mongo unique index; the SQL planner emits no unique constraint (index creation there is\n * migration-owned). On PostgreSQL two concurrent first-ever turns can therefore each insert a\n * row, after which consumption is SPLIT across them while reads see only one — under-reported\n * spend, and a cap that fires late. The accumulator's create-race fallback repairs the common\n * interleaving (a rejected create falls through to an increment) but cannot repair what the\n * database never rejected. Closing this properly needs a unique constraint on the owner FK in\n * the PostgreSQL migration for each variant table.\n *\n * @see flows-actors-execution.shared.schemas.ts — the 3-scope polymorphic precedent\n * @see billing-account.shared.schemas.ts — the polymorphic-singleton precedent\n */\n\nimport { z } from 'zod';\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\nexport const A2ATokenBudgetStateSchema = z.object({\n  /** MongoDB document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey(),\n\n  /**\n   * The budget PERIOD this counter currently covers — a stable string id for the active\n   * window (e.g. the subscription period id, or a `YYYY-MM` calendar key). The reset\n   * boundary: when the resolved current period differs from this value, the accumulator\n   * service resets `consumedTokens` to the new turn's tokens and advances `periodKey`.\n   */\n  periodKey: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * Tokens (prompt + completion) consumed by this tenant's A2A agent turns IN THE CURRENT\n   * period (`periodKey`). Compared against the plan allowance (resolved live) to fail-closed\n   * before dispatch. Reset to 0 (then incremented) when the period rolls.\n   */\n  consumedTokens: z.number().min(0).default(0).isSummaryField(),\n\n  /** When the last A2A turn was recorded against this budget (observability). */\n  lastTurnAt: z.date().optional().isSummaryField(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type A2ATokenBudgetState = z.infer<typeof A2ATokenBudgetStateSchema>;\n\n//===============================================================\n//  Polymorphic declaration — one owner-scope SINGLETON per scope\n//===============================================================\n\n/**\n * The three owner-scope variants the A2A token budget is stamped out for. Each is\n * `isPrimaryScope: true` and — unlike the multi-row flows-actors executions — does NOT opt\n * out of the singleton auto-business-key: the injected owner FK IS the business key, so there\n * is exactly ONE budget row per tenant (the period lives inside that row).\n */\nexport const A2A_TOKEN_BUDGET_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Polymorphic declaration for the A2A token budget state. Produces 3 singleton variants:\n *   - users        → `userA2aTokenBudgetState`         (`userId` injected)\n *   - organizations→ `organizationA2aTokenBudgetState` (`organizationId` injected)\n *   - applications → `applicationA2aTokenBudgetState`  (`applicationId` injected)\n */\nexport const a2aTokenBudgetStatePolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aTokenBudgetState',\n  baseFieldIdentifier: 'a2aTokenBudgetStateId',\n  baseEnumKey: 'A2A_TOKEN_BUDGET_STATE',\n  baseSchema: A2ATokenBudgetStateSchema,\n  variants: A2A_TOKEN_BUDGET_SCOPE_VARIANTS,\n});\n\n// NOTE: there is deliberately NO update DTO for this resource. The counter is advanced by an\n// ATOMIC repository-tier increment (`atomicIncrementField`) rather than a service-tier UPDATE,\n// precisely so concurrent turns cannot lose tokens to a read-modify-write race. A DTO here would\n// describe a write path nothing takes — and would invite routing the counter through it, silently\n// reintroducing that race. See `a2a-token-budget-state.shared.resources-config.schemas.ts`.\n"]}
+{"version":3,"file":"a2a-token-budget-state.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/a2a-token-budget-state.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,yBAAyB,GAE1B,MAAM,kDAAkD,CAAC;AAE1D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,kFAAkF;IAClF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IAErC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE3D;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAE7D,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAEhD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,iEAAiE;AACjE,iEAAiE;AACjE,iEAAiE;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAmC;IAC7E,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK,EAAU,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAU,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,yBAAyB,CAAC;IACjF,gBAAgB,EAAE,qBAAqB;IACvC,mBAAmB,EAAE,uBAAuB;IAC5C,WAAW,EAAE,wBAAwB;IACrC,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,+BAA+B;CAC1C,CAAC,CAAC;AAEH,6FAA6F;AAC7F,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,4FAA4F","sourcesContent":["/**\n * A2A Token Budget State — Persisted Resource Schema (POLYMORPHIC SINGLETON)\n * ==========================================================================\n *\n * The durable per-tenant accumulator that enforces a per-period LLM **token budget**\n * on inbound Agent2Agent (A2A) agent turns. Each A2A turn runs the LLM runtime; this\n * record holds how many tokens the tenant has consumed IN THE CURRENT PERIOD, so the\n * A2A transport can fail-closed BEFORE dispatch once the plan allowance is reached.\n *\n * WHY A DEDICATED RESOURCE (not `UsageRecord`, not `CreditPool`): a plan-included token\n * ALLOWANCE is a genuinely distinct concept from metered pay-per-use (`UsageRecord`, which\n * is metered-subscription-gated) and from a prepaid credit pack (`CreditPool`). Conflating\n * them would bend those semantics; this resource owns exactly one concern — period token\n * accounting for enforcement. The plan ALLOWANCE itself is NOT stored here — it is resolved\n * live from the billing plan (`FeatureResolution.resolveForScope(...).limits[featureId]`);\n * this record only accumulates CONSUMPTION.\n *\n * POLYMORPHIC SINGLETON ACROSS OWNER SCOPE. One row per tenant, stamped out as THREE\n * genuine single-scope resources by `declarePolymorphicSchemas()`, one owner FK injected\n * per variant (mirrors the flows-actors-execution / billing-account precedent):\n *   - `userA2aTokenBudgetState`         (USER_SELF     — `userId`)         ← user-delegated A2A\n *   - `organizationA2aTokenBudgetState` (ORGANIZATIONS — `organizationId`) ← org-machine A2A\n *   - `applicationA2aTokenBudgetState`  (APPLICATION   — `applicationId`)  ← app-machine A2A\n *\n * SINGLETON, DELIBERATELY: the injected owner FK is the auto business key (`.isUnique()`,\n * ONE row per tenant) — we do NOT `optOutPolymorphicAutoBusinessKey` (that is for multi-row\n * collections). One row per tenant is what keeps the counter un-splittable (no compound-key\n * engineering), and the period ROLLOVER is a mutation of that single row (reset\n * `consumedTokens` when `periodKey` changes), owned atomically by the accumulator service.\n * Per-period HISTORY and multi-budget-feature accounting are documented follow-ons — v1\n * enforces a single A2A token budget and only needs the current period.\n *\n * ⚠️ ADAPTER CAVEAT — that uniqueness is DB-ENFORCED ONLY ON MONGODB. `.isUnique()` compiles\n * to a Mongo unique index; the SQL planner emits no unique constraint (index creation there is\n * migration-owned). On PostgreSQL two concurrent first-ever turns can therefore each insert a\n * row, after which consumption is SPLIT across them while reads see only one — under-reported\n * spend, and a cap that fires late. The accumulator's create-race fallback repairs the common\n * interleaving (a rejected create falls through to an increment) but cannot repair what the\n * database never rejected. Closing this properly needs a unique constraint on the owner FK in\n * the PostgreSQL migration for each variant table.\n *\n * @see flows-actors-execution.shared.schemas.ts — the 3-scope polymorphic precedent\n * @see billing-account.shared.schemas.ts — the polymorphic-singleton precedent\n */\n\nimport { z } from 'zod';\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\n\nimport {\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  declarePolymorphicSchemas,\n  type PolymorphicVariantDefinition,\n} from '../resources/utils/resource-polymorphism.schemas';\n\ninitZodDecorators(z);\n\nexport const A2ATokenBudgetStateSchema = z.object({\n  /** MongoDB document id — auto-generated / auto-managed (excluded from create). */\n  _id: z.string().min(1).isPrimaryKey(),\n\n  /**\n   * The budget PERIOD this counter currently covers — a stable string id for the active\n   * window (e.g. the subscription period id, or a `YYYY-MM` calendar key). The reset\n   * boundary: when the resolved current period differs from this value, the accumulator\n   * service resets `consumedTokens` to the new turn's tokens and advances `periodKey`.\n   */\n  periodKey: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * Tokens (prompt + completion) consumed by this tenant's A2A agent turns IN THE CURRENT\n   * period (`periodKey`). Compared against the plan allowance (resolved live) to fail-closed\n   * before dispatch. Reset to 0 (then incremented) when the period rolls.\n   */\n  consumedTokens: z.number().min(0).default(0).isSummaryField(),\n\n  /** When the last A2A turn was recorded against this budget (observability). */\n  lastTurnAt: z.date().optional().isSummaryField(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type A2ATokenBudgetState = z.infer<typeof A2ATokenBudgetStateSchema>;\n\n//===============================================================\n//  Polymorphic declaration — one owner-scope SINGLETON per scope\n//===============================================================\n\n/**\n * The three owner-scope variants the A2A token budget is stamped out for. Each is\n * `isPrimaryScope: true` and — unlike the multi-row flows-actors executions — does NOT opt\n * out of the singleton auto-business-key: the injected owner FK IS the business key, so there\n * is exactly ONE budget row per tenant (the period lives inside that row).\n */\nexport const A2A_TOKEN_BUDGET_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.USERS,         parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],         isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n/**\n * Polymorphic declaration for the A2A token budget state. Produces 3 singleton variants:\n *   - users        → `userA2aTokenBudgetState`         (`userId` injected)\n *   - organizations→ `organizationA2aTokenBudgetState` (`organizationId` injected)\n *   - applications → `applicationA2aTokenBudgetState`  (`applicationId` injected)\n */\nexport const a2aTokenBudgetStatePolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'a2aTokenBudgetState',\n  baseFieldIdentifier: 'a2aTokenBudgetStateId',\n  baseEnumKey: 'A2A_TOKEN_BUDGET_STATE',\n  baseSchema: A2ATokenBudgetStateSchema,\n  variants: A2A_TOKEN_BUDGET_SCOPE_VARIANTS,\n});\n\n// NOTE: there is deliberately NO update DTO for this resource. The counter is advanced by an\n// ATOMIC repository-tier increment (`atomicIncrementField`) rather than a service-tier UPDATE,\n// precisely so concurrent turns cannot lose tokens to a read-modify-write race. A DTO here would\n// describe a write path nothing takes — and would invite routing the counter through it, silently\n// reintroducing that race. See `a2a-token-budget-state.shared.resources-config.schemas.ts`.\n"]}

package/dist/esm/flows-actors/actors.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actors.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/actors.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAA6B,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAmG,oBAAoB,EAAG,MAAM,sCAAsC,CAAC;AAgB9K,oBAAY,mBAAmB;IAC7B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,iBAAiB,sBAAsB;IACvC,cAAc,mBAAmB;CAClC;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,WAAW;;;;;;;iBAOtB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgC1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+DtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"actors.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/actors.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAA6B,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAmG,oBAAoB,EAAG,MAAM,sCAAsC,CAAC;AAgB9K,oBAAY,mBAAmB;IAC7B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,iBAAiB,sBAAsB;IACvC,cAAc,mBAAmB;CAClC;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,WAAW;;;;;;;iBAOtB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgC1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+DtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/flows-actors/actors.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"actors.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/actors.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,oBAAoB,GAAG,MAAM,sCAAsC,CAAC;AAC9K,OAAO,EAAE,kBAAkB,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AACtG,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAGxK,iEAAiE;AACjE,SAAS;AACT,WAAW;AACX,gEAAgE;AAChE,kEAAkE;AAClE,iEAAiE;AACjE,sEAAsE;AACtE,mEAAmE;AACnE,iEAAiE;AAGjE,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,kDAA2B,CAAA;IAC3B,oDAA6B,CAAA;IAC7B,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;IACrB,8DAAuC,CAAA;IACvC,wDAAiC,CAAA;AACnC,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,wDAAiC,CAAA;IACjC,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,iEAAiE;AACjE,gBAAgB;AAChB,iEAAiE;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACjE;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;CAC3C,CAAC,CAAC;AAIH,iEAAiE;AACjE,0BAA0B;AAC1B,iEAAiE;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC7B;;;;OAIG;IACH,KAAK,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3C,yFAAyF;IACzF,SAAS,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACnD;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAChC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;OAUG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC,MAAM,CAAC;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAE3C,2GAA2G;IAC3G,UAAU,EAAE,+BAA+B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,+GAA+G;IAC/G,UAAU,EAAE,+BAA+B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEjE;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE9C;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;QACxF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;KACtD,CAAC,CAAC;IAEH,IAAI,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAClD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAE5C,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;iBAC/B,QAAQ,CAAC,yBAAyB,CAAC,4FAA4F,CAAC,CAAC;YACpI,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;SAC5B,CAAC,CAAC;KACJ,CAAC,CAAC,KAAK,EAAE;IAEV;;;;;OAKG;IACH,WAAW,EAAG,kCAAkC,CAAC,MAAM,CAAC;QACtD,UAAU,EAAE,wBAAwB,CAAC,MAAM,CAAC;YAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { WildoError_BackendSchema } from \"../errors/errors.shared.schemas\";\nimport { FlowsActors_Status, describeFlowsActorsStatus } from \"./flows-actors.commons.shared.schemas\";\nimport { FlowActorSystem_BaseSchema, FlowActorSystem_ErrorStates_Schema, FlowActorSystem_ExecutionSchema, FlowActorSystem_Kind, } from \"./flows-actors.system.shared.schemas\";\nimport { Actors_Task_Schema, ActorsSystem_ExecutionPlan_Schema } from \"./tasks.actors.shared.schemas\";\nimport { HumanDecision_RequestSchema, HumanDecision_RequesterSchema, HumanDecision_ResolutionSchema, HumanDecision_RouteSchema } from \"./human-decision.shared.schemas\";\n\n\n//===============================================================\n//  Actor\n// --------\n// Actors are reactive components that subscribe to event topics\n// and respond with automated processing. They enable event-driven\n// architecture by processing messages asynchronously, supporting\n// batch processing, filtering, and various error handling strategies.\n// Actors can emit new events, creating event chains and workflows.\n//===============================================================\n\n\nexport enum Actor_Role_Category {\n  COORDINATOR = \"coordinator\",\n  TASK_PLANNER = \"task_planner\",\n  OPERATOR = \"operator\",\n  ANALYZER = \"analyzer\",\n  REVIEWER = \"reviewer\",\n  HUMAN_IN_THE_LOOP = \"human_in_the_loop\",\n  FLOW_EXECUTION = \"flow_execution\"\n}\n\n\n/**\n * HOW an actor does its work when the runtime drives it.\n *\n * `PROGRAMMATIC` (added 2026-09-20, #1358) is the mode of an actor whose behaviour is supplied by the\n * HOST as code rather than by an agent, a flow or a person: the execution driver opens the actor's\n * task, hands the opened identities to a host-supplied executor, and settles on its outcome. An actor\n * is not an agent — a methodology step run by the app-creation companion, or a deterministic check,\n * is an actor with no model behind it, and until this member existed such an actor had to borrow\n * `AGENTIC` without an `agentRef`, which is a lie the registry cannot see.\n *\n * `FLOW_EXECUTION` is a PLANNED member and stays (decided by Paul, 2026-09-21, #1363). The Flow\n * execution model is not implemented yet — `FlowsBackendService.executeFlow` refuses honestly — and\n * it is intended: an actor whose work is a declared flow is part of what this system is for. No\n * driver dispatches on this member today, so a reader sweep reports zero; that is the state of the\n * build, not a verdict on the member. Do not delete it, the Flow model, or `Actor_Role_Category`'s\n * matching member on that measurement.\n */\nexport enum Actor_ExecutionMode {\n  AGENTIC = \"agentic\",\n  FLOW_EXECUTION = \"flow_execution\",\n  HUMAN_INTERACTION = \"human_interaction\",\n  PROGRAMMATIC = \"programmatic\",\n}\n\nexport const ActorSchema = z.object({\n  ref: z.string().min(1),\n  displayName: z.string().min(1),\n  roleCategory: z.enum(Actor_Role_Category),\n  executionMode: z.enum(Actor_ExecutionMode),\n  agentRef: z.string().optional(),\n  flowRef: z.string().optional(),\n});\nexport type Actor = z.infer<typeof ActorSchema>;\n\n//===============================================================\n//  Actor System\n//===============================================================\n\n/**\n * The ACTOR specialization of the system base — the schema that OWNS a system's\n * actor list. `actors` is declared here and in no other system schema: the base\n * cannot declare it, because a FLOW system has no actors. (Unrelated `actors`\n * members exist on the TASK schemas; those point at one actor, they are not a\n * system's roster.)\n *\n * An actor system must therefore be parsed with this schema, or one derived\n * from it. Parsing one with `FlowActorSystem_BaseSchema` strips `actors`\n * silently — see the warning there.\n */\nexport const ActorSystemSchema = FlowActorSystem_BaseSchema.extend({\n  /**\n   * Narrows the inherited `kind` discriminant to ACTOR. The historical shape\n   * added a separate `type` field here while every consumer (backend registry,\n   * execution schemas, flows counterpart) discriminates on `kind` — fixed\n   * 2026-07-02 (meta-workflows Step 0 hygiene; no `.type` consumer existed).\n   */\n  kind: z.literal(FlowActorSystem_Kind.ACTOR),\n  actors: z.array(z.lazy(() => ActorSchema)),\n});\nexport type ActorSystem = z.infer<typeof ActorSystemSchema>;\n\n\n//===============================================================\n//  Actor System Execution\n//===============================================================\n\n/**\n * The human decision an execution is WAITING on — present exactly while its status is\n * `AWAITING_APPROVAL`, and cleared by the resume that answers it.\n *\n * Until #1360 three stores held this for three kinds of question (a checkpoint file for a mid-run\n * clarification, another for an interrupted composite, a task's `output.suspension` for a parked\n * coding question), projecting one `HumanDecision_Request` each — the payload was unified by #1269\n * and the storage was left where it was on the premise that a playbook run had no execution row.\n * #1343 removed that premise. The decision lives on the row the run already has.\n */\nexport const ActorExecution_SuspensionSchema = z.object({\n  decision: HumanDecision_RequestSchema,\n  suspendedAt: z.iso.datetime(),\n  /**\n   * WHO may settle this decision (#1594 D2) — the same shape the conversational plane stores in columns.\n   * Absent on a suspension whose host routes nothing: its own door is then the only authority over it,\n   * and the engine authorizes nothing it was not given a route for.\n   */\n  route: HumanDecision_RouteSchema.optional(),\n  /** The authority the run was raised under, and resumes under. Stamped beside `route`. */\n  requester: HumanDecision_RequesterSchema.optional(),\n  /**\n   * Bumped by every move of `route` (#1594 I5). The persistence port's compare-and-swap checks it, so an\n   * answer read under an older route loses. Written `0` with a route; absent when there is none.\n   */\n  routeVersion: z.number().int().nonnegative().optional(),\n  /**\n   * THIS suspension's identity, written once when the run suspends (#1581). A run may ask again after\n   * an answer, and its decision id names the RUN (hosts use their run or task id), so neither that nor\n   * an instant tells two questions of one run apart. An answer names the suspension it read, and a\n   * resume refuses one the run has moved past. Absent on a row written before it existed; such a\n   * suspension is named by its instant (`actorExecutionSuspensionRef` in the backend runtime).\n   */\n  suspensionId: z.string().min(1).optional(),\n});\nexport type ActorExecution_Suspension = z.infer<typeof ActorExecution_SuspensionSchema>;\n\n/**\n * What a run left behind so that whatever runs next can CONTINUE it — the host's resume inputs.\n *\n * `context` is opaque to the engine, exactly as `FlowsActors_Checkpoint.context` is: the engine owns\n * the slot and when it is written and read; the host that executes the work owns the content and\n * validates it at its own boundary. Written while a run progresses (so a run whose process is taken\n * away can be continued) and when a run suspends (so its resume can rebuild what it was doing).\n *\n * A checkpoint outliving its run is the ordinary signal of an INTERRUPTED run: the driver settles a\n * run whose host died `ABORTED` at the next startup and leaves this in place, so \"interrupted and\n * resumable\" is `ABORTED` with a checkpoint — a fact of the row, not a fourth status (#1360).\n */\nexport const ActorExecution_CheckpointSchema = z.object({\n  context: z.any(),\n  checkpointedAt: z.iso.datetime(),\n  /**\n   * The question a RESUMED run was answering, kept until the run moves past it.\n   *\n   * A resume clears `suspension` and moves the row to `PROCESSING`. When the host asked for a failed\n   * continuation to leave the question standing (`restoreSuspensionOnFailure`), a THROWN continuation\n   * is caught and the suspension restored. A continuation whose PROCESS dies throws nothing: the\n   * startup orphan sweep used to settle it `ABORTED`, and the person's answer went with it. Measured\n   * 2026-09-24 on a real domain-plan clarification: answered, resumed, and aborted 85 s later by a\n   * companion restart, which the dev loop performs every few minutes.\n   *\n   * So the resume writes the suspension here, and the sweep puts an orphan that carries one back to\n   * `AWAITING_APPROVAL` on the same question instead of aborting it. It lives on the CHECKPOINT\n   * because it is a resume input with the same lifetime: a host checkpoint written mid-run replaces\n   * the whole checkpoint and drops it (the run has moved past the question), a new suspension\n   * replaces it, and a settle that keeps the checkpoint strips it.\n   */\n  resumedSuspension: ActorExecution_SuspensionSchema.optional(),\n  /**\n   * How many continuations of the pending question DIED WITH THEIR PROCESS before this one (#1507).\n   *\n   * The startup sweep puts such a run back to waiting (see `resumedSuspension`), and nothing else\n   * remembers that a continuation ran: whatever it did and spent went with the process. Counted here so\n   * the host can say so — a playbook run records each as an unobserved part of its spend, so its total\n   * reads as a floor rather than as complete. Cleared once a host has accounted for them in the task's\n   * own record (a restored output after a thrown continuation), and whenever the run moves past the\n   * question: a new suspension replaces the checkpoint, a consuming settle clears it, and a settle that\n   * keeps it drops this count with `resumedSuspension`.\n   */\n  interruptedContinuations: z.number().int().positive().optional(),\n});\nexport type ActorExecution_Checkpoint = z.infer<typeof ActorExecution_CheckpointSchema>;\n\n\nexport const ActorSystem_ExecutionSchema = FlowActorSystem_ExecutionSchema.extend({\n  kind: z.literal(FlowActorSystem_Kind.ACTOR),\n\n  /** See {@link ActorExecution_SuspensionSchema}. `null` once answered; absent on a run that never asked. */\n  suspension: ActorExecution_SuspensionSchema.nullable().optional(),\n  /** See {@link ActorExecution_CheckpointSchema}. `null` once consumed; absent on a run that never wrote one. */\n  checkpoint: ActorExecution_CheckpointSchema.nullable().optional(),\n\n  /**\n   * What this execution runs EXCLUSIVELY — the subject of its single-flight lease (#1361).\n   *\n   * While an execution carrying a subject is `PENDING` or `PROCESSING`, the runtime refuses to open\n   * or resume another execution of the SAME system with the same subject. The lease IS the row: no\n   * second record says \"busy\", so nothing can disagree with what is actually running. A run that is\n   * waiting on a person (`AWAITING_APPROVAL`) does not hold it — it is not running — and a host's\n   * startup orphan sweep is what releases a lease whose holder died.\n   *\n   * Absent on the ordinary run, which excludes nothing. The subject's vocabulary is the opening\n   * domain's: the runtime compares it and never reads it.\n   *\n   * Until #1361 this principle was implemented three times in one consumer as in-memory flags, each\n   * of which a restart — or a second process — could not see.\n   */\n  exclusiveSubject: z.string().min(1).optional(),\n\n  /**\n   * The run's history, oldest first — as on every execution, plus the RESOLUTION of the decision a move\n   * ended (#1594 I4). The change that takes a run out of waiting carries how that wait ended, written in\n   * the same statement, so no second write can be lost between them. A decision that won and was then\n   * put back (the tasks could not follow) is followed by a change back to waiting: the history keeps what\n   * happened, and the latest change says where the run stands.\n   */\n  statusChanges: z.array(FlowActorSystem_ExecutionSchema.shape.statusChanges.element.extend({\n    resolution: HumanDecision_ResolutionSchema.optional(),\n  })),\n\n  plan: ActorsSystem_ExecutionPlan_Schema.optional(),\n  standaloneTasks: z.array(Actors_Task_Schema),\n\n  standaloneTaskStates: z.object({\n    taskId: z.string(),\n    status: z.enum(FlowsActors_Status),\n    updatedAt: z.iso.datetime(),\n    statusChanges: z.array(z.object({\n      status: z.enum(FlowsActors_Status)\n        .describe(describeFlowsActorsStatus(\"The state this run moved into at `timestamp`. The list is the run's history, oldest first.\")),\n      timestamp: z.iso.datetime(),\n    })),\n  }).array(),\n\n  /**\n   * Overrides the base `errorItems` with the actor-execution-scoped variant\n   * (adds taskId/planStepId locators). Historically this extension used a\n   * divergent `errors` key coexisting with the base `errorItems` — aligned\n   * 2026-07-02 (meta-workflows Step 0 hygiene; the field had no consumers).\n   */\n  errorStates : FlowActorSystem_ErrorStates_Schema.extend({\n    errorItems: WildoError_BackendSchema.extend({\n      systemRef: z.string(),\n      taskId: z.string().optional(),\n      planStepId: z.string().optional(),\n    }).array().optional(),\n  }).optional(),\n});\nexport type ActorSystem_Execution = z.infer<typeof ActorSystem_ExecutionSchema>;\n"]}
+{"version":3,"file":"actors.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/actors.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,oBAAoB,GAAG,MAAM,sCAAsC,CAAC;AAC9K,OAAO,EAAE,kBAAkB,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AACtG,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAGxK,iEAAiE;AACjE,SAAS;AACT,WAAW;AACX,gEAAgE;AAChE,kEAAkE;AAClE,iEAAiE;AACjE,sEAAsE;AACtE,mEAAmE;AACnE,iEAAiE;AAGjE,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,kDAA2B,CAAA;IAC3B,oDAA6B,CAAA;IAC7B,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;IACrB,8DAAuC,CAAA;IACvC,wDAAiC,CAAA;AACnC,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,wDAAiC,CAAA;IACjC,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,iEAAiE;AACjE,gBAAgB;AAChB,iEAAiE;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACjE;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;CAC3C,CAAC,CAAC;AAIH,iEAAiE;AACjE,0BAA0B;AAC1B,iEAAiE;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC7B;;;;OAIG;IACH,KAAK,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3C,yFAAyF;IACzF,SAAS,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACnD;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAChC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;OAUG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC,MAAM,CAAC;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAE3C,2GAA2G;IAC3G,UAAU,EAAE,+BAA+B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,+GAA+G;IAC/G,UAAU,EAAE,+BAA+B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEjE;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE9C;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;QACxF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;KACtD,CAAC,CAAC;IAEH,IAAI,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAClD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAE5C,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;iBAC/B,QAAQ,CAAC,yBAAyB,CAAC,4FAA4F,CAAC,CAAC;YACpI,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;SAC5B,CAAC,CAAC;KACJ,CAAC,CAAC,KAAK,EAAE;IAEV;;;;;OAKG;IACH,WAAW,EAAG,kCAAkC,CAAC,MAAM,CAAC;QACtD,UAAU,EAAE,wBAAwB,CAAC,MAAM,CAAC;YAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { WildoError_BackendSchema } from \"../errors/errors.shared.schemas\";\nimport { FlowsActors_Status, describeFlowsActorsStatus } from \"./flows-actors.commons.shared.schemas\";\nimport { FlowActorSystem_BaseSchema, FlowActorSystem_ErrorStates_Schema, FlowActorSystem_ExecutionSchema, FlowActorSystem_Kind, } from \"./flows-actors.system.shared.schemas\";\nimport { Actors_Task_Schema, ActorsSystem_ExecutionPlan_Schema } from \"./tasks.actors.shared.schemas\";\nimport { HumanDecision_RequestSchema, HumanDecision_RequesterSchema, HumanDecision_ResolutionSchema, HumanDecision_RouteSchema } from \"./human-decision.shared.schemas\";\n\n\n//===============================================================\n//  Actor\n// --------\n// Actors are reactive components that subscribe to event topics\n// and respond with automated processing. They enable event-driven\n// architecture by processing messages asynchronously, supporting\n// batch processing, filtering, and various error handling strategies.\n// Actors can emit new events, creating event chains and workflows.\n//===============================================================\n\n\nexport enum Actor_Role_Category {\n  COORDINATOR = \"coordinator\",\n  TASK_PLANNER = \"task_planner\",\n  OPERATOR = \"operator\",\n  ANALYZER = \"analyzer\",\n  REVIEWER = \"reviewer\",\n  HUMAN_IN_THE_LOOP = \"human_in_the_loop\",\n  FLOW_EXECUTION = \"flow_execution\"\n}\n\n\n/**\n * HOW an actor does its work when the runtime drives it.\n *\n * `PROGRAMMATIC` (added 2026-09-20, #1358) is the mode of an actor whose behaviour is supplied by the\n * HOST as code rather than by an agent, a flow or a person: the execution driver opens the actor's\n * task, hands the opened identities to a host-supplied executor, and settles on its outcome. An actor\n * is not an agent — a methodology step run by the app-creation companion, or a deterministic check,\n * is an actor with no model behind it, and until this member existed such an actor had to borrow\n * `AGENTIC` without an `agentRef`, which is a lie the registry cannot see.\n *\n * `FLOW_EXECUTION` is a PLANNED member and stays (decided by Paul, 2026-09-21, #1363). The Flow\n * execution model is not implemented yet — `FlowsBackendService.executeFlow` refuses honestly — and\n * it is intended: an actor whose work is a declared flow is part of what this system is for. No\n * driver dispatches on this member today, so a reader sweep reports zero; that is the state of the\n * build, not a verdict on the member. Do not delete it, the Flow model, or `Actor_Role_Category`'s\n * matching member on that measurement.\n */\nexport enum Actor_ExecutionMode {\n  AGENTIC = \"agentic\",\n  FLOW_EXECUTION = \"flow_execution\",\n  HUMAN_INTERACTION = \"human_interaction\",\n  PROGRAMMATIC = \"programmatic\",\n}\n\nexport const ActorSchema = z.object({\n  ref: z.string().min(1),\n  displayName: z.string().min(1),\n  roleCategory: z.enum(Actor_Role_Category),\n  executionMode: z.enum(Actor_ExecutionMode),\n  agentRef: z.string().optional(),\n  flowRef: z.string().optional(),\n});\nexport type Actor = z.infer<typeof ActorSchema>;\n\n//===============================================================\n//  Actor System\n//===============================================================\n\n/**\n * The ACTOR specialization of the system base — the schema that OWNS a system's\n * actor list. `actors` is declared here and in no other system schema: the base\n * cannot declare it, because a FLOW system has no actors. (Unrelated `actors`\n * members exist on the TASK schemas; those point at one actor, they are not a\n * system's roster.)\n *\n * An actor system must therefore be parsed with this schema, or one derived\n * from it. Parsing one with `FlowActorSystem_BaseSchema` strips `actors`\n * silently — see the warning there.\n */\nexport const ActorSystemSchema = FlowActorSystem_BaseSchema.extend({\n  /**\n   * Narrows the inherited `kind` discriminant to ACTOR. The historical shape\n   * added a separate `type` field here while every consumer (backend registry,\n   * execution schemas, flows counterpart) discriminates on `kind` — fixed\n   * 2026-07-02 (meta-workflows Step 0 hygiene; no `.type` consumer existed).\n   */\n  kind: z.literal(FlowActorSystem_Kind.ACTOR),\n  actors: z.array(z.lazy(() => ActorSchema)),\n});\nexport type ActorSystem = z.infer<typeof ActorSystemSchema>;\n\n\n//===============================================================\n//  Actor System Execution\n//===============================================================\n\n/**\n * The human decision an execution is WAITING on — present exactly while its status is\n * `AWAITING_APPROVAL`, and cleared by the resume that answers it.\n *\n * Until #1360 three stores held this for three kinds of question (a checkpoint file for a mid-run\n * clarification, another for an interrupted composite, a task's `output.suspension` for a parked\n * coding question), projecting one `HumanDecision_Request` each — the payload was unified by #1269\n * and the storage was left where it was on the premise that a playbook run had no execution row.\n * #1343 removed that premise. The decision lives on the row the run already has.\n */\nexport const ActorExecution_SuspensionSchema = z.object({\n  decision: HumanDecision_RequestSchema,\n  suspendedAt: z.iso.datetime(),\n  /**\n   * WHO may settle this decision (#1594 D2) — the same shape the conversational plane stores in columns.\n   * Absent on a suspension whose host routes nothing: its own door is then the only authority over it,\n   * and the engine authorizes nothing it was not given a route for.\n   */\n  route: HumanDecision_RouteSchema.optional(),\n  /** The authority the run was raised under, and resumes under. Stamped beside `route`. */\n  requester: HumanDecision_RequesterSchema.optional(),\n  /**\n   * Bumped by every move of `route` (#1594 I5). The persistence port's compare-and-swap checks it, so an\n   * answer read under an older route loses. Written `0` with a route; absent when there is none.\n   */\n  routeVersion: z.number().int().nonnegative().optional(),\n  /**\n   * THIS suspension's identity, written once when the run suspends (#1581). A run may ask again after\n   * an answer, and its decision id names the RUN (hosts use their run or task id), so neither that nor\n   * an instant tells two questions of one run apart. An answer names the suspension it read, and a\n   * resume refuses one the run has moved past. Absent on a row written before it existed; such a\n   * suspension is named by its instant (`actorExecutionSuspensionRef` in the backend runtime).\n   */\n  suspensionId: z.string().min(1).optional(),\n});\nexport type ActorExecution_Suspension = z.infer<typeof ActorExecution_SuspensionSchema>;\n\n/**\n * What a run left behind so that whatever runs next can CONTINUE it — the host's resume inputs.\n *\n * `context` is opaque to the engine, exactly as `FlowsActors_Checkpoint.context` is: the engine owns\n * the slot and when it is written and read; the host that executes the work owns the content and\n * validates it at its own boundary. Written while a run progresses (so a run whose process is taken\n * away can be continued) and when a run suspends (so its resume can rebuild what it was doing).\n *\n * A checkpoint outliving its run is the ordinary signal of an INTERRUPTED run: the driver settles a\n * run whose host died `ABORTED` at the next startup and leaves this in place, so \"interrupted and\n * resumable\" is `ABORTED` with a checkpoint — a fact of the row, not a fourth status (#1360).\n */\nexport const ActorExecution_CheckpointSchema = z.object({\n  context: z.any(),\n  checkpointedAt: z.iso.datetime(),\n  /**\n   * The question a RESUMED run was answering, kept until the run moves past it.\n   *\n   * A resume clears `suspension` and moves the row to `PROCESSING`. When the host asked for a failed\n   * continuation to leave the question standing (`restoreSuspensionOnFailure`), a THROWN continuation\n   * is caught and the suspension restored. A continuation whose PROCESS dies throws nothing: the\n   * startup orphan sweep used to settle it `ABORTED`, and the person's answer went with it. Measured\n   * 2026-09-24 on a real domain-plan clarification: answered, resumed, and aborted 85 s later by a\n   * companion restart, which the dev loop performs every few minutes.\n   *\n   * So the resume writes the suspension here, and the sweep puts an orphan that carries one back to\n   * `AWAITING_APPROVAL` on the same question instead of aborting it. It lives on the CHECKPOINT\n   * because it is a resume input with the same lifetime: a host checkpoint written mid-run replaces\n   * the whole checkpoint and drops it (the run has moved past the question), a new suspension\n   * replaces it, and a settle that keeps the checkpoint strips it.\n   */\n  resumedSuspension: ActorExecution_SuspensionSchema.optional(),\n  /**\n   * How many continuations of the pending question DIED WITH THEIR PROCESS before this one (#1507).\n   *\n   * The startup sweep puts such a run back to waiting (see `resumedSuspension`), and nothing else\n   * remembers that a continuation ran: whatever it did and spent went with the process. Counted here so\n   * the host can say so — a playbook run records each as an unobserved part of its spend, so its total\n   * reads as a floor rather than as complete. Cleared once a host has accounted for them in the task's\n   * own record (a restored output after a thrown continuation), and whenever the run moves past the\n   * question: a new suspension replaces the checkpoint, a consuming settle clears it, and a settle that\n   * keeps it drops this count with `resumedSuspension`.\n   */\n  interruptedContinuations: z.number().int().positive().optional(),\n});\nexport type ActorExecution_Checkpoint = z.infer<typeof ActorExecution_CheckpointSchema>;\n\n\nexport const ActorSystem_ExecutionSchema = FlowActorSystem_ExecutionSchema.extend({\n  kind: z.literal(FlowActorSystem_Kind.ACTOR),\n\n  /** See {@link ActorExecution_SuspensionSchema}. `null` once answered; absent on a run that never asked. */\n  suspension: ActorExecution_SuspensionSchema.nullable().optional(),\n  /** See {@link ActorExecution_CheckpointSchema}. `null` once consumed; absent on a run that never wrote one. */\n  checkpoint: ActorExecution_CheckpointSchema.nullable().optional(),\n\n  /**\n   * What this execution runs EXCLUSIVELY — the subject of its single-flight lease (#1361).\n   *\n   * While an execution carrying a subject is `PENDING` or `PROCESSING`, the runtime refuses to open\n   * or resume another execution of the SAME system with the same subject. The lease IS the row: no\n   * second record says \"busy\", so nothing can disagree with what is actually running. A run that is\n   * waiting on a person (`AWAITING_APPROVAL`) does not hold it — it is not running — and a host's\n   * startup orphan sweep is what releases a lease whose holder died.\n   *\n   * Absent on the ordinary run, which excludes nothing. The subject's vocabulary is the opening\n   * domain's: the runtime compares it and never reads it.\n   *\n   * Until #1361 this principle was implemented three times in one consumer as in-memory flags, each\n   * of which a restart — or a second process — could not see.\n   */\n  exclusiveSubject: z.string().min(1).optional(),\n\n  /**\n   * The run's history, oldest first — as on every execution, plus the RESOLUTION of the decision a move\n   * ended (#1594 I4). The change that takes a run out of waiting carries how that wait ended, written in\n   * the same statement, so no second write can be lost between them. A decision that won and was then\n   * put back (the tasks could not follow) is followed by a change back to waiting: the history keeps what\n   * happened, and the latest change says where the run stands.\n   */\n  statusChanges: z.array(FlowActorSystem_ExecutionSchema.shape.statusChanges.element.extend({\n    resolution: HumanDecision_ResolutionSchema.optional(),\n  })),\n\n  plan: ActorsSystem_ExecutionPlan_Schema.optional(),\n  standaloneTasks: z.array(Actors_Task_Schema),\n\n  standaloneTaskStates: z.object({\n    taskId: z.string(),\n    status: z.enum(FlowsActors_Status),\n    updatedAt: z.iso.datetime(),\n    statusChanges: z.array(z.object({\n      status: z.enum(FlowsActors_Status)\n        .describe(describeFlowsActorsStatus(\"The state this run moved into at `timestamp`. The list is the run's history, oldest first.\")),\n      timestamp: z.iso.datetime(),\n    })),\n  }).array(),\n\n  /**\n   * Overrides the base `errorItems` with the actor-execution-scoped variant\n   * (adds taskId/planStepId locators). Historically this extension used a\n   * divergent `errors` key coexisting with the base `errorItems` — aligned\n   * 2026-07-02 (meta-workflows Step 0 hygiene; the field had no consumers).\n   */\n  errorStates : FlowActorSystem_ErrorStates_Schema.extend({\n    errorItems: WildoError_BackendSchema.extend({\n      systemRef: z.string(),\n      taskId: z.string().optional(),\n      planStepId: z.string().optional(),\n    }).array().optional(),\n  }).optional(),\n});\nexport type ActorSystem_Execution = z.infer<typeof ActorSystem_ExecutionSchema>;\n"]}

package/dist/esm/flows-actors/agent-traceability.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-traceability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/agent-traceability.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;GAUG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;IACb,KAAK,UAAU;IACf,aAAa,kBAAkB;CAChC;AAED,wEAAwE;AACxE,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAIjF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,sBAAsB,EACnC,YAAY,EAAE,sBAAsB,GACnC,OAAO,CAET;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,sBAAsB,EACzB,CAAC,EAAE,sBAAsB,GACxB,sBAAsB,CAExB;AAED,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qDAAqD;AACrD,oBAAY,gBAAgB;IAC1B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe;IACzB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4B/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;iBAiBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC"}
+{"version":3,"file":"agent-traceability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/agent-traceability.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;GAUG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;IACb,KAAK,UAAU;IACf,aAAa,kBAAkB;CAChC;AAED,wEAAwE;AACxE,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAIjF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,sBAAsB,EACnC,YAAY,EAAE,sBAAsB,GACnC,OAAO,CAET;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,sBAAsB,EACzB,CAAC,EAAE,sBAAsB,GACxB,sBAAsB,CAExB;AAED,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qDAAqD;AACrD,oBAAY,gBAAgB;IAC1B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe;IACzB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4B/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;iBAiBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC"}

package/dist/esm/flows-actors/agent-traceability.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-traceability.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/agent-traceability.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,uCAAa,CAAA;IACb,yCAAe,CAAA;IACf,yDAA+B,CAAA;AACjC,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAA2C;IACpF,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;IAChC,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;IACjC,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmC,EACnC,YAAoC;IAEpC,OAAO,8BAA8B,CAAC,WAAW,CAAC,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,CAAyB,EACzB,CAAyB;IAEzB,OAAO,8BAA8B,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC;CAC3E,CAAC,CAAC;AAGH,qDAAqD;AACrD,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;AACrB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,6CAAuB,CAAA;AACzB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,0FAA0F;IAC1F,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,8CAA8C;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iEAAiE;IACjE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjC,sFAAsF;IACtF,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,qFAAqF;IACrF,OAAO,EAAE,uCAAuC,CAAC,QAAQ,EAAE;IAC3D,4BAA4B;IAC5B,KAAK,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,6EAA6E;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,oFAAoF;IACpF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD;;;;OAIG;IACH,WAAW,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { LLMProvider_OperationContext_BaseSchema } from '@wildo-ai/external-connectors-models';\nimport { ModelCallAttributionInputSchema } from './work-attribution.shared.schemas';\n\n/**\n * Verbosity policy for engine-level agent-call traceability. Promotes the\n * companion's previously-local `WILDO_DEV_COMPANION_TRACEABILITY_LEVEL` to a\n * shared engine contract so every agent caller (companion, backend runtime,\n * minions, workers) and every sink (filesystem, logger, OTel) speak the same\n * levels.\n *\n * - `NONE`          — tracing fully off; emitters must no-op before any I/O.\n * - `DEBUG`         — per-call metadata + token usage + latency (no payloads).\n * - `DEBUG_VERBOSE` — adds the resolved prompt input + raw output payloads.\n */\nexport enum AgentTraceabilityLevel {\n  NONE = 'NONE',\n  DEBUG = 'DEBUG',\n  DEBUG_VERBOSE = 'DEBUG_VERBOSE',\n}\n\n/** Numeric ordering for `AgentTraceabilityLevel` gating comparisons. */\nexport const AGENT_TRACEABILITY_LEVEL_ORDER: Record<AgentTraceabilityLevel, number> = {\n  [AgentTraceabilityLevel.NONE]: 0,\n  [AgentTraceabilityLevel.DEBUG]: 1,\n  [AgentTraceabilityLevel.DEBUG_VERBOSE]: 2,\n};\n\n/**\n * True when `activeLevel` is at least `minimumLevel` — the canonical gate every\n * sink/emitter uses so a record is persisted only when the active policy meets\n * the record's minimum verbosity.\n */\nexport function agentTraceabilityLevelAllows(\n  activeLevel: AgentTraceabilityLevel,\n  minimumLevel: AgentTraceabilityLevel,\n): boolean {\n  return AGENT_TRACEABILITY_LEVEL_ORDER[activeLevel] >= AGENT_TRACEABILITY_LEVEL_ORDER[minimumLevel];\n}\n\n/**\n * The more verbose of two levels — for hosts that COMPOSE traceability\n * concerns behind one policy binding. A host policy must never be LESS\n * verbose than any interested sink: a companion whose filesystem tracing is\n * off (`NONE`) but whose LLM-observability provider is active still needs\n * `DEBUG` so the emission reaches the sinks (each sink then self-gates).\n * Replacing a live policy with a static lower level silently kills every\n * downstream sink — the failure mode that motivated this helper.\n */\nexport function maxAgentTraceabilityLevel(\n  a: AgentTraceabilityLevel,\n  b: AgentTraceabilityLevel,\n): AgentTraceabilityLevel {\n  return AGENT_TRACEABILITY_LEVEL_ORDER[a] >= AGENT_TRACEABILITY_LEVEL_ORDER[b] ? a : b;\n}\n\n/** Engine-resolved traceability policy handed to `AgentsBackendService`. */\nexport const AgentTraceabilityPolicySchema = z.object({\n  level: z.enum(AgentTraceabilityLevel).default(AgentTraceabilityLevel.NONE),\n});\nexport type AgentTraceabilityPolicy = z.infer<typeof AgentTraceabilityPolicySchema>;\n\n/** Terminal outcome of a single agent invocation. */\nexport enum AgentCallOutcome {\n  SUCCESS = 'success',\n  FAILURE = 'failure',\n}\n\n/**\n * WHAT KIND of model call a trace records — the operation-aware axis observability sinks branch\n * on (RAG plan DL2/H4). The two kinds differ structurally, not cosmetically:\n *\n * - a GENERATION consumes prompt tokens and produces completion tokens; its usage is complete\n *   only when BOTH dimensions are present, and its payload (prompt/completion text) may be\n *   forwarded to analytics under an explicit content opt-in;\n * - an EMBEDDING consumes input tokens and produces VECTORS; it has no completion-token\n *   dimension (so completeness is judged on input tokens alone), and its output must NEVER\n *   reach analytics or logs at any verbosity — a vector is a lossy encoding of the source text,\n *   not telemetry. Producers put a `{ vectorCount, dims }` summary in `output`; sinks enforce\n *   the exclusion defensively on top.\n *\n * Absent means GENERATION (every pre-existing producer), so the field is additive.\n */\nexport enum AgentCallTraceKind {\n  GENERATION = 'generation',\n  EMBEDDING = 'embedding',\n}\n\n/**\n * Structured, JSON-serializable shape for a failed agent call. (Never the raw\n * `Error` object — it collapses to `{}` under `JSON.stringify`.)\n */\nexport const AgentCallTraceErrorSchema = z.object({\n  name: z.string().optional(),\n  message: z.string(),\n  code: z.string().optional(),\n});\nexport type AgentCallTraceError = z.infer<typeof AgentCallTraceErrorSchema>;\n\n/**\n * The typed per-call trace record the engine emits to the configured sink, once\n * per `invokeAgent` completion (success or failure). This is the contract that\n * replaces every caller's hand-rolled `response.executionContext as { usage?,\n * executionTime? }` cast + manual artifact write.\n *\n * - `context` reuses {@link LLMProvider_OperationContext_BaseSchema} — the exact\n *   telemetry envelope (`usage` / `executionTime` / `finishedAt` / `finishReason`\n *   / `transport` / `outputTracking`) that `invokeAgent` already assembles. No\n *   parallel shape, no drift.\n * - `input` / `output` are agent-specific and therefore opaque here; sinks\n *   persist them only at `DEBUG_VERBOSE` (payload gating is a sink concern).\n * - `attempt` lets a caller-side retry loop correlate multiple records for one\n *   logical generation: the engine traces each physical call; retry orchestration\n *   stays caller-side.\n */\nexport const AgentCallTraceSchema = z.object({\n  agentRef: z.string(),\n  /** See {@link AgentCallTraceKind}. Absent = `GENERATION` (the pre-existing producers). */\n  kind: z.enum(AgentCallTraceKind).optional(),\n  /**\n   * Resolved LLM vendor ref (e.g. `anthropic`, `openai`). Maps to analytics\n   * dimensions like PostHog `$ai_provider`. Optional — non-LLM/uncaptured calls omit it.\n   */\n  provider: z.string().optional(),\n  /**\n   * Resolved model id (e.g. `claude-opus-4-8`). Load-bearing for analytics sinks:\n   * PostHog derives `$ai_total_cost_usd` from `$ai_model` + token usage, so without\n   * it cost attribution is lost. Optional — populated for model-backed agent calls.\n   */\n  model: z.string().optional(),\n  /** ISO 8601 — when the call was initiated. */\n  callTimestamp: z.string(),\n  /** 1-based attempt index when the caller drives a retry loop. */\n  attempt: z.number().int().positive().optional(),\n  outcome: z.enum(AgentCallOutcome),\n  /** Resolved agent input (e.g. the prompt). Opaque; sink persists at DEBUG_VERBOSE. */\n  input: z.unknown().optional(),\n  /** Raw agent output. Opaque; sink persists at DEBUG_VERBOSE. */\n  output: z.unknown().optional(),\n  /** Telemetry the engine captured — token usage, latency, transport, finishReason. */\n  context: LLMProvider_OperationContext_BaseSchema.optional(),\n  /** Present on `FAILURE`. */\n  error: AgentCallTraceErrorSchema.optional(),\n});\nexport type AgentCallTrace = z.infer<typeof AgentCallTraceSchema>;\n\n/**\n * Caller-supplied correlation + enrichment, handed to `invokeAgent` so the\n * emitted {@link AgentCallTraceSchema} record can be routed and contextualized\n * by the sink.\n *\n * The engine does NOT interpret `sessionRef` / `stepRef` — they are opaque\n * handles the sink owns (e.g. the companion filesystem sink's session/step\n * directory ids). `attributes` carry caller domain context (templateRef,\n * locale, bucket, …) for filtering/grouping.\n */\nexport const AgentTraceContextSchema = z.object({\n  /** Opaque sink-owned session handle (groups many calls of one operation). */\n  sessionRef: z.string().optional(),\n  /** Opaque sink-owned step handle (one logical sub-operation within a session). */\n  stepRef: z.string().optional(),\n  /** Human-readable label (e.g. `email-template-generation:system.welcome_email`). */\n  label: z.string().optional(),\n  /** Caller domain attributes for filtering/grouping (templateRef, locale, …). */\n  attributes: z.record(z.string(), z.unknown()).optional(),\n  /** Per-call override of the engine policy level (else the engine default applies). */\n  levelOverride: z.enum(AgentTraceabilityLevel).optional(),\n  /**\n   * Explicit work attribution for this call (#1598): tenant, case, execution and task. Wins over the\n   * ambient work frame. Deliberately a typed field and NOT part of `attributes`, which are free-form\n   * caller dimensions for telemetry and never reach the attribution store.\n   */\n  attribution: ModelCallAttributionInputSchema.optional(),\n});\nexport type AgentTraceContext = z.infer<typeof AgentTraceContextSchema>;\n\n/**\n * One agent-call trace emission handed to a sink: the typed per-call record, the\n * engine-resolved active level (never `NONE` — the engine skips emission at `NONE`),\n * and the caller's correlation/enrichment context. Bundled so sinks gain fields\n * without a signature change.\n */\nexport interface AgentCallTraceEmission {\n  trace: AgentCallTrace;\n  level: AgentTraceabilityLevel;\n  context?: AgentTraceContext;\n}\n\n/**\n * Pluggable destination for engine-level agent-call traces — the swappable output\n * side of `AgentsBackendService.invokeAgent` tracing (filesystem artifacts, structured\n * logs, 3rd-party LLM analytics, OTel spans, …).\n *\n * The interface lives in `saas-models` (not a backend package) so implementations can\n * live where their dependency belongs WITHOUT a dependency cycle: generic ones in\n * `saas-backend-lib` (NoOp / Logger / Composite), provider-specific ones in\n * `external-connectors-private` (e.g. the PostHog LLM-analytics sink, which owns\n * `posthog-node`), app-specific ones in the app (e.g. the companion filesystem sink).\n *\n * `recordAgentCall` MUST be best-effort: the engine wraps it so a sink failure never\n * turns a successful agent call into a failed one, and output is byte-identical when\n * traceability is off.\n */\nexport interface AgentCallTraceSink {\n  recordAgentCall(emission: AgentCallTraceEmission): void | Promise<void>;\n  /**\n   * Optional flush/cleanup, called best-effort on host shutdown. Implementations\n   * that batch + flush asynchronously (e.g. a 3rd-party analytics client) MUST drain\n   * here so short-lived processes (CLI / companion / minion) don't lose queued events.\n   */\n  shutdown?(): void | Promise<void>;\n}\n"]}
+{"version":3,"file":"agent-traceability.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/agent-traceability.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,uCAAa,CAAA;IACb,yCAAe,CAAA;IACf,yDAA+B,CAAA;AACjC,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAA2C;IACpF,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;IAChC,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;IACjC,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmC,EACnC,YAAoC;IAEpC,OAAO,8BAA8B,CAAC,WAAW,CAAC,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,CAAyB,EACzB,CAAyB;IAEzB,OAAO,8BAA8B,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC;CAC3E,CAAC,CAAC;AAGH,qDAAqD;AACrD,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;AACrB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,6CAAuB,CAAA;AACzB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,0FAA0F;IAC1F,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,8CAA8C;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iEAAiE;IACjE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjC,sFAAsF;IACtF,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,qFAAqF;IACrF,OAAO,EAAE,uCAAuC,CAAC,QAAQ,EAAE;IAC3D,4BAA4B;IAC5B,KAAK,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,6EAA6E;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,oFAAoF;IACpF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD;;;;OAIG;IACH,WAAW,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { LLMProvider_OperationContext_BaseSchema } from '@wildo-ai/external-connectors-models';\nimport { ModelCallAttributionInputSchema } from './work-attribution.shared.schemas';\n\n/**\n * Verbosity policy for engine-level agent-call traceability. Promotes the\n * companion's previously-local `WILDO_DEV_COMPANION_TRACEABILITY_LEVEL` to a\n * shared engine contract so every agent caller (companion, backend runtime,\n * minions, workers) and every sink (filesystem, logger, OTel) speak the same\n * levels.\n *\n * - `NONE`          — tracing fully off; emitters must no-op before any I/O.\n * - `DEBUG`         — per-call metadata + token usage + latency (no payloads).\n * - `DEBUG_VERBOSE` — adds the resolved prompt input + raw output payloads.\n */\nexport enum AgentTraceabilityLevel {\n  NONE = 'NONE',\n  DEBUG = 'DEBUG',\n  DEBUG_VERBOSE = 'DEBUG_VERBOSE',\n}\n\n/** Numeric ordering for `AgentTraceabilityLevel` gating comparisons. */\nexport const AGENT_TRACEABILITY_LEVEL_ORDER: Record<AgentTraceabilityLevel, number> = {\n  [AgentTraceabilityLevel.NONE]: 0,\n  [AgentTraceabilityLevel.DEBUG]: 1,\n  [AgentTraceabilityLevel.DEBUG_VERBOSE]: 2,\n};\n\n/**\n * True when `activeLevel` is at least `minimumLevel` — the canonical gate every\n * sink/emitter uses so a record is persisted only when the active policy meets\n * the record's minimum verbosity.\n */\nexport function agentTraceabilityLevelAllows(\n  activeLevel: AgentTraceabilityLevel,\n  minimumLevel: AgentTraceabilityLevel,\n): boolean {\n  return AGENT_TRACEABILITY_LEVEL_ORDER[activeLevel] >= AGENT_TRACEABILITY_LEVEL_ORDER[minimumLevel];\n}\n\n/**\n * The more verbose of two levels — for hosts that COMPOSE traceability\n * concerns behind one policy binding. A host policy must never be LESS\n * verbose than any interested sink: a companion whose filesystem tracing is\n * off (`NONE`) but whose LLM-observability provider is active still needs\n * `DEBUG` so the emission reaches the sinks (each sink then self-gates).\n * Replacing a live policy with a static lower level silently kills every\n * downstream sink — the failure mode that motivated this helper.\n */\nexport function maxAgentTraceabilityLevel(\n  a: AgentTraceabilityLevel,\n  b: AgentTraceabilityLevel,\n): AgentTraceabilityLevel {\n  return AGENT_TRACEABILITY_LEVEL_ORDER[a] >= AGENT_TRACEABILITY_LEVEL_ORDER[b] ? a : b;\n}\n\n/** Engine-resolved traceability policy handed to `AgentsBackendService`. */\nexport const AgentTraceabilityPolicySchema = z.object({\n  level: z.enum(AgentTraceabilityLevel).default(AgentTraceabilityLevel.NONE),\n});\nexport type AgentTraceabilityPolicy = z.infer<typeof AgentTraceabilityPolicySchema>;\n\n/** Terminal outcome of a single agent invocation. */\nexport enum AgentCallOutcome {\n  SUCCESS = 'success',\n  FAILURE = 'failure',\n}\n\n/**\n * WHAT KIND of model call a trace records — the operation-aware axis observability sinks branch\n * on (RAG plan DL2/H4). The two kinds differ structurally, not cosmetically:\n *\n * - a GENERATION consumes prompt tokens and produces completion tokens; its usage is complete\n *   only when BOTH dimensions are present, and its payload (prompt/completion text) may be\n *   forwarded to analytics under an explicit content opt-in;\n * - an EMBEDDING consumes input tokens and produces VECTORS; it has no completion-token\n *   dimension (so completeness is judged on input tokens alone), and its output must NEVER\n *   reach analytics or logs at any verbosity — a vector is a lossy encoding of the source text,\n *   not telemetry. Producers put a `{ vectorCount, dims }` summary in `output`; sinks enforce\n *   the exclusion defensively on top.\n *\n * Absent means GENERATION (every pre-existing producer), so the field is additive.\n */\nexport enum AgentCallTraceKind {\n  GENERATION = 'generation',\n  EMBEDDING = 'embedding',\n}\n\n/**\n * Structured, JSON-serializable shape for a failed agent call. (Never the raw\n * `Error` object — it collapses to `{}` under `JSON.stringify`.)\n */\nexport const AgentCallTraceErrorSchema = z.object({\n  name: z.string().optional(),\n  message: z.string(),\n  code: z.string().optional(),\n});\nexport type AgentCallTraceError = z.infer<typeof AgentCallTraceErrorSchema>;\n\n/**\n * The typed per-call trace record the engine emits to the configured sink, once\n * per `invokeAgent` completion (success or failure). This is the contract that\n * replaces every caller's hand-rolled `response.executionContext as { usage?,\n * executionTime? }` cast + manual artifact write.\n *\n * - `context` reuses {@link LLMProvider_OperationContext_BaseSchema} — the exact\n *   telemetry envelope (`usage` / `executionTime` / `finishedAt` / `finishReason`\n *   / `transport` / `outputTracking`) that `invokeAgent` already assembles. No\n *   parallel shape, no drift.\n * - `input` / `output` are agent-specific and therefore opaque here; sinks\n *   persist them only at `DEBUG_VERBOSE` (payload gating is a sink concern).\n * - `attempt` lets a caller-side retry loop correlate multiple records for one\n *   logical generation: the engine traces each physical call; retry orchestration\n *   stays caller-side.\n */\nexport const AgentCallTraceSchema = z.object({\n  agentRef: z.string(),\n  /** See {@link AgentCallTraceKind}. Absent = `GENERATION` (the pre-existing producers). */\n  kind: z.enum(AgentCallTraceKind).optional(),\n  /**\n   * Resolved LLM vendor ref (e.g. `anthropic`, `openai`). Maps to analytics\n   * dimensions like PostHog `$ai_provider`. Optional — non-LLM/uncaptured calls omit it.\n   */\n  provider: z.string().optional(),\n  /**\n   * Resolved model id (e.g. `claude-opus-4-8`). Load-bearing for analytics sinks:\n   * PostHog derives `$ai_total_cost_usd` from `$ai_model` + token usage, so without\n   * it cost attribution is lost. Optional — populated for model-backed agent calls.\n   */\n  model: z.string().optional(),\n  /** ISO 8601 — when the call was initiated. */\n  callTimestamp: z.string(),\n  /** 1-based attempt index when the caller drives a retry loop. */\n  attempt: z.number().int().positive().optional(),\n  outcome: z.enum(AgentCallOutcome),\n  /** Resolved agent input (e.g. the prompt). Opaque; sink persists at DEBUG_VERBOSE. */\n  input: z.unknown().optional(),\n  /** Raw agent output. Opaque; sink persists at DEBUG_VERBOSE. */\n  output: z.unknown().optional(),\n  /** Telemetry the engine captured — token usage, latency, transport, finishReason. */\n  context: LLMProvider_OperationContext_BaseSchema.optional(),\n  /** Present on `FAILURE`. */\n  error: AgentCallTraceErrorSchema.optional(),\n});\nexport type AgentCallTrace = z.infer<typeof AgentCallTraceSchema>;\n\n/**\n * Caller-supplied correlation + enrichment, handed to `invokeAgent` so the\n * emitted {@link AgentCallTraceSchema} record can be routed and contextualized\n * by the sink.\n *\n * The engine does NOT interpret `sessionRef` / `stepRef` — they are opaque\n * handles the sink owns (e.g. the companion filesystem sink's session/step\n * directory ids). `attributes` carry caller domain context (templateRef,\n * locale, bucket, …) for filtering/grouping.\n */\nexport const AgentTraceContextSchema = z.object({\n  /** Opaque sink-owned session handle (groups many calls of one operation). */\n  sessionRef: z.string().optional(),\n  /** Opaque sink-owned step handle (one logical sub-operation within a session). */\n  stepRef: z.string().optional(),\n  /** Human-readable label (e.g. `email-template-generation:system.welcome_email`). */\n  label: z.string().optional(),\n  /** Caller domain attributes for filtering/grouping (templateRef, locale, …). */\n  attributes: z.record(z.string(), z.unknown()).optional(),\n  /** Per-call override of the engine policy level (else the engine default applies). */\n  levelOverride: z.enum(AgentTraceabilityLevel).optional(),\n  /**\n   * Explicit work attribution for this call (#1598): tenant, case, execution and task. Wins over the\n   * ambient work frame. Deliberately a typed field and NOT part of `attributes`, which are free-form\n   * caller dimensions for telemetry and never reach the attribution store.\n   */\n  attribution: ModelCallAttributionInputSchema.optional(),\n});\nexport type AgentTraceContext = z.infer<typeof AgentTraceContextSchema>;\n\n/**\n * One agent-call trace emission handed to a sink: the typed per-call record, the\n * engine-resolved active level (never `NONE` — the engine skips emission at `NONE`),\n * and the caller's correlation/enrichment context. Bundled so sinks gain fields\n * without a signature change.\n */\nexport interface AgentCallTraceEmission {\n  trace: AgentCallTrace;\n  level: AgentTraceabilityLevel;\n  context?: AgentTraceContext;\n}\n\n/**\n * Pluggable destination for engine-level agent-call traces — the swappable output\n * side of `AgentsBackendService.invokeAgent` tracing (filesystem artifacts, structured\n * logs, 3rd-party LLM analytics, OTel spans, …).\n *\n * The interface lives in `saas-models` (not a backend package) so implementations can\n * live where their dependency belongs WITHOUT a dependency cycle: generic ones in\n * `saas-backend-lib` (NoOp / Logger / Composite), provider-specific ones in\n * `external-connectors-private` (e.g. the PostHog LLM-analytics sink, which owns\n * `posthog-node`), app-specific ones in the app (e.g. the companion filesystem sink).\n *\n * `recordAgentCall` MUST be best-effort: the engine wraps it so a sink failure never\n * turns a successful agent call into a failed one, and output is byte-identical when\n * traceability is off.\n */\nexport interface AgentCallTraceSink {\n  recordAgentCall(emission: AgentCallTraceEmission): void | Promise<void>;\n  /**\n   * Optional flush/cleanup, called best-effort on host shutdown. Implementations\n   * that batch + flush asynchronously (e.g. a 3rd-party analytics client) MUST drain\n   * here so short-lived processes (CLI / companion / minion) don't lose queued events.\n   */\n  shutdown?(): void | Promise<void>;\n}\n"]}

package/dist/esm/flows-actors/agent-work-decisions.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-work-decisions.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/agent-work-decisions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAmC5I,qGAAqG;AACrG,eAAO,MAAM,sCAAsC,qPAgDlD,CAAC;AAEF,0HAA0H;AAC1H,eAAO,MAAM,6CAA6C,qPAmDzD,CAAC;AAGF,KAAK,iCAAiC,GAAG,qBAAqB,CAAC,IAAI,GAAG,qBAAqB,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;AAQjK;;;GAGG;AACH,eAAO,MAAM,mEAAmE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;iCAqC9H,CAAC;AAEL,0HAA0H;AAC1H,eAAO,MAAM,yEAAyE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;iCAiCpI,CAAC;AAEL,uGAAuG;AACvG,eAAO,MAAM,mEAAmE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;iCAmD9H,CAAC"}
+{"version":3,"file":"agent-work-decisions.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/agent-work-decisions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAmC5I,qGAAqG;AACrG,eAAO,MAAM,sCAAsC,qPAgDlD,CAAC;AAEF,0HAA0H;AAC1H,eAAO,MAAM,6CAA6C,qPAmDzD,CAAC;AAGF,KAAK,iCAAiC,GAAG,qBAAqB,CAAC,IAAI,GAAG,qBAAqB,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;AAQjK;;;GAGG;AACH,eAAO,MAAM,mEAAmE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;iCAqC9H,CAAC;AAEL,0HAA0H;AAC1H,eAAO,MAAM,yEAAyE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;iCAiCpI,CAAC;AAEL,uGAAuG;AACvG,eAAO,MAAM,mEAAmE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;iCAmD9H,CAAC"}

package/dist/esm/flows-actors/agent-work-decisions.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-work-decisions.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/agent-work-decisions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,mCAAmC,EACnC,+CAA+C,EAC/C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;IAChE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;IACvF,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAGF,qGAAqG;AACrG,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,oGAAoG;QACpG,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E;;;OAGG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC5G,uHAAuH;IACvH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;KACF;CACF,CACF,CAAC;AAEF,0HAA0H;AAC1H,MAAM,CAAC,MAAM,6CAA6C,GAAG,uCAAuC,CAClG,+CAA+C,EAC/C;IACE,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E;;;;OAIG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,aAAa,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC/G;;;OAGG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC;SACvK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACpK;KACF;CACF,CACF,CAAC;AAIF,MAAM,oCAAoC,GAAwC;IAChF,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAAsF;IAC9H,UAAU,EAAE,8BAA8B;IAC1C,kBAAkB,EAAE,gBAAgB,CAAC,2BAA2B;IAChE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;IACzG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,mHAAmH;IACnH,4CAA4C;IAC5C,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAC3J,cAAc,EAAE,oCAAoC;IACpD,uBAAuB,EAAE;QACvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;gBACtJ,gHAAgH;gBAChH,gFAAgF;gBAChF,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACnK;QACD,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACxK;KACF;CACF,CAAC,CAAC;AAEL,0HAA0H;AAC1H,MAAM,CAAC,MAAM,yEAAyE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC1I,0CAA0C,CAA2F;IACnI,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAAE,gBAAgB,CAAC,gCAAgC;IACrE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gCAAgC,CAAC;IAC9G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAC3J,cAAc,EAAE,oCAAoC;IACpD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;gBACtJ,yEAAyE;gBACzE,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACnK;QACD,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACxK;KACF;CACF,CAAC,CAAC;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAIxC;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IACD,mHAAmH;IACnH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC5G,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;gBACrJ,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Agent-work decisions: resource configurations (#1599).\n *\n * Five resources, one concern: the record of what experts did with agents' proposals, and what the tenant allowed\n * to be done with it.\n *\n * - `agentWorkDecisions` (polymorphic, the owner scope of the paused work) — the metadata record. Written by the\n *   engine only (the settlement, the repair sweep, `recordOutputReview`), read by the scope's administrator. Kept\n *   for the declared AUDIT_LOGS period; an erasure of the decider severs `deciderUserId` and keeps the decision.\n * - `agentWorkDecisionContents` (polymorphic, same scopes) — the opt-in content. Written by the engine only, under\n *   the tenant's `WITH_CONTENT` setting. Deleted with its owner scope by the composition cascade, like the tenant's\n *   other data (a per-row RESOURCE_DATA clock cannot be bound: the user and application variants name no\n *   organization, which `SCOPE_DELETED` counts from). An erasure scrubs every content field.\n * - `agentWorkCaptureSettings` / `evaluationExportAuthorizations` (organization singletons) — the organization\n *   administrator's two decisions; every change is audited by the backend's postfix.\n * - `evaluationDatasetExports` (organization) — the export ledger, kept for AUDIT_LOGS.\n */\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport {\n  AgentWorkCaptureSettingsSchema,\n  EvaluationDatasetExportSchema,\n  EvaluationExportAuthorizationSchema,\n  agentWorkDecisionContentsPolymorphicDeclaration,\n  agentWorkDecisionsPolymorphicDeclaration,\n} from './agent-work-decisions.shared.schemas';\n\n/**\n * Who reads a scope's decisions. A user reads the decisions taken on their OWN threads; an organization's or an\n * application's are shared scope data, read by its administrator — the `flowActorExecutions` reasoning, since the\n * records describe work in those threads.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n/**\n * Content is the client's material: its reader is the scope's ADMINISTRATOR, plus — in an organization — the one role\n * the organization's capture setting names (`contentReaderRole`). The organization route therefore admits members, and\n * the backend's read gate (`agent-work-decisions.custom-impl.backend.service.ts`) narrows every READ and LIST to an\n * organization-wide administrator or holder of that role, reading the setting at the moment of the read. A user never\n * reads content from the generic plane.\n */\nconst CONTENT_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n\n/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */\nexport const agentWorkDecisionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  agentWorkDecisionsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    systemAccessPolicy: {\n      // The decider's own decisions belong in their subject export; the backend-only floor still applies.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n    /*\n     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the operator's evidence of supervised agent work, kept for\n     * the declared AUDIT_LOGS period from creation, never a number of this resource's own.\n     */\n    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },\n    /** An erasure severs the decider (`deciderUserId` REMOVE) and keeps the decision: the evidence outlives the person. */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n    },\n  },\n);\n\n/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */\nexport const agentWorkDecisionContentsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  agentWorkDecisionContentsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    systemAccessPolicy: {\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n    /*\n     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the content is the client's material, kept for the declared\n     * RESOURCE_DATA period from when it was written (#1599 Q3), and never longer than the evidence beside it. A creation\n     * start point needs no organization, so it binds all three owner scopes alike.\n     */\n    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },\n    /**\n     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure scrubs the proposal, the final version, the\n     * diff and the reason (all REMOVE); the metadata record beside it survives.\n     */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.MEDIUM }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n    },\n  },\n);\n\n\ntype OrganizationSettingCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;\nconst ORGANIZATION_SETTING_CORE_OPERATIONS: OrganizationSettingCoreOperations[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.DELETE,\n];\n\n/**\n * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — content capture is off unless the organization turns it on,\n * with a stated purpose; every change is audited.\n */\nexport const agentWorkCaptureSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<undefined, OrganizationSettingCoreOperations, typeof AgentWorkCaptureSettingsSchema>({\n    mainSchema: AgentWorkCaptureSettingsSchema,\n    resourceIdentifier: CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    // The settlement writer reads the organization's setting as the engine; the settings page's first READ creates the\n    // organization's row as the engine (below).\n    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,\n    operationsConfiguration: {\n      /**\n       * The settings page IS this READ (a singleton of the organization, route `/organizations/{id}/agent-work-capture-setting`).\n       * An organization that never chose has no row, so the backend's READ postfix creates it METADATA_ONLY on first\n       * access: the default stated as a row, not a decision, so it is neither audited as a change nor a system-write\n       * audit.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },\n          // The READ materialization's door: route-less, and preferred by the service layer, so the engine's write of the\n          // default does not pass through the administrator's guarded and audited CREATE.\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      // The composition cascade's door; route-less.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n    },\n  });\n\n/** assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — no export without a recorded basis; every change audited. */\nexport const evaluationExportAuthorizationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<undefined, OrganizationSettingCoreOperations, typeof EvaluationExportAuthorizationSchema>({\n    mainSchema: EvaluationExportAuthorizationSchema,\n    resourceIdentifier: CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,\n    operationsConfiguration: {\n      /**\n       * The authorisation page IS this READ (`/organizations/{id}/evaluation-export-authorization`). An organization that\n       * never granted one has no row, so the READ postfix creates it NOT_GRANTED on first access: nobody decided, so it\n       * is not audited as a change. Granting is the UPDATE that sets ACTIVE with a basis.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },\n          // The READ materialization's door (route-less; see the capture setting).\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      // The composition cascade's door; route-less.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n    },\n  });\n\n/** The export ledger: written by the engine at each export, read by the organization administrator. */\nexport const evaluationDatasetExportsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    undefined,\n    CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE,\n    typeof EvaluationDatasetExportSchema\n  >({\n    mainSchema: EvaluationDatasetExportSchema,\n    resourceIdentifier: CoreResourceType.EVALUATION_DATASET_EXPORTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_DATASET_EXPORTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: {\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n    /** assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the ledger is kept for the declared AUDIT_LOGS period. */\n    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n    },\n  });\n"]}
+{"version":3,"file":"agent-work-decisions.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/agent-work-decisions.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,mCAAmC,EACnC,+CAA+C,EAC/C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,gBAAgB,GAAG;IACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;IACnD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG;IACzB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;IAChE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;IACvF,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAGF,qGAAqG;AACrG,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,oGAAoG;QACpG,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E;;;OAGG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC5G,uHAAuH;IACvH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;KACF;CACF,CACF,CAAC;AAEF,0HAA0H;AAC1H,MAAM,CAAC,MAAM,6CAA6C,GAAG,uCAAuC,CAClG,+CAA+C,EAC/C;IACE,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5E;;;;OAIG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,aAAa,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC/G;;;OAGG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC;SACvK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACpK;KACF;CACF,CACF,CAAC;AAIF,MAAM,oCAAoC,GAAwC;IAChF,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAAsF;IAC9H,UAAU,EAAE,8BAA8B;IAC1C,kBAAkB,EAAE,gBAAgB,CAAC,2BAA2B;IAChE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;IACzG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,mHAAmH;IACnH,4CAA4C;IAC5C,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAC3J,cAAc,EAAE,oCAAoC;IACpD,uBAAuB,EAAE;QACvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;gBACtJ,gHAAgH;gBAChH,gFAAgF;gBAChF,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACnK;QACD,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACxK;KACF;CACF,CAAC,CAAC;AAEL,0HAA0H;AAC1H,MAAM,CAAC,MAAM,yEAAyE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC1I,0CAA0C,CAA2F;IACnI,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAAE,gBAAgB,CAAC,gCAAgC;IACrE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gCAAgC,CAAC;IAC9G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAC3J,cAAc,EAAE,oCAAoC;IACpD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE;gBACtJ,yEAAyE;gBACzE,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACnK;QACD,8CAA8C;QAC9C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACxK;KACF;CACF,CAAC,CAAC;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACpI,0CAA0C,CAIxC;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IACD,mHAAmH;IACnH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAC5G,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE;IACxE,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,sHAAsH;QACtH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;gBACrJ,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACvK;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Agent-work decisions: resource configurations (#1599).\n *\n * Five resources, one concern: the record of what experts did with agents' proposals, and what the tenant allowed\n * to be done with it.\n *\n * - `agentWorkDecisions` (polymorphic, the owner scope of the paused work) — the metadata record. Written by the\n *   engine only (the settlement, the repair sweep, `recordOutputReview`), read by the scope's administrator. Kept\n *   for the declared AUDIT_LOGS period; an erasure of the decider severs `deciderUserId` and keeps the decision.\n * - `agentWorkDecisionContents` (polymorphic, same scopes) — the opt-in content. Written by the engine only, under\n *   the tenant's `WITH_CONTENT` setting. Deleted with its owner scope by the composition cascade, like the tenant's\n *   other data (a per-row RESOURCE_DATA clock cannot be bound: the user and application variants name no\n *   organization, which `SCOPE_DELETED` counts from). An erasure scrubs every content field.\n * - `agentWorkCaptureSettings` / `evaluationExportAuthorizations` (organization singletons) — the organization\n *   administrator's two decisions; every change is audited by the backend's postfix.\n * - `evaluationDatasetExports` (organization) — the export ledger, kept for AUDIT_LOGS.\n */\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { createPolymorphicResourceConfigurations } from '../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport {\n  AgentWorkCaptureSettingsSchema,\n  EvaluationDatasetExportSchema,\n  EvaluationExportAuthorizationSchema,\n  agentWorkDecisionContentsPolymorphicDeclaration,\n  agentWorkDecisionsPolymorphicDeclaration,\n} from './agent-work-decisions.shared.schemas';\n\n/**\n * Who reads a scope's decisions. A user reads the decisions taken on their OWN threads; an organization's or an\n * application's are shared scope data, read by its administrator — the `flowActorExecutions` reasoning, since the\n * records describe work in those threads.\n */\nconst OWNER_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_USER],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n/**\n * Content is the client's material: its reader is the scope's ADMINISTRATOR, plus — in an organization — the one role\n * the organization's capture setting names (`contentReaderRole`). The organization route therefore admits members, and\n * the backend's read gate (`agent-work-decisions.custom-impl.backend.service.ts`) narrows every READ and LIST to an\n * organization-wide administrator or holder of that role, reading the setting at the moment of the read. A user never\n * reads content from the generic plane.\n */\nconst CONTENT_READ_ROLES = {\n  [CoreResourceType.USERS]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_MEMBER],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\n\n/** `userAgentWorkDecisions` / `organizationAgentWorkDecisions` / `applicationAgentWorkDecisions`. */\nexport const agentWorkDecisionsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  agentWorkDecisionsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    systemAccessPolicy: {\n      // The decider's own decisions belong in their subject export; the backend-only floor still applies.\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n    /*\n     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the operator's evidence of supervised agent work, kept for\n     * the declared AUDIT_LOGS period from creation, never a number of this resource's own.\n     */\n    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },\n    /** An erasure severs the decider (`deciderUserId` REMOVE) and keeps the decision: the evidence outlives the person. */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: OWNER_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n    },\n  },\n);\n\n/** `userAgentWorkDecisionContents` / `organizationAgentWorkDecisionContents` / `applicationAgentWorkDecisionContents`. */\nexport const agentWorkDecisionContentsPolymorphicFactories = createPolymorphicResourceConfigurations(\n  agentWorkDecisionContentsPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    systemAccessPolicy: {\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n    },\n    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n    /*\n     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the content is the client's material, kept for the declared\n     * RESOURCE_DATA period from when it was written (#1599 Q3), and never longer than the evidence beside it. A creation\n     * start point needs no organization, so it binds all three owner scopes alike.\n     */\n    retentionBinding: { retentionClass: DataRetentionClass.RESOURCE_DATA, startPoint: RetentionStartPoint.CREATED },\n    /**\n     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure scrubs the proposal, the final version, the\n     * diff and the reason (all REMOVE); the metadata record beside it survives.\n     */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.MEDIUM }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, polymorphicRole: CONTENT_READ_ROLES, riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n    },\n  },\n);\n\n\ntype OrganizationSettingCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;\nconst ORGANIZATION_SETTING_CORE_OPERATIONS: OrganizationSettingCoreOperations[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.DELETE,\n];\n\n/**\n * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — content capture is off unless the organization turns it on,\n * with a stated purpose; every change is audited.\n */\nexport const agentWorkCaptureSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<undefined, OrganizationSettingCoreOperations, typeof AgentWorkCaptureSettingsSchema>({\n    mainSchema: AgentWorkCaptureSettingsSchema,\n    resourceIdentifier: CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    // The settlement writer reads the organization's setting as the engine; the settings page's first READ creates the\n    // organization's row as the engine (below).\n    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,\n    operationsConfiguration: {\n      /**\n       * The settings page IS this READ (a singleton of the organization, route `/organizations/{id}/agent-work-capture-setting`).\n       * An organization that never chose has no row, so the backend's READ postfix creates it METADATA_ONLY on first\n       * access: the default stated as a row, not a decision, so it is neither audited as a change nor a system-write\n       * audit.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },\n          // The READ materialization's door: route-less, and preferred by the service layer, so the engine's write of the\n          // default does not pass through the administrator's guarded and audited CREATE.\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      // The composition cascade's door; route-less.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n    },\n  });\n\n/** assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — no export without a recorded basis; every change audited. */\nexport const evaluationExportAuthorizationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<undefined, OrganizationSettingCoreOperations, typeof EvaluationExportAuthorizationSchema>({\n    mainSchema: EvaluationExportAuthorizationSchema,\n    resourceIdentifier: CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: { read: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED, exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n    coreOperations: ORGANIZATION_SETTING_CORE_OPERATIONS,\n    operationsConfiguration: {\n      /**\n       * The authorisation page IS this READ (`/organizations/{id}/evaluation-export-authorization`). An organization that\n       * never granted one has no row, so the READ postfix creates it NOT_GRANTED on first access: nobody decided, so it\n       * is not audited as a change. Granting is the UPDATE that sets ACTIVE with a basis.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH },\n          // The READ materialization's door (route-less; see the capture setting).\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      // The composition cascade's door; route-less.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n    },\n  });\n\n/** The export ledger: written by the engine at each export, read by the organization administrator. */\nexport const evaluationDatasetExportsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    undefined,\n    CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE,\n    typeof EvaluationDatasetExportSchema\n  >({\n    mainSchema: EvaluationDatasetExportSchema,\n    resourceIdentifier: CoreResourceType.EVALUATION_DATASET_EXPORTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.EVALUATION_DATASET_EXPORTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: {\n      create: ResourceSystemAccessMode.ALLOWED,\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n    /** assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — the ledger is kept for the declared AUDIT_LOGS period. */\n    retentionBinding: { retentionClass: DataRetentionClass.AUDIT_LOGS, startPoint: RetentionStartPoint.CREATED },\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      // The retention writer's door (`retentionPolicy` requires it); route-less.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The composition cascade's and the retention sweep's door: route-less, and service-resolvable as the sweep requires.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n          { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW },\n        ],\n      },\n    },\n  });\n"]}

package/dist/esm/flows-actors/agent-work-decisions.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-work-decisions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/agent-work-decisions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,wBAAwB,EAA6B,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAM7H,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D;;;;GAIG;AACH,oBAAY,6BAA6B;IACvC,qFAAqF;IACrF,UAAU,eAAe;IACzB;;;OAGG;IACH,UAAU,eAAe;CAC1B;AAED,+DAA+D;AAC/D,oBAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,gBAAgB,qBAAqB;IACrC,mDAAmD;IACnD,qBAAqB,0BAA0B;CAChD;AAED,+CAA+C;AAC/C,oBAAY,yBAAyB;IACnC,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,oBAAY,wBAAwB;IAClC,+GAA+G;IAC/G,aAAa,kBAAkB;IAC/B,wGAAwG;IACxG,YAAY,iBAAiB;CAC9B;AAED;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B;;;OAGG;IACH,gCAAgC,qCAAqC;IACrE;;;OAGG;IACH,iCAAiC,sCAAsC;CACxE;AAED,kEAAkE;AAClE,oBAAY,mCAAmC;IAC7C;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B,4DAA4D;IAC5D,MAAM,WAAW;IACjB,kGAAkG;IAClG,OAAO,YAAY;CACpB;AAED,qDAAqD;AACrD,oBAAY,mCAAmC;IAC7C,qCAAqC;IACrC,eAAe,oBAAoB;IACnC,2DAA2D;IAC3D,iBAAiB,sBAAsB;CACxC;AAED;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAAS,qBAAqB,EAI7E,CAAC;AACH,mFAAmF;AACnF,eAAO,MAAM,qCAAqC,EAAE,SAAS,qBAAqB,EAGhF,CAAC;AACH,wEAAwE;AAExE,yFAAyF;AACzF,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;IACtC,+GAA+G;;IAE/G,sGAAsG;;kBAEtG,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAUhF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuEtC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAM5E,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;iBAiB7C,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,4BAA4B,EAItC,CAAC;AAExC,qGAAqG;AACrG,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAMnD,CAAC;AAEH,0HAA0H;AAC1H,eAAO,MAAM,+CAA+C;;;;;;;;;;;;;kBAM1D,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;iBAezC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,qEAAqE;AAErE,iGAAiG;AACjG,eAAO,MAAM,6BAA6B;;;;;IAExC,+GAA+G;;;kBAG/G,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;QAf9C,+GAA+G;;;;;;;;;;iBAgC/G,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,yEAAyE;AAEzE,uGAAuG;AACvG,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;iBAsBxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;IAK3C,kGAAkG;;;;;;IAGlG,gDAAgD;;;;;IAEhD,mHAAmH;;;;;IAKnH,oHAAoH;;kBAEpH,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,kEAAkE;AAElE,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAO9C;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC;;;;IAI7C,wGAAwG;;;kBAGW,CAAC;AACtH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;iBAc3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,kEAAkE;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;;;;IAK/C,2FAA2F;;kBAEwB,CAAC;AACtH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,mCAAmC;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,mEAAmE;AAEnE,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,yBAAyB,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAGtI"}
+{"version":3,"file":"agent-work-decisions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/agent-work-decisions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,wBAAwB,EAA6B,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAM7H,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,kDAAkD,CAAC;AAI1D;;;;GAIG;AACH,oBAAY,6BAA6B;IACvC,qFAAqF;IACrF,UAAU,eAAe;IACzB;;;OAGG;IACH,UAAU,eAAe;CAC1B;AAED,+DAA+D;AAC/D,oBAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,gBAAgB,qBAAqB;IACrC,mDAAmD;IACnD,qBAAqB,0BAA0B;CAChD;AAED,+CAA+C;AAC/C,oBAAY,yBAAyB;IACnC,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,oBAAY,wBAAwB;IAClC,+GAA+G;IAC/G,aAAa,kBAAkB;IAC/B,wGAAwG;IACxG,YAAY,iBAAiB;CAC9B;AAED;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B;;;OAGG;IACH,gCAAgC,qCAAqC;IACrE;;;OAGG;IACH,iCAAiC,sCAAsC;CACxE;AAED,kEAAkE;AAClE,oBAAY,mCAAmC;IAC7C;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B,4DAA4D;IAC5D,MAAM,WAAW;IACjB,kGAAkG;IAClG,OAAO,YAAY;CACpB;AAED,qDAAqD;AACrD,oBAAY,mCAAmC;IAC7C,qCAAqC;IACrC,eAAe,oBAAoB;IACnC,2DAA2D;IAC3D,iBAAiB,sBAAsB;CACxC;AAED;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAAS,qBAAqB,EAI7E,CAAC;AACH,mFAAmF;AACnF,eAAO,MAAM,qCAAqC,EAAE,SAAS,qBAAqB,EAGhF,CAAC;AACH,wEAAwE;AAExE,yFAAyF;AACzF,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;IACtC,+GAA+G;;IAE/G,sGAAsG;;kBAEtG,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAUhF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuEtC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAM5E,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;iBAiB7C,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,4BAA4B,EAItC,CAAC;AAExC,qGAAqG;AACrG,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAMnD,CAAC;AAEH,0HAA0H;AAC1H,eAAO,MAAM,+CAA+C;;;;;;;;;;;;;kBAM1D,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;iBAezC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,qEAAqE;AAErE,iGAAiG;AACjG,eAAO,MAAM,6BAA6B;;;;;IAExC,+GAA+G;;;kBAG/G,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;QAf9C,+GAA+G;;;;;;;;;;iBAgC/G,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,yEAAyE;AAEzE,uGAAuG;AACvG,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;iBAsBxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;IAK3C,kGAAkG;;;;;;IAGlG,gDAAgD;;;;;IAEhD,mHAAmH;;;;;IAKnH,oHAAoH;;kBAEpH,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,kEAAkE;AAElE,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAO9C;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC;;;;IAI7C,wGAAwG;;;kBAGW,CAAC;AACtH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;iBAc3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,kEAAkE;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;;;;IAK/C,2FAA2F;;kBAEwB,CAAC;AACtH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,mCAAmC;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,mEAAmE;AAEnE,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,yBAAyB,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAGtI"}