@ttt-productions/ttt-core 0.78.21 → 0.78.22

package/dist/safety/active-safety-case-alert.js.map

@@ -1 +1 @@
-{"version":3,"file":"active-safety-case-alert.js","sourceRoot":"","sources":["../../src/safety/active-safety-case-alert.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,wEAAwE;AACxE,EAAE;AACF,mFAAmF;AACnF,0DAA0D;AAC1D,sEAAsE;AACtE,qFAAqF;AACrF,wFAAwF;AACxF,yFAAyF;AACzF,uFAAuF;AACvF,wFAAwF;AACxF,uFAAuF;AACvF,0BAA0B;AAC1B,EAAE;AACF,oFAAoF;AACpF,EAAE;AACF,wFAAwF;AACxF,yFAAyF;AACzF,2FAA2F;AAC3F,EAAE;AACF,yFAAyF;AACzF,qFAAqF;AACrF,yFAAyF;AACzF,yFAAyF;AAEzF,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG1D,MAAM,cAAc,GAAG,CAAU,CAAC;AAmBlC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,EAA8B,EAC9B,IAA2F;IAE3F,MAAM,KAAK,GAAsB;QAC/B,aAAa,EAAE,cAAc;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,GAAG;KACpB,CAAC;IACF,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAAqB,EAAE,MAAc;IACrF,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACvE,CAAC","sourcesContent":["// The ONE writer/remover of the time-sensitive admin-tray pin\n// (`activeSafetyCaseAlerts/{caseId}` — a PII-free `SafetyCaseAlertV1`).\n//\n// A row exists while a protected case needs operator attention; its mere EXISTENCE\n// lights the admin-only 5th notification-tray tab. It is:\n//   - WRITTEN at the ONE protected place — the case-open transactions\n//     (openChildSafetyCase / openNciiCaseFromReport) call writeActiveSafetyCaseAlert\n//     in-transaction; the public take-it-down intake calls the SAME writer from its own\n//     module graph, keyed by requestId (so a statutory request's \"case\" is the request).\n//   - REMOVED by the case-close Cloud Function when the case reaches a terminal/closed\n//     state on the Safety Case Console. There is NO client clear path (firestore.rules:\n//     admin-read, CF-write-only), so the tray's Clear All can never dismiss it while a\n//     case is still open.\n//\n// PII-free by construction — the schema carries only {caseId, caseKind, createdAt}.\n//\n// Rule 36 / Cross-Boundary Type Invariant: this is the SINGLE canonical writer. It used\n// to be hand-mirrored in both TTT app TS projects (the Cloud Functions graph and the App\n// Hosting route graph) because they cannot cross-import; both now import it from ttt-core.\n//\n// ttt-core must NOT gain a runtime firebase-admin dependency (the `./safety` entry stays\n// server-safe), so the injected Firestore handles are MINIMAL STRUCTURAL types — the\n// writer only needs `tx.create(ref, data)`, `db.doc(path)`, and `ref.delete()`. The real\n// Admin SDK `Transaction` / `Firestore` / `DocumentReference` satisfy them structurally.\n\nimport { PATH_BUILDERS, toPath } from '../paths/index.js';\nimport type { SafetyCaseAlertV1, SafetyCaseAlertKind } from '../doc-schemas/index.js';\n\nconst SCHEMA_VERSION = 1 as const;\n\n/** Minimal structural handle for the Firestore doc reference the writer touches.\n *  The Admin SDK `DocumentReference` satisfies it (its `delete()` returns a WriteResult\n *  promise, assignable to `Promise<unknown>`). */\nexport interface SafetyAlertDocRefLike {\n  delete(): Promise<unknown>;\n}\n\n/** Minimal structural handle for an Admin SDK `Transaction` — only `create` is used. */\nexport interface SafetyAlertTransactionLike {\n  create(documentRef: SafetyAlertDocRefLike, data: SafetyCaseAlertV1): void;\n}\n\n/** Minimal structural handle for an Admin SDK `Firestore` — only `doc(path)` is used. */\nexport interface SafetyAlertDbLike {\n  doc(path: string): SafetyAlertDocRefLike;\n}\n\n/**\n * Create the time-sensitive pin for a freshly-opened protected case, IN the case-open\n * transaction. Call ONLY on the first-creation path (where the case docs are\n * `tx.create`d) — the alert id is the caseId, so a retry that re-creates the case would\n * also re-create the same alert; gating it with the case create keeps it idempotent.\n */\nexport function writeActiveSafetyCaseAlert(\n  tx: SafetyAlertTransactionLike,\n  args: { db: SafetyAlertDbLike; caseId: string; caseKind: SafetyCaseAlertKind; now: number },\n): void {\n  const alert: SafetyCaseAlertV1 = {\n    schemaVersion: SCHEMA_VERSION,\n    caseId: args.caseId,\n    caseKind: args.caseKind,\n    createdAt: args.now,\n  };\n  tx.create(args.db.doc(toPath(PATH_BUILDERS.safetyCaseAlert(args.caseId))), alert);\n}\n\n/**\n * Remove the pin when a case closes. Idempotent — a delete of an absent doc is a no-op,\n * so a trigger redelivery (or a case that never armed a pin) is harmless.\n */\nexport async function deleteActiveSafetyCaseAlert(db: SafetyAlertDbLike, caseId: string): Promise<void> {\n  await db.doc(toPath(PATH_BUILDERS.safetyCaseAlert(caseId))).delete();\n}\n"]}
+{"version":3,"file":"active-safety-case-alert.js","sourceRoot":"","sources":["../../src/safety/active-safety-case-alert.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,wEAAwE;AACxE,EAAE;AACF,mFAAmF;AACnF,0DAA0D;AAC1D,sEAAsE;AACtE,qFAAqF;AACrF,wFAAwF;AACxF,yFAAyF;AACzF,uFAAuF;AACvF,wFAAwF;AACxF,uFAAuF;AACvF,0BAA0B;AAC1B,EAAE;AACF,oFAAoF;AACpF,EAAE;AACF,yFAAyF;AACzF,yFAAyF;AACzF,2FAA2F;AAC3F,EAAE;AACF,yFAAyF;AACzF,qFAAqF;AACrF,yFAAyF;AACzF,yFAAyF;AAEzF,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG1D,MAAM,cAAc,GAAG,CAAU,CAAC;AAmBlC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,EAA8B,EAC9B,IAA2F;IAE3F,MAAM,KAAK,GAAsB;QAC/B,aAAa,EAAE,cAAc;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,GAAG;KACpB,CAAC;IACF,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAAqB,EAAE,MAAc;IACrF,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACvE,CAAC","sourcesContent":["// The ONE writer/remover of the time-sensitive admin-tray pin\n// (`activeSafetyCaseAlerts/{caseId}` — a PII-free `SafetyCaseAlertV1`).\n//\n// A row exists while a protected case needs operator attention; its mere EXISTENCE\n// lights the admin-only 5th notification-tray tab. It is:\n//   - WRITTEN at the ONE protected place — the case-open transactions\n//     (openChildSafetyCase / openNciiCaseFromReport) call writeActiveSafetyCaseAlert\n//     in-transaction; the public take-it-down intake calls the SAME writer from its own\n//     module graph, keyed by requestId (so a statutory request's \"case\" is the request).\n//   - REMOVED by the case-close Cloud Function when the case reaches a terminal/closed\n//     state on the Safety Case Console. There is NO client clear path (firestore.rules:\n//     admin-read, CF-write-only), so the tray's Clear All can never dismiss it while a\n//     case is still open.\n//\n// PII-free by construction — the schema carries only {caseId, caseKind, createdAt}.\n//\n// ARCH-102 / Cross-Boundary Type Invariant: this is the SINGLE canonical writer. It used\n// to be hand-mirrored in both TTT app TS projects (the Cloud Functions graph and the App\n// Hosting route graph) because they cannot cross-import; both now import it from ttt-core.\n//\n// ttt-core must NOT gain a runtime firebase-admin dependency (the `./safety` entry stays\n// server-safe), so the injected Firestore handles are MINIMAL STRUCTURAL types — the\n// writer only needs `tx.create(ref, data)`, `db.doc(path)`, and `ref.delete()`. The real\n// Admin SDK `Transaction` / `Firestore` / `DocumentReference` satisfy them structurally.\n\nimport { PATH_BUILDERS, toPath } from '../paths/index.js';\nimport type { SafetyCaseAlertV1, SafetyCaseAlertKind } from '../doc-schemas/index.js';\n\nconst SCHEMA_VERSION = 1 as const;\n\n/** Minimal structural handle for the Firestore doc reference the writer touches.\n *  The Admin SDK `DocumentReference` satisfies it (its `delete()` returns a WriteResult\n *  promise, assignable to `Promise<unknown>`). */\nexport interface SafetyAlertDocRefLike {\n  delete(): Promise<unknown>;\n}\n\n/** Minimal structural handle for an Admin SDK `Transaction` — only `create` is used. */\nexport interface SafetyAlertTransactionLike {\n  create(documentRef: SafetyAlertDocRefLike, data: SafetyCaseAlertV1): void;\n}\n\n/** Minimal structural handle for an Admin SDK `Firestore` — only `doc(path)` is used. */\nexport interface SafetyAlertDbLike {\n  doc(path: string): SafetyAlertDocRefLike;\n}\n\n/**\n * Create the time-sensitive pin for a freshly-opened protected case, IN the case-open\n * transaction. Call ONLY on the first-creation path (where the case docs are\n * `tx.create`d) — the alert id is the caseId, so a retry that re-creates the case would\n * also re-create the same alert; gating it with the case create keeps it idempotent.\n */\nexport function writeActiveSafetyCaseAlert(\n  tx: SafetyAlertTransactionLike,\n  args: { db: SafetyAlertDbLike; caseId: string; caseKind: SafetyCaseAlertKind; now: number },\n): void {\n  const alert: SafetyCaseAlertV1 = {\n    schemaVersion: SCHEMA_VERSION,\n    caseId: args.caseId,\n    caseKind: args.caseKind,\n    createdAt: args.now,\n  };\n  tx.create(args.db.doc(toPath(PATH_BUILDERS.safetyCaseAlert(args.caseId))), alert);\n}\n\n/**\n * Remove the pin when a case closes. Idempotent — a delete of an absent doc is a no-op,\n * so a trigger redelivery (or a case that never armed a pin) is harmless.\n */\nexport async function deleteActiveSafetyCaseAlert(db: SafetyAlertDbLike, caseId: string): Promise<void> {\n  await db.doc(toPath(PATH_BUILDERS.safetyCaseAlert(caseId))).delete();\n}\n"]}

package/dist/safety/ncii-intake-derivations.js

@@ -3,7 +3,7 @@
 // used by BOTH the public Next.js intake route and the Cloud Functions deadline/scan
 // workers. These used to be hand-mirrored in two app TS projects (the Cloud Functions
 // graph AND the App Hosting route graph, which cannot cross-import). This is now the ONE
-// canonical declaration (Rule 36 / Cross-Boundary Type Invariant): both module graphs
+// canonical declaration (ARCH-102 / Cross-Boundary Type Invariant): both module graphs
 // import these derivations from ttt-core so the deterministic id/key contracts can never
 // drift between the two runtimes.
 //

package/dist/safety/ncii-intake-derivations.js.map

@@ -1 +1 @@
-{"version":3,"file":"ncii-intake-derivations.js","sourceRoot":"","sources":["../../src/safety/ncii-intake-derivations.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,qFAAqF;AACrF,qFAAqF;AACrF,sFAAsF;AACtF,yFAAyF;AACzF,sFAAsF;AACtF,yFAAyF;AACzF,kCAAkC;AAClC,EAAE;AACF,uFAAuF;AACvF,sFAAsF;AACtF,oFAAoF;AACpF,kDAAkD;AAClD,EAAE;AACF,iFAAiF;AACjF,sFAAsF;AACtF,uFAAuF;AACvF,2EAA2E;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAQrD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC;6EAC6E;AAC7E,MAAM,GAAG,GAAG,MAAM,CAAC;AAEnB,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E;6EAC6E;AAC7E,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAElD;;8EAE8E;AAC9E,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,SAAS,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAwB;IAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACvB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,YAAY;YACf,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,YAAY;YACf,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,KAAK,cAAc;YACjB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,YAAY;YACf,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,KAAK,mBAAmB;YACtB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,eAAe;YAClB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,oBAAoB;YACvB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnF,KAAK,kBAAkB;YACrB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,KAAK,kBAAkB;YACrB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,KAAK,oBAAoB;YACvB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClF,KAAK,aAAa;YAChB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,KAAK,WAAW;YACd,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,KAAK,WAAW;YACd,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,KAAK,KAAK;YACR,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAO,CAAC,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,cAAsB,EAAE,SAAiB;IAC9E,OAAO,SAAS,CAAC,GAAG,kBAAkB,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,SAAS,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,SAAS,CACd,CAAC,uBAAuB,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,UAAU;YACb,OAAO,mBAAmB,CAAC;QAC7B,KAAK,YAAY;YACf,OAAO,qBAAqB,CAAC;QAC/B,KAAK,cAAc;YACjB,OAAO,eAAe,CAAC;QACzB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,aAAa,CAAC;QACvB,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,gBAAgB,CAAC;QAC1B,KAAK,oBAAoB;YACvB,OAAO,sBAAsB,CAAC;QAChC,KAAK,gBAAgB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,kBAAkB;YACrB,OAAO,6BAA6B,CAAC;QACvC,KAAK,oBAAoB;YACvB,OAAO,qBAAqB,CAAC;QAC/B,KAAK,aAAa;YAChB,OAAO,cAAc,CAAC;QACxB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,eAAe,CAAC;QACzB,KAAK,gBAAgB;YACnB,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,OAAwB,EACxB,iBAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC;QACtC,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;kDAEkD;AAClD,MAAM,gBAAgB,GAAyC,IAAI,GAAG,CAAC;IACrE,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,cAAc;IACd,UAAU;IACV,YAAY;IACZ,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,oBAAoB;IACpB,gBAAgB;CACjB,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,8FAA8F;AAC9F,2FAA2F;AAC3F,yFAAyF;AACzF,8FAA8F;AAC9F,oGAAoG;AACpG,mGAAmG;AACnG,wBAAwB","sourcesContent":["// Shared NCII / TAKE IT DOWN intake derivations (Trust & Safety IMPLEMENTATION_PLAN\n// Phase NCII-2/3/4, Appendix A §A11). Pure, deterministic id/key/summary derivations\n// used by BOTH the public Next.js intake route and the Cloud Functions deadline/scan\n// workers. These used to be hand-mirrored in two app TS projects (the Cloud Functions\n// graph AND the App Hosting route graph, which cannot cross-import). This is now the ONE\n// canonical declaration (Rule 36 / Cross-Boundary Type Invariant): both module graphs\n// import these derivations from ttt-core so the deterministic id/key contracts can never\n// drift between the two runtimes.\n//\n// These are LOAD-BEARING KEYSPACE CONTRACTS. A formula (or version-tag) change re-keys\n// EVERY existing intake request doc / receipt / snapshot — treat any such change as a\n// breaking migration of the intake keyspace, never a routine edit. The per-function\n// version-bump warnings below are not decorative.\n//\n// node:crypto sha256 keeps this pure + server-safe: this module lives behind the\n// `./safety` entry (never on the main barrel), so the frontend bundle never loads it.\n// The completeness predicate + intake-facts shape are NOT here — they are canonical on\n// `./doc-schemas` (beside `computeCompleteness`); import those from there.\n\nimport { resourceKeyHash } from './resource-keys.js';\nimport type {\n  TakeItDownFieldCode,\n  TakeItDownRequesterRole,\n  TargetLocatorV1,\n  TargetLocatorSummaryV1,\n} from '../doc-schemas/index.js';\n\n/**\n * sha256-hex chokepoint. Aliased to `resourceKeyHash` (the single canonical hashing\n * helper in `./resource-keys`) so the whole `./safety` surface has ONE sha256\n * implementation, never two. Named `sha256Hex` here because these intake derivations\n * hash arbitrary keyspace strings, not resource keys.\n */\nexport const sha256Hex = resourceKeyHash;\n\n/** Unit separator — illegal in any id/url/field we join, so a flat separator-joined\n *  string is stable by construction (no key-ordering ambiguity, no JSON). */\nconst SEP = '\\x1f';\n\n// ===========================================================================\n// Deterministic ids ([H-07] idempotent intake)\n// ===========================================================================\n\n/** Version tag for the deterministic intake requestId. A bump re-keys EVERY\n *  request doc id — treat as a breaking migration of the intake keyspace. */\nconst REQUEST_ID_VERSION = 'takeItDownRequest:v1';\n\n/** Deterministic `nciiTemporaryHolds/{holdId}` doc id for a request. ONE definition shared\n *  by intake (which writes the row) and the removal saga (which reads its `target` locator as\n *  the fallback when a public-form request has no case-linked allegation). */\nexport function tempHoldId(requestId: string): string {\n  return sha256Hex(`nciiTemporaryHold:v1:${requestId}`);\n}\n\n/**\n * Canonical, collision-resistant key for a request target. For a resolvable\n * TTT-hosted locator the key is the locator discriminant + its identity fields;\n * for an external/unresolvable locator (a bare URL or free text) it is the\n * `url`/`additionalText` payload. The SAME logical target ALWAYS normalizes to the\n * SAME key so two submissions about the same content with the same idempotencyKey\n * resolve to ONE request doc, and two DIFFERENT targets never collide.\n *\n * No JSON — a flat unit-separator-joined string (the separator is illegal in any\n * id/url field) is stable by construction (no key-ordering ambiguity).\n */\nexport function normalizedTargetKey(locator: TargetLocatorV1): string {\n  const k = locator.kind;\n  switch (locator.kind) {\n    case 'mediaAsset':\n      return [k, locator.mediaAssetId].join(SEP);\n    case 'hallItem':\n      return [k, locator.hallItemId, locator.subItemId ?? ''].join(SEP);\n    case 'squarePost':\n      return [k, locator.postId].join(SEP);\n    case 'profileImage':\n      return [k, locator.profileUid].join(SEP);\n    case 'username':\n      return [k, locator.profileUid].join(SEP);\n    case 'craftSkill':\n      return [k, locator.profileUid, locator.craftSkillId].join(SEP);\n    case 'commissionListing':\n      return [k, locator.commissionListingId].join(SEP);\n    case 'audition':\n      return [k, locator.auditionId].join(SEP);\n    case 'auditionEntry':\n      return [k, locator.auditionId, locator.auditionEntryId].join(SEP);\n    case 'guildInviteMessage':\n      return [k, locator.channelId, locator.messageId].join(SEP);\n    case 'chatAttachment':\n      return [k, locator.channelId, locator.messageId, locator.attachmentId].join(SEP);\n    case 'guildChatMessage':\n      return [k, locator.channelId, locator.messageId].join(SEP);\n    case 'adminWorkMessage':\n      return [k, locator.adminDispatchId, locator.messageId].join(SEP);\n    case 'commissionProposal':\n      return [k, locator.commissionListingId, locator.commissionProposalId].join(SEP);\n    case 'workProject':\n      return [k, locator.workProjectId].join(SEP);\n    case 'workAsset':\n      return [k, locator.workProjectId, locator.workAssetId].join(SEP);\n    case 'workRealm':\n      return [k, locator.workRealmId].join(SEP);\n    case 'url':\n      // Normalize the URL (trim + lowercase scheme/host) so trivially-different\n      // spellings of the same external link collapse to one request.\n      return [k, normalizeExternalUrl(locator.url)].join(SEP);\n    case 'additionalText':\n      return [k, locator.textRef].join(SEP);\n  }\n}\n\n/** Best-effort URL normalization for the external-locator key. A non-parseable\n *  string is lowercased + trimmed (still deterministic). NEVER throws. */\nexport function normalizeExternalUrl(raw: string): string {\n  const trimmed = raw.trim();\n  try {\n    const u = new URL(trimmed);\n    u.protocol = u.protocol.toLowerCase();\n    u.hostname = u.hostname.toLowerCase();\n    return u.toString();\n  } catch {\n    return trimmed.toLowerCase();\n  }\n}\n\n/**\n * [H-07] The deterministic intake requestId:\n *   sha256('takeItDownRequest:v1:' + idempotencyKey + ':' + normalizedTargetKey).\n * A retry with the SAME client idempotencyKey + the SAME target re-derives the SAME\n * id, so the create-if-absent transaction is a no-op and re-returns the same receipt\n * (never double-arms a clock / double-commits a hold).\n */\nexport function deterministicRequestId(idempotencyKey: string, targetKey: string): string {\n  return sha256Hex(`${REQUEST_ID_VERSION}:${idempotencyKey}:${targetKey}`);\n}\n\n/**\n * The opaque public `requestReference` printed on the one-time receipt and stored on the\n * public-status projection. Since the status token was removed, this is a deterministic\n * derivation of the internal `requestId` — a separate sha256 so the raw `requestId` is\n * never recoverable from the reference (which appears on the receipt / projection).\n * 32 hex chars is ample entropy for an opaque, non-enumerable capability.\n */\nexport function deriveRequestReference(requestId: string): string {\n  return sha256Hex(`takeItDownRequestRef:v1:${requestId}`).slice(0, 32);\n}\n\n// ===========================================================================\n// Cumulative submission snapshot hash (the immutable receipt fingerprint)\n// ===========================================================================\n\n/**\n * Deterministic hash of the cumulative request state as of a submission — recorded\n * on `TakeItDownSubmissionV1.cumulativeRequestSnapshotHash`. Built from the SORTED\n * supplied field codes + the normalized target key + the requester role so the same\n * cumulative state always fingerprints identically (append-order independent).\n */\nexport function cumulativeSnapshotHash(args: {\n  requesterRole: TakeItDownRequesterRole;\n  targetKey: string;\n  suppliedFieldCodes: readonly TakeItDownFieldCode[];\n}): string {\n  const sorted = [...args.suppliedFieldCodes].sort();\n  return sha256Hex(\n    ['takeItDownSnapshot:v1', args.requesterRole, args.targetKey, sorted.join(',')].join(SEP),\n  );\n}\n\n// ===========================================================================\n// Privacy-safe target summary (root + public projection — NO narrative / PII)\n// ===========================================================================\n\n/** A short, non-sensitive surface label per locator kind (no ids, no narrative). */\nexport function surfaceLabelFor(locator: TargetLocatorV1): string {\n  switch (locator.kind) {\n    case 'mediaAsset':\n      return 'Media item';\n    case 'hallItem':\n      return 'Hall library item';\n    case 'squarePost':\n      return 'Square Streetz post';\n    case 'profileImage':\n      return 'Profile image';\n    case 'username':\n      return 'Username';\n    case 'craftSkill':\n      return 'Craft skill';\n    case 'commissionListing':\n      return 'Commission listing';\n    case 'audition':\n      return 'Audition';\n    case 'auditionEntry':\n      return 'Audition entry';\n    case 'guildInviteMessage':\n      return 'Guild invite message';\n    case 'chatAttachment':\n      return 'Chat attachment';\n    case 'guildChatMessage':\n      return 'Guild chat message';\n    case 'adminWorkMessage':\n      return 'Work correspondence message';\n    case 'commissionProposal':\n      return 'Commission proposal';\n    case 'workProject':\n      return 'Work project';\n    case 'workAsset':\n      return 'Work file';\n    case 'workRealm':\n      return 'Work realm';\n    case 'url':\n      return 'External link';\n    case 'additionalText':\n      return 'Described content';\n  }\n}\n\n/** Build the privacy-safe `TargetLocatorSummaryV1` (kind + surface label +\n *  whether a TTT-hosted target was server-resolved). NEVER the narrative or ids. */\nexport function targetLocatorSummary(\n  locator: TargetLocatorV1,\n  hasResolvedTarget: boolean,\n): TargetLocatorSummaryV1 {\n  return {\n    kind: locator.kind,\n    surfaceLabel: surfaceLabelFor(locator),\n    hasResolvedTarget,\n  };\n}\n\n/** TTT-hosted locator kinds the intake will synchronously server-resolve +\n *  snapshot + temp-hold. `url` / `additionalText` are external/unresolvable: store\n *  the locator + submission, invent NO target. */\nconst TTT_HOSTED_KINDS: ReadonlySet<TargetLocatorV1['kind']> = new Set([\n  'mediaAsset',\n  'hallItem',\n  'squarePost',\n  'profileImage',\n  'username',\n  'craftSkill',\n  'commissionListing',\n  'audition',\n  'auditionEntry',\n  'guildInviteMessage',\n  'chatAttachment',\n]);\n\n/** True when the locator points at a TTT-hosted surface (server-resolvable). */\nexport function isTttHostedLocator(locator: TargetLocatorV1): boolean {\n  return TTT_HOSTED_KINDS.has(locator.kind);\n}\n\n// The intake temp hold is placed on the canonical key(s) every destructive guard checks — the\n// content-doc key (`contentDocResourceKey(docPath, 'current')` in `./resource-keys`) + the\n// mediaAsset byte key when the target is media-backed. There is intentionally NO bespoke\n// `nciiTemporaryTarget` key builder here: that namespace was consulted by NO guard, so a hold\n// placed on it never blocked deletion ([H3] void). The route-side mirror's `contentDocCanonicalKey`\n// is likewise NOT ported — it duplicated `contentDocResourceKey(docPath, 'current')`, which is the\n// single key authority.\n"]}
+{"version":3,"file":"ncii-intake-derivations.js","sourceRoot":"","sources":["../../src/safety/ncii-intake-derivations.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,qFAAqF;AACrF,qFAAqF;AACrF,sFAAsF;AACtF,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,kCAAkC;AAClC,EAAE;AACF,uFAAuF;AACvF,sFAAsF;AACtF,oFAAoF;AACpF,kDAAkD;AAClD,EAAE;AACF,iFAAiF;AACjF,sFAAsF;AACtF,uFAAuF;AACvF,2EAA2E;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAQrD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC;6EAC6E;AAC7E,MAAM,GAAG,GAAG,MAAM,CAAC;AAEnB,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E;6EAC6E;AAC7E,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAElD;;8EAE8E;AAC9E,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,SAAS,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAwB;IAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACvB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,YAAY;YACf,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,YAAY;YACf,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,KAAK,cAAc;YACjB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,YAAY;YACf,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,KAAK,mBAAmB;YACtB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,eAAe;YAClB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,oBAAoB;YACvB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnF,KAAK,kBAAkB;YACrB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,KAAK,kBAAkB;YACrB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,KAAK,oBAAoB;YACvB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClF,KAAK,aAAa;YAChB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,KAAK,WAAW;YACd,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,KAAK,WAAW;YACd,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,KAAK,KAAK;YACR,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAO,CAAC,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,cAAsB,EAAE,SAAiB;IAC9E,OAAO,SAAS,CAAC,GAAG,kBAAkB,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,SAAS,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,SAAS,CACd,CAAC,uBAAuB,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,UAAU;YACb,OAAO,mBAAmB,CAAC;QAC7B,KAAK,YAAY;YACf,OAAO,qBAAqB,CAAC;QAC/B,KAAK,cAAc;YACjB,OAAO,eAAe,CAAC;QACzB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,aAAa,CAAC;QACvB,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,gBAAgB,CAAC;QAC1B,KAAK,oBAAoB;YACvB,OAAO,sBAAsB,CAAC;QAChC,KAAK,gBAAgB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,kBAAkB;YACrB,OAAO,6BAA6B,CAAC;QACvC,KAAK,oBAAoB;YACvB,OAAO,qBAAqB,CAAC;QAC/B,KAAK,aAAa;YAChB,OAAO,cAAc,CAAC;QACxB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,eAAe,CAAC;QACzB,KAAK,gBAAgB;YACnB,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,OAAwB,EACxB,iBAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC;QACtC,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;kDAEkD;AAClD,MAAM,gBAAgB,GAAyC,IAAI,GAAG,CAAC;IACrE,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,cAAc;IACd,UAAU;IACV,YAAY;IACZ,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,oBAAoB;IACpB,gBAAgB;CACjB,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,8FAA8F;AAC9F,2FAA2F;AAC3F,yFAAyF;AACzF,8FAA8F;AAC9F,oGAAoG;AACpG,mGAAmG;AACnG,wBAAwB","sourcesContent":["// Shared NCII / TAKE IT DOWN intake derivations (Trust & Safety IMPLEMENTATION_PLAN\n// Phase NCII-2/3/4, Appendix A §A11). Pure, deterministic id/key/summary derivations\n// used by BOTH the public Next.js intake route and the Cloud Functions deadline/scan\n// workers. These used to be hand-mirrored in two app TS projects (the Cloud Functions\n// graph AND the App Hosting route graph, which cannot cross-import). This is now the ONE\n// canonical declaration (ARCH-102 / Cross-Boundary Type Invariant): both module graphs\n// import these derivations from ttt-core so the deterministic id/key contracts can never\n// drift between the two runtimes.\n//\n// These are LOAD-BEARING KEYSPACE CONTRACTS. A formula (or version-tag) change re-keys\n// EVERY existing intake request doc / receipt / snapshot — treat any such change as a\n// breaking migration of the intake keyspace, never a routine edit. The per-function\n// version-bump warnings below are not decorative.\n//\n// node:crypto sha256 keeps this pure + server-safe: this module lives behind the\n// `./safety` entry (never on the main barrel), so the frontend bundle never loads it.\n// The completeness predicate + intake-facts shape are NOT here — they are canonical on\n// `./doc-schemas` (beside `computeCompleteness`); import those from there.\n\nimport { resourceKeyHash } from './resource-keys.js';\nimport type {\n  TakeItDownFieldCode,\n  TakeItDownRequesterRole,\n  TargetLocatorV1,\n  TargetLocatorSummaryV1,\n} from '../doc-schemas/index.js';\n\n/**\n * sha256-hex chokepoint. Aliased to `resourceKeyHash` (the single canonical hashing\n * helper in `./resource-keys`) so the whole `./safety` surface has ONE sha256\n * implementation, never two. Named `sha256Hex` here because these intake derivations\n * hash arbitrary keyspace strings, not resource keys.\n */\nexport const sha256Hex = resourceKeyHash;\n\n/** Unit separator — illegal in any id/url/field we join, so a flat separator-joined\n *  string is stable by construction (no key-ordering ambiguity, no JSON). */\nconst SEP = '\\x1f';\n\n// ===========================================================================\n// Deterministic ids ([H-07] idempotent intake)\n// ===========================================================================\n\n/** Version tag for the deterministic intake requestId. A bump re-keys EVERY\n *  request doc id — treat as a breaking migration of the intake keyspace. */\nconst REQUEST_ID_VERSION = 'takeItDownRequest:v1';\n\n/** Deterministic `nciiTemporaryHolds/{holdId}` doc id for a request. ONE definition shared\n *  by intake (which writes the row) and the removal saga (which reads its `target` locator as\n *  the fallback when a public-form request has no case-linked allegation). */\nexport function tempHoldId(requestId: string): string {\n  return sha256Hex(`nciiTemporaryHold:v1:${requestId}`);\n}\n\n/**\n * Canonical, collision-resistant key for a request target. For a resolvable\n * TTT-hosted locator the key is the locator discriminant + its identity fields;\n * for an external/unresolvable locator (a bare URL or free text) it is the\n * `url`/`additionalText` payload. The SAME logical target ALWAYS normalizes to the\n * SAME key so two submissions about the same content with the same idempotencyKey\n * resolve to ONE request doc, and two DIFFERENT targets never collide.\n *\n * No JSON — a flat unit-separator-joined string (the separator is illegal in any\n * id/url field) is stable by construction (no key-ordering ambiguity).\n */\nexport function normalizedTargetKey(locator: TargetLocatorV1): string {\n  const k = locator.kind;\n  switch (locator.kind) {\n    case 'mediaAsset':\n      return [k, locator.mediaAssetId].join(SEP);\n    case 'hallItem':\n      return [k, locator.hallItemId, locator.subItemId ?? ''].join(SEP);\n    case 'squarePost':\n      return [k, locator.postId].join(SEP);\n    case 'profileImage':\n      return [k, locator.profileUid].join(SEP);\n    case 'username':\n      return [k, locator.profileUid].join(SEP);\n    case 'craftSkill':\n      return [k, locator.profileUid, locator.craftSkillId].join(SEP);\n    case 'commissionListing':\n      return [k, locator.commissionListingId].join(SEP);\n    case 'audition':\n      return [k, locator.auditionId].join(SEP);\n    case 'auditionEntry':\n      return [k, locator.auditionId, locator.auditionEntryId].join(SEP);\n    case 'guildInviteMessage':\n      return [k, locator.channelId, locator.messageId].join(SEP);\n    case 'chatAttachment':\n      return [k, locator.channelId, locator.messageId, locator.attachmentId].join(SEP);\n    case 'guildChatMessage':\n      return [k, locator.channelId, locator.messageId].join(SEP);\n    case 'adminWorkMessage':\n      return [k, locator.adminDispatchId, locator.messageId].join(SEP);\n    case 'commissionProposal':\n      return [k, locator.commissionListingId, locator.commissionProposalId].join(SEP);\n    case 'workProject':\n      return [k, locator.workProjectId].join(SEP);\n    case 'workAsset':\n      return [k, locator.workProjectId, locator.workAssetId].join(SEP);\n    case 'workRealm':\n      return [k, locator.workRealmId].join(SEP);\n    case 'url':\n      // Normalize the URL (trim + lowercase scheme/host) so trivially-different\n      // spellings of the same external link collapse to one request.\n      return [k, normalizeExternalUrl(locator.url)].join(SEP);\n    case 'additionalText':\n      return [k, locator.textRef].join(SEP);\n  }\n}\n\n/** Best-effort URL normalization for the external-locator key. A non-parseable\n *  string is lowercased + trimmed (still deterministic). NEVER throws. */\nexport function normalizeExternalUrl(raw: string): string {\n  const trimmed = raw.trim();\n  try {\n    const u = new URL(trimmed);\n    u.protocol = u.protocol.toLowerCase();\n    u.hostname = u.hostname.toLowerCase();\n    return u.toString();\n  } catch {\n    return trimmed.toLowerCase();\n  }\n}\n\n/**\n * [H-07] The deterministic intake requestId:\n *   sha256('takeItDownRequest:v1:' + idempotencyKey + ':' + normalizedTargetKey).\n * A retry with the SAME client idempotencyKey + the SAME target re-derives the SAME\n * id, so the create-if-absent transaction is a no-op and re-returns the same receipt\n * (never double-arms a clock / double-commits a hold).\n */\nexport function deterministicRequestId(idempotencyKey: string, targetKey: string): string {\n  return sha256Hex(`${REQUEST_ID_VERSION}:${idempotencyKey}:${targetKey}`);\n}\n\n/**\n * The opaque public `requestReference` printed on the one-time receipt and stored on the\n * public-status projection. Since the status token was removed, this is a deterministic\n * derivation of the internal `requestId` — a separate sha256 so the raw `requestId` is\n * never recoverable from the reference (which appears on the receipt / projection).\n * 32 hex chars is ample entropy for an opaque, non-enumerable capability.\n */\nexport function deriveRequestReference(requestId: string): string {\n  return sha256Hex(`takeItDownRequestRef:v1:${requestId}`).slice(0, 32);\n}\n\n// ===========================================================================\n// Cumulative submission snapshot hash (the immutable receipt fingerprint)\n// ===========================================================================\n\n/**\n * Deterministic hash of the cumulative request state as of a submission — recorded\n * on `TakeItDownSubmissionV1.cumulativeRequestSnapshotHash`. Built from the SORTED\n * supplied field codes + the normalized target key + the requester role so the same\n * cumulative state always fingerprints identically (append-order independent).\n */\nexport function cumulativeSnapshotHash(args: {\n  requesterRole: TakeItDownRequesterRole;\n  targetKey: string;\n  suppliedFieldCodes: readonly TakeItDownFieldCode[];\n}): string {\n  const sorted = [...args.suppliedFieldCodes].sort();\n  return sha256Hex(\n    ['takeItDownSnapshot:v1', args.requesterRole, args.targetKey, sorted.join(',')].join(SEP),\n  );\n}\n\n// ===========================================================================\n// Privacy-safe target summary (root + public projection — NO narrative / PII)\n// ===========================================================================\n\n/** A short, non-sensitive surface label per locator kind (no ids, no narrative). */\nexport function surfaceLabelFor(locator: TargetLocatorV1): string {\n  switch (locator.kind) {\n    case 'mediaAsset':\n      return 'Media item';\n    case 'hallItem':\n      return 'Hall library item';\n    case 'squarePost':\n      return 'Square Streetz post';\n    case 'profileImage':\n      return 'Profile image';\n    case 'username':\n      return 'Username';\n    case 'craftSkill':\n      return 'Craft skill';\n    case 'commissionListing':\n      return 'Commission listing';\n    case 'audition':\n      return 'Audition';\n    case 'auditionEntry':\n      return 'Audition entry';\n    case 'guildInviteMessage':\n      return 'Guild invite message';\n    case 'chatAttachment':\n      return 'Chat attachment';\n    case 'guildChatMessage':\n      return 'Guild chat message';\n    case 'adminWorkMessage':\n      return 'Work correspondence message';\n    case 'commissionProposal':\n      return 'Commission proposal';\n    case 'workProject':\n      return 'Work project';\n    case 'workAsset':\n      return 'Work file';\n    case 'workRealm':\n      return 'Work realm';\n    case 'url':\n      return 'External link';\n    case 'additionalText':\n      return 'Described content';\n  }\n}\n\n/** Build the privacy-safe `TargetLocatorSummaryV1` (kind + surface label +\n *  whether a TTT-hosted target was server-resolved). NEVER the narrative or ids. */\nexport function targetLocatorSummary(\n  locator: TargetLocatorV1,\n  hasResolvedTarget: boolean,\n): TargetLocatorSummaryV1 {\n  return {\n    kind: locator.kind,\n    surfaceLabel: surfaceLabelFor(locator),\n    hasResolvedTarget,\n  };\n}\n\n/** TTT-hosted locator kinds the intake will synchronously server-resolve +\n *  snapshot + temp-hold. `url` / `additionalText` are external/unresolvable: store\n *  the locator + submission, invent NO target. */\nconst TTT_HOSTED_KINDS: ReadonlySet<TargetLocatorV1['kind']> = new Set([\n  'mediaAsset',\n  'hallItem',\n  'squarePost',\n  'profileImage',\n  'username',\n  'craftSkill',\n  'commissionListing',\n  'audition',\n  'auditionEntry',\n  'guildInviteMessage',\n  'chatAttachment',\n]);\n\n/** True when the locator points at a TTT-hosted surface (server-resolvable). */\nexport function isTttHostedLocator(locator: TargetLocatorV1): boolean {\n  return TTT_HOSTED_KINDS.has(locator.kind);\n}\n\n// The intake temp hold is placed on the canonical key(s) every destructive guard checks — the\n// content-doc key (`contentDocResourceKey(docPath, 'current')` in `./resource-keys`) + the\n// mediaAsset byte key when the target is media-backed. There is intentionally NO bespoke\n// `nciiTemporaryTarget` key builder here: that namespace was consulted by NO guard, so a hold\n// placed on it never blocked deletion ([H3] void). The route-side mirror's `contentDocCanonicalKey`\n// is likewise NOT ported — it duplicated `contentDocResourceKey(docPath, 'current')`, which is the\n// single key authority.\n"]}

package/dist/safety/resource-keys.js

@@ -18,7 +18,7 @@
 // IDENTICALLY — that is the whole correctness story: every hold over the same bytes
 // joins the same aggregate, and every destructive guard consults the same doc.
 //
-// This is the ONE canonical declaration (Rule 36). Both TTT app TS projects (the Cloud
+// This is the ONE canonical declaration (ARCH-102). Both TTT app TS projects (the Cloud
 // Functions graph AND the App Hosting route graph) import these builders from ttt-core
 // rather than hand-mirroring the format — a re-key would otherwise drift the two runtimes
 // apart. node:crypto sha256 keeps it pure + server-safe (this module lives behind the

package/dist/safety/resource-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-keys.js","sourceRoot":"","sources":["../../src/safety/resource-keys.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,kFAAkF;AAClF,8DAA8D;AAC9D,iFAAiF;AACjF,uEAAuE;AACvE,wEAAwE;AACxE,8CAA8C;AAC9C,wCAAwC;AACxC,EAAE;AACF,oFAAoF;AACpF,oFAAoF;AACpF,qFAAqF;AACrF,oFAAoF;AACpF,+EAA+E;AAC/E,EAAE;AACF,uFAAuF;AACvF,uFAAuF;AACvF,0FAA0F;AAC1F,sFAAsF;AACtF,sFAAsF;AACtF,EAAE;AACF,gEAAgE;AAChE,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,iEAAiE;AACjE,sFAAsF;AACtF,yEAAyE;AACzE,qFAAqF;AACrF,qFAAqF;AACrF,2CAA2C;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,kFAAkF;AAClF,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;iFACiF;AACjF,MAAM,GAAG,GAAG,MAAM,CAAC;AAenB,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,oBAA4B;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CACf,YAAoC,EACpC,UAAkB,EAClB,GAAG,KAAe;IAElB,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO;QACL,YAAY;QACZ,UAAU;QACV,oBAAoB;QACpB,eAAe,EAAE,eAAe,CAAC,oBAAoB,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,QAAyB;IAC9E,OAAO,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAc,EACd,GAAW,EACX,UAA2B;IAE3B,OAAO,QAAQ,CAAC,eAAe,EAAE,GAAG,MAAM,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyD;IAC9F,MAAM,IAAI,GAAkB;QAC1B,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC;KACxE,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC;IACvD,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;wFACwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,iBAAkC;IAElC,OAAO,QAAQ,CACb,kBAAkB,EAClB,GAAG,SAAS,IAAI,iBAAiB,EAAE,EACnC,SAAS,EACT,MAAM,CAAC,iBAAiB,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC","sourcesContent":["// Canonical safety-hold resource keys (Trust & Safety IMPLEMENTATION_PLAN Appendix A3).\n//\n// A safety hold is keyed by the PHYSICAL resource it protects, not by the case or\n// the request that created it. The `canonicalResourceKey` is a deterministic string\n// built from exactly the identity fields that pin a physical resource:\n//\n//   - a Firestore content target  = document path + immutable revision/generation\n//   - a storage object            = bucket + key + generation\n//   - a media target              = mediaAsset identity (and, incident-wide, its\n//                                   MediaOriginLineageV1.rootIngestId)\n//   - a chat message range        = channelId + sequence/epoch boundary\n//   - a channel                   = channelId\n//   - an account                  = uid\n//\n// `resourceKeyHash = sha256(canonicalResourceKey)` is the Firestore doc id for both\n// `safetyHoldResources/{resourceKeyHash}` (the O(1) per-flag counter aggregate) and\n// the `{caseId}__{resourceKeyHash}` ref. THE SAME PHYSICAL RESOURCE MUST ALWAYS HASH\n// IDENTICALLY — that is the whole correctness story: every hold over the same bytes\n// joins the same aggregate, and every destructive guard consults the same doc.\n//\n// This is the ONE canonical declaration (Rule 36). Both TTT app TS projects (the Cloud\n// Functions graph AND the App Hosting route graph) import these builders from ttt-core\n// rather than hand-mirroring the format — a re-key would otherwise drift the two runtimes\n// apart. node:crypto sha256 keeps it pure + server-safe (this module lives behind the\n// `./safety` entry, never on the main barrel, so the frontend bundle never loads it).\n//\n// Determinism rules (do not change without a key-version bump):\n//   - Format is `v1` + a type tag + the identity fields, joined by the unit-separator\n//     control char (\\x1f), which cannot appear in a Firestore path, bucket name, key,\n//     uid, or channel id. No JSON (key ordering / whitespace is not load-bearing here;\n//     a flat separator-joined string is stable by construction).\n//   - The type tag prevents cross-type collisions (a contentDoc whose path happens to\n//     equal a storage key never shares a hash with that storage object).\n//   - A bump to the format string ('v1') is a hold-key migration and is NOT backward\n//     compatible — every existing ref/aggregate would re-key. Treat it as a breaking\n//     change to the entire hold authority.\n\nimport { createHash } from 'node:crypto';\nimport type { MediaAsset, SafetyHoldResourceType } from '../doc-schemas/index.js';\n\n/** Format/version tag for every canonical key. Bumping this re-keys ALL holds. */\nconst KEY_FORMAT = 'safetyHoldKey/v1';\n\n/** Unit separator — illegal in every identity field we join, so it is an unambiguous\n *  field delimiter that never appears inside a path, key, uid, or channel id. */\nconst SEP = '\\x1f';\n\n/** A canonical resource key paired with its sha256 hash (the Firestore doc id). */\nexport interface ResourceKey {\n  /** The hold `resourceType` this key belongs to (Appendix A3 enum). */\n  readonly resourceType: SafetyHoldResourceType;\n  /** A natural identifier for the resource, stored on the ref as `resourceId`\n   *  (human-debuggable; NOT used for hashing — the canonical key is). */\n  readonly resourceId: string;\n  /** The deterministic canonical key string (Appendix A3). */\n  readonly canonicalResourceKey: string;\n  /** `sha256(canonicalResourceKey)` hex — the `safetyHoldResources` doc id. */\n  readonly resourceKeyHash: string;\n}\n\n/** sha256-hex of a canonical key string. The single hashing chokepoint. */\nexport function resourceKeyHash(canonicalResourceKey: string): string {\n  return createHash('sha256').update(canonicalResourceKey, 'utf8').digest('hex');\n}\n\n/** Build a {canonicalResourceKey, resourceKeyHash} from a type tag + identity parts. */\nfunction buildKey(\n  resourceType: SafetyHoldResourceType,\n  resourceId: string,\n  ...parts: string[]\n): ResourceKey {\n  const canonicalResourceKey = [KEY_FORMAT, resourceType, ...parts].join(SEP);\n  return {\n    resourceType,\n    resourceId,\n    canonicalResourceKey,\n    resourceKeyHash: resourceKeyHash(canonicalResourceKey),\n  };\n}\n\n/**\n * Firestore content document target = document path + immutable revision.\n * `docPath` must be the canonical full path (e.g. via `toPath(PATH_BUILDERS.x(...))`),\n * NOT a client-supplied path. `revision` pins a mutable doc to a specific version so a\n * post-hold edit cannot slip the bytes out from under the hold; pass the revision/\n * version the report froze.\n */\nexport function contentDocResourceKey(docPath: string, revision: string | number): ResourceKey {\n  return buildKey('contentDoc', docPath, docPath, String(revision));\n}\n\n/**\n * Storage object target = bucket + key + generation. `generation` pins the exact\n * object version (a re-upload to the same key gets a new generation and is a different\n * physical resource). Pass the generation captured when the hold was placed.\n */\nexport function storageObjectResourceKey(\n  bucket: string,\n  key: string,\n  generation: string | number,\n): ResourceKey {\n  return buildKey('storageObject', `${bucket}/${key}`, bucket, key, String(generation));\n}\n\n/**\n * Media target. Returns keys for BOTH:\n *   1. the specific `mediaAssetId` (this exact asset/copy), AND\n *   2. its `originLineage.rootIngestId` — when present — as a SEPARATE `mediaAsset`\n *      key so a hold can block the ENTIRE incident lineage (every copy/variant that\n *      inherited the same root ingest), per Appendix A0/A3 incident-wide blocking.\n *\n * The caller decides which key(s) to place a hold on: a single-asset takedown holds\n * key[0]; an incident-wide block over a CSAM/NCII lineage holds the rootIngest key so\n * every existing AND future copy of the same root is denied. Both keys are `mediaAsset`\n * resourceType (rootIngest is a media identity, not a distinct type — A3 has no\n * separate `rootIngest` type; it is modeled as a mediaAsset key over the root id).\n *\n * Order is stable: index 0 = the asset itself; index 1 (if any) = the rootIngest.\n */\nexport function mediaAssetResourceKeys(asset: Pick<MediaAsset, 'mediaAssetId' | 'originLineage'>): ResourceKey[] {\n  const keys: ResourceKey[] = [\n    buildKey('mediaAsset', asset.mediaAssetId, 'asset', asset.mediaAssetId),\n  ];\n  const rootIngestId = asset.originLineage?.rootIngestId;\n  if (rootIngestId) {\n    keys.push(buildKey('mediaAsset', rootIngestId, 'rootIngest', rootIngestId));\n  }\n  return keys;\n}\n\n/** The mediaAsset key for a bare rootIngestId (no asset doc in hand) — same canonical\n *  shape as `mediaAssetResourceKeys(...)`'s index-1 entry, so it hashes identically. */\nexport function rootIngestResourceKey(rootIngestId: string): ResourceKey {\n  return buildKey('mediaAsset', rootIngestId, 'rootIngest', rootIngestId);\n}\n\n/**\n * Chat message-range target = channelId + a sequence/epoch boundary identifying the\n * span of messages held. `messageSeqOrEpoch` is the caller's range identifier (e.g. a\n * sequence number or epoch marker); the SAME range over the same channel must always\n * be passed in the same canonical form by the caller.\n */\nexport function chatMessageRangeResourceKey(\n  channelId: string,\n  messageSeqOrEpoch: string | number,\n): ResourceKey {\n  return buildKey(\n    'chatMessageRange',\n    `${channelId}#${messageSeqOrEpoch}`,\n    channelId,\n    String(messageSeqOrEpoch),\n  );\n}\n\n/** Channel target = channelId. */\nexport function channelResourceKey(channelId: string): ResourceKey {\n  return buildKey('channel', channelId, channelId);\n}\n\n/** Account target = uid. */\nexport function accountResourceKey(uid: string): ResourceKey {\n  return buildKey('account', uid, uid);\n}\n"]}
+{"version":3,"file":"resource-keys.js","sourceRoot":"","sources":["../../src/safety/resource-keys.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,kFAAkF;AAClF,8DAA8D;AAC9D,iFAAiF;AACjF,uEAAuE;AACvE,wEAAwE;AACxE,8CAA8C;AAC9C,wCAAwC;AACxC,EAAE;AACF,oFAAoF;AACpF,oFAAoF;AACpF,qFAAqF;AACrF,oFAAoF;AACpF,+EAA+E;AAC/E,EAAE;AACF,wFAAwF;AACxF,uFAAuF;AACvF,0FAA0F;AAC1F,sFAAsF;AACtF,sFAAsF;AACtF,EAAE;AACF,gEAAgE;AAChE,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,iEAAiE;AACjE,sFAAsF;AACtF,yEAAyE;AACzE,qFAAqF;AACrF,qFAAqF;AACrF,2CAA2C;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,kFAAkF;AAClF,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;iFACiF;AACjF,MAAM,GAAG,GAAG,MAAM,CAAC;AAenB,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,oBAA4B;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CACf,YAAoC,EACpC,UAAkB,EAClB,GAAG,KAAe;IAElB,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO;QACL,YAAY;QACZ,UAAU;QACV,oBAAoB;QACpB,eAAe,EAAE,eAAe,CAAC,oBAAoB,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,QAAyB;IAC9E,OAAO,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAc,EACd,GAAW,EACX,UAA2B;IAE3B,OAAO,QAAQ,CAAC,eAAe,EAAE,GAAG,MAAM,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyD;IAC9F,MAAM,IAAI,GAAkB;QAC1B,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC;KACxE,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC;IACvD,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;wFACwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,iBAAkC;IAElC,OAAO,QAAQ,CACb,kBAAkB,EAClB,GAAG,SAAS,IAAI,iBAAiB,EAAE,EACnC,SAAS,EACT,MAAM,CAAC,iBAAiB,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC","sourcesContent":["// Canonical safety-hold resource keys (Trust & Safety IMPLEMENTATION_PLAN Appendix A3).\n//\n// A safety hold is keyed by the PHYSICAL resource it protects, not by the case or\n// the request that created it. The `canonicalResourceKey` is a deterministic string\n// built from exactly the identity fields that pin a physical resource:\n//\n//   - a Firestore content target  = document path + immutable revision/generation\n//   - a storage object            = bucket + key + generation\n//   - a media target              = mediaAsset identity (and, incident-wide, its\n//                                   MediaOriginLineageV1.rootIngestId)\n//   - a chat message range        = channelId + sequence/epoch boundary\n//   - a channel                   = channelId\n//   - an account                  = uid\n//\n// `resourceKeyHash = sha256(canonicalResourceKey)` is the Firestore doc id for both\n// `safetyHoldResources/{resourceKeyHash}` (the O(1) per-flag counter aggregate) and\n// the `{caseId}__{resourceKeyHash}` ref. THE SAME PHYSICAL RESOURCE MUST ALWAYS HASH\n// IDENTICALLY — that is the whole correctness story: every hold over the same bytes\n// joins the same aggregate, and every destructive guard consults the same doc.\n//\n// This is the ONE canonical declaration (ARCH-102). Both TTT app TS projects (the Cloud\n// Functions graph AND the App Hosting route graph) import these builders from ttt-core\n// rather than hand-mirroring the format — a re-key would otherwise drift the two runtimes\n// apart. node:crypto sha256 keeps it pure + server-safe (this module lives behind the\n// `./safety` entry, never on the main barrel, so the frontend bundle never loads it).\n//\n// Determinism rules (do not change without a key-version bump):\n//   - Format is `v1` + a type tag + the identity fields, joined by the unit-separator\n//     control char (\\x1f), which cannot appear in a Firestore path, bucket name, key,\n//     uid, or channel id. No JSON (key ordering / whitespace is not load-bearing here;\n//     a flat separator-joined string is stable by construction).\n//   - The type tag prevents cross-type collisions (a contentDoc whose path happens to\n//     equal a storage key never shares a hash with that storage object).\n//   - A bump to the format string ('v1') is a hold-key migration and is NOT backward\n//     compatible — every existing ref/aggregate would re-key. Treat it as a breaking\n//     change to the entire hold authority.\n\nimport { createHash } from 'node:crypto';\nimport type { MediaAsset, SafetyHoldResourceType } from '../doc-schemas/index.js';\n\n/** Format/version tag for every canonical key. Bumping this re-keys ALL holds. */\nconst KEY_FORMAT = 'safetyHoldKey/v1';\n\n/** Unit separator — illegal in every identity field we join, so it is an unambiguous\n *  field delimiter that never appears inside a path, key, uid, or channel id. */\nconst SEP = '\\x1f';\n\n/** A canonical resource key paired with its sha256 hash (the Firestore doc id). */\nexport interface ResourceKey {\n  /** The hold `resourceType` this key belongs to (Appendix A3 enum). */\n  readonly resourceType: SafetyHoldResourceType;\n  /** A natural identifier for the resource, stored on the ref as `resourceId`\n   *  (human-debuggable; NOT used for hashing — the canonical key is). */\n  readonly resourceId: string;\n  /** The deterministic canonical key string (Appendix A3). */\n  readonly canonicalResourceKey: string;\n  /** `sha256(canonicalResourceKey)` hex — the `safetyHoldResources` doc id. */\n  readonly resourceKeyHash: string;\n}\n\n/** sha256-hex of a canonical key string. The single hashing chokepoint. */\nexport function resourceKeyHash(canonicalResourceKey: string): string {\n  return createHash('sha256').update(canonicalResourceKey, 'utf8').digest('hex');\n}\n\n/** Build a {canonicalResourceKey, resourceKeyHash} from a type tag + identity parts. */\nfunction buildKey(\n  resourceType: SafetyHoldResourceType,\n  resourceId: string,\n  ...parts: string[]\n): ResourceKey {\n  const canonicalResourceKey = [KEY_FORMAT, resourceType, ...parts].join(SEP);\n  return {\n    resourceType,\n    resourceId,\n    canonicalResourceKey,\n    resourceKeyHash: resourceKeyHash(canonicalResourceKey),\n  };\n}\n\n/**\n * Firestore content document target = document path + immutable revision.\n * `docPath` must be the canonical full path (e.g. via `toPath(PATH_BUILDERS.x(...))`),\n * NOT a client-supplied path. `revision` pins a mutable doc to a specific version so a\n * post-hold edit cannot slip the bytes out from under the hold; pass the revision/\n * version the report froze.\n */\nexport function contentDocResourceKey(docPath: string, revision: string | number): ResourceKey {\n  return buildKey('contentDoc', docPath, docPath, String(revision));\n}\n\n/**\n * Storage object target = bucket + key + generation. `generation` pins the exact\n * object version (a re-upload to the same key gets a new generation and is a different\n * physical resource). Pass the generation captured when the hold was placed.\n */\nexport function storageObjectResourceKey(\n  bucket: string,\n  key: string,\n  generation: string | number,\n): ResourceKey {\n  return buildKey('storageObject', `${bucket}/${key}`, bucket, key, String(generation));\n}\n\n/**\n * Media target. Returns keys for BOTH:\n *   1. the specific `mediaAssetId` (this exact asset/copy), AND\n *   2. its `originLineage.rootIngestId` — when present — as a SEPARATE `mediaAsset`\n *      key so a hold can block the ENTIRE incident lineage (every copy/variant that\n *      inherited the same root ingest), per Appendix A0/A3 incident-wide blocking.\n *\n * The caller decides which key(s) to place a hold on: a single-asset takedown holds\n * key[0]; an incident-wide block over a CSAM/NCII lineage holds the rootIngest key so\n * every existing AND future copy of the same root is denied. Both keys are `mediaAsset`\n * resourceType (rootIngest is a media identity, not a distinct type — A3 has no\n * separate `rootIngest` type; it is modeled as a mediaAsset key over the root id).\n *\n * Order is stable: index 0 = the asset itself; index 1 (if any) = the rootIngest.\n */\nexport function mediaAssetResourceKeys(asset: Pick<MediaAsset, 'mediaAssetId' | 'originLineage'>): ResourceKey[] {\n  const keys: ResourceKey[] = [\n    buildKey('mediaAsset', asset.mediaAssetId, 'asset', asset.mediaAssetId),\n  ];\n  const rootIngestId = asset.originLineage?.rootIngestId;\n  if (rootIngestId) {\n    keys.push(buildKey('mediaAsset', rootIngestId, 'rootIngest', rootIngestId));\n  }\n  return keys;\n}\n\n/** The mediaAsset key for a bare rootIngestId (no asset doc in hand) — same canonical\n *  shape as `mediaAssetResourceKeys(...)`'s index-1 entry, so it hashes identically. */\nexport function rootIngestResourceKey(rootIngestId: string): ResourceKey {\n  return buildKey('mediaAsset', rootIngestId, 'rootIngest', rootIngestId);\n}\n\n/**\n * Chat message-range target = channelId + a sequence/epoch boundary identifying the\n * span of messages held. `messageSeqOrEpoch` is the caller's range identifier (e.g. a\n * sequence number or epoch marker); the SAME range over the same channel must always\n * be passed in the same canonical form by the caller.\n */\nexport function chatMessageRangeResourceKey(\n  channelId: string,\n  messageSeqOrEpoch: string | number,\n): ResourceKey {\n  return buildKey(\n    'chatMessageRange',\n    `${channelId}#${messageSeqOrEpoch}`,\n    channelId,\n    String(messageSeqOrEpoch),\n  );\n}\n\n/** Channel target = channelId. */\nexport function channelResourceKey(channelId: string): ResourceKey {\n  return buildKey('channel', channelId, channelId);\n}\n\n/** Account target = uid. */\nexport function accountResourceKey(uid: string): ResourceKey {\n  return buildKey('account', uid, uid);\n}\n"]}

package/dist/schemas/chat.js

@@ -57,7 +57,7 @@ export const StartAdminSupportThreadResultSchema = z.object({
     messageId: z.string().min(1),
 });
 // Member-initiated workProject → admin correspondence thread (party-generic dispatch,
-// partyKind 'workProject'). Initiating is a Work ACTION (`adminDispatch.start`, Rule 23);
+// partyKind 'workProject'). Initiating is a Work ACTION (`adminDispatch.start`, BACKEND-006);
 // the callable enforces the one-open-work-initiated-thread spam guard. `contextRef` is
 // server-validated against the workProject before it is stored.
 export const StartWorkProjectAdminSupportThreadInputSchema = z.object({

package/dist/schemas/chat.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat.js","sourceRoot":"","sources":["../../src/schemas/chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,yCAAyC,GAC1C,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAE5E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,wBAAwB;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,gGAAgG;AAChG,kGAAkG;AAClG,yFAAyF;AACzF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,wBAAwB;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,mBAAmB;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,QAAQ,EAAE;IACjF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC7D,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,qFAAqF;AACrF,uFAAuF;AACvF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACrC,eAAe,EAAE,qBAAqB;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC7C,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0FAA0F;AAC1F,6EAA6E;AAC7E,sFAAsF;AACtF,qFAAqF;AACrF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAGH,mFAAmF;AACnF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;CAC9E,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,kDAAkD;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAGH,sFAAsF;AACtF,0FAA0F;AAC1F,uFAAuF;AACvF,gEAAgE;AAChE,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;IAC7E,UAAU,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,oFAAoF;AACpF,mFAAmF;AACnF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,aAAa,EAAE,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;IAC7E,UAAU,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF;AAClF,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,wBAAwB;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,QAAQ,EAAE;IACjF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,QAAQ,EAAE;IACjF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7E,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,iFAAiF;AAEjF,wEAAwE;AACxE,0FAA0F;AAC1F,mFAAmF;AACnF,yFAAyF;AACzF,gFAAgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;CACrF,CAAC,CAAC;AAGH,6FAA6F;AAC7F,4FAA4F;AAC5F,sCAAsC;AACtC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAChE,OAAO,EAAE,gCAAgC;CAC1C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0FAA0F;AAC1F,0FAA0F;AAC1F,uBAAuB;AACvB,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,OAAO,EAAE,gCAAgC;CAC1C,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["import { z } from 'zod';\nimport {\n  workProjectIdSchema,\n  guildChatChannelIdSchema,\n  guildInviteIdSchema,\n  adminDispatchIdSchema,\n} from './atoms.js';\nimport {\n  MAX_CHAT_MESSAGE_LENGTH,\n  MAX_GUILD_CHAT_CHANNEL_NAME_LENGTH,\n  MAX_GUILD_CHAT_CHANNEL_DESCRIPTION_LENGTH,\n} from '../constants/chat.js';\nimport {\n  MAX_ADMIN_DISPATCH_SUBJECT_LENGTH,\n  MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH,\n  MAX_CHAT_MODERATION_REASON_LENGTH,\n} from '../constants/business.js';\nimport {\n  ReplyToSchema,\n} from '@ttt-productions/chat-schemas';\nimport { AdminDispatchContextRefSchema } from '../doc-schemas/messaging.js';\n\nexport const ArchiveGuildChatChannelInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  guildChatChannelId: guildChatChannelIdSchema,\n}).strict();\nexport type ArchiveGuildChatChannelInput = z.infer<typeof ArchiveGuildChatChannelInputSchema>;\n\n// Tombstone (delete) a guild chat channel — same input shape as archive. The callable marks the\n// channel `isDeleted`, bumps configVersion, revokes grants, and re-projects members to `removed`;\n// storage is retained (never a physical purge). See docs/design/chat-realtime-system.md.\nexport const DeleteGuildChatChannelInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  guildChatChannelId: guildChatChannelIdSchema,\n}).strict();\nexport type DeleteGuildChatChannelInput = z.infer<typeof DeleteGuildChatChannelInputSchema>;\n\nexport const CreateGuildChatChannelInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  channelName: z.string().min(1).max(MAX_GUILD_CHAT_CHANNEL_NAME_LENGTH),\n  description: z.string().max(MAX_GUILD_CHAT_CHANNEL_DESCRIPTION_LENGTH).optional(),\n  requiredGuildStandings: z.array(z.string().min(1).max(64)).max(20),\n  allowedUserIds: z.array(z.string().min(1).max(128)).max(500),\n}).strict();\nexport type CreateGuildChatChannelInput = z.infer<typeof CreateGuildChatChannelInputSchema>;\n\n// Guild channels + invite threads moved to the realtime chat (Cloudflare DOs), which\n// sends through the DO client — NOT this callable. The Firestore send path is retained\n// PERMANENTLY for admin-support threads only (docs/design/chat-realtime-system.md).\nexport const SendGuildChatMessageInputSchema = z.object({\n  threadKind: z.literal('adminSupport'),\n  adminDispatchId: adminDispatchIdSchema,\n  isUserReply: z.boolean(),\n  text: z.string().max(MAX_CHAT_MESSAGE_LENGTH),\n  replyTo: ReplyToSchema.optional(),\n}).strict();\nexport type SendGuildChatMessageInput = z.infer<typeof SendGuildChatMessageInputSchema>;\n\n// Wire result contract for the sendGuildChatMessage callable — what the CLIENT relies on.\n// The backend core's internal result type extends this with composition-only\n// inline-materialize fields (backend↔backend contract; see runSendGuildChatMessage) —\n// those extra fields may appear on the wire and are not part of the client contract,\n// so this schema is deliberately non-strict.\nexport const SendGuildChatMessageResultSchema = z.object({\n  success: z.literal(true),\n  messageId: z.string().min(1),\n  messageDocPath: z.string().min(1),\n});\nexport type SendGuildChatMessageResult = z.infer<typeof SendGuildChatMessageResultSchema>;\n\n// Subject/initial-text share the admin-dispatch caps (the \"contact admin\" composer\n// enforces them) — the old MAX_CHAT_MESSAGE_LENGTH bound let a 4000-char SUBJECT through.\nexport const StartAdminSupportThreadInputSchema = z.object({\n  subject: z.string().min(1).max(MAX_ADMIN_DISPATCH_SUBJECT_LENGTH),\n  initialMessage: z.string().min(1).max(MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH),\n}).strict();\nexport type StartAdminSupportThreadInput = z.infer<typeof StartAdminSupportThreadInputSchema>;\n\n// Authoritative result of startAdminSupportThread — both ids are minted inside the\n// creating transaction. Non-strict (server → client result posture).\nexport const StartAdminSupportThreadResultSchema = z.object({\n  success: z.literal(true),\n  adminDispatchId: z.string().min(1),\n  /** Doc id of the initial conversation message. */\n  messageId: z.string().min(1),\n});\nexport type StartAdminSupportThreadResult = z.infer<typeof StartAdminSupportThreadResultSchema>;\n\n// Member-initiated workProject → admin correspondence thread (party-generic dispatch,\n// partyKind 'workProject'). Initiating is a Work ACTION (`adminDispatch.start`, Rule 23);\n// the callable enforces the one-open-work-initiated-thread spam guard. `contextRef` is\n// server-validated against the workProject before it is stored.\nexport const StartWorkProjectAdminSupportThreadInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  subject: z.string().min(1).max(MAX_ADMIN_DISPATCH_SUBJECT_LENGTH),\n  initialMessage: z.string().min(1).max(MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH),\n  contextRef: AdminDispatchContextRefSchema.optional(),\n}).strict();\nexport type StartWorkProjectAdminSupportThreadInput = z.infer<typeof StartWorkProjectAdminSupportThreadInputSchema>;\n\n// Admin-initiated dispatch to a workProject party (mirrors the admin→user dispatch:\n// lands unread for the work's active guildmates, creates NO admin task, uncapped).\nexport const CreateAdminDispatchToWorkProjectInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  subject: z.string().trim().min(1).max(MAX_ADMIN_DISPATCH_SUBJECT_LENGTH),\n  message: z.string().trim().min(1).max(MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH),\n  contextRef: AdminDispatchContextRefSchema.optional(),\n}).strict();\nexport type CreateAdminDispatchToWorkProjectInput = z.infer<typeof CreateAdminDispatchToWorkProjectInputSchema>;\n\n// CLIENT-CALLED wire contract for the `mintChatGrant` callable (Contract A; P3).\n// Crosses the backend↔frontend boundary — the web client (and any future mobile/TV\n// client) constructs this payload — so it lives here per the callable-validation\n// convention, not locally in the functions repo. The REAL Firestore authorization\n// check happens in the callable; this schema pins the scope shape.\nexport const ChatGrantInputSchema = z.discriminatedUnion('kind', [\n  z.object({ kind: z.literal('channel'), workProjectId: workProjectIdSchema, guildChatChannelId: guildChatChannelIdSchema }).strict(),\n  z.object({ kind: z.literal('invite'), guildInviteId: guildInviteIdSchema }).strict(),\n  z.object({ kind: z.literal('inbox') }).strict(),\n]);\nexport type ChatGrantInput = z.infer<typeof ChatGrantInputSchema>;\n\nexport const UpdateGuildChatChannelInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  guildChatChannelId: guildChatChannelIdSchema,\n  channelName: z.string().min(1).max(MAX_GUILD_CHAT_CHANNEL_NAME_LENGTH).optional(),\n  description: z.string().max(MAX_GUILD_CHAT_CHANNEL_DESCRIPTION_LENGTH).optional(),\n  requiredGuildStandings: z.array(z.string().min(1).max(64)).max(20).optional(),\n  allowedUserIds: z.array(z.string().min(1).max(128)).max(500).optional(),\n}).strict();\nexport type UpdateGuildChatChannelInput = z.infer<typeof UpdateGuildChatChannelInputSchema>;\n\n// --- Admin chat moderation callables (review-only; chat-realtime-system.md) ---\n\n// The CLIENT-facing channel-ref for the admin chat-moderation callables\n// (`adminModerateChatMessage` / `adminReadChannelContext`). This is the WIRE shape, which\n// is `kind`-discriminated — NOT the internal `scope`-keyed `ChannelRefTupleSchema`\n// (@ttt-productions/chat-schemas), which the callables map to server-side AFTER parsing.\n// Mirrors the existing `TombstoneChatSchema.channel` union in schemas/admin.ts.\nexport const AdminChatModerationChannelSchema = z.discriminatedUnion('kind', [\n  z.object({ kind: z.literal('channel'), workProjectId: workProjectIdSchema, guildChatChannelId: guildChatChannelIdSchema }).strict(),\n  z.object({ kind: z.literal('invite'), guildInviteId: guildInviteIdSchema }).strict(),\n]);\nexport type AdminChatModerationChannel = z.infer<typeof AdminChatModerationChannelSchema>;\n\n// `adminModerateChatMessage` — queue a DO-owned hide/delete command. The moderated message's\n// attachment asset id(s) are NEVER client-supplied (the drain derives them server-side), so\n// `.strict()` rejects any such field.\nexport const AdminModerateChatMessageInputSchema = z.object({\n  requestId: z.string().min(1).max(200),\n  action: z.enum(['hide', 'delete']),\n  messageSeq: z.number().int().nonnegative(),\n  expectedMessageRevision: z.number().int().nonnegative(),\n  caseId: z.string().min(1).max(200),\n  reason: z.string().min(1).max(MAX_CHAT_MODERATION_REASON_LENGTH),\n  channel: AdminChatModerationChannelSchema,\n}).strict();\nexport type AdminModerateChatMessageInput = z.infer<typeof AdminModerateChatMessageInputSchema>;\n\n// `adminReadChannelContext` — case-bound admin read of a bounded (≤50 before / ≤50 after)\n// message window around a reported message. Requires a case id + reason; both request and\n// outcome are audited.\nexport const AdminReadChannelContextInputSchema = z.object({\n  reportedSeq: z.number().int().nonnegative(),\n  caseId: z.string().min(1).max(200),\n  reason: z.string().min(1).max(MAX_CHAT_MODERATION_REASON_LENGTH),\n  before: z.number().int().min(0).max(50).optional(),\n  after: z.number().int().min(0).max(50).optional(),\n  channel: AdminChatModerationChannelSchema,\n}).strict();\nexport type AdminReadChannelContextInput = z.infer<typeof AdminReadChannelContextInputSchema>;\n\n\n\n"]}
+{"version":3,"file":"chat.js","sourceRoot":"","sources":["../../src/schemas/chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,yCAAyC,GAC1C,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAE5E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,wBAAwB;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,gGAAgG;AAChG,kGAAkG;AAClG,yFAAyF;AACzF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,wBAAwB;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,mBAAmB;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,QAAQ,EAAE;IACjF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC7D,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,qFAAqF;AACrF,uFAAuF;AACvF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACrC,eAAe,EAAE,qBAAqB;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC7C,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0FAA0F;AAC1F,6EAA6E;AAC7E,sFAAsF;AACtF,qFAAqF;AACrF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAGH,mFAAmF;AACnF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;CAC9E,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,kDAAkD;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAGH,sFAAsF;AACtF,8FAA8F;AAC9F,uFAAuF;AACvF,gEAAgE;AAChE,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;IAC7E,UAAU,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,oFAAoF;AACpF,mFAAmF;AACnF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,aAAa,EAAE,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC;IAC7E,UAAU,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF;AAClF,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,wBAAwB;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,QAAQ,EAAE;IACjF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,QAAQ,EAAE;IACjF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7E,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,iFAAiF;AAEjF,wEAAwE;AACxE,0FAA0F;AAC1F,mFAAmF;AACnF,yFAAyF;AACzF,gFAAgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;CACrF,CAAC,CAAC;AAGH,6FAA6F;AAC7F,4FAA4F;AAC5F,sCAAsC;AACtC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAChE,OAAO,EAAE,gCAAgC;CAC1C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0FAA0F;AAC1F,0FAA0F;AAC1F,uBAAuB;AACvB,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,OAAO,EAAE,gCAAgC;CAC1C,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["import { z } from 'zod';\nimport {\n  workProjectIdSchema,\n  guildChatChannelIdSchema,\n  guildInviteIdSchema,\n  adminDispatchIdSchema,\n} from './atoms.js';\nimport {\n  MAX_CHAT_MESSAGE_LENGTH,\n  MAX_GUILD_CHAT_CHANNEL_NAME_LENGTH,\n  MAX_GUILD_CHAT_CHANNEL_DESCRIPTION_LENGTH,\n} from '../constants/chat.js';\nimport {\n  MAX_ADMIN_DISPATCH_SUBJECT_LENGTH,\n  MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH,\n  MAX_CHAT_MODERATION_REASON_LENGTH,\n} from '../constants/business.js';\nimport {\n  ReplyToSchema,\n} from '@ttt-productions/chat-schemas';\nimport { AdminDispatchContextRefSchema } from '../doc-schemas/messaging.js';\n\nexport const ArchiveGuildChatChannelInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  guildChatChannelId: guildChatChannelIdSchema,\n}).strict();\nexport type ArchiveGuildChatChannelInput = z.infer<typeof ArchiveGuildChatChannelInputSchema>;\n\n// Tombstone (delete) a guild chat channel — same input shape as archive. The callable marks the\n// channel `isDeleted`, bumps configVersion, revokes grants, and re-projects members to `removed`;\n// storage is retained (never a physical purge). See docs/design/chat-realtime-system.md.\nexport const DeleteGuildChatChannelInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  guildChatChannelId: guildChatChannelIdSchema,\n}).strict();\nexport type DeleteGuildChatChannelInput = z.infer<typeof DeleteGuildChatChannelInputSchema>;\n\nexport const CreateGuildChatChannelInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  channelName: z.string().min(1).max(MAX_GUILD_CHAT_CHANNEL_NAME_LENGTH),\n  description: z.string().max(MAX_GUILD_CHAT_CHANNEL_DESCRIPTION_LENGTH).optional(),\n  requiredGuildStandings: z.array(z.string().min(1).max(64)).max(20),\n  allowedUserIds: z.array(z.string().min(1).max(128)).max(500),\n}).strict();\nexport type CreateGuildChatChannelInput = z.infer<typeof CreateGuildChatChannelInputSchema>;\n\n// Guild channels + invite threads moved to the realtime chat (Cloudflare DOs), which\n// sends through the DO client — NOT this callable. The Firestore send path is retained\n// PERMANENTLY for admin-support threads only (docs/design/chat-realtime-system.md).\nexport const SendGuildChatMessageInputSchema = z.object({\n  threadKind: z.literal('adminSupport'),\n  adminDispatchId: adminDispatchIdSchema,\n  isUserReply: z.boolean(),\n  text: z.string().max(MAX_CHAT_MESSAGE_LENGTH),\n  replyTo: ReplyToSchema.optional(),\n}).strict();\nexport type SendGuildChatMessageInput = z.infer<typeof SendGuildChatMessageInputSchema>;\n\n// Wire result contract for the sendGuildChatMessage callable — what the CLIENT relies on.\n// The backend core's internal result type extends this with composition-only\n// inline-materialize fields (backend↔backend contract; see runSendGuildChatMessage) —\n// those extra fields may appear on the wire and are not part of the client contract,\n// so this schema is deliberately non-strict.\nexport const SendGuildChatMessageResultSchema = z.object({\n  success: z.literal(true),\n  messageId: z.string().min(1),\n  messageDocPath: z.string().min(1),\n});\nexport type SendGuildChatMessageResult = z.infer<typeof SendGuildChatMessageResultSchema>;\n\n// Subject/initial-text share the admin-dispatch caps (the \"contact admin\" composer\n// enforces them) — the old MAX_CHAT_MESSAGE_LENGTH bound let a 4000-char SUBJECT through.\nexport const StartAdminSupportThreadInputSchema = z.object({\n  subject: z.string().min(1).max(MAX_ADMIN_DISPATCH_SUBJECT_LENGTH),\n  initialMessage: z.string().min(1).max(MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH),\n}).strict();\nexport type StartAdminSupportThreadInput = z.infer<typeof StartAdminSupportThreadInputSchema>;\n\n// Authoritative result of startAdminSupportThread — both ids are minted inside the\n// creating transaction. Non-strict (server → client result posture).\nexport const StartAdminSupportThreadResultSchema = z.object({\n  success: z.literal(true),\n  adminDispatchId: z.string().min(1),\n  /** Doc id of the initial conversation message. */\n  messageId: z.string().min(1),\n});\nexport type StartAdminSupportThreadResult = z.infer<typeof StartAdminSupportThreadResultSchema>;\n\n// Member-initiated workProject → admin correspondence thread (party-generic dispatch,\n// partyKind 'workProject'). Initiating is a Work ACTION (`adminDispatch.start`, BACKEND-006);\n// the callable enforces the one-open-work-initiated-thread spam guard. `contextRef` is\n// server-validated against the workProject before it is stored.\nexport const StartWorkProjectAdminSupportThreadInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  subject: z.string().min(1).max(MAX_ADMIN_DISPATCH_SUBJECT_LENGTH),\n  initialMessage: z.string().min(1).max(MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH),\n  contextRef: AdminDispatchContextRefSchema.optional(),\n}).strict();\nexport type StartWorkProjectAdminSupportThreadInput = z.infer<typeof StartWorkProjectAdminSupportThreadInputSchema>;\n\n// Admin-initiated dispatch to a workProject party (mirrors the admin→user dispatch:\n// lands unread for the work's active guildmates, creates NO admin task, uncapped).\nexport const CreateAdminDispatchToWorkProjectInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  subject: z.string().trim().min(1).max(MAX_ADMIN_DISPATCH_SUBJECT_LENGTH),\n  message: z.string().trim().min(1).max(MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH),\n  contextRef: AdminDispatchContextRefSchema.optional(),\n}).strict();\nexport type CreateAdminDispatchToWorkProjectInput = z.infer<typeof CreateAdminDispatchToWorkProjectInputSchema>;\n\n// CLIENT-CALLED wire contract for the `mintChatGrant` callable (Contract A; P3).\n// Crosses the backend↔frontend boundary — the web client (and any future mobile/TV\n// client) constructs this payload — so it lives here per the callable-validation\n// convention, not locally in the functions repo. The REAL Firestore authorization\n// check happens in the callable; this schema pins the scope shape.\nexport const ChatGrantInputSchema = z.discriminatedUnion('kind', [\n  z.object({ kind: z.literal('channel'), workProjectId: workProjectIdSchema, guildChatChannelId: guildChatChannelIdSchema }).strict(),\n  z.object({ kind: z.literal('invite'), guildInviteId: guildInviteIdSchema }).strict(),\n  z.object({ kind: z.literal('inbox') }).strict(),\n]);\nexport type ChatGrantInput = z.infer<typeof ChatGrantInputSchema>;\n\nexport const UpdateGuildChatChannelInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  guildChatChannelId: guildChatChannelIdSchema,\n  channelName: z.string().min(1).max(MAX_GUILD_CHAT_CHANNEL_NAME_LENGTH).optional(),\n  description: z.string().max(MAX_GUILD_CHAT_CHANNEL_DESCRIPTION_LENGTH).optional(),\n  requiredGuildStandings: z.array(z.string().min(1).max(64)).max(20).optional(),\n  allowedUserIds: z.array(z.string().min(1).max(128)).max(500).optional(),\n}).strict();\nexport type UpdateGuildChatChannelInput = z.infer<typeof UpdateGuildChatChannelInputSchema>;\n\n// --- Admin chat moderation callables (review-only; chat-realtime-system.md) ---\n\n// The CLIENT-facing channel-ref for the admin chat-moderation callables\n// (`adminModerateChatMessage` / `adminReadChannelContext`). This is the WIRE shape, which\n// is `kind`-discriminated — NOT the internal `scope`-keyed `ChannelRefTupleSchema`\n// (@ttt-productions/chat-schemas), which the callables map to server-side AFTER parsing.\n// Mirrors the existing `TombstoneChatSchema.channel` union in schemas/admin.ts.\nexport const AdminChatModerationChannelSchema = z.discriminatedUnion('kind', [\n  z.object({ kind: z.literal('channel'), workProjectId: workProjectIdSchema, guildChatChannelId: guildChatChannelIdSchema }).strict(),\n  z.object({ kind: z.literal('invite'), guildInviteId: guildInviteIdSchema }).strict(),\n]);\nexport type AdminChatModerationChannel = z.infer<typeof AdminChatModerationChannelSchema>;\n\n// `adminModerateChatMessage` — queue a DO-owned hide/delete command. The moderated message's\n// attachment asset id(s) are NEVER client-supplied (the drain derives them server-side), so\n// `.strict()` rejects any such field.\nexport const AdminModerateChatMessageInputSchema = z.object({\n  requestId: z.string().min(1).max(200),\n  action: z.enum(['hide', 'delete']),\n  messageSeq: z.number().int().nonnegative(),\n  expectedMessageRevision: z.number().int().nonnegative(),\n  caseId: z.string().min(1).max(200),\n  reason: z.string().min(1).max(MAX_CHAT_MODERATION_REASON_LENGTH),\n  channel: AdminChatModerationChannelSchema,\n}).strict();\nexport type AdminModerateChatMessageInput = z.infer<typeof AdminModerateChatMessageInputSchema>;\n\n// `adminReadChannelContext` — case-bound admin read of a bounded (≤50 before / ≤50 after)\n// message window around a reported message. Requires a case id + reason; both request and\n// outcome are audited.\nexport const AdminReadChannelContextInputSchema = z.object({\n  reportedSeq: z.number().int().nonnegative(),\n  caseId: z.string().min(1).max(200),\n  reason: z.string().min(1).max(MAX_CHAT_MODERATION_REASON_LENGTH),\n  before: z.number().int().min(0).max(50).optional(),\n  after: z.number().int().min(0).max(50).optional(),\n  channel: AdminChatModerationChannelSchema,\n}).strict();\nexport type AdminReadChannelContextInput = z.infer<typeof AdminReadChannelContextInputSchema>;\n\n\n\n"]}

package/dist/schemas/craft-skills.js

@@ -5,7 +5,7 @@ export const DeleteCraftSkillInputSchema = z.object({
     craftSkillId: craftSkillIdSchema,
 }).strict();
 // `tag` is constrained to the canonical option list — the wire schema is the moderation
-// boundary (Invariant 12). A free-text tag would put unmoderated public text on the profile
+// boundary (BACKEND-106). A free-text tag would put unmoderated public text on the profile
 // badge + pollute the craftSkillsByTag index with junk doc IDs (and could break path builders).
 export const UpdateCraftSkillTagsInputSchema = z.object({
     craftSkillId: craftSkillIdSchema,

package/dist/schemas/craft-skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"craft-skills.js","sourceRoot":"","sources":["../../src/schemas/craft-skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,wFAAwF;AACxF,4FAA4F;AAC5F,gGAAgG;AAChG,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,YAAY,EAAE,kBAAkB;IAChC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACnC,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAE9E,gFAAgF;AAChF,oFAAoF;AACpF,gFAAgF;AAChF,qFAAqF;AACrF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,oDAAoD;IACpD,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAC;AAGH,sFAAsF;AACtF,mFAAmF;AACnF,qFAAqF;AACrF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,YAAY,EAAE,kBAAkB;IAChC,+EAA+E;IAC/E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,qEAAqE;IACrE,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { craftSkillIdSchema, addRemoveActionSchema } from './atoms.js';\nimport { CRAFT_SKILL_TAG_VALUES } from '../constants/options.js';\n\nexport const DeleteCraftSkillInputSchema = z.object({\n  craftSkillId: craftSkillIdSchema,\n}).strict();\nexport type DeleteCraftSkillInput = z.infer<typeof DeleteCraftSkillInputSchema>;\n\n// `tag` is constrained to the canonical option list — the wire schema is the moderation\n// boundary (Invariant 12). A free-text tag would put unmoderated public text on the profile\n// badge + pollute the craftSkillsByTag index with junk doc IDs (and could break path builders).\nexport const UpdateCraftSkillTagsInputSchema = z.object({\n  craftSkillId: craftSkillIdSchema,\n  tag: z.enum(CRAFT_SKILL_TAG_VALUES),\n  action: addRemoveActionSchema,\n}).strict();\nexport type UpdateCraftSkillTagsInput = z.infer<typeof UpdateCraftSkillTagsInputSchema>;\n\n// --- Authoritative mutation RESULTS (non-strict server → client posture) ---\n\n// Acceptance result of the craft-skill CREATE flow (startUpload with fileOrigin\n// 'craft-skill-media'). Creation itself is asynchronous via the media pipeline; the\n// skill doc id is minted server-side AS the pendingMedia id (processCraftSkill:\n// craftSkillId = pendingFile.id), so it is knowable at accept time without any read.\nexport const UploadCraftSkillAcceptedResultSchema = z.object({\n  success: z.literal(true),\n  pendingMediaId: z.string().min(1),\n  /** Equal to pendingMediaId by pipeline contract. */\n  craftSkillId: craftSkillIdSchema,\n});\nexport type UploadCraftSkillAcceptedResult = z.infer<typeof UploadCraftSkillAcceptedResultSchema>;\n\n// deleteCraftSkill: the skill doc + tag-index mirrors are gone at commit. The Streetz\n// feed patch (updatedPostIds/updates) deliberately does NOT ride this result — the\n// DELETE_CRAFT_SKILL post update is enqueued to the squareAnnouncementJobs outbox in\n// the delete transaction and applied by the outbox worker.\nexport const DeleteCraftSkillResultSchema = z.object({\n  success: z.literal(true),\n  craftSkillId: craftSkillIdSchema,\n});\nexport type DeleteCraftSkillResult = z.infer<typeof DeleteCraftSkillResultSchema>;\n\nexport const UpdateCraftSkillTagsResultSchema = z.object({\n  success: z.literal(true),\n  craftSkillId: craftSkillIdSchema,\n  /** Authoritative tag list after commit (unchanged when `changed` is false). */\n  newTags: z.array(z.enum(CRAFT_SKILL_TAG_VALUES)),\n  changed: z.boolean(),\n  /** Echo of the requested action (always known — it is the input). */\n  action: addRemoveActionSchema,\n});\nexport type UpdateCraftSkillTagsResult = z.infer<typeof UpdateCraftSkillTagsResultSchema>;\n\n\n"]}
+{"version":3,"file":"craft-skills.js","sourceRoot":"","sources":["../../src/schemas/craft-skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,wFAAwF;AACxF,2FAA2F;AAC3F,gGAAgG;AAChG,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,YAAY,EAAE,kBAAkB;IAChC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACnC,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAE9E,gFAAgF;AAChF,oFAAoF;AACpF,gFAAgF;AAChF,qFAAqF;AACrF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,oDAAoD;IACpD,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAC;AAGH,sFAAsF;AACtF,mFAAmF;AACnF,qFAAqF;AACrF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,YAAY,EAAE,kBAAkB;IAChC,+EAA+E;IAC/E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,qEAAqE;IACrE,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { craftSkillIdSchema, addRemoveActionSchema } from './atoms.js';\nimport { CRAFT_SKILL_TAG_VALUES } from '../constants/options.js';\n\nexport const DeleteCraftSkillInputSchema = z.object({\n  craftSkillId: craftSkillIdSchema,\n}).strict();\nexport type DeleteCraftSkillInput = z.infer<typeof DeleteCraftSkillInputSchema>;\n\n// `tag` is constrained to the canonical option list — the wire schema is the moderation\n// boundary (BACKEND-106). A free-text tag would put unmoderated public text on the profile\n// badge + pollute the craftSkillsByTag index with junk doc IDs (and could break path builders).\nexport const UpdateCraftSkillTagsInputSchema = z.object({\n  craftSkillId: craftSkillIdSchema,\n  tag: z.enum(CRAFT_SKILL_TAG_VALUES),\n  action: addRemoveActionSchema,\n}).strict();\nexport type UpdateCraftSkillTagsInput = z.infer<typeof UpdateCraftSkillTagsInputSchema>;\n\n// --- Authoritative mutation RESULTS (non-strict server → client posture) ---\n\n// Acceptance result of the craft-skill CREATE flow (startUpload with fileOrigin\n// 'craft-skill-media'). Creation itself is asynchronous via the media pipeline; the\n// skill doc id is minted server-side AS the pendingMedia id (processCraftSkill:\n// craftSkillId = pendingFile.id), so it is knowable at accept time without any read.\nexport const UploadCraftSkillAcceptedResultSchema = z.object({\n  success: z.literal(true),\n  pendingMediaId: z.string().min(1),\n  /** Equal to pendingMediaId by pipeline contract. */\n  craftSkillId: craftSkillIdSchema,\n});\nexport type UploadCraftSkillAcceptedResult = z.infer<typeof UploadCraftSkillAcceptedResultSchema>;\n\n// deleteCraftSkill: the skill doc + tag-index mirrors are gone at commit. The Streetz\n// feed patch (updatedPostIds/updates) deliberately does NOT ride this result — the\n// DELETE_CRAFT_SKILL post update is enqueued to the squareAnnouncementJobs outbox in\n// the delete transaction and applied by the outbox worker.\nexport const DeleteCraftSkillResultSchema = z.object({\n  success: z.literal(true),\n  craftSkillId: craftSkillIdSchema,\n});\nexport type DeleteCraftSkillResult = z.infer<typeof DeleteCraftSkillResultSchema>;\n\nexport const UpdateCraftSkillTagsResultSchema = z.object({\n  success: z.literal(true),\n  craftSkillId: craftSkillIdSchema,\n  /** Authoritative tag list after commit (unchanged when `changed` is false). */\n  newTags: z.array(z.enum(CRAFT_SKILL_TAG_VALUES)),\n  changed: z.boolean(),\n  /** Echo of the requested action (always known — it is the input). */\n  action: addRemoveActionSchema,\n});\nexport type UpdateCraftSkillTagsResult = z.infer<typeof UpdateCraftSkillTagsResultSchema>;\n\n\n"]}

package/dist/schemas/hall-library.js

@@ -174,7 +174,7 @@ export const UpdateTuneDetailsInputSchema = z.object({
     description: z.string().max(MAX_TUNE_DESCRIPTION_LENGTH).optional(),
 }).strict();
 // --- Per-user Hall viewing-state doc (hall-viewing-experience Area 2, ruled 2026-07-04) ---
-// One core (`runX`) owns the single privateData doc per Rule 3; writes are CALLABLE-ONLY —
+// One core (`runX`) owns the single privateData doc per ARCH-001; writes are CALLABLE-ONLY —
 // no direct client Firestore writes anywhere in this system. Every list on the doc is capped
 // (HALL_LIBRARY_PREFS_CAPS in ../constants/business.js); cap enforcement is the backend
 // core's job, not this input-validation layer.

package/dist/schemas/hall-library.js.map

@@ -1 +1 @@
-{"version":3,"file":"hall-library.js","sourceRoot":"","sources":["../../src/schemas/hall-library.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,iCAAiC,EACjC,iCAAiC,EACjC,yCAAyC,EACzC,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,sFAAsF;AACtF,mFAAmF;AACnF,sFAAsF;AACtF,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,KAAyC,CAAC;AACjG,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,KAAyC,CAAC;AACjG,MAAM,uBAAuB,GAAG,4BAA4B,CAAC,UAA8C,CAAC;AAE5G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,qBAAqB;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnF,yFAAyF;IACzF,0FAA0F;IAC1F,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,oFAAoF;IACpF,oFAAoF;IACpF,qFAAqF;IACrF,kCAAkC;IAClC,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,aAAa,EAAE,mBAAmB;IAClC,eAAe,EAAE,qBAAqB;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACrF,gFAAgF;IAChF,8EAA8E;IAC9E,gFAAgF;IAChF,uDAAuD;IACvD,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,yFAAyF;AACzF,qFAAqF;AACrF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,eAAe,EAAE,qBAAqB;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0FAA0F;AAC1F,+EAA+E;AAC/E,sFAAsF;AACtF,qEAAqE;AACrE,sFAAsF;AACtF,sEAAsE;AACtE,wFAAwF;AACxF,0EAA0E;AAC1E,kFAAkF;AAClF,qEAAqE;AACrE,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,UAAU,EAAE,gBAAgB,CAAC,OAAO,EAAE;IACtC,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;SAC1G,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;CACzG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACnC,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,6DAA6D;YACtE,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,yFAAyF;AACzF,uDAAuD;AACvD,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,qBAAqB;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;CAC1F,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,QAAQ,EAAE;CAClF,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,aAAa;IACtB,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACpC,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAC1C,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACpC,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,6FAA6F;AAC7F,2FAA2F;AAC3F,6FAA6F;AAC7F,wFAAwF;AACxF,+CAA+C;AAE/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,4FAA4F;AAC5F,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,6FAA6F;AAC7F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,YAAY;IACpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,sFAAsF;AACtF,gDAAgD;AAChD,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["import { z } from 'zod';\nimport {\n  workProjectIdSchema,\n  workProjectTypeSchema,\n  taleIdSchema,\n  tuneIdSchema,\n  televisionIdSchema,\n  chapterIdSchema,\n  trackIdSchema,\n  episodeIdSchema,\n  titleSchema,\n  addRemoveActionSchema,\n  thresholdItemIdSchema,\n  hallItemIdSchema,\n  itemIdSchema,\n  changeRequestIdSchema,\n} from './atoms.js';\nimport {\n  MAX_HALL_LIBRARY_SUBMIT_BATCH,\n  MAX_CHAPTER_CONTENT_LENGTH,\n  MAX_TALE_DESCRIPTION_LENGTH,\n  MAX_TUNE_DESCRIPTION_LENGTH,\n  MAX_TELEVISION_DESCRIPTION_LENGTH,\n  MAX_TUNE_TRACK_DESCRIPTION_LENGTH,\n  MAX_TELEVISION_EPISODE_DESCRIPTION_LENGTH,\n  MAX_THRESHOLD_REVIEW_NOTES_LENGTH,\n  MAX_HALL_CHANGE_REQUEST_REASON_LENGTH,\n} from '../constants/business.js';\nimport { WORK_PROJECT_SPECIFIC_GENRES } from '../constants/options.js';\n\n// Canonical per-type genre enums. `WORK_PROJECT_SPECIFIC_GENRES.<type>` is a readonly\n// tuple of the exact genre strings the UI offers; the schema is the cross-boundary\n// contract, so a crafted callable can no longer put arbitrary/unmoderated text (or an\n// unbounded array of distinct strings) onto the public hall parent.\nconst TALE_GENRE_VALUES = WORK_PROJECT_SPECIFIC_GENRES.Tales as unknown as [string, ...string[]];\nconst TUNE_GENRE_VALUES = WORK_PROJECT_SPECIFIC_GENRES.Tunes as unknown as [string, ...string[]];\nconst TELEVISION_GENRE_VALUES = WORK_PROJECT_SPECIFIC_GENRES.Television as unknown as [string, ...string[]];\n\nexport const CreateChapterInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  taleId: taleIdSchema,\n  title: titleSchema,\n}).strict();\nexport type CreateChapterInput = z.infer<typeof CreateChapterInputSchema>;\n\nexport const CreateTelevisionEpisodeInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  televisionId: televisionIdSchema,\n  title: titleSchema,\n}).strict();\nexport type CreateTelevisionEpisodeInput = z.infer<typeof CreateTelevisionEpisodeInputSchema>;\n\nexport const CreateTuneTrackInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  tuneId: tuneIdSchema,\n  title: titleSchema,\n}).strict();\nexport type CreateTuneTrackInput = z.infer<typeof CreateTuneTrackInputSchema>;\n\nexport const ReviewThresholdItemInputSchema = z.object({\n  thresholdItemId: thresholdItemIdSchema,\n  decision: z.enum(['approved', 'needs_revision']),\n  adminNotes: z.string().max(MAX_THRESHOLD_REVIEW_NOTES_LENGTH).nullable().optional(),\n  // Reviewer checklist confirmations, recorded on the review (mirrors `teachesSomething`).\n  // Optional here so a `needs_revision` decision still validates; the callable REQUIRES all\n  // true on an `approved` decision. First two: no-begging-for-bouquets, no-credits-in-content.\n  confirmedNoBegging: z.boolean().optional(),\n  confirmedNoCredits: z.boolean().optional(),\n  // Reviewer verified the AUTHOR's real-people/parody attestation sits in the correct\n  // position for the content they reviewed — checked if the work depicts real people,\n  // unchecked if it does not (R3, DJ 2026-07-12). A wrong position is a needs-revision\n  // send-back, never an admin edit.\n  confirmedRealPeopleAttestation: z.boolean().optional(),\n}).strict();\nexport type ReviewThresholdItemInput = z.infer<typeof ReviewThresholdItemInputSchema>;\n\nexport const SubmitForThresholdLibraryReviewInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  workProjectType: workProjectTypeSchema,\n  selectedItemIds: z.array(z.string().min(1)).min(1).max(MAX_HALL_LIBRARY_SUBMIT_BATCH),\n  // AUTHOR attestation (R3, 2026-07-12): the submitting artisan attests this work\n  // depicts real people (parody / satire / commentary). Stored on the threshold\n  // item as `hasRealPeople`; the reviewer sees it READ-ONLY. When true, published\n  // surfaces render the ONE standard platform disclaimer\n  // (REAL_PEOPLE_DISCLAIMER_MESSAGE) — no free-text disclaimer input exists.\n  depictsRealPeople: z.boolean(),\n}).strict();\nexport type SubmitForThresholdLibraryReviewInput = z.infer<typeof SubmitForThresholdLibraryReviewInputSchema>;\n\n// Member-initiated pull-back of a still-pending threshold submission. The runner derives\n// everything else from the threshold doc; rejects unless reviewStatus === 'pending'.\nexport const WithdrawFromThresholdLibraryReviewInputSchema = z.object({\n  thresholdItemId: thresholdItemIdSchema,\n}).strict();\nexport type WithdrawFromThresholdLibraryReviewInput = z.infer<typeof WithdrawFromThresholdLibraryReviewInputSchema>;\n\n// Published change request (text-only at launch): the member proposes new values for TEXT\n// fields on a PUBLISHED surface — one pipeline, three grains (R1, 2026-07-12):\n//  - hall grains: `hallItemId` set (+ `workProjectType`); the hall parent detail when\n//    `subItemId` is absent, else the chapter/track/episode sub-item.\n//  - realm grain: `workRealmId` set; targets the `workRealms/{id}` doc once the realm\n//    counts as published. `workProjectType`/`subItemId` do not apply.\n// Exactly one of `hallItemId` / `workRealmId` must be set. Field names are validated by\n// the runner against the per-surface HALL_CONTENT_TEXT_FIELDS allowlist +\n// HALL_CONTENT_TEXT_FIELD_MAX caps; the schema-level cap is the largest field cap\n// anywhere (chapter content), derived from the same owning constant.\nexport const SubmitHallContentChangeRequestInputSchema = z.object({\n  hallItemId: hallItemIdSchema.nullish(),\n  workProjectType: workProjectTypeSchema.nullish(),\n  workRealmId: z.string().min(1).nullish(),\n  subItemId: z.string().min(1).nullish(),\n  proposedFields: z.record(z.string().min(1).max(64), z.string().trim().min(1).max(MAX_CHAPTER_CONTENT_LENGTH))\n    .refine((fields) => Object.keys(fields).length > 0, { message: 'Propose at least one field change.' }),\n}).strict().superRefine((val, ctx) => {\n  const hasHallItem = typeof val.hallItemId === 'string' && val.hallItemId.length > 0;\n  const hasRealm = typeof val.workRealmId === 'string' && val.workRealmId.length > 0;\n  if (hasHallItem === hasRealm) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: 'Provide exactly one of hallItemId or workRealmId.',\n      path: [hasRealm ? 'workRealmId' : 'hallItemId'],\n    });\n    return;\n  }\n  if (hasHallItem && (val.workProjectType === null || val.workProjectType === undefined)) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: 'workProjectType is required for a hall-item change request.',\n      path: ['workProjectType'],\n    });\n  }\n  if (hasRealm && (val.workProjectType !== null && val.workProjectType !== undefined)) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: 'workProjectType does not apply to a realm change request.',\n      path: ['workProjectType'],\n    });\n  }\n  if (hasRealm && typeof val.subItemId === 'string' && val.subItemId.length > 0) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: 'subItemId does not apply to a realm change request.',\n      path: ['subItemId'],\n    });\n  }\n});\nexport type SubmitHallContentChangeRequestInput = z.infer<typeof SubmitHallContentChangeRequestInputSchema>;\n\n// Admin decision on a published change request. `resolutionReason` is REQUIRED on a deny\n// (the member is shown why); optional note on approve.\nexport const ReviewHallContentChangeRequestInputSchema = z.object({\n  changeRequestId: changeRequestIdSchema,\n  decision: z.enum(['approved', 'denied']),\n  resolutionReason: z.string().trim().max(MAX_HALL_CHANGE_REQUEST_REASON_LENGTH).optional(),\n}).strict().superRefine((val, ctx) => {\n  if (val.decision === 'denied' && (!val.resolutionReason || val.resolutionReason.length === 0)) {\n    ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'A reason is required when denying a change request.', path: ['resolutionReason'] });\n  }\n});\nexport type ReviewHallContentChangeRequestInput = z.infer<typeof ReviewHallContentChangeRequestInputSchema>;\n\nexport const UpdateChapterDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  taleId: taleIdSchema,\n  chapterId: chapterIdSchema,\n  title: titleSchema.optional(),\n  content: z.string().max(MAX_CHAPTER_CONTENT_LENGTH).optional(),\n}).strict();\nexport type UpdateChapterDetailsInput = z.infer<typeof UpdateChapterDetailsInputSchema>;\n\nexport const UpdateTelevisionEpisodeDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  televisionId: televisionIdSchema,\n  episodeId: episodeIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TELEVISION_EPISODE_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTelevisionEpisodeDetailsInput = z.infer<typeof UpdateTelevisionEpisodeDetailsInputSchema>;\n\nexport const UpdateTuneTrackDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  tuneId: tuneIdSchema,\n  trackId: trackIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TUNE_TRACK_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTuneTrackDetailsInput = z.infer<typeof UpdateTuneTrackDetailsInputSchema>;\n\nexport const UpdateTaleWorkGenresInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  taleId: taleIdSchema,\n  workGenre: z.enum(TALE_GENRE_VALUES),\n  action: addRemoveActionSchema,\n}).strict();\nexport type UpdateTaleWorkGenresInput = z.infer<typeof UpdateTaleWorkGenresInputSchema>;\n\nexport const UpdateTaleDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  taleId: taleIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TALE_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTaleDetailsInput = z.infer<typeof UpdateTaleDetailsInputSchema>;\n\nexport const UpdateTelevisionWorkGenresInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  televisionId: televisionIdSchema,\n  workGenre: z.enum(TELEVISION_GENRE_VALUES),\n  action: addRemoveActionSchema,\n}).strict();\nexport type UpdateTelevisionWorkGenresInput = z.infer<typeof UpdateTelevisionWorkGenresInputSchema>;\n\nexport const UpdateTelevisionDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  televisionId: televisionIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TELEVISION_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTelevisionDetailsInput = z.infer<typeof UpdateTelevisionDetailsInputSchema>;\n\nexport const UpdateTuneWorkGenresInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  tuneId: tuneIdSchema,\n  workGenre: z.enum(TUNE_GENRE_VALUES),\n  action: addRemoveActionSchema,\n}).strict();\nexport type UpdateTuneWorkGenresInput = z.infer<typeof UpdateTuneWorkGenresInputSchema>;\n\nexport const UpdateTuneDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  tuneId: tuneIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TUNE_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTuneDetailsInput = z.infer<typeof UpdateTuneDetailsInputSchema>;\n\n// --- Per-user Hall viewing-state doc (hall-viewing-experience Area 2, ruled 2026-07-04) ---\n// One core (`runX`) owns the single privateData doc per Rule 3; writes are CALLABLE-ONLY —\n// no direct client Firestore writes anywhere in this system. Every list on the doc is capped\n// (HALL_LIBRARY_PREFS_CAPS in ../constants/business.js); cap enforcement is the backend\n// core's job, not this input-validation layer.\n\nexport const UpdateHallWorkHiddenInputSchema = z.object({\n  hallItemId: hallItemIdSchema,\n  hidden: z.boolean(),\n}).strict();\nexport type UpdateHallWorkHiddenInput = z.infer<typeof UpdateHallWorkHiddenInputSchema>;\n\n// \"Inked\" save-for-later watchlist toggle (My Playbill Area 7) — deliberately separate from\n// follows (Inked is private organization; follow is semi-public with a counter + notifications).\nexport const UpdateHallInkedWorkInputSchema = z.object({\n  hallItemId: hallItemIdSchema,\n  inked: z.boolean(),\n}).strict();\nexport type UpdateHallInkedWorkInput = z.infer<typeof UpdateHallInkedWorkInputSchema>;\n\n// Playback-progress heartbeat (throttled client-side to ~60s during playback, plus writes on\n// pause / pane-exit / media-end). `durationSeconds` is optional — not always known up front.\nexport const UpdateHallPlaybackProgressInputSchema = z.object({\n  hallItemId: hallItemIdSchema,\n  itemId: itemIdSchema,\n  positionSeconds: z.number().min(0),\n  durationSeconds: z.number().min(0).optional(),\n}).strict();\nexport type UpdateHallPlaybackProgressInput = z.infer<typeof UpdateHallPlaybackProgressInputSchema>;\n\n// Recently-viewed / History rail record. `itemId` is optional — a work-level view (no\n// sub-item selected yet) still records History.\nexport const UpdateHallRecentlyViewedInputSchema = z.object({\n  hallItemId: hallItemIdSchema,\n  itemId: itemIdSchema.nullish(),\n}).strict();\nexport type UpdateHallRecentlyViewedInput = z.infer<typeof UpdateHallRecentlyViewedInputSchema>;\n\nexport const UpdateHallLibrarySettingsInputSchema = z.object({\n  tunesAutoplay: z.boolean(),\n}).strict();\nexport type UpdateHallLibrarySettingsInput = z.infer<typeof UpdateHallLibrarySettingsInputSchema>;\n\n\n"]}
+{"version":3,"file":"hall-library.js","sourceRoot":"","sources":["../../src/schemas/hall-library.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,iCAAiC,EACjC,iCAAiC,EACjC,yCAAyC,EACzC,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,sFAAsF;AACtF,mFAAmF;AACnF,sFAAsF;AACtF,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,KAAyC,CAAC;AACjG,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,KAAyC,CAAC;AACjG,MAAM,uBAAuB,GAAG,4BAA4B,CAAC,UAA8C,CAAC;AAE5G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,qBAAqB;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnF,yFAAyF;IACzF,0FAA0F;IAC1F,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,oFAAoF;IACpF,oFAAoF;IACpF,qFAAqF;IACrF,kCAAkC;IAClC,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,aAAa,EAAE,mBAAmB;IAClC,eAAe,EAAE,qBAAqB;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACrF,gFAAgF;IAChF,8EAA8E;IAC9E,gFAAgF;IAChF,uDAAuD;IACvD,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,yFAAyF;AACzF,qFAAqF;AACrF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,eAAe,EAAE,qBAAqB;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0FAA0F;AAC1F,+EAA+E;AAC/E,sFAAsF;AACtF,qEAAqE;AACrE,sFAAsF;AACtF,sEAAsE;AACtE,wFAAwF;AACxF,0EAA0E;AAC1E,kFAAkF;AAClF,qEAAqE;AACrE,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,UAAU,EAAE,gBAAgB,CAAC,OAAO,EAAE;IACtC,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;SAC1G,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;CACzG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACnC,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,6DAA6D;YACtE,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,yFAAyF;AACzF,uDAAuD;AACvD,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,qBAAqB;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;CAC1F,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,QAAQ,EAAE;CAClF,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,aAAa;IACtB,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACpC,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAC1C,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACpC,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,mBAAmB;IAClC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,6FAA6F;AAC7F,6FAA6F;AAC7F,6FAA6F;AAC7F,wFAAwF;AACxF,+CAA+C;AAE/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,4FAA4F;AAC5F,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,6FAA6F;AAC7F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,YAAY;IACpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,sFAAsF;AACtF,gDAAgD;AAChD,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["import { z } from 'zod';\nimport {\n  workProjectIdSchema,\n  workProjectTypeSchema,\n  taleIdSchema,\n  tuneIdSchema,\n  televisionIdSchema,\n  chapterIdSchema,\n  trackIdSchema,\n  episodeIdSchema,\n  titleSchema,\n  addRemoveActionSchema,\n  thresholdItemIdSchema,\n  hallItemIdSchema,\n  itemIdSchema,\n  changeRequestIdSchema,\n} from './atoms.js';\nimport {\n  MAX_HALL_LIBRARY_SUBMIT_BATCH,\n  MAX_CHAPTER_CONTENT_LENGTH,\n  MAX_TALE_DESCRIPTION_LENGTH,\n  MAX_TUNE_DESCRIPTION_LENGTH,\n  MAX_TELEVISION_DESCRIPTION_LENGTH,\n  MAX_TUNE_TRACK_DESCRIPTION_LENGTH,\n  MAX_TELEVISION_EPISODE_DESCRIPTION_LENGTH,\n  MAX_THRESHOLD_REVIEW_NOTES_LENGTH,\n  MAX_HALL_CHANGE_REQUEST_REASON_LENGTH,\n} from '../constants/business.js';\nimport { WORK_PROJECT_SPECIFIC_GENRES } from '../constants/options.js';\n\n// Canonical per-type genre enums. `WORK_PROJECT_SPECIFIC_GENRES.<type>` is a readonly\n// tuple of the exact genre strings the UI offers; the schema is the cross-boundary\n// contract, so a crafted callable can no longer put arbitrary/unmoderated text (or an\n// unbounded array of distinct strings) onto the public hall parent.\nconst TALE_GENRE_VALUES = WORK_PROJECT_SPECIFIC_GENRES.Tales as unknown as [string, ...string[]];\nconst TUNE_GENRE_VALUES = WORK_PROJECT_SPECIFIC_GENRES.Tunes as unknown as [string, ...string[]];\nconst TELEVISION_GENRE_VALUES = WORK_PROJECT_SPECIFIC_GENRES.Television as unknown as [string, ...string[]];\n\nexport const CreateChapterInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  taleId: taleIdSchema,\n  title: titleSchema,\n}).strict();\nexport type CreateChapterInput = z.infer<typeof CreateChapterInputSchema>;\n\nexport const CreateTelevisionEpisodeInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  televisionId: televisionIdSchema,\n  title: titleSchema,\n}).strict();\nexport type CreateTelevisionEpisodeInput = z.infer<typeof CreateTelevisionEpisodeInputSchema>;\n\nexport const CreateTuneTrackInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  tuneId: tuneIdSchema,\n  title: titleSchema,\n}).strict();\nexport type CreateTuneTrackInput = z.infer<typeof CreateTuneTrackInputSchema>;\n\nexport const ReviewThresholdItemInputSchema = z.object({\n  thresholdItemId: thresholdItemIdSchema,\n  decision: z.enum(['approved', 'needs_revision']),\n  adminNotes: z.string().max(MAX_THRESHOLD_REVIEW_NOTES_LENGTH).nullable().optional(),\n  // Reviewer checklist confirmations, recorded on the review (mirrors `teachesSomething`).\n  // Optional here so a `needs_revision` decision still validates; the callable REQUIRES all\n  // true on an `approved` decision. First two: no-begging-for-bouquets, no-credits-in-content.\n  confirmedNoBegging: z.boolean().optional(),\n  confirmedNoCredits: z.boolean().optional(),\n  // Reviewer verified the AUTHOR's real-people/parody attestation sits in the correct\n  // position for the content they reviewed — checked if the work depicts real people,\n  // unchecked if it does not (R3, DJ 2026-07-12). A wrong position is a needs-revision\n  // send-back, never an admin edit.\n  confirmedRealPeopleAttestation: z.boolean().optional(),\n}).strict();\nexport type ReviewThresholdItemInput = z.infer<typeof ReviewThresholdItemInputSchema>;\n\nexport const SubmitForThresholdLibraryReviewInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  workProjectType: workProjectTypeSchema,\n  selectedItemIds: z.array(z.string().min(1)).min(1).max(MAX_HALL_LIBRARY_SUBMIT_BATCH),\n  // AUTHOR attestation (R3, 2026-07-12): the submitting artisan attests this work\n  // depicts real people (parody / satire / commentary). Stored on the threshold\n  // item as `hasRealPeople`; the reviewer sees it READ-ONLY. When true, published\n  // surfaces render the ONE standard platform disclaimer\n  // (REAL_PEOPLE_DISCLAIMER_MESSAGE) — no free-text disclaimer input exists.\n  depictsRealPeople: z.boolean(),\n}).strict();\nexport type SubmitForThresholdLibraryReviewInput = z.infer<typeof SubmitForThresholdLibraryReviewInputSchema>;\n\n// Member-initiated pull-back of a still-pending threshold submission. The runner derives\n// everything else from the threshold doc; rejects unless reviewStatus === 'pending'.\nexport const WithdrawFromThresholdLibraryReviewInputSchema = z.object({\n  thresholdItemId: thresholdItemIdSchema,\n}).strict();\nexport type WithdrawFromThresholdLibraryReviewInput = z.infer<typeof WithdrawFromThresholdLibraryReviewInputSchema>;\n\n// Published change request (text-only at launch): the member proposes new values for TEXT\n// fields on a PUBLISHED surface — one pipeline, three grains (R1, 2026-07-12):\n//  - hall grains: `hallItemId` set (+ `workProjectType`); the hall parent detail when\n//    `subItemId` is absent, else the chapter/track/episode sub-item.\n//  - realm grain: `workRealmId` set; targets the `workRealms/{id}` doc once the realm\n//    counts as published. `workProjectType`/`subItemId` do not apply.\n// Exactly one of `hallItemId` / `workRealmId` must be set. Field names are validated by\n// the runner against the per-surface HALL_CONTENT_TEXT_FIELDS allowlist +\n// HALL_CONTENT_TEXT_FIELD_MAX caps; the schema-level cap is the largest field cap\n// anywhere (chapter content), derived from the same owning constant.\nexport const SubmitHallContentChangeRequestInputSchema = z.object({\n  hallItemId: hallItemIdSchema.nullish(),\n  workProjectType: workProjectTypeSchema.nullish(),\n  workRealmId: z.string().min(1).nullish(),\n  subItemId: z.string().min(1).nullish(),\n  proposedFields: z.record(z.string().min(1).max(64), z.string().trim().min(1).max(MAX_CHAPTER_CONTENT_LENGTH))\n    .refine((fields) => Object.keys(fields).length > 0, { message: 'Propose at least one field change.' }),\n}).strict().superRefine((val, ctx) => {\n  const hasHallItem = typeof val.hallItemId === 'string' && val.hallItemId.length > 0;\n  const hasRealm = typeof val.workRealmId === 'string' && val.workRealmId.length > 0;\n  if (hasHallItem === hasRealm) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: 'Provide exactly one of hallItemId or workRealmId.',\n      path: [hasRealm ? 'workRealmId' : 'hallItemId'],\n    });\n    return;\n  }\n  if (hasHallItem && (val.workProjectType === null || val.workProjectType === undefined)) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: 'workProjectType is required for a hall-item change request.',\n      path: ['workProjectType'],\n    });\n  }\n  if (hasRealm && (val.workProjectType !== null && val.workProjectType !== undefined)) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: 'workProjectType does not apply to a realm change request.',\n      path: ['workProjectType'],\n    });\n  }\n  if (hasRealm && typeof val.subItemId === 'string' && val.subItemId.length > 0) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: 'subItemId does not apply to a realm change request.',\n      path: ['subItemId'],\n    });\n  }\n});\nexport type SubmitHallContentChangeRequestInput = z.infer<typeof SubmitHallContentChangeRequestInputSchema>;\n\n// Admin decision on a published change request. `resolutionReason` is REQUIRED on a deny\n// (the member is shown why); optional note on approve.\nexport const ReviewHallContentChangeRequestInputSchema = z.object({\n  changeRequestId: changeRequestIdSchema,\n  decision: z.enum(['approved', 'denied']),\n  resolutionReason: z.string().trim().max(MAX_HALL_CHANGE_REQUEST_REASON_LENGTH).optional(),\n}).strict().superRefine((val, ctx) => {\n  if (val.decision === 'denied' && (!val.resolutionReason || val.resolutionReason.length === 0)) {\n    ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'A reason is required when denying a change request.', path: ['resolutionReason'] });\n  }\n});\nexport type ReviewHallContentChangeRequestInput = z.infer<typeof ReviewHallContentChangeRequestInputSchema>;\n\nexport const UpdateChapterDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  taleId: taleIdSchema,\n  chapterId: chapterIdSchema,\n  title: titleSchema.optional(),\n  content: z.string().max(MAX_CHAPTER_CONTENT_LENGTH).optional(),\n}).strict();\nexport type UpdateChapterDetailsInput = z.infer<typeof UpdateChapterDetailsInputSchema>;\n\nexport const UpdateTelevisionEpisodeDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  televisionId: televisionIdSchema,\n  episodeId: episodeIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TELEVISION_EPISODE_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTelevisionEpisodeDetailsInput = z.infer<typeof UpdateTelevisionEpisodeDetailsInputSchema>;\n\nexport const UpdateTuneTrackDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  tuneId: tuneIdSchema,\n  trackId: trackIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TUNE_TRACK_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTuneTrackDetailsInput = z.infer<typeof UpdateTuneTrackDetailsInputSchema>;\n\nexport const UpdateTaleWorkGenresInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  taleId: taleIdSchema,\n  workGenre: z.enum(TALE_GENRE_VALUES),\n  action: addRemoveActionSchema,\n}).strict();\nexport type UpdateTaleWorkGenresInput = z.infer<typeof UpdateTaleWorkGenresInputSchema>;\n\nexport const UpdateTaleDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  taleId: taleIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TALE_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTaleDetailsInput = z.infer<typeof UpdateTaleDetailsInputSchema>;\n\nexport const UpdateTelevisionWorkGenresInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  televisionId: televisionIdSchema,\n  workGenre: z.enum(TELEVISION_GENRE_VALUES),\n  action: addRemoveActionSchema,\n}).strict();\nexport type UpdateTelevisionWorkGenresInput = z.infer<typeof UpdateTelevisionWorkGenresInputSchema>;\n\nexport const UpdateTelevisionDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  televisionId: televisionIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TELEVISION_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTelevisionDetailsInput = z.infer<typeof UpdateTelevisionDetailsInputSchema>;\n\nexport const UpdateTuneWorkGenresInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  tuneId: tuneIdSchema,\n  workGenre: z.enum(TUNE_GENRE_VALUES),\n  action: addRemoveActionSchema,\n}).strict();\nexport type UpdateTuneWorkGenresInput = z.infer<typeof UpdateTuneWorkGenresInputSchema>;\n\nexport const UpdateTuneDetailsInputSchema = z.object({\n  workProjectId: workProjectIdSchema,\n  tuneId: tuneIdSchema,\n  title: titleSchema.optional(),\n  description: z.string().max(MAX_TUNE_DESCRIPTION_LENGTH).optional(),\n}).strict();\nexport type UpdateTuneDetailsInput = z.infer<typeof UpdateTuneDetailsInputSchema>;\n\n// --- Per-user Hall viewing-state doc (hall-viewing-experience Area 2, ruled 2026-07-04) ---\n// One core (`runX`) owns the single privateData doc per ARCH-001; writes are CALLABLE-ONLY —\n// no direct client Firestore writes anywhere in this system. Every list on the doc is capped\n// (HALL_LIBRARY_PREFS_CAPS in ../constants/business.js); cap enforcement is the backend\n// core's job, not this input-validation layer.\n\nexport const UpdateHallWorkHiddenInputSchema = z.object({\n  hallItemId: hallItemIdSchema,\n  hidden: z.boolean(),\n}).strict();\nexport type UpdateHallWorkHiddenInput = z.infer<typeof UpdateHallWorkHiddenInputSchema>;\n\n// \"Inked\" save-for-later watchlist toggle (My Playbill Area 7) — deliberately separate from\n// follows (Inked is private organization; follow is semi-public with a counter + notifications).\nexport const UpdateHallInkedWorkInputSchema = z.object({\n  hallItemId: hallItemIdSchema,\n  inked: z.boolean(),\n}).strict();\nexport type UpdateHallInkedWorkInput = z.infer<typeof UpdateHallInkedWorkInputSchema>;\n\n// Playback-progress heartbeat (throttled client-side to ~60s during playback, plus writes on\n// pause / pane-exit / media-end). `durationSeconds` is optional — not always known up front.\nexport const UpdateHallPlaybackProgressInputSchema = z.object({\n  hallItemId: hallItemIdSchema,\n  itemId: itemIdSchema,\n  positionSeconds: z.number().min(0),\n  durationSeconds: z.number().min(0).optional(),\n}).strict();\nexport type UpdateHallPlaybackProgressInput = z.infer<typeof UpdateHallPlaybackProgressInputSchema>;\n\n// Recently-viewed / History rail record. `itemId` is optional — a work-level view (no\n// sub-item selected yet) still records History.\nexport const UpdateHallRecentlyViewedInputSchema = z.object({\n  hallItemId: hallItemIdSchema,\n  itemId: itemIdSchema.nullish(),\n}).strict();\nexport type UpdateHallRecentlyViewedInput = z.infer<typeof UpdateHallRecentlyViewedInputSchema>;\n\nexport const UpdateHallLibrarySettingsInputSchema = z.object({\n  tunesAutoplay: z.boolean(),\n}).strict();\nexport type UpdateHallLibrarySettingsInput = z.infer<typeof UpdateHallLibrarySettingsInputSchema>;\n\n\n"]}

package/dist/schemas/notification.js

@@ -18,7 +18,7 @@ import { HallSubItemTypeSchema } from '../doc-schemas/content.js';
 import { ReportableItemTypeSchema } from '../doc-schemas/safety/foundation.js';
 // String shape atoms specific to notifications.
 const notificationMessageSchema = z.string().min(1).max(MAX_NOTIFICATION_MESSAGE_LENGTH);
-// The canonical reportable-item enum — never an open string (Rule 36).
+// The canonical reportable-item enum — never an open string (ARCH-102).
 const reportedItemTypeSchema = ReportableItemTypeSchema;
 const reportedItemIdSchema = z.string().min(1).max(128);
 const reportIdSchema = z.string().min(1);