@ttt-productions/ttt-core 0.19.0 → 0.19.2

package/dist/doc-schemas/ncii/notices.js

@@ -0,0 +1,114 @@
+// Trust & Safety — durable uploader-notice delivery state machine (Appendix A
+// §A11 [H-10]).
+//
+// `nciiCases/{caseId}/uploaderNotices/{noticeId}` — the uploader notice is a
+// first-class durable delivery record like every other NCII workflow object (NOT
+// just two bare enums). NOTE: this notices cluster OWNS the
+// `nciiCases/{caseId}/uploaderNotices/{noticeId}` subcollection schema even though
+// the `nciiCases` root doc itself is owned by the requests cluster.
+//
+// Deterministic `noticeId = sha256('ncii-uploader-notice-v1:' + caseId + ':' +
+// recipientUid + ':' + removalGeneration)`. The client-supplied ≥128-bit
+// `idempotencyKey` together with the deterministic noticeId guarantees one record
+// per retry.
+//
+// TRANSITIONS [H-10]:
+//   pending → sent | delayed | suppressed | notApplicable
+//   delayed → sent  (when `delayedUntil` elapses and no suppression applies)
+//   delayed → suppressed
+// A failed delivery re-drives through `command` (retry/dead-letter), never silently
+// drops. Each terminal/transition writes the matching NciiActionType
+// (`uploaderNoticeSent` / `uploaderNoticeDelayed` / `uploaderNoticeSuppressed` /
+// `uploaderNoticeNotApplicable`) to the request `actions` log.
+//
+// Every shape here is transcribed verbatim from docs/code_changes_needed/
+// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 [H-10] — no invented
+// values, no placeholders.
+//
+// SHARED enums come from ../safety/foundation.js (the single source for every
+// cross-cluster enum); they are NEVER redefined here. This cluster IMPORTS
+// UploaderNoticeStatusSchema + UploaderNoticeReasonSchema.
+//
+// Collection note: this cluster owns a NEW subcollection of the requests-cluster
+// `nciiCases` root (+ an append-only per-attempt ledger); wiring collections.ts /
+// path-builders.ts / registry.ts is deferred to the app leg (the orchestrator
+// binds the schemas + path builders there); the deterministic doc-id shape is
+// documented on each schema below.
+import { z } from 'zod';
+import { UploaderNoticeStatusSchema, UploaderNoticeReasonSchema, } from '../safety/foundation.js';
+// ===========================================================================
+// §A11 [H-10] — delivery channel + embedded shapes
+// ===========================================================================
+/** Notice delivery channel. */
+export const NciiUploaderNoticeChannelSchema = z.enum(['inApp', 'email']);
+/** Who the notice is for, snapshotted at decision time (NEVER re-resolved). */
+export const NciiUploaderNoticeRecipientSnapshotSchema = z.object({
+    uid: z.string().min(1),
+    deliveryAddressRef: z.string().min(1),
+    capturedAt: z.number(),
+}).strict();
+/** Durable retry/dead-letter delivery command on the notice. */
+export const NciiUploaderNoticeCommandV1Schema = z.object({
+    commandId: z.string().min(1),
+    attemptCount: z.number(),
+    nextAttemptAt: z.number().optional(),
+    leaseOwner: z.string().min(1).optional(),
+    leaseExpiresAt: z.number().optional(),
+    lastErrorCode: z.string().optional(),
+}).strict();
+// ===========================================================================
+// §A11 [H-10] — nciiCases/{caseId}/uploaderNotices/{noticeId}
+// ===========================================================================
+/** `nciiCases/{caseId}/uploaderNotices/{noticeId}` — durable uploader-notice
+ * delivery record (OWNED by the notices cluster). Doc id `noticeId` is
+ * deterministic:
+ * `sha256('ncii-uploader-notice-v1:' + caseId + ':' + recipientUid + ':' + removalGeneration)`. */
+export const NciiUploaderNoticeV1Schema = z.object({
+    schemaVersion: z.literal(1),
+    noticeId: z.string().min(1),
+    caseId: z.string().min(1),
+    requestIds: z.array(z.string().min(1)).max(16),
+    removalGeneration: z.number(),
+    // who, snapshotted at decision time (never re-resolved)
+    recipientSnapshot: NciiUploaderNoticeRecipientSnapshotSchema,
+    channel: NciiUploaderNoticeChannelSchema,
+    // the notice template + version actually used
+    templateId: z.string().min(1),
+    templateVersion: z.number(),
+    // 'pending'|'sent'|'delayed'|'suppressed'|'notApplicable'
+    status: UploaderNoticeStatusSchema,
+    // present ONLY when status='suppressed' (+ restricted rationale via rationaleRef + reviewer identity)
+    suppressionReason: UploaderNoticeReasonSchema.optional(),
+    // suppression/delay rationale (restricted) + reviewer identity
+    rationaleRef: z.string().min(1).optional(),
+    decidedByUid: z.string().min(1).optional(),
+    // when status='delayed' — the scheduled re-evaluation time (delayed → sent transition)
+    delayedUntil: z.number().optional(),
+    // ≥128-bit; with the deterministic noticeId guarantees one record per retry
+    idempotencyKey: z.string().min(1),
+    // durable retry/dead-letter delivery command
+    command: NciiUploaderNoticeCommandV1Schema,
+    // proof of delivery (provider receipt / read marker), when available
+    verifiedDeliveredAt: z.number().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+}).strict();
+// ===========================================================================
+// §A11 [H-10] — nciiCases/{caseId}/uploaderNotices/{noticeId}/attempts/{attemptId}
+// IMMUTABLE append-only per-attempt ledger.
+// ===========================================================================
+/** Per-attempt delivery result. */
+export const NciiUploaderNoticeAttemptResultSchema = z.enum(['queued', 'sent', 'failed', 'deferred']);
+/** `nciiCases/{caseId}/uploaderNotices/{noticeId}/attempts/{attemptId}` —
+ * IMMUTABLE append-only per-attempt ledger. Doc id `attemptId` is a
+ * deterministic/assigned id (z.string().min(1)). */
+export const NciiUploaderNoticeAttemptV1Schema = z.object({
+    schemaVersion: z.literal(1),
+    attemptId: z.string().min(1),
+    at: z.number(),
+    channel: NciiUploaderNoticeChannelSchema,
+    result: NciiUploaderNoticeAttemptResultSchema,
+    providerRef: z.string().min(1).optional(),
+    errorCode: z.string().optional(),
+}).strict();
+//# sourceMappingURL=notices.js.map

package/dist/doc-schemas/ncii/notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/notices.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gBAAgB;AAChB,EAAE;AACF,6EAA6E;AAC7E,iFAAiF;AACjF,4DAA4D;AAC5D,mFAAmF;AACnF,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,kFAAkF;AAClF,aAAa;AACb,EAAE;AACF,sBAAsB;AACtB,0DAA0D;AAC1D,6EAA6E;AAC7E,yBAAyB;AACzB,oFAAoF;AACpF,qEAAqE;AACrE,iFAAiF;AACjF,+DAA+D;AAC/D,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,2BAA2B;AAC3B,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,8EAA8E;AAC9E,8EAA8E;AAC9E,mCAAmC;AAEnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,+BAA+B;AAC/B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAG1E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,gEAAgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E;;;mGAGmG;AACnG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,wDAAwD;IACxD,iBAAiB,EAAE,yCAAyC;IAC5D,OAAO,EAAE,+BAA+B;IACxC,8CAA8C;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,0DAA0D;IAC1D,MAAM,EAAE,0BAA0B;IAClC,sGAAsG;IACtG,iBAAiB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACxD,+DAA+D;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,uFAAuF;IACvF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,4EAA4E;IAC5E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,6CAA6C;IAC7C,OAAO,EAAE,iCAAiC;IAC1C,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,mFAAmF;AACnF,4CAA4C;AAC5C,8EAA8E;AAE9E,mCAAmC;AACnC,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAGtG;;oDAEoD;AACpD,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,+BAA+B;IACxC,MAAM,EAAE,qCAAqC;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/doc-schemas/ncii/removal.d.ts

@@ -0,0 +1,222 @@
+import { z } from 'zod';
+/** The removal saga phase progression. `denyServing` precedes
+ * `removeOrTombstone`; `verifyRemoval` precedes `complete`. */
+export declare const NciiRemovalPhaseSchema: z.ZodEnum<{
+    complete: "complete";
+    resolveTargets: "resolveTargets";
+    discoverKnownCopies: "discoverKnownCopies";
+    denyServing: "denyServing";
+    removeOrTombstone: "removeOrTombstone";
+    writeHashBlocks: "writeHashBlocks";
+    verifyRemoval: "verifyRemoval";
+}>;
+export type NciiRemovalPhase = z.infer<typeof NciiRemovalPhaseSchema>;
+/** Top-level durable run status of the removal job. */
+export declare const NciiRemovalStatusSchema: z.ZodEnum<{
+    pending: "pending";
+    completed: "completed";
+    retryableFailure: "retryableFailure";
+    deadLetter: "deadLetter";
+    running: "running";
+}>;
+export type NciiRemovalStatus = z.infer<typeof NciiRemovalStatusSchema>;
+/** Typed resumable discovery cursor. `phase` mirrors the job phase enum;
+ * `lastSurface` is the cross-cluster NciiTargetSurface. */
+export declare const NciiDiscoveryCursorV1Schema: z.ZodObject<{
+    phase: z.ZodEnum<{
+        complete: "complete";
+        resolveTargets: "resolveTargets";
+        discoverKnownCopies: "discoverKnownCopies";
+        denyServing: "denyServing";
+        removeOrTombstone: "removeOrTombstone";
+        writeHashBlocks: "writeHashBlocks";
+        verifyRemoval: "verifyRemoval";
+    }>;
+    lastSurface: z.ZodEnum<{
+        chatAttachment: "chatAttachment";
+        original: "original";
+        hallCopy: "hallCopy";
+        profileMedia: "profileMedia";
+        variant: "variant";
+        cacheServing: "cacheServing";
+        exactHashMatch: "exactHashMatch";
+    }>;
+    lastCursorToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type NciiDiscoveryCursorV1 = z.infer<typeof NciiDiscoveryCursorV1Schema>;
+/** `nciiRemovalJobs/{jobId}` — REQUEST-scoped durable removal saga. Doc id
+ * `jobId` is deterministic:
+ * `sha256('ncii-removal-v1:' + requestId + ':' + caseId + ':' + generation)`
+ * (racing workers create the same job). */
+export declare const NciiRemovalJobV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    jobId: z.ZodString;
+    caseId: z.ZodString;
+    requestId: z.ZodString;
+    generation: z.ZodNumber;
+    phase: z.ZodEnum<{
+        complete: "complete";
+        resolveTargets: "resolveTargets";
+        discoverKnownCopies: "discoverKnownCopies";
+        denyServing: "denyServing";
+        removeOrTombstone: "removeOrTombstone";
+        writeHashBlocks: "writeHashBlocks";
+        verifyRemoval: "verifyRemoval";
+    }>;
+    status: z.ZodEnum<{
+        pending: "pending";
+        completed: "completed";
+        retryableFailure: "retryableFailure";
+        deadLetter: "deadLetter";
+        running: "running";
+    }>;
+    cursor: z.ZodOptional<z.ZodObject<{
+        phase: z.ZodEnum<{
+            complete: "complete";
+            resolveTargets: "resolveTargets";
+            discoverKnownCopies: "discoverKnownCopies";
+            denyServing: "denyServing";
+            removeOrTombstone: "removeOrTombstone";
+            writeHashBlocks: "writeHashBlocks";
+            verifyRemoval: "verifyRemoval";
+        }>;
+        lastSurface: z.ZodEnum<{
+            chatAttachment: "chatAttachment";
+            original: "original";
+            hallCopy: "hallCopy";
+            profileMedia: "profileMedia";
+            variant: "variant";
+            cacheServing: "cacheServing";
+            exactHashMatch: "exactHashMatch";
+        }>;
+        lastCursorToken: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    leaseOwner: z.ZodOptional<z.ZodString>;
+    leaseExpiresAt: z.ZodOptional<z.ZodNumber>;
+    attemptCount: z.ZodNumber;
+    nextAttemptAt: z.ZodOptional<z.ZodNumber>;
+    lastErrorCode: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    completedAt: z.ZodOptional<z.ZodNumber>;
+    deadLetterAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type NciiRemovalJobV1 = z.infer<typeof NciiRemovalJobV1Schema>;
+/** Serving-deny sub-state. */
+export declare const NciiTargetServingDenyStateSchema: z.ZodEnum<{
+    pending: "pending";
+    failed: "failed";
+    denied: "denied";
+}>;
+export type NciiTargetServingDenyState = z.infer<typeof NciiTargetServingDenyStateSchema>;
+/** Removal sub-state. */
+export declare const NciiTargetRemovalStateSchema: z.ZodEnum<{
+    pending: "pending";
+    failed: "failed";
+    removed: "removed";
+    tombstoned: "tombstoned";
+}>;
+export type NciiTargetRemovalState = z.infer<typeof NciiTargetRemovalStateSchema>;
+/** Verification sub-state. */
+export declare const NciiTargetVerificationStateSchema: z.ZodEnum<{
+    pending: "pending";
+    verifiedGone: "verifiedGone";
+    leftover: "leftover";
+}>;
+export type NciiTargetVerificationState = z.infer<typeof NciiTargetVerificationStateSchema>;
+/** `nciiRemovalJobs/{jobId}/targets/{targetKeyHash}` — per-target removal row.
+ * Doc id `targetKeyHash` is the deterministic id from the canonical locator.
+ * Per-target transitions: `servingDeny (pending→denied | failed)`;
+ * `removal (pending→removed | tombstoned | failed)`;
+ * `verification (pending→verifiedGone | leftover)`. */
+export declare const NciiRemovalTargetV1Schema: z.ZodObject<{
+    targetKeyHash: z.ZodString;
+    locator: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"mediaAsset">;
+        mediaAssetId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"hallItem">;
+        hallItemId: z.ZodString;
+        subItemId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"squarePost">;
+        postId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"profileImage">;
+        profileUid: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"username">;
+        profileUid: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"craftSkill">;
+        profileUid: z.ZodString;
+        craftSkillId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"commissionListing">;
+        commissionListingId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"audition">;
+        auditionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"auditionEntry">;
+        auditionId: z.ZodString;
+        auditionEntryId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"guildInviteMessage">;
+        channelId: z.ZodString;
+        messageId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"chatAttachment">;
+        channelId: z.ZodString;
+        messageId: z.ZodString;
+        attachmentId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"url">;
+        url: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"additionalText">;
+        textRef: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    surface: z.ZodEnum<{
+        chatAttachment: "chatAttachment";
+        original: "original";
+        hallCopy: "hallCopy";
+        profileMedia: "profileMedia";
+        variant: "variant";
+        cacheServing: "cacheServing";
+        exactHashMatch: "exactHashMatch";
+    }>;
+    expectedGeneration: z.ZodOptional<z.ZodNumber>;
+    servingDenyState: z.ZodEnum<{
+        pending: "pending";
+        failed: "failed";
+        denied: "denied";
+    }>;
+    removalState: z.ZodEnum<{
+        pending: "pending";
+        failed: "failed";
+        removed: "removed";
+        tombstoned: "tombstoned";
+    }>;
+    verificationState: z.ZodEnum<{
+        pending: "pending";
+        verifiedGone: "verifiedGone";
+        leftover: "leftover";
+    }>;
+    outcome: z.ZodEnum<{
+        pending: "pending";
+        unableToComplete: "unableToComplete";
+        removed: "removed";
+        tombstoned: "tombstoned";
+        verifiedGone: "verifiedGone";
+        leftoverRetrying: "leftoverRetrying";
+        terminalException: "terminalException";
+    }>;
+    attemptCount: z.ZodNumber;
+    leaseOwner: z.ZodOptional<z.ZodString>;
+    leaseExpiresAt: z.ZodOptional<z.ZodNumber>;
+    lastErrorCode: z.ZodOptional<z.ZodString>;
+    updatedAt: z.ZodNumber;
+}, z.core.$strict>;
+export type NciiRemovalTargetV1 = z.infer<typeof NciiRemovalTargetV1Schema>;
+//# sourceMappingURL=removal.d.ts.map

package/dist/doc-schemas/ncii/removal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"removal.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/removal.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB;+DAC+D;AAC/D,eAAO,MAAM,sBAAsB;;;;;;;;EAQjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,uDAAuD;AACvD,eAAO,MAAM,uBAAuB;;;;;;EAMlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAOxE;2DAC2D;AAC3D,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;kBAI7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAQhF;;;2CAG2C;AAC3C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAoBxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAQtE,8BAA8B;AAC9B,eAAO,MAAM,gCAAgC;;;;EAA0C,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,yBAAyB;AACzB,eAAO,MAAM,4BAA4B;;;;;EAAyD,CAAC;AACnG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,8BAA8B;AAC9B,eAAO,MAAM,iCAAiC;;;;EAAkD,CAAC;AACjG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;uDAIuD;AACvD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAe3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/doc-schemas/ncii/removal.js

@@ -0,0 +1,130 @@
+// Trust & Safety — NCII per-request removal deadline + durable removal saga
+// (Appendix A §A11 [H4]).
+//
+// The removal job is REQUEST-scoped, not case-scoped: the deadline monitor lives
+// at `safetySlaMonitors/{requestId}__nciiRemovalDeadline` and a monitor can never
+// be resolved by finishing a DIFFERENT linked request. The case-level
+// `nciiRemovalDeadlineAt` MAY mirror the minimum active deadline but is NOT the
+// source of truth.
+//
+// COMPLETION PREDICATE [H4]: completion is derived ONLY from verified target rows
+// + approved legal outcomes — a request is `completed` ONLY when the reported
+// target AND every known identical copy reaches `verificationState='verifiedGone'`
+// OR carries an approved `NciiTerminalException`. A partial technical failure is
+// the HONEST outcome `unableToComplete` (technical) or
+// `completedWithApprovedException` (counsel-approved) — NEVER ordinary `completed`.
+// A worker crash resumes idempotently (replay is idempotent by `targetKeyHash` +
+// the job's deterministic `jobId`); a `leftover`/`failed` target re-drives from
+// its last unverified sub-state.
+//
+// Every shape here is transcribed verbatim from docs/code_changes_needed/
+// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 [H4] — no invented
+// values, no placeholders.
+//
+// SHARED enums + the locator come from ../safety/foundation.js (the single source
+// for every cross-cluster enum); they are NEVER redefined here. This cluster
+// IMPORTS NciiTargetSurfaceSchema, NciiTargetOutcomeSchema, and TargetLocatorV1Schema.
+//
+// Collection note: this cluster introduces NEW Firestore collections (+ one child
+// subcollection under `nciiRemovalJobs`); wiring collections.ts / path-builders.ts
+// / registry.ts is deferred to the app leg (the orchestrator binds the schemas +
+// path builders there); the deterministic doc-id shapes are documented on each
+// schema below.
+import { z } from 'zod';
+import { NciiTargetSurfaceSchema, NciiTargetOutcomeSchema, TargetLocatorV1Schema, } from '../safety/foundation.js';
+// ===========================================================================
+// §A11 [H4] — phase / status vocabularies for the removal saga
+// ===========================================================================
+/** The removal saga phase progression. `denyServing` precedes
+ * `removeOrTombstone`; `verifyRemoval` precedes `complete`. */
+export const NciiRemovalPhaseSchema = z.enum([
+    'resolveTargets',
+    'discoverKnownCopies',
+    'denyServing',
+    'removeOrTombstone',
+    'writeHashBlocks',
+    'verifyRemoval',
+    'complete',
+]);
+/** Top-level durable run status of the removal job. */
+export const NciiRemovalStatusSchema = z.enum([
+    'pending',
+    'running',
+    'retryableFailure',
+    'deadLetter',
+    'completed',
+]);
+// ===========================================================================
+// §A11 [H4] — NciiDiscoveryCursorV1 (typed resumable discovery cursor — never an
+// untyped blob). Embedded on NciiRemovalJobV1.cursor.
+// ===========================================================================
+/** Typed resumable discovery cursor. `phase` mirrors the job phase enum;
+ * `lastSurface` is the cross-cluster NciiTargetSurface. */
+export const NciiDiscoveryCursorV1Schema = z.object({
+    phase: NciiRemovalPhaseSchema,
+    lastSurface: NciiTargetSurfaceSchema,
+    lastCursorToken: z.string().min(1).optional(),
+}).strict();
+// ===========================================================================
+// §A11 [H4] — nciiRemovalJobs/{jobId}
+// Deterministic `jobId = sha256('ncii-removal-v1:' + requestId + ':' + caseId +
+// ':' + generation)` (racing workers create the SAME job — idempotent).
+// ===========================================================================
+/** `nciiRemovalJobs/{jobId}` — REQUEST-scoped durable removal saga. Doc id
+ * `jobId` is deterministic:
+ * `sha256('ncii-removal-v1:' + requestId + ':' + caseId + ':' + generation)`
+ * (racing workers create the same job). */
+export const NciiRemovalJobV1Schema = z.object({
+    schemaVersion: z.literal(1),
+    // = sha256('ncii-removal-v1:' + requestId + ':' + caseId + ':' + generation)
+    jobId: z.string().min(1),
+    caseId: z.string().min(1),
+    requestId: z.string().min(1),
+    generation: z.number(),
+    phase: NciiRemovalPhaseSchema,
+    status: NciiRemovalStatusSchema,
+    // typed resumable discovery cursor — never an untyped blob
+    cursor: NciiDiscoveryCursorV1Schema.optional(),
+    leaseOwner: z.string().min(1).optional(),
+    leaseExpiresAt: z.number().optional(),
+    attemptCount: z.number(),
+    nextAttemptAt: z.number().optional(),
+    lastErrorCode: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    completedAt: z.number().optional(),
+    deadLetterAt: z.number().optional(),
+}).strict();
+// ===========================================================================
+// §A11 [H4] — nciiRemovalJobs/{jobId}/targets/{targetKeyHash}
+// Per-target child row. `targetKeyHash` is the deterministic id derived from the
+// canonical locator. Per-target transitions are independent sub-state machines.
+// ===========================================================================
+/** Serving-deny sub-state. */
+export const NciiTargetServingDenyStateSchema = z.enum(['pending', 'denied', 'failed']);
+/** Removal sub-state. */
+export const NciiTargetRemovalStateSchema = z.enum(['pending', 'removed', 'tombstoned', 'failed']);
+/** Verification sub-state. */
+export const NciiTargetVerificationStateSchema = z.enum(['pending', 'verifiedGone', 'leftover']);
+/** `nciiRemovalJobs/{jobId}/targets/{targetKeyHash}` — per-target removal row.
+ * Doc id `targetKeyHash` is the deterministic id from the canonical locator.
+ * Per-target transitions: `servingDeny (pending→denied | failed)`;
+ * `removal (pending→removed | tombstoned | failed)`;
+ * `verification (pending→verifiedGone | leftover)`. */
+export const NciiRemovalTargetV1Schema = z.object({
+    // deterministic id from the canonical locator
+    targetKeyHash: z.string().min(1),
+    locator: TargetLocatorV1Schema,
+    surface: NciiTargetSurfaceSchema,
+    expectedGeneration: z.number().optional(),
+    servingDenyState: NciiTargetServingDenyStateSchema,
+    removalState: NciiTargetRemovalStateSchema,
+    verificationState: NciiTargetVerificationStateSchema,
+    outcome: NciiTargetOutcomeSchema,
+    attemptCount: z.number(),
+    leaseOwner: z.string().min(1).optional(),
+    leaseExpiresAt: z.number().optional(),
+    lastErrorCode: z.string().optional(),
+    updatedAt: z.number(),
+}).strict();
+//# sourceMappingURL=removal.js.map

package/dist/doc-schemas/ncii/removal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"removal.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/removal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,0BAA0B;AAC1B,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,sEAAsE;AACtE,gFAAgF;AAChF,mBAAmB;AACnB,EAAE;AACF,kFAAkF;AAClF,8EAA8E;AAC9E,mFAAmF;AACnF,iFAAiF;AACjF,uDAAuD;AACvD,oFAAoF;AACpF,iFAAiF;AACjF,gFAAgF;AAChF,iCAAiC;AACjC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,2BAA2B;AAC3B,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,uFAAuF;AACvF,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AAC/E,gBAAgB;AAEhB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;+DAC+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,gBAAgB;IAChB,qBAAqB;IACrB,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAGH,uDAAuD;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,SAAS;IACT,SAAS;IACT,kBAAkB;IAClB,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AAGH,8EAA8E;AAC9E,iFAAiF;AACjF,sDAAsD;AACtD,8EAA8E;AAE9E;2DAC2D;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,uBAAuB;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,sCAAsC;AACtC,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAE9E;;;2CAG2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,uBAAuB;IAC/B,2DAA2D;IAC3D,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,8DAA8D;AAC9D,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAE9E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGxF,yBAAyB;AACzB,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnG,8BAA8B;AAC9B,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAGjG;;;;uDAIuD;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,8CAA8C;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,uBAAuB;IAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,gCAAgC;IAClD,YAAY,EAAE,4BAA4B;IAC1C,iBAAiB,EAAE,iCAAiC;IACpD,OAAO,EAAE,uBAAuB;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC"}