@ttt-productions/ttt-core 0.78.22 → 0.78.24

package/dist/doc-schemas/media-assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-assets.js","sourceRoot":"","sources":["../../src/doc-schemas/media-assets.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,yEAAyE;AACzE,kEAAkE;AAElE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAGzF;4DAC4D;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAGjG;;uCAEuC;AACvC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,aAAa;IACb,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,aAAa,EAAE,qEAAqE;IACpF,UAAU;IACV,mBAAmB;IACnB,oBAAoB;IACpB,UAAU;IACV,eAAe;IACf,qBAAqB;IACrB,WAAW,EAAE,qDAAqD;IAClE,gBAAgB,EAAE,oFAAoF;CACvG,CAAC,CAAC;AAGH,iDAAiD;AACjD,2EAA2E;AAC3E,4BAA4B;AAE5B;;uFAEuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAGhE,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,UAAU;IACV,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,OAAO;CACR,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2DAA2D;IAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uCAAuC;IACvE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,oDAAoD;IACjG,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iEAAiE;IAC5G,gGAAgG;IAChG,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,sFAAsF;IACtF,sFAAsF;IACtF,yFAAyF;IACzF,yFAAyF;IACzF,mFAAmF;IACnF,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,UAAU,EAAE,qBAAqB;IACjC,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IAClF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,+DAA+D;IAC3G,gBAAgB,EAAE,yBAAyB,EAAE,qCAAqC;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,UAAU,EAAE,sDAAsD;IAClE,2BAA2B;IAC3B,WAAW;CACZ,CAAC,CAAC;AAGH,yEAAyE;AACzE,iDAAiD;AACjD,qDAAqD;AACrD,sFAAsF;AACtF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAGhF,sEAAsE;AACtE,wFAAwF;AAExF,iFAAiF;AACjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAG1F;iFACiF;AACjF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAGhG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAClE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACpC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACnC,CAAC,CAAC,MAAM,EAAE;CACZ,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,gBAAgB;IAChB,iBAAiB;IACjB,WAAW;IACX,WAAW;IACX,wEAAwE;IACxE,8DAA8D;IAC9D,YAAY;IACZ,kBAAkB,EAAE,mJAAmJ;IACvK,eAAe;IACf,wBAAwB;IACxB,yBAAyB;IACzB,iBAAiB;IACjB,gBAAgB;IAChB,qFAAqF;IACrF,6FAA6F;IAC7F,wFAAwF;IACxF,wBAAwB;CACzB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,aAAa,EAAE,wBAAwB;IACvC,UAAU,EAAE,qBAAqB;IAEjC,SAAS,EAAE,yBAAyB;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAEzC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC;IAEvD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,sBAAsB;IACjC,UAAU,EAAE,gBAAgB;IAE5B,uEAAuE;IACvE,qEAAqE;IACrE,SAAS,EAAE,yBAAyB;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,gEAAgE;IAChE,UAAU,EAAE,qBAAqB;IACjC,aAAa,EAAE,wBAAwB;IAEvC,sEAAsE;IACtE,0EAA0E;IAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC;IAEvD,gCAAgC;IAChC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACrD,eAAe,EAAE,0BAA0B;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,aAAa,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEpD,gFAAgF;IAChF,gFAAgF;IAChF,wEAAwE;IACxE,oBAAoB,EAAE,0BAA0B;IAEhD,4EAA4E;IAC5E,4EAA4E;IAC5E,kEAAkE;IAClE,+EAA+E;IAC/E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,kBAAkB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC7D,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IACzC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,kBAAkB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACpD,6FAA6F;IAC7F,iGAAiG;IACjG,2DAA2D;IAC3D,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// mediaAssets/{mediaAssetId} — the canonical media registry. One doc per\n// logical uploaded media item; all variants inside. Content docs reference\n// media ONLY by `*AssetId` fields — never URLs. Serving authority is the\n// gateway Worker (cookie/grant + KV blocklist); this doc is the server-side\n// truth the edge records derive from. NO client reads, NO client writes.\n// See ttt-prod docs/design/media-assets-and-protected-serving.md.\n\nimport { z } from 'zod';\nimport { StructuredErrorSchema } from '@ttt-productions/edge-protocol-core';\nimport { FileOriginSchema } from '../media/file-origin.js';\n\n/** Who may be served the bytes (the Worker's tier check). */\nexport const MediaAccessTierSchema = z.enum(['broad', 'scoped', 'artisan', 'adminOnly']);\nexport type MediaAccessTier = z.infer<typeof MediaAccessTierSchema>;\n\n/** Canonical serving state. The edge record derives from this; hide/restore/\n * quarantine flows write it together with the blocklist. */\nexport const MediaServingStatusSchema = z.enum(['servable', 'hidden', 'quarantined', 'deleted']);\nexport type MediaServingStatus = z.infer<typeof MediaServingStatusSchema>;\n\n/** The surface that owns this asset. One asset never serves two scopes —\n * publishing to the Hall (or future realm promotion) creates a NEW asset\n * owned by the destination surface. */\nexport const MediaAssetOwnerTypeSchema = z.enum([\n  'userProfile',\n  'craftSkill',\n  'squareStreetzPost',\n  'workProject',\n  'workContent', // tale chapter / tune track / television episode media (pre-publish)\n  'hallItem',\n  'commissionListing',\n  'commissionProposal',\n  'audition',\n  'auditionEntry',\n  'guildChatAttachment',\n  'realmFile', // reserved seam — realm shared files are post-launch\n  'safetyEvidence', // inert system sentinel — synthetic NCII-evidence assets (never an account surface)\n]);\nexport type MediaAssetOwnerType = z.infer<typeof MediaAssetOwnerTypeSchema>;\n\n// ===== Media origin lineage (Appendix A0) =====\n// One canonical lineage used by media, CSAM, and safety. Embedded on every\n// media asset + every copy.\n\n/** The ONE canonical stored content media kind (what the pipeline produces and the\n * asset doc records). Distinct from the 4-value display/transport MediaTypeSchema\n * (doc-schemas/social.ts, adds 'other') and media-schemas' generic MediaKindSchema. */\nexport const ContentMediaKindSchema = z.enum(['image', 'video', 'audio']);\nexport type ContentMediaKind = z.infer<typeof ContentMediaKindSchema>;\n\n/**\n * The named-variant key set for `variantSha256s` — declared ONCE here; every declared\n * `image.variants[].key` in `TTT_MEDIA_SPECS` is compile-checked against this union\n * (the specs type their variant keys as `MediaVariantKey`), so an undeclared variant\n * name fails the BUILD — no sync test needed. Never an open `string`.\n */\nexport const MEDIA_VARIANT_KEYS = ['full', 'medium', 'small', 'main'] as const;\nexport const MediaVariantKeySchema = z.enum(MEDIA_VARIANT_KEYS);\nexport type MediaVariantKey = z.infer<typeof MediaVariantKeySchema>;\n\n/** Why this asset was created from its source (A0). */\nexport const MediaCopyReasonSchema = z.enum([\n  'original',\n  'variant',\n  'hall_publish',\n  'profile_derivative',\n  'chat_derivative',\n  'moderation_copy',\n  'evidence_copy',\n  'other',\n]);\nexport type MediaCopyReason = z.infer<typeof MediaCopyReasonSchema>;\n\n/**\n * Canonical media origin lineage (Appendix A0). A copy INHERITS\n * rootIngestId/rootAssetId/originatingUploaderUid/originatingUploadEventId/\n * originalUploadCreatedAt/rootSha256/originalSha256 unchanged; it sets its own\n * sourceAssetId/variantSha256s/copyReason/copyActorUid/currentOwner*. Client\n * requests can NEVER set or override any lineage field. Automatic account\n * action targets ONLY `originatingUploaderUid`; incident-wide blocking\n * enumerates by `rootIngestId`. Missing/corrupt lineage → safetyLocked +\n * manual decision, never a guessed ban.\n */\nexport const MediaOriginLineageV1Schema = z.object({\n  lineageVersion: z.literal(1),\n  rootIngestId: z.string().min(1), // first-accepted ingest event id; stable across all copies\n  rootAssetId: z.string().min(1), // first asset created from that ingest\n  sourceAssetId: z.string().min(1).optional(), // immediate parent copied from (absent on the root)\n  originatingUploaderUid: z.string().min(1), // set server-side at first accepted ingest; IMMUTABLE; inherited\n  // May be '' for a legacy copy synthesized from a pre-rollout source with no known upload event.\n  originatingUploadEventId: z.string(),\n  originalUploadCreatedAt: z.number(),\n  // '' until content hashing backfills the real sha256 (Phase 5 PhotoDNA / evidence capture).\n  // NOT z.string().min(1): the media pipeline does not compute a content hash at finalize yet,\n  // so a freshly-ingested asset legitimately carries an empty rootSha256 until it is hashed.\n  rootSha256: z.string(),\n  originalSha256: z.string().min(1).optional(),\n  // PARTIAL map: one hash per PRODUCED variant (an asset produces only the variants its\n  // origin declares — e.g. full/medium/small for a profile picture, 'main' for others —\n  // never all four). Typed keys, never an open string. `z.partialRecord` (NOT `z.record`):\n  // in Zod 4 `z.record(enum,…)` is EXHAUSTIVE (demands every enum key), which would reject\n  // every real asset's partial variant set; `partialRecord` makes the keys optional.\n  variantSha256s: z.partialRecord(MediaVariantKeySchema, z.string().min(1)),\n  copyReason: MediaCopyReasonSchema,\n  createdFromOwnerType: MediaAssetOwnerTypeSchema.optional(), // never a bare string\n  createdFromOwnerId: z.string().min(1).optional(),\n  copyActorUid: z.string().min(1).optional(), // who triggered the copy (distinct from the original uploader)\n  currentOwnerType: MediaAssetOwnerTypeSchema, // mutable; the asset's present owner\n  currentOwnerId: z.string().min(1),\n}).strict();\nexport type MediaOriginLineageV1 = z.infer<typeof MediaOriginLineageV1Schema>;\n\nexport const MediaAssetVariantSchema = z.object({\n  contentType: z.string().min(1),\n  sizeBytes: z.number().int().nonnegative(),\n  width: z.number().int().positive().optional(),\n  height: z.number().int().positive().optional(),\n  durationSec: z.number().positive().optional(),\n}).strict();\nexport type MediaAssetVariant = z.infer<typeof MediaAssetVariantSchema>;\n\nexport const MediaRetentionPolicySchema = z.enum([\n  'standard', // staging original deleted ~24h after verified mirror\n  'preserveForTrustAndSafety',\n  'legalHold',\n]);\nexport type MediaRetentionPolicy = z.infer<typeof MediaRetentionPolicySchema>;\n\n// Realm shared-files: a work file's standing in its realm's shared pool.\n//   none     — not shared to the realm (default)\n//   nonCanon — shared to the realm's pool, non-canon\n//   canon    — shared and marked canon (realm steward/owner toggles canon ↔ nonCanon)\n// Moderation/takedown is NOT a value here — a hidden file is hidden via the shared\n// media path (`servingStatus: 'hidden'`), so the gallery filters on servingStatus.\nexport const RealmFileCanonStatusSchema = z.enum(['none', 'nonCanon', 'canon']);\nexport type RealmFileCanonStatus = z.infer<typeof RealmFileCanonStatusSchema>;\n\n// ===== Serving authority (Durable Object) + publication gating =====\n// See MEDIA_AUTHORITY_DO_DESIGN.md §6–§9/§13 and media-assets-and-protected-serving.md.\n\n/** Whether the canonical serving record has been applied to the DO authority. */\nexport const MediaAuthoritySyncStateSchema = z.enum(['pending', 'applied', 'deadLetter']);\nexport type MediaAuthoritySyncState = z.infer<typeof MediaAuthoritySyncStateSchema>;\n\n/** Whether the asset is referenced by a visible owner doc. Orthogonal to the\n * upload's processing outcome (`pendingMedia.status`) and to `servingStatus`. */\nexport const MediaAssetPublicationStateSchema = z.enum(['unpublished', 'published', 'retired']);\nexport type MediaAssetPublicationState = z.infer<typeof MediaAssetPublicationStateSchema>;\n\n/**\n * Typed immutable serving scope for scoped-tier assets. The gateway Worker matches\n * a grant against the scope by `kind` — so a whole-Work `{w}` grant matches ONLY a\n * `workProject` scope, NEVER a `guildChannel` scope (even though both carry a\n * `workProjectId`): a restricted channel's attachment is not reachable by a plain\n * Work grant, and a chat grant is not reachable by a Work asset.\n *\n * - `workProject` — pre-publish content media (hall covers / sub-item media during\n *   authoring), scoped to project read membership. Carries the matchable\n *   `workProjectId`. This is the typed home for work scope on the strongly-consistent\n *   serving record so the DO-fallback path can authorize it (the DO persists scope\n *   only as `scopeJson`, no separate column).\n * - `workFileFolder` — a work-project FILE living in a folder. The EXACT folder scope,\n *   NOT the whole-Work `{w}` grant: a custom folder's bytes must be unreachable by a\n *   guildmate outside that folder's view trade-professions, so the grant callable runs\n *   the per-folder view check and the Worker EXACT-matches `{workProjectId,\n *   workFileFolderId}` — a plain Work `{w}` grant NEVER matches a folder file, and a\n *   folder grant NEVER matches a `workProject`-scoped content asset.\n * - `guildChannel` / `guildInvite` — guild-chat attachments; an EXACT channel/\n *   invite scope (Contract E \"Chat attachment authorization\"). A guildChannel's\n *   `workProjectId` lives ONLY inside this scope, never as a bare matchable field.\n *\n * `null` scope = no scope match required beyond the access tier (e.g. broad).\n */\nexport const MediaServingScopeSchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal('workProject'),\n    workProjectId: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal('workFileFolder'),\n    workProjectId: z.string().min(1),\n    workFileFolderId: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal('guildChannel'),\n    workProjectId: z.string().min(1),\n    guildChatChannelId: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal('guildInvite'),\n    guildInviteId: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal('adminSupport'),\n    adminDispatchId: z.string().min(1),\n  }).strict(),\n]);\nexport type MediaServingScope = z.infer<typeof MediaServingScopeSchema>;\n\n/**\n * The typed owner adapter a publication goes through (§11). The activation job\n * carries this kind; a server-side registry validates per-kind `publicationArgs`\n * and performs the idempotent owner write. Chat is the non-Firestore-owner\n * adapter (publishes via its durable attachmentFlip ack, not an owner txn).\n */\nexport const MediaPublicationKindSchema = z.enum([\n  'profilePicture',\n  'squarePostMedia',\n  'workAsset',\n  'hallCover',\n  // Realm cover — Firestore-owner adapter writes `realmCoverAssetId` onto\n  // workRealms/{workRealmId} (the 'realm-cover' upload origin).\n  'realmCover',\n  'workContentMedia', // sub-item media (tale chapter / tune track / television episode) — attaches the *AssetId field on the workContent doc; scoped to the work project\n  'auditionMedia',\n  'commissionListingMedia',\n  'commissionProposalMedia',\n  'craftSkillMedia',\n  'chatAttachment',\n  // Admin-support thread attachment: Firestore-transported (no Durable Object), so its\n  // publication adapter does a Firestore owner write (flips the dispatch message placeholder),\n  // unlike DO-ack'd `chatAttachment`. Carries the typed `adminSupport` MediaServingScope.\n  'adminSupportAttachment',\n]);\nexport type MediaPublicationKind = z.infer<typeof MediaPublicationKindSchema>;\n\n/**\n * The normalized serving record (§7) — the SAME contract used to generate both\n * the DO authority row and the KV cache payload (one function, so they can't\n * drift). The R2 object key stays deterministic (`mediaAssets/{assetId}/{key}`)\n * and is NOT persisted here. `payloadHash` is computed over the canonical\n * payload EXCLUDING the hash itself (see edge-protocol-core `hashPayload`).\n */\nexport const MediaServingAuthorityRecordSchema = z.object({\n  schemaVersion: z.number().int().positive(),\n  assetId: z.string().min(1),\n  authorityVersion: z.number().int().nonnegative(),\n  operationId: z.string().min(1),\n  payloadHash: z.string().min(1),\n\n  servingStatus: MediaServingStatusSchema,\n  accessTier: MediaAccessTierSchema,\n\n  ownerType: MediaAssetOwnerTypeSchema,\n  ownerId: z.string().min(1),\n  scope: MediaServingScopeSchema.nullable(),\n\n  variants: z.record(z.string(), MediaAssetVariantSchema),\n\n  updatedAtMs: z.number(),\n}).strict();\nexport type MediaServingAuthorityRecord = z.infer<typeof MediaServingAuthorityRecordSchema>;\n\nexport const MediaAssetSchema = z.object({\n  mediaAssetId: z.string().min(1),\n  mediaKind: ContentMediaKindSchema,\n  fileOrigin: FileOriginSchema,\n\n  // Ownership / scope. ownerId is the owning doc's id within ownerType's\n  // surface; scope ids let the Worker/grant layer match scoped access.\n  ownerType: MediaAssetOwnerTypeSchema,\n  ownerId: z.string().min(1),\n  workProjectId: z.string().optional(),\n  realmId: z.string().optional(),\n  createdByUid: z.string().min(1),\n\n  // Access + serving (canonical; edge records derive from these).\n  accessTier: MediaAccessTierSchema,\n  servingStatus: MediaServingStatusSchema,\n\n  // Variants by key. The object key in R2 (and the Storage emulator) is\n  // deterministic — mediaAssets/{mediaAssetId}/{variantKey} — never stored.\n  variants: z.record(z.string(), MediaAssetVariantSchema),\n\n  // Lifecycle / trust-and-safety.\n  moderationStatus: z.enum(['approved', 'quarantined']),\n  retentionPolicy: MediaRetentionPolicySchema,\n  legalHold: z.boolean(),\n  originalDeletedAt: z.number().optional(),\n\n  // T&S provenance lineage (Appendix A0). Additive/optional so assets written\n  // before the lineage rollout still parse; set server-side at first accepted\n  // ingest, inherited unchanged by every copy/variant. Never client-supplied.\n  originLineage: MediaOriginLineageV1Schema.optional(),\n\n  // Realm shared-files seam. A file's standing in its realm's shared pool; set at\n  // creation to 'none' and moved by the realm shared-files callables. Attribution\n  // fields (who set canon, when) are added by that feature when it ships.\n  realmFileCanonStatus: RealmFileCanonStatusSchema,\n\n  // Serving authority + publication gating (§13). Additive/optional so assets\n  // written before the authority build still parse: absent authorityVersion ⇒\n  // 0/never-applied, absent publicationState ⇒ 'unpublished'. Every\n  // serving-record mutation increments authorityVersion in an authoritative txn.\n  authorityVersion: z.number().int().nonnegative().optional(),\n  authorityPayloadHash: z.string().optional(),\n  authoritySyncState: MediaAuthoritySyncStateSchema.optional(),\n  publicationState: MediaAssetPublicationStateSchema.optional(),\n  scope: MediaServingScopeSchema.optional(),\n  authorityAppliedAt: z.number().optional(),\n  publishedAt: z.number().optional(),\n  lastAuthorityError: StructuredErrorSchema.optional(),\n  // Authority-sync retry ledger (M1): the scheduled worker bumps attemptCount + sets a backoff\n  // nextAttemptAt on a transient apply failure, and dead-letters (authoritySyncState='deadLetter')\n  // past a threshold. Absent ⇒ 0 attempts / immediately due.\n  authoritySyncAttemptCount: z.number().int().nonnegative().optional(),\n  authoritySyncNextAttemptAt: z.number().optional(),\n\n  createdAt: z.number(),\n  updatedAt: z.number(),\n}).strict();\nexport type MediaAsset = z.infer<typeof MediaAssetSchema>;\n"]}
+{"version":3,"file":"media-assets.js","sourceRoot":"","sources":["../../src/doc-schemas/media-assets.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,yEAAyE;AACzE,kEAAkE;AAElE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAGzF;4DAC4D;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAGjG;;uCAEuC;AACvC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,aAAa;IACb,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,aAAa,EAAE,qEAAqE;IACpF,UAAU;IACV,mBAAmB;IACnB,oBAAoB;IACpB,UAAU;IACV,eAAe;IACf,qBAAqB;IACrB,WAAW,EAAE,qDAAqD;IAClE,gBAAgB,EAAE,oFAAoF;CACvG,CAAC,CAAC;AAGH,iDAAiD;AACjD,2EAA2E;AAC3E,4BAA4B;AAE5B;;uFAEuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAGhE,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,UAAU;IACV,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,OAAO;CACR,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2DAA2D;IAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uCAAuC;IACvE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,oDAAoD;IACjG,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iEAAiE;IAC5G,gGAAgG;IAChG,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,sFAAsF;IACtF,sFAAsF;IACtF,yFAAyF;IACzF,yFAAyF;IACzF,mFAAmF;IACnF,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,UAAU,EAAE,qBAAqB;IACjC,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IAClF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,+DAA+D;IAC3G,gBAAgB,EAAE,yBAAyB,EAAE,qCAAqC;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,UAAU,EAAE,sDAAsD;IAClE,2BAA2B;IAC3B,WAAW;CACZ,CAAC,CAAC;AAGH,yEAAyE;AACzE,iDAAiD;AACjD,qDAAqD;AACrD,sFAAsF;AACtF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAGhF,sEAAsE;AACtE,mFAAmF;AACnF,oEAAoE;AAEpE,iFAAiF;AACjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAG1F;iFACiF;AACjF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAGhG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAClE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACpC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACnC,CAAC,CAAC,MAAM,EAAE;CACZ,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,gBAAgB;IAChB,iBAAiB;IACjB,WAAW;IACX,WAAW;IACX,wEAAwE;IACxE,8DAA8D;IAC9D,YAAY;IACZ,kBAAkB,EAAE,mJAAmJ;IACvK,eAAe;IACf,wBAAwB;IACxB,yBAAyB;IACzB,iBAAiB;IACjB,gBAAgB;IAChB,qFAAqF;IACrF,6FAA6F;IAC7F,wFAAwF;IACxF,wBAAwB;CACzB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,aAAa,EAAE,wBAAwB;IACvC,UAAU,EAAE,qBAAqB;IAEjC,SAAS,EAAE,yBAAyB;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAEzC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC;IAEvD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,sBAAsB;IACjC,UAAU,EAAE,gBAAgB;IAE5B,uEAAuE;IACvE,qEAAqE;IACrE,SAAS,EAAE,yBAAyB;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,gEAAgE;IAChE,UAAU,EAAE,qBAAqB;IACjC,aAAa,EAAE,wBAAwB;IAEvC,sEAAsE;IACtE,0EAA0E;IAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC;IAEvD,gCAAgC;IAChC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACrD,eAAe,EAAE,0BAA0B;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,aAAa,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEpD,gFAAgF;IAChF,gFAAgF;IAChF,wEAAwE;IACxE,oBAAoB,EAAE,0BAA0B;IAEhD,sEAAsE;IACtE,4EAA4E;IAC5E,kEAAkE;IAClE,+EAA+E;IAC/E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,kBAAkB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC7D,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IACzC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,kBAAkB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACpD,6FAA6F;IAC7F,iGAAiG;IACjG,2DAA2D;IAC3D,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// mediaAssets/{mediaAssetId} — the canonical media registry. One doc per\n// logical uploaded media item; all variants inside. Content docs reference\n// media ONLY by `*AssetId` fields — never URLs. Serving authority is the\n// gateway Worker (cookie/grant + KV blocklist); this doc is the server-side\n// truth the edge records derive from. NO client reads, NO client writes.\n// See ttt-prod docs/design/media-assets-and-protected-serving.md.\n\nimport { z } from 'zod';\nimport { StructuredErrorSchema } from '@ttt-productions/edge-protocol-core';\nimport { FileOriginSchema } from '../media/file-origin.js';\n\n/** Who may be served the bytes (the Worker's tier check). */\nexport const MediaAccessTierSchema = z.enum(['broad', 'scoped', 'artisan', 'adminOnly']);\nexport type MediaAccessTier = z.infer<typeof MediaAccessTierSchema>;\n\n/** Canonical serving state. The edge record derives from this; hide/restore/\n * quarantine flows write it together with the blocklist. */\nexport const MediaServingStatusSchema = z.enum(['servable', 'hidden', 'quarantined', 'deleted']);\nexport type MediaServingStatus = z.infer<typeof MediaServingStatusSchema>;\n\n/** The surface that owns this asset. One asset never serves two scopes —\n * publishing to the Hall (or future realm promotion) creates a NEW asset\n * owned by the destination surface. */\nexport const MediaAssetOwnerTypeSchema = z.enum([\n  'userProfile',\n  'craftSkill',\n  'squareStreetzPost',\n  'workProject',\n  'workContent', // tale chapter / tune track / television episode media (pre-publish)\n  'hallItem',\n  'commissionListing',\n  'commissionProposal',\n  'audition',\n  'auditionEntry',\n  'guildChatAttachment',\n  'realmFile', // reserved seam — realm shared files are post-launch\n  'safetyEvidence', // inert system sentinel — synthetic NCII-evidence assets (never an account surface)\n]);\nexport type MediaAssetOwnerType = z.infer<typeof MediaAssetOwnerTypeSchema>;\n\n// ===== Media origin lineage (Appendix A0) =====\n// One canonical lineage used by media, CSAM, and safety. Embedded on every\n// media asset + every copy.\n\n/** The ONE canonical stored content media kind (what the pipeline produces and the\n * asset doc records). Distinct from the 4-value display/transport MediaTypeSchema\n * (doc-schemas/social.ts, adds 'other') and media-schemas' generic MediaKindSchema. */\nexport const ContentMediaKindSchema = z.enum(['image', 'video', 'audio']);\nexport type ContentMediaKind = z.infer<typeof ContentMediaKindSchema>;\n\n/**\n * The named-variant key set for `variantSha256s` — declared ONCE here; every declared\n * `image.variants[].key` in `TTT_MEDIA_SPECS` is compile-checked against this union\n * (the specs type their variant keys as `MediaVariantKey`), so an undeclared variant\n * name fails the BUILD — no sync test needed. Never an open `string`.\n */\nexport const MEDIA_VARIANT_KEYS = ['full', 'medium', 'small', 'main'] as const;\nexport const MediaVariantKeySchema = z.enum(MEDIA_VARIANT_KEYS);\nexport type MediaVariantKey = z.infer<typeof MediaVariantKeySchema>;\n\n/** Why this asset was created from its source (A0). */\nexport const MediaCopyReasonSchema = z.enum([\n  'original',\n  'variant',\n  'hall_publish',\n  'profile_derivative',\n  'chat_derivative',\n  'moderation_copy',\n  'evidence_copy',\n  'other',\n]);\nexport type MediaCopyReason = z.infer<typeof MediaCopyReasonSchema>;\n\n/**\n * Canonical media origin lineage (Appendix A0). A copy INHERITS\n * rootIngestId/rootAssetId/originatingUploaderUid/originatingUploadEventId/\n * originalUploadCreatedAt/rootSha256/originalSha256 unchanged; it sets its own\n * sourceAssetId/variantSha256s/copyReason/copyActorUid/currentOwner*. Client\n * requests can NEVER set or override any lineage field. Automatic account\n * action targets ONLY `originatingUploaderUid`; incident-wide blocking\n * enumerates by `rootIngestId`. Missing/corrupt lineage → safetyLocked +\n * manual decision, never a guessed ban.\n */\nexport const MediaOriginLineageV1Schema = z.object({\n  lineageVersion: z.literal(1),\n  rootIngestId: z.string().min(1), // first-accepted ingest event id; stable across all copies\n  rootAssetId: z.string().min(1), // first asset created from that ingest\n  sourceAssetId: z.string().min(1).optional(), // immediate parent copied from (absent on the root)\n  originatingUploaderUid: z.string().min(1), // set server-side at first accepted ingest; IMMUTABLE; inherited\n  // May be '' for a legacy copy synthesized from a pre-rollout source with no known upload event.\n  originatingUploadEventId: z.string(),\n  originalUploadCreatedAt: z.number(),\n  // '' until content hashing backfills the real sha256 (Phase 5 PhotoDNA / evidence capture).\n  // NOT z.string().min(1): the media pipeline does not compute a content hash at finalize yet,\n  // so a freshly-ingested asset legitimately carries an empty rootSha256 until it is hashed.\n  rootSha256: z.string(),\n  originalSha256: z.string().min(1).optional(),\n  // PARTIAL map: one hash per PRODUCED variant (an asset produces only the variants its\n  // origin declares — e.g. full/medium/small for a profile picture, 'main' for others —\n  // never all four). Typed keys, never an open string. `z.partialRecord` (NOT `z.record`):\n  // in Zod 4 `z.record(enum,…)` is EXHAUSTIVE (demands every enum key), which would reject\n  // every real asset's partial variant set; `partialRecord` makes the keys optional.\n  variantSha256s: z.partialRecord(MediaVariantKeySchema, z.string().min(1)),\n  copyReason: MediaCopyReasonSchema,\n  createdFromOwnerType: MediaAssetOwnerTypeSchema.optional(), // never a bare string\n  createdFromOwnerId: z.string().min(1).optional(),\n  copyActorUid: z.string().min(1).optional(), // who triggered the copy (distinct from the original uploader)\n  currentOwnerType: MediaAssetOwnerTypeSchema, // mutable; the asset's present owner\n  currentOwnerId: z.string().min(1),\n}).strict();\nexport type MediaOriginLineageV1 = z.infer<typeof MediaOriginLineageV1Schema>;\n\nexport const MediaAssetVariantSchema = z.object({\n  contentType: z.string().min(1),\n  sizeBytes: z.number().int().nonnegative(),\n  width: z.number().int().positive().optional(),\n  height: z.number().int().positive().optional(),\n  durationSec: z.number().positive().optional(),\n}).strict();\nexport type MediaAssetVariant = z.infer<typeof MediaAssetVariantSchema>;\n\nexport const MediaRetentionPolicySchema = z.enum([\n  'standard', // staging original deleted ~24h after verified mirror\n  'preserveForTrustAndSafety',\n  'legalHold',\n]);\nexport type MediaRetentionPolicy = z.infer<typeof MediaRetentionPolicySchema>;\n\n// Realm shared-files: a work file's standing in its realm's shared pool.\n//   none     — not shared to the realm (default)\n//   nonCanon — shared to the realm's pool, non-canon\n//   canon    — shared and marked canon (realm steward/owner toggles canon ↔ nonCanon)\n// Moderation/takedown is NOT a value here — a hidden file is hidden via the shared\n// media path (`servingStatus: 'hidden'`), so the gallery filters on servingStatus.\nexport const RealmFileCanonStatusSchema = z.enum(['none', 'nonCanon', 'canon']);\nexport type RealmFileCanonStatus = z.infer<typeof RealmFileCanonStatusSchema>;\n\n// ===== Serving authority (Durable Object) + publication gating =====\n// See ttt-prod docs/design/media-assets-and-protected-serving.md (the design owner\n// for the Durable Object serving authority and publication gating).\n\n/** Whether the canonical serving record has been applied to the DO authority. */\nexport const MediaAuthoritySyncStateSchema = z.enum(['pending', 'applied', 'deadLetter']);\nexport type MediaAuthoritySyncState = z.infer<typeof MediaAuthoritySyncStateSchema>;\n\n/** Whether the asset is referenced by a visible owner doc. Orthogonal to the\n * upload's processing outcome (`pendingMedia.status`) and to `servingStatus`. */\nexport const MediaAssetPublicationStateSchema = z.enum(['unpublished', 'published', 'retired']);\nexport type MediaAssetPublicationState = z.infer<typeof MediaAssetPublicationStateSchema>;\n\n/**\n * Typed immutable serving scope for scoped-tier assets. The gateway Worker matches\n * a grant against the scope by `kind` — so a whole-Work `{w}` grant matches ONLY a\n * `workProject` scope, NEVER a `guildChannel` scope (even though both carry a\n * `workProjectId`): a restricted channel's attachment is not reachable by a plain\n * Work grant, and a chat grant is not reachable by a Work asset.\n *\n * - `workProject` — pre-publish content media (hall covers / sub-item media during\n *   authoring), scoped to project read membership. Carries the matchable\n *   `workProjectId`. This is the typed home for work scope on the strongly-consistent\n *   serving record so the DO-fallback path can authorize it (the DO persists scope\n *   only as `scopeJson`, no separate column).\n * - `workFileFolder` — a work-project FILE living in a folder. The EXACT folder scope,\n *   NOT the whole-Work `{w}` grant: a custom folder's bytes must be unreachable by a\n *   guildmate outside that folder's view trade-professions, so the grant callable runs\n *   the per-folder view check and the Worker EXACT-matches `{workProjectId,\n *   workFileFolderId}` — a plain Work `{w}` grant NEVER matches a folder file, and a\n *   folder grant NEVER matches a `workProject`-scoped content asset.\n * - `guildChannel` / `guildInvite` — guild-chat attachments; an EXACT channel/\n *   invite scope (Contract E \"Chat attachment authorization\"). A guildChannel's\n *   `workProjectId` lives ONLY inside this scope, never as a bare matchable field.\n *\n * `null` scope = no scope match required beyond the access tier (e.g. broad).\n */\nexport const MediaServingScopeSchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal('workProject'),\n    workProjectId: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal('workFileFolder'),\n    workProjectId: z.string().min(1),\n    workFileFolderId: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal('guildChannel'),\n    workProjectId: z.string().min(1),\n    guildChatChannelId: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal('guildInvite'),\n    guildInviteId: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal('adminSupport'),\n    adminDispatchId: z.string().min(1),\n  }).strict(),\n]);\nexport type MediaServingScope = z.infer<typeof MediaServingScopeSchema>;\n\n/**\n * The typed owner adapter a publication goes through. The activation job\n * carries this kind; a server-side registry validates per-kind `publicationArgs`\n * and performs the idempotent owner write. Chat is the non-Firestore-owner\n * adapter (publishes via its durable attachmentFlip ack, not an owner txn).\n */\nexport const MediaPublicationKindSchema = z.enum([\n  'profilePicture',\n  'squarePostMedia',\n  'workAsset',\n  'hallCover',\n  // Realm cover — Firestore-owner adapter writes `realmCoverAssetId` onto\n  // workRealms/{workRealmId} (the 'realm-cover' upload origin).\n  'realmCover',\n  'workContentMedia', // sub-item media (tale chapter / tune track / television episode) — attaches the *AssetId field on the workContent doc; scoped to the work project\n  'auditionMedia',\n  'commissionListingMedia',\n  'commissionProposalMedia',\n  'craftSkillMedia',\n  'chatAttachment',\n  // Admin-support thread attachment: Firestore-transported (no Durable Object), so its\n  // publication adapter does a Firestore owner write (flips the dispatch message placeholder),\n  // unlike DO-ack'd `chatAttachment`. Carries the typed `adminSupport` MediaServingScope.\n  'adminSupportAttachment',\n]);\nexport type MediaPublicationKind = z.infer<typeof MediaPublicationKindSchema>;\n\n/**\n * The normalized serving record — the SAME contract used to generate both\n * the DO authority row and the KV cache payload (one function, so they can't\n * drift). The R2 object key stays deterministic (`mediaAssets/{assetId}/{key}`)\n * and is NOT persisted here. `payloadHash` is computed over the canonical\n * payload EXCLUDING the hash itself (see edge-protocol-core `hashPayload`).\n */\nexport const MediaServingAuthorityRecordSchema = z.object({\n  schemaVersion: z.number().int().positive(),\n  assetId: z.string().min(1),\n  authorityVersion: z.number().int().nonnegative(),\n  operationId: z.string().min(1),\n  payloadHash: z.string().min(1),\n\n  servingStatus: MediaServingStatusSchema,\n  accessTier: MediaAccessTierSchema,\n\n  ownerType: MediaAssetOwnerTypeSchema,\n  ownerId: z.string().min(1),\n  scope: MediaServingScopeSchema.nullable(),\n\n  variants: z.record(z.string(), MediaAssetVariantSchema),\n\n  updatedAtMs: z.number(),\n}).strict();\nexport type MediaServingAuthorityRecord = z.infer<typeof MediaServingAuthorityRecordSchema>;\n\nexport const MediaAssetSchema = z.object({\n  mediaAssetId: z.string().min(1),\n  mediaKind: ContentMediaKindSchema,\n  fileOrigin: FileOriginSchema,\n\n  // Ownership / scope. ownerId is the owning doc's id within ownerType's\n  // surface; scope ids let the Worker/grant layer match scoped access.\n  ownerType: MediaAssetOwnerTypeSchema,\n  ownerId: z.string().min(1),\n  workProjectId: z.string().optional(),\n  realmId: z.string().optional(),\n  createdByUid: z.string().min(1),\n\n  // Access + serving (canonical; edge records derive from these).\n  accessTier: MediaAccessTierSchema,\n  servingStatus: MediaServingStatusSchema,\n\n  // Variants by key. The object key in R2 (and the Storage emulator) is\n  // deterministic — mediaAssets/{mediaAssetId}/{variantKey} — never stored.\n  variants: z.record(z.string(), MediaAssetVariantSchema),\n\n  // Lifecycle / trust-and-safety.\n  moderationStatus: z.enum(['approved', 'quarantined']),\n  retentionPolicy: MediaRetentionPolicySchema,\n  legalHold: z.boolean(),\n  originalDeletedAt: z.number().optional(),\n\n  // T&S provenance lineage (Appendix A0). Additive/optional so assets written\n  // before the lineage rollout still parse; set server-side at first accepted\n  // ingest, inherited unchanged by every copy/variant. Never client-supplied.\n  originLineage: MediaOriginLineageV1Schema.optional(),\n\n  // Realm shared-files seam. A file's standing in its realm's shared pool; set at\n  // creation to 'none' and moved by the realm shared-files callables. Attribution\n  // fields (who set canon, when) are added by that feature when it ships.\n  realmFileCanonStatus: RealmFileCanonStatusSchema,\n\n  // Serving authority + publication gating. Additive/optional so assets\n  // written before the authority build still parse: absent authorityVersion ⇒\n  // 0/never-applied, absent publicationState ⇒ 'unpublished'. Every\n  // serving-record mutation increments authorityVersion in an authoritative txn.\n  authorityVersion: z.number().int().nonnegative().optional(),\n  authorityPayloadHash: z.string().optional(),\n  authoritySyncState: MediaAuthoritySyncStateSchema.optional(),\n  publicationState: MediaAssetPublicationStateSchema.optional(),\n  scope: MediaServingScopeSchema.optional(),\n  authorityAppliedAt: z.number().optional(),\n  publishedAt: z.number().optional(),\n  lastAuthorityError: StructuredErrorSchema.optional(),\n  // Authority-sync retry ledger (M1): the scheduled worker bumps attemptCount + sets a backoff\n  // nextAttemptAt on a transient apply failure, and dead-letters (authoritySyncState='deadLetter')\n  // past a threshold. Absent ⇒ 0 attempts / immediately due.\n  authoritySyncAttemptCount: z.number().int().nonnegative().optional(),\n  authoritySyncNextAttemptAt: z.number().optional(),\n\n  createdAt: z.number(),\n  updatedAt: z.number(),\n}).strict();\nexport type MediaAsset = z.infer<typeof MediaAssetSchema>;\n"]}

package/dist/doc-schemas/messaging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/messaging.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;iBAwBjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAQtE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF,eAAO,MAAM,6BAA6B;;;;;;;;;;2BASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;EAAkC,CAAC;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAShE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB9B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"messaging.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/messaging.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;iBAwBjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAQtE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF,eAAO,MAAM,6BAA6B;;;;;;;;;;2BASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;EAAkC,CAAC;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAShE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB9B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/doc-schemas/messaging.js

@@ -22,7 +22,7 @@ export const GuildChatChannelSchema = z.object({
     lastMessage: z.string().optional(),
     messageCount: z.number(),
     isArchived: z.boolean(),
-    // Delete/tombstone marker (docs/design/chat-realtime-system.md "Channel lifecycle semantics").
+    // Delete/tombstone marker (ttt-prod docs/design/chat-realtime-system.md "Channel lifecycle semantics").
     // Independent of `isArchived`: archive = visible-under-a-toggle, delete = gone from every user's
     // UI with grants revoked and sends rejected DO-side; storage is RETAINED (never a physical purge).
     // Optional, absent ⇒ false, so existing/seeded channels need no backfill. Backend-only-writable.
@@ -57,7 +57,8 @@ export const GuildInviteConversationSchema = z.object({
     source: InviteSourceSchema,
     // State machine: pending → accepted (transient, trigger-consumed) → finalized (terminal
     // success), or pending → declined / cancelled (terminal failure). No 'error' state is ever
-    // written (dead state removed 2026-07-03; see CODE_CHANGE_list_invites_missing_finalized).
+    // written (dead state removed 2026-07-03). See ttt-prod
+    // docs/design/work-guild-membership-and-stake.md for the invite lifecycle.
     status: guildInviteConversationStatusSchema,
     createdAt: z.number(),
     updatedAt: z.number(),

package/dist/doc-schemas/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/doc-schemas/messaging.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,sFAAsF;AACtF,qFAAqF;AACrF,8BAA8B;AAE9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iFAAiF;IACjF,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,+FAA+F;IAC/F,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,oFAAoF;IACpF,8EAA8E;IAC9E,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,4FAA4F;AAC5F,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,iGAAiG;AACjG,+BAA+B;AAC/B,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,kFAAkF;IAClF,mFAAmF;IACnF,gFAAgF;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,SAAS,EAAE,aAAa;IACxB,MAAM,EAAE,aAAa;IACrB,SAAS,EAAE,aAAa;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,MAAM,EAAE,kBAAkB;IAC1B,wFAAwF;IACxF,2FAA2F;IAC3F,2FAA2F;IAC3F,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,iFAAiF;AACjF,oFAAoF;AACpF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACxE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3E,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,yEAAyE;QACzE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACvF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAG5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,2BAA2B;IAC3B,SAAS,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,yFAAyF;AACzF,2FAA2F;AAC3F,yFAAyF;AACzF,+EAA+E;AAC/E,qGAAqG;AACrG,qGAAqG;AACrG,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,oFAAoF;IACpF,iFAAiF;IACjF,6EAA6E;IAC7E,+CAA+C;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,gFAAgF;IAChF,mFAAmF;IACnF,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["// Messaging parent-thread Firestore document SCHEMAS — guildChatChannels, the\n// guildInviteConversations shell, and pendingAdminDispatches. Per-message body shapes\n// live in @ttt-productions/chat-core (ChatMessageV1); ttt-core owns the thread docs.\n// Types inferred via z.infer.\n\nimport { z } from 'zod';\nimport { ReplyToSchema, ChatAttachmentSchema } from '@ttt-productions/chat-schemas';\nimport { InviteSourceSchema } from '../schemas/work-project-management.js';\nimport { guildInviteConversationStatusSchema } from '../schemas/atoms.js';\n\nconst userRefSchema = z.object({ uid: z.string() });\n\nexport const GuildChatChannelSchema = z.object({\n  guildChatChannelId: z.string(),\n  workProjectId: z.string(),\n  channelName: z.string(),\n  description: z.string().optional(),\n  requiredGuildStandings: z.array(z.string()),\n  allowedUserIds: z.array(z.string()),\n  createdAt: z.number(),\n  // NOTE: createdBy here is a flat uid string (unlike the `{ uid }` object form on\n  // most other docs). Preserved as-is; flagged in the schema-registry recon.\n  createdBy: z.string(),\n  lastMessageAt: z.string().optional(),\n  lastMessage: z.string().optional(),\n  messageCount: z.number(),\n  isArchived: z.boolean(),\n  // Delete/tombstone marker (docs/design/chat-realtime-system.md \"Channel lifecycle semantics\").\n  // Independent of `isArchived`: archive = visible-under-a-toggle, delete = gone from every user's\n  // UI with grants revoked and sends rejected DO-side; storage is RETAINED (never a physical purge).\n  // Optional, absent ⇒ false, so existing/seeded channels need no backfill. Backend-only-writable.\n  isDeleted: z.boolean().optional(),\n  // Monotonic config version for the chat-realtime sync layer (Contract B). Bumped by\n  // each channel create / edit / archive / delete in the authoritative txn; the\n  // `config` chatSyncEvents + channel-scoped fanout key on it. Absent ⇒ 0.\n  configVersion: z.number().optional(),\n});\nexport type GuildChatChannel = z.infer<typeof GuildChatChannelSchema>;\n\n// The guildInviteConversations/{guildInviteId} doc as actually written by inviteUserToGuild\n// (and mutated by the accept/decline/finalize/cancel callables). This is the single source of\n// truth — the former duplicate `GuildInviteSchema` in ./work-project.ts was a stale, narrower\n// shape that the callable bypassed with an `as unknown as` cast. The inviter is `createdBy`\n// (== `sender`); there is no separate `workSteward`/`workProjectTitle` field (the title lives in\n// `workProject.workingTitle`).\nexport const GuildInviteConversationSchema = z.object({\n  guildInviteId: z.string(),\n  workProjectId: z.string(),\n  relatedUserIds: z.array(z.string()),\n  // Title/description are NOT snapshotted (Display Identity Invariant — resolve at render\n  // from publicWorkProjects by id). `type` (Tales/Tunes/Television) is an immutable\n  // classification, not display text, and IS consumed by an invites-list type filter\n  // (guild-invites-section.tsx), so it stays. Triggers read only `workProjectId`.\n  workProject: z.object({\n    workProjectId: z.string(),\n    type: z.string(),\n  }),\n  createdBy: userRefSchema,\n  sender: userRefSchema,\n  recipient: userRefSchema,\n  stakeSharesOffered: z.number(),\n  source: InviteSourceSchema,\n  // State machine: pending → accepted (transient, trigger-consumed) → finalized (terminal\n  // success), or pending → declined / cancelled (terminal failure). No 'error' state is ever\n  // written (dead state removed 2026-07-03; see CODE_CHANGE_list_invites_missing_finalized).\n  status: guildInviteConversationStatusSchema,\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  lastUpdatedAt: z.number(),\n  finalizedAt: z.number().optional(),\n  senderConfirmed: z.boolean(),\n  recipientConfirmed: z.boolean(),\n  lastMessage: z.string().optional(),\n  lastMessageAt: z.string().optional(),\n});\nexport type GuildInviteConversation = z.infer<typeof GuildInviteConversationSchema>;\n\n// Typed context ref carried by a dispatch thread born from a review send-back, a\n// moderation placeholder, or a published change request — lets the admin queue card\n// say what the thread is about without parsing the subject line. Extensible union;\n// server-validated against the thread's party (never trusted raw from the client).\nexport const AdminDispatchContextRefSchema = z.discriminatedUnion('kind', [\n  z.object({ kind: z.literal('thresholdItem'), thresholdItemId: z.string() }),\n  z.object({\n    kind: z.literal('hallContent'),\n    hallItemId: z.string(),\n    // null ⇒ the hall parent DETAIL; set ⇒ a chapter/track/episode sub-item.\n    subItemId: z.string().nullable(),\n  }),\n  z.object({ kind: z.literal('hallContentChangeRequest'), changeRequestId: z.string() }),\n]);\nexport type AdminDispatchContextRef = z.infer<typeof AdminDispatchContextRefSchema>;\n\nexport const AdminDispatchPartyKindSchema = z.enum(['user', 'workProject']);\nexport type AdminDispatchPartyKind = z.infer<typeof AdminDispatchPartyKindSchema>;\n\nexport const AdminDispatchSchema = z.object({\n  adminDispatchId: z.string(),\n  // Party-generic dispatch: the platform corresponds with a PARTY — a user or a\n  // workProject. Absent ⇒ 'user' (every pre-generalization thread). For 'user'\n  // threads `userId` is the thread owner (the sole member-side authority). For\n  // 'workProject' threads `workProjectId` is set, read/reply authority is ACTIVE\n  // GUILDMATE standing evaluated server-side (never a stored member list), and\n  // `userId` holds the INITIATING member's uid for attribution only — it is never\n  // a work-thread authority.\n  partyKind: AdminDispatchPartyKindSchema.optional(),\n  workProjectId: z.string().optional(),\n  contextRef: AdminDispatchContextRefSchema.optional(),\n  userId: z.string(),\n  initiatorUserId: z.string(),\n  initiatedBy: z.enum(['user', 'admin']),\n  subject: z.string(),\n  status: z.enum(['open', 'user_reply', 'admin_reply', 'closed_resolved', 'closed_unresolved']),\n  createdAt: z.number(),\n  lastUpdatedAt: z.number(),\n  readByAdmin: z.boolean(),\n  readByUser: z.boolean(),\n  closedBy: z.string().optional(),\n});\nexport type AdminDispatch = z.infer<typeof AdminDispatchSchema>;\n\n// Per-message body for admin-support `conversationMessages` — the ONE chat surface still\n// transported through Firestore (guild channel + invite messages are realtime-only, served\n// by the chat Worker Durable Object). Written by runSendGuildChatMessage (senderId/text/\n// createdAt + optional replyTo/attachment); the admin-dispatch INITIAL message\n// (runStartAdminSupportThread) additionally stores `messageId`. This is the STORED shape — a relaxed\n// @ttt-productions/chat-core ChatMessageV1: `messageId` is the doc id (only sometimes persisted) and\n// `threadId` is not stored. Reuses the chat-schemas Zod shapes for attachment + replyTo.\nexport const ChatMessageV1Schema = z.object({\n  senderId: z.string(),\n  text: z.string(),\n  createdAt: z.number(),\n  messageId: z.string().optional(),\n  threadId: z.string().optional(),\n  type: z.string().optional(),\n  // Rides on the realtime invite-thread envelope (chat Worker invite Durable Object);\n  // guild-invite messages are realtime-only — there is no Firestore inviteMessages\n  // subcollection. Optional so the same body schema still fits the guildChat /\n  // admin-dispatch messages that don't carry it.\n  guildInviteId: z.string().optional(),\n  attachment: ChatAttachmentSchema.optional(),\n  replyTo: ReplyToSchema.optional(),\n  isSystemMessage: z.boolean().optional(),\n  meta: z.record(z.string(), z.unknown()).optional(),\n  // Moderation tombstone flag — the single-doc `hidden` flip written by the admin\n  // moderateReportedContent pipeline (the admin-work-message itemType). Backend-only\n  // writable (conversationMessages is callable-only in rules); absent ⇒ visible.\n  // Thread views render a hidden message as a moderation tombstone.\n  hidden: z.boolean().optional(),\n});\nexport type ChatMessageV1Doc = z.infer<typeof ChatMessageV1Schema>;\n"]}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/doc-schemas/messaging.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,sFAAsF;AACtF,qFAAqF;AACrF,8BAA8B;AAE9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iFAAiF;IACjF,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,wGAAwG;IACxG,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,oFAAoF;IACpF,8EAA8E;IAC9E,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,4FAA4F;AAC5F,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,iGAAiG;AACjG,+BAA+B;AAC/B,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,kFAAkF;IAClF,mFAAmF;IACnF,gFAAgF;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,SAAS,EAAE,aAAa;IACxB,MAAM,EAAE,aAAa;IACrB,SAAS,EAAE,aAAa;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,MAAM,EAAE,kBAAkB;IAC1B,wFAAwF;IACxF,2FAA2F;IAC3F,wDAAwD;IACxD,2EAA2E;IAC3E,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,iFAAiF;AACjF,oFAAoF;AACpF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACxE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3E,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,yEAAyE;QACzE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACvF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAG5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,2BAA2B;IAC3B,SAAS,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,yFAAyF;AACzF,2FAA2F;AAC3F,yFAAyF;AACzF,+EAA+E;AAC/E,qGAAqG;AACrG,qGAAqG;AACrG,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,oFAAoF;IACpF,iFAAiF;IACjF,6EAA6E;IAC7E,+CAA+C;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,gFAAgF;IAChF,mFAAmF;IACnF,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["// Messaging parent-thread Firestore document SCHEMAS — guildChatChannels, the\n// guildInviteConversations shell, and pendingAdminDispatches. Per-message body shapes\n// live in @ttt-productions/chat-core (ChatMessageV1); ttt-core owns the thread docs.\n// Types inferred via z.infer.\n\nimport { z } from 'zod';\nimport { ReplyToSchema, ChatAttachmentSchema } from '@ttt-productions/chat-schemas';\nimport { InviteSourceSchema } from '../schemas/work-project-management.js';\nimport { guildInviteConversationStatusSchema } from '../schemas/atoms.js';\n\nconst userRefSchema = z.object({ uid: z.string() });\n\nexport const GuildChatChannelSchema = z.object({\n  guildChatChannelId: z.string(),\n  workProjectId: z.string(),\n  channelName: z.string(),\n  description: z.string().optional(),\n  requiredGuildStandings: z.array(z.string()),\n  allowedUserIds: z.array(z.string()),\n  createdAt: z.number(),\n  // NOTE: createdBy here is a flat uid string (unlike the `{ uid }` object form on\n  // most other docs). Preserved as-is; flagged in the schema-registry recon.\n  createdBy: z.string(),\n  lastMessageAt: z.string().optional(),\n  lastMessage: z.string().optional(),\n  messageCount: z.number(),\n  isArchived: z.boolean(),\n  // Delete/tombstone marker (ttt-prod docs/design/chat-realtime-system.md \"Channel lifecycle semantics\").\n  // Independent of `isArchived`: archive = visible-under-a-toggle, delete = gone from every user's\n  // UI with grants revoked and sends rejected DO-side; storage is RETAINED (never a physical purge).\n  // Optional, absent ⇒ false, so existing/seeded channels need no backfill. Backend-only-writable.\n  isDeleted: z.boolean().optional(),\n  // Monotonic config version for the chat-realtime sync layer (Contract B). Bumped by\n  // each channel create / edit / archive / delete in the authoritative txn; the\n  // `config` chatSyncEvents + channel-scoped fanout key on it. Absent ⇒ 0.\n  configVersion: z.number().optional(),\n});\nexport type GuildChatChannel = z.infer<typeof GuildChatChannelSchema>;\n\n// The guildInviteConversations/{guildInviteId} doc as actually written by inviteUserToGuild\n// (and mutated by the accept/decline/finalize/cancel callables). This is the single source of\n// truth — the former duplicate `GuildInviteSchema` in ./work-project.ts was a stale, narrower\n// shape that the callable bypassed with an `as unknown as` cast. The inviter is `createdBy`\n// (== `sender`); there is no separate `workSteward`/`workProjectTitle` field (the title lives in\n// `workProject.workingTitle`).\nexport const GuildInviteConversationSchema = z.object({\n  guildInviteId: z.string(),\n  workProjectId: z.string(),\n  relatedUserIds: z.array(z.string()),\n  // Title/description are NOT snapshotted (Display Identity Invariant — resolve at render\n  // from publicWorkProjects by id). `type` (Tales/Tunes/Television) is an immutable\n  // classification, not display text, and IS consumed by an invites-list type filter\n  // (guild-invites-section.tsx), so it stays. Triggers read only `workProjectId`.\n  workProject: z.object({\n    workProjectId: z.string(),\n    type: z.string(),\n  }),\n  createdBy: userRefSchema,\n  sender: userRefSchema,\n  recipient: userRefSchema,\n  stakeSharesOffered: z.number(),\n  source: InviteSourceSchema,\n  // State machine: pending → accepted (transient, trigger-consumed) → finalized (terminal\n  // success), or pending → declined / cancelled (terminal failure). No 'error' state is ever\n  // written (dead state removed 2026-07-03). See ttt-prod\n  // docs/design/work-guild-membership-and-stake.md for the invite lifecycle.\n  status: guildInviteConversationStatusSchema,\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  lastUpdatedAt: z.number(),\n  finalizedAt: z.number().optional(),\n  senderConfirmed: z.boolean(),\n  recipientConfirmed: z.boolean(),\n  lastMessage: z.string().optional(),\n  lastMessageAt: z.string().optional(),\n});\nexport type GuildInviteConversation = z.infer<typeof GuildInviteConversationSchema>;\n\n// Typed context ref carried by a dispatch thread born from a review send-back, a\n// moderation placeholder, or a published change request — lets the admin queue card\n// say what the thread is about without parsing the subject line. Extensible union;\n// server-validated against the thread's party (never trusted raw from the client).\nexport const AdminDispatchContextRefSchema = z.discriminatedUnion('kind', [\n  z.object({ kind: z.literal('thresholdItem'), thresholdItemId: z.string() }),\n  z.object({\n    kind: z.literal('hallContent'),\n    hallItemId: z.string(),\n    // null ⇒ the hall parent DETAIL; set ⇒ a chapter/track/episode sub-item.\n    subItemId: z.string().nullable(),\n  }),\n  z.object({ kind: z.literal('hallContentChangeRequest'), changeRequestId: z.string() }),\n]);\nexport type AdminDispatchContextRef = z.infer<typeof AdminDispatchContextRefSchema>;\n\nexport const AdminDispatchPartyKindSchema = z.enum(['user', 'workProject']);\nexport type AdminDispatchPartyKind = z.infer<typeof AdminDispatchPartyKindSchema>;\n\nexport const AdminDispatchSchema = z.object({\n  adminDispatchId: z.string(),\n  // Party-generic dispatch: the platform corresponds with a PARTY — a user or a\n  // workProject. Absent ⇒ 'user' (every pre-generalization thread). For 'user'\n  // threads `userId` is the thread owner (the sole member-side authority). For\n  // 'workProject' threads `workProjectId` is set, read/reply authority is ACTIVE\n  // GUILDMATE standing evaluated server-side (never a stored member list), and\n  // `userId` holds the INITIATING member's uid for attribution only — it is never\n  // a work-thread authority.\n  partyKind: AdminDispatchPartyKindSchema.optional(),\n  workProjectId: z.string().optional(),\n  contextRef: AdminDispatchContextRefSchema.optional(),\n  userId: z.string(),\n  initiatorUserId: z.string(),\n  initiatedBy: z.enum(['user', 'admin']),\n  subject: z.string(),\n  status: z.enum(['open', 'user_reply', 'admin_reply', 'closed_resolved', 'closed_unresolved']),\n  createdAt: z.number(),\n  lastUpdatedAt: z.number(),\n  readByAdmin: z.boolean(),\n  readByUser: z.boolean(),\n  closedBy: z.string().optional(),\n});\nexport type AdminDispatch = z.infer<typeof AdminDispatchSchema>;\n\n// Per-message body for admin-support `conversationMessages` — the ONE chat surface still\n// transported through Firestore (guild channel + invite messages are realtime-only, served\n// by the chat Worker Durable Object). Written by runSendGuildChatMessage (senderId/text/\n// createdAt + optional replyTo/attachment); the admin-dispatch INITIAL message\n// (runStartAdminSupportThread) additionally stores `messageId`. This is the STORED shape — a relaxed\n// @ttt-productions/chat-core ChatMessageV1: `messageId` is the doc id (only sometimes persisted) and\n// `threadId` is not stored. Reuses the chat-schemas Zod shapes for attachment + replyTo.\nexport const ChatMessageV1Schema = z.object({\n  senderId: z.string(),\n  text: z.string(),\n  createdAt: z.number(),\n  messageId: z.string().optional(),\n  threadId: z.string().optional(),\n  type: z.string().optional(),\n  // Rides on the realtime invite-thread envelope (chat Worker invite Durable Object);\n  // guild-invite messages are realtime-only — there is no Firestore inviteMessages\n  // subcollection. Optional so the same body schema still fits the guildChat /\n  // admin-dispatch messages that don't carry it.\n  guildInviteId: z.string().optional(),\n  attachment: ChatAttachmentSchema.optional(),\n  replyTo: ReplyToSchema.optional(),\n  isSystemMessage: z.boolean().optional(),\n  meta: z.record(z.string(), z.unknown()).optional(),\n  // Moderation tombstone flag — the single-doc `hidden` flip written by the admin\n  // moderateReportedContent pipeline (the admin-work-message itemType). Backend-only\n  // writable (conversationMessages is callable-only in rules); absent ⇒ visible.\n  // Thread views render a hidden message as a moderation tombstone.\n  hidden: z.boolean().optional(),\n});\nexport type ChatMessageV1Doc = z.infer<typeof ChatMessageV1Schema>;\n"]}

package/dist/doc-schemas/ncii/allegations.js

@@ -6,9 +6,9 @@
 // statutory `takeItDownRequest`. The discriminated locator is the ONE typed
 // locator (TargetLocatorV1) — never an all-optional contentRef.
 //
-// Every shape here is transcribed verbatim from docs/code_changes_needed/
-// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 (1) — no invented
-// values, no placeholders.
+// Every shape here is transcribed verbatim from the frozen Trust & Safety spec
+// (Appendix A §A11 (1)) — no invented values, no placeholders; the durable design
+// owner is ttt-prod docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.
 //
 // SHARED enums + the locator come from ../safety/foundation.js (the single source
 // for every cross-cluster enum); they are NEVER redefined here. This cluster

package/dist/doc-schemas/ncii/allegations.js.map

@@ -1 +1 @@
-{"version":3,"file":"allegations.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/allegations.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,8EAA8E;AAC9E,4EAA4E;AAC5E,gEAAgE;AAChE,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,iCAAiC;AACjC,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,4EAA4E;AAC5E,kCAAkC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEnE,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;4FAG4F;AAC5F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAG7G;8EAC8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAGnG;;oDAEoD;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,gCAAgC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,uFAAuF;IACvF,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,8DAA8D;IAC5F,MAAM,EAAE,0BAA0B;IAClC,4FAA4F;IAC5F,0FAA0F;IAC1F,8FAA8F;IAC9F,gGAAgG;IAChG,6DAA6D;IAC7D,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — NCII allegations (Appendix A §A11, concept (1)).\n//\n// `nciiAllegations/{allegationId}` — ANY user (authenticated or anonymous public)\n// may allege NCII. An allegation may justify platform-policy hiding but does NOT\n// by itself satisfy the statute or arm the 48h clock; it NEVER auto-becomes a\n// statutory `takeItDownRequest`. The discriminated locator is the ONE typed\n// locator (TargetLocatorV1) — never an all-optional contentRef.\n//\n// Every shape here is transcribed verbatim from docs/code_changes_needed/\n// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 (1) — no invented\n// values, no placeholders.\n//\n// SHARED enums + the locator come from ../safety/foundation.js (the single source\n// for every cross-cluster enum); they are NEVER redefined here. This cluster\n// IMPORTS TargetLocatorV1Schema.\n//\n// Collection note: this cluster introduces a NEW Firestore collection; wiring\n// collections.ts / path-builders.ts / registry.ts is deferred to the app leg (the\n// orchestrator binds the schema + path builders there); the doc-id shape is\n// documented on the schema below.\n\nimport { z } from 'zod';\nimport { TargetLocatorV1Schema } from '../safety/foundation.js';\nimport { ResolvedReportTargetV1Schema } from '../safety/report.js';\n\n// ===========================================================================\n// §A11 (1) — nciiAllegations/{allegationId}\n// ===========================================================================\n\n/** Who alleged: an authenticated user, an anonymous member of the public, or an `operator` — an\n *  admin who found existing on-platform content and marked it as NCII-linked evidence (the\n *  admin-only \"NCII linked evidence\" report option). Operator allegations are the unlinked\n *  evidence POOL (status `received`, no `caseId`) until an operator links one to a case. */\nexport const NciiAllegationReporterTypeSchema = z.enum(['authenticatedUser', 'anonymousPublic', 'operator']);\nexport type NciiAllegationReporterType = z.infer<typeof NciiAllegationReporterTypeSchema>;\n\n/** Allegation lifecycle status — `received` until triaged into one of the\n * terminal/linked states. An allegation NEVER becomes a statutory request. */\nexport const NciiAllegationStatusSchema = z.enum(['received', 'linked', 'dismissed', 'escalated']);\nexport type NciiAllegationStatus = z.infer<typeof NciiAllegationStatusSchema>;\n\n/** `nciiAllegations/{allegationId}` — any user may allege; does NOT by itself\n * satisfy the statute or arm the 48h clock. Doc id `allegationId` is a\n * deterministic/assigned id (z.string().min(1)). */\nexport const NciiAllegationV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  allegationId: z.string().min(1),\n  caseId: z.string().min(1).optional(),\n  reporterType: NciiAllegationReporterTypeSchema,\n  submittedAt: z.number(),\n  // the discriminated locator (the ONE typed locator) — never an all-optional contentRef\n  targetLocator: TargetLocatorV1Schema,\n  allegationReason: z.string(), // free-text reason; NEVER substitutes for a statutory request\n  status: NciiAllegationStatusSchema,\n  // For an OPERATOR-marked evidence allegation (reporterType 'operator'): the server-resolved\n  // target captured at mark time (owner / canonical parent+item / revision). Carried so the\n  // link-to-case step can arm the `nciiTemporary` preservation hold and pre-fill the ban target\n  // WITHOUT re-resolving (a TargetLocatorV1 kind does not map cleanly back to a report itemType).\n  // Absent on authenticatedUser / anonymousPublic allegations.\n  resolvedTarget: ResolvedReportTargetV1Schema.optional(),\n}).strict();\nexport type NciiAllegationV1 = z.infer<typeof NciiAllegationV1Schema>;\n"]}
+{"version":3,"file":"allegations.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/allegations.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,8EAA8E;AAC9E,4EAA4E;AAC5E,gEAAgE;AAChE,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,oFAAoF;AACpF,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,iCAAiC;AACjC,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,4EAA4E;AAC5E,kCAAkC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEnE,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;4FAG4F;AAC5F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAG7G;8EAC8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAGnG;;oDAEoD;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,gCAAgC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,uFAAuF;IACvF,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,8DAA8D;IAC5F,MAAM,EAAE,0BAA0B;IAClC,4FAA4F;IAC5F,0FAA0F;IAC1F,8FAA8F;IAC9F,gGAAgG;IAChG,6DAA6D;IAC7D,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — NCII allegations (Appendix A §A11, concept (1)).\n//\n// `nciiAllegations/{allegationId}` — ANY user (authenticated or anonymous public)\n// may allege NCII. An allegation may justify platform-policy hiding but does NOT\n// by itself satisfy the statute or arm the 48h clock; it NEVER auto-becomes a\n// statutory `takeItDownRequest`. The discriminated locator is the ONE typed\n// locator (TargetLocatorV1) — never an all-optional contentRef.\n//\n// Every shape here is transcribed verbatim from the frozen Trust & Safety spec\n// (Appendix A §A11 (1)) — no invented values, no placeholders; the durable design\n// owner is ttt-prod docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.\n//\n// SHARED enums + the locator come from ../safety/foundation.js (the single source\n// for every cross-cluster enum); they are NEVER redefined here. This cluster\n// IMPORTS TargetLocatorV1Schema.\n//\n// Collection note: this cluster introduces a NEW Firestore collection; wiring\n// collections.ts / path-builders.ts / registry.ts is deferred to the app leg (the\n// orchestrator binds the schema + path builders there); the doc-id shape is\n// documented on the schema below.\n\nimport { z } from 'zod';\nimport { TargetLocatorV1Schema } from '../safety/foundation.js';\nimport { ResolvedReportTargetV1Schema } from '../safety/report.js';\n\n// ===========================================================================\n// §A11 (1) — nciiAllegations/{allegationId}\n// ===========================================================================\n\n/** Who alleged: an authenticated user, an anonymous member of the public, or an `operator` — an\n *  admin who found existing on-platform content and marked it as NCII-linked evidence (the\n *  admin-only \"NCII linked evidence\" report option). Operator allegations are the unlinked\n *  evidence POOL (status `received`, no `caseId`) until an operator links one to a case. */\nexport const NciiAllegationReporterTypeSchema = z.enum(['authenticatedUser', 'anonymousPublic', 'operator']);\nexport type NciiAllegationReporterType = z.infer<typeof NciiAllegationReporterTypeSchema>;\n\n/** Allegation lifecycle status — `received` until triaged into one of the\n * terminal/linked states. An allegation NEVER becomes a statutory request. */\nexport const NciiAllegationStatusSchema = z.enum(['received', 'linked', 'dismissed', 'escalated']);\nexport type NciiAllegationStatus = z.infer<typeof NciiAllegationStatusSchema>;\n\n/** `nciiAllegations/{allegationId}` — any user may allege; does NOT by itself\n * satisfy the statute or arm the 48h clock. Doc id `allegationId` is a\n * deterministic/assigned id (z.string().min(1)). */\nexport const NciiAllegationV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  allegationId: z.string().min(1),\n  caseId: z.string().min(1).optional(),\n  reporterType: NciiAllegationReporterTypeSchema,\n  submittedAt: z.number(),\n  // the discriminated locator (the ONE typed locator) — never an all-optional contentRef\n  targetLocator: TargetLocatorV1Schema,\n  allegationReason: z.string(), // free-text reason; NEVER substitutes for a statutory request\n  status: NciiAllegationStatusSchema,\n  // For an OPERATOR-marked evidence allegation (reporterType 'operator'): the server-resolved\n  // target captured at mark time (owner / canonical parent+item / revision). Carried so the\n  // link-to-case step can arm the `nciiTemporary` preservation hold and pre-fill the ban target\n  // WITHOUT re-resolving (a TargetLocatorV1 kind does not map cleanly back to a report itemType).\n  // Absent on authenticatedUser / anonymousPublic allegations.\n  resolvedTarget: ResolvedReportTargetV1Schema.optional(),\n}).strict();\nexport type NciiAllegationV1 = z.infer<typeof NciiAllegationV1Schema>;\n"]}

package/dist/doc-schemas/ncii/cases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cases.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/cases.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,oDAAoD;AACpD,eAAO,MAAM,kBAAkB;;;EAA+B,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;gCAKgC;AAChC,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6BlB,CAAC;AACZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D;6CAC6C;AAC7C,eAAO,MAAM,8BAA8B;;;;;kBAQhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;0CAC0C;AAC1C,eAAO,MAAM,2BAA2B;;;;kBAI7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,uDAAuD;AACvD,eAAO,MAAM,iCAAiC;;;;EAAuD,CAAC;AACtG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;oCACoC;AACpC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;kBAQ/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAOpF;mCACmC;AACnC,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;YAEY;AACZ,eAAO,MAAM,2BAA2B;;;EAAiC,CAAC;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;mBACmB;AACnB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;kBAWzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"cases.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/cases.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,oDAAoD;AACpD,eAAO,MAAM,kBAAkB;;;EAA+B,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;gCAKgC;AAChC,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6BlB,CAAC;AACZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D;6CAC6C;AAC7C,eAAO,MAAM,8BAA8B;;;;;kBAQhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;0CAC0C;AAC1C,eAAO,MAAM,2BAA2B;;;;kBAI7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,uDAAuD;AACvD,eAAO,MAAM,iCAAiC;;;;EAAuD,CAAC;AACtG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;oCACoC;AACpC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;kBAQ/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAOpF;mCACmC;AACnC,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;YAEY;AACZ,eAAO,MAAM,2BAA2B;;;EAAiC,CAAC;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;mBACmB;AACnB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;kBAWzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/doc-schemas/ncii/cases.js

@@ -9,9 +9,10 @@
 // linkage can never close/pause/replace/delete the NCII request or its 48h
 // deadline.
 //
-// Every shape here is transcribed verbatim from docs/code_changes_needed/
-// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 (3) + [F8] — no invented
-// values, no placeholders.
+// Every shape here is transcribed verbatim from the frozen Trust & Safety spec
+// (Appendix A §A11 (3) + [F8]) — no invented values, no placeholders; the durable
+// design owner is ttt-prod
+// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.
 //
 // SHARED enums come from ../safety/foundation.js (the single source for every
 // cross-cluster enum); they are NEVER redefined here. This cluster IMPORTS

package/dist/doc-schemas/ncii/cases.js.map

@@ -1 +1 @@
-{"version":3,"file":"cases.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/cases.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,YAAY;AACZ,EAAE;AACF,0EAA0E;AAC1E,mFAAmF;AACnF,2BAA2B;AAC3B,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,iEAAiE;AACjE,kCAAkC;AAClC,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,qFAAqF;AACrF,yDAAyD;AAEzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAG/D;;;;;gCAKgC;AAChC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,kBAAkB;IACxB,wCAAwC;IACxC,cAAc,EAAE,wBAAwB;IACxC,mCAAmC;IACnC,qBAAqB,EAAE,+BAA+B;IACtD,+FAA+F;IAC/F,SAAS,EAAE,8BAA8B;IACzC,oGAAoG;IACpG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,+FAA+F;IAC/F,qDAAqD;IACrD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,gGAAgG;IAChG,iGAAiG;IACjG,kEAAkE;IAClE,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC7C,qFAAqF;IACrF,oGAAoG;IACpG,sGAAsG;IACtG,6FAA6F;IAC7F,uBAAuB;IACvB,kBAAkB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;6CAC6C;AAC7C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,gGAAgG;IAChG,iGAAiG;IACjG,yFAAyF;IACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;0CAC0C;AAC1C,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,uDAAuD;AACvD,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;AAGtG;oCACoC;AACpC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AACjE,8EAA8E;AAE9E;mCACmC;AACnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,oBAAoB;CACrB,CAAC,CAAC;AAGH;;YAEY;AACZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAG1E;mBACmB;AACnB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,2BAA2B;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — NCII operational case (Appendix A §A11, concept (3)) + the\n// multi-hash block ([F8]).\n//\n// `nciiCases/{caseId}` — the internal operational record linking allegations +\n// requests; minimize-retention (NOT NCMEC, NOT 1-yr). It uses bounded CHILD-LINK\n// ROWS, never unbounded root arrays. Locked invariant [H7]: an NCII case NEVER\n// \"reclassifies to CSAM\" — a linked child-safety case independently owns\n// preservation / CyberTipline / child-safety account actions; child-safety\n// linkage can never close/pause/replace/delete the NCII request or its 48h\n// deadline.\n//\n// Every shape here is transcribed verbatim from docs/code_changes_needed/\n// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 (3) + [F8] — no invented\n// values, no placeholders.\n//\n// SHARED enums come from ../safety/foundation.js (the single source for every\n// cross-cluster enum); they are NEVER redefined here. This cluster IMPORTS\n// NciiInternalStatusSchema, NciiChildSafetyLinkStatusSchema, and\n// NciiChildSafetyCrossoverSchema.\n//\n// Collection note: this cluster introduces a NEW Firestore collection plus child\n// subcollections (allegationLinks / requestLinks / removalActions / blockedHashes).\n// Wiring collections.ts / path-builders.ts / registry.ts is deferred to the app leg;\n// the doc-id shapes are documented on each schema below.\n\nimport { z } from 'zod';\nimport {\n  NciiInternalStatusSchema,\n  NciiChildSafetyLinkStatusSchema,\n  NciiChildSafetyCrossoverSchema,\n  SafetyCaseClosureV1Schema,\n  TargetLocatorV1Schema,\n} from '../safety/foundation.js';\n\n// ===========================================================================\n// §A11 (3) — nciiCases/{caseId}\n// ===========================================================================\n\n/** Case lane — adult NCII vs likeness/depiction. */\nexport const NciiCaseLaneSchema = z.enum(['ncii', 'likeness']);\nexport type NciiCaseLane = z.infer<typeof NciiCaseLaneSchema>;\n\n/** `nciiCases/{caseId}` — the operational record; minimize-retention; child-link\n * rows, never unbounded root arrays. Doc id `caseId` is a deterministic/assigned\n * id (z.string().min(1)). NO case-level `fileDeleteAfter` [M3]: a single\n * case-level timestamp could wrongly override a LATER-linked request, so each\n * evidence row owns its own `deleteAfter` and each request owns its own\n * PII/status/token schedule. */\nexport const NciiCaseV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string().min(1),\n  revision: z.number(),\n  lane: NciiCaseLaneSchema,\n  // [H7] internal operational case status\n  internalStatus: NciiInternalStatusSchema,\n  // [H7] child-safety linkage status\n  childSafetyLinkStatus: NciiChildSafetyLinkStatusSchema,\n  // [F4] the possible-minor assessment; childSafetyCaseId lives HERE ([H7], one canonical place)\n  crossover: NciiChildSafetyCrossoverSchema,\n  // OPTIONAL labeled repairable PROJECTION of crossover.childSafetyCaseId — never the source of truth\n  childSafetyCaseId: z.string().min(1).optional(),\n  // NON-AUTHORITATIVE projection of the minimum active request monitor ([H4]); source of truth =\n  // safetySlaMonitors/{requestId}__nciiRemovalDeadline\n  nciiRemovalDeadlineAt: z.number().optional(),\n  // [EUAS-008] the structured operator closure record, set when the case is closed via the guided\n  // resolution flow. The terminal `internalStatus: 'closed'` flip is the lifecycle status; THIS is\n  // who closed it, why, and with what outcome. Absent until closed.\n  closure: SafetyCaseClosureV1Schema.optional(),\n  // [F-014] Protected chat-report context recovery — parity with the child-safety case\n  // (doc-schemas/safety/case.ts). When an NCII case opens from a chat report while the chat Worker is\n  // unavailable, the immutable channel/message locator is preserved here and `contextResolutionPending`\n  // flags that surrounding context still needs an operator re-fetch. Both optional; absent for\n  // non-chat NCII cases.\n  chatMessageLocator: TargetLocatorV1Schema.optional(),\n  contextResolutionPending: z.boolean().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n}).strict();\nexport type NciiCaseV1 = z.infer<typeof NciiCaseV1Schema>;\n\n// ===========================================================================\n// §A11 (3) — child-link rows (bounded; NEVER root arrays)\n// ===========================================================================\n\n/** `nciiCases/{caseId}/allegationLinks/{allegationId}` — links an allegation to\n * the case. Doc id is the `allegationId`. */\nexport const NciiCaseAllegationLinkV1Schema = z.object({\n  allegationId: z.string().min(1),\n  linkedAt: z.number(),\n  linkedByUid: z.string().min(1),\n  // [EUAS-016/R4] The originating in-app report id, so a case close can flip the protected report\n  // root(s) terminal (the child-safety path resolves this via sourceSignals; NCII via this field).\n  // Optional for backward compat — a link written before this field simply yields no flip.\n  reportId: z.string().min(1).optional(),\n}).strict();\nexport type NciiCaseAllegationLinkV1 = z.infer<typeof NciiCaseAllegationLinkV1Schema>;\n\n/** `nciiCases/{caseId}/requestLinks/{requestId}` — links a statutory request to\n * the case. Doc id is the `requestId`. */\nexport const NciiCaseRequestLinkV1Schema = z.object({\n  requestId: z.string().min(1),\n  linkedAt: z.number(),\n  linkedByUid: z.string().min(1),\n}).strict();\nexport type NciiCaseRequestLinkV1 = z.infer<typeof NciiCaseRequestLinkV1Schema>;\n\n/** Removal-action method on a `removalActions` row. */\nexport const NciiCaseRemovalActionMethodSchema = z.enum(['tombstone', 'accountAction', 'assetBlock']);\nexport type NciiCaseRemovalActionMethod = z.infer<typeof NciiCaseRemovalActionMethodSchema>;\n\n/** `nciiCases/{caseId}/removalActions/{actionId}` — append-only removal-action\n * row. Doc id is the `actionId`. */\nexport const NciiCaseRemovalActionV1Schema = z.object({\n  at: z.number(),\n  actorId: z.string().min(1),\n  surface: z.string(),\n  targetItemType: z.string(),\n  targetItemId: z.string().min(1),\n  method: NciiCaseRemovalActionMethodSchema,\n  result: z.string(),\n}).strict();\nexport type NciiCaseRemovalActionV1 = z.infer<typeof NciiCaseRemovalActionV1Schema>;\n\n// ===========================================================================\n// §A11 (4) [F8] — nciiCases/{caseId}/blockedHashes/{hashId} (multi-hash block;\n// exact-hash blocks only; replaces the singular `reUploadBlock`)\n// ===========================================================================\n\n/** Provenance of a blocked exact hash. Transformed / non-identical content is\n * NEVER auto-claimed identical. */\nexport const NciiBlockedHashSourceSchema = z.enum([\n  'requestEvidence',\n  'platformOriginal',\n  'platformCopy',\n  'knownIdenticalCopy',\n]);\nexport type NciiBlockedHashSource = z.infer<typeof NciiBlockedHashSourceSchema>;\n\n/** Blocked-hash lifecycle. Reversal is restricted + audited; adult NCII hashes do\n * NOT enter the CSAM hash system unless child-safety criteria independently\n * apply. */\nexport const NciiBlockedHashStatusSchema = z.enum(['active', 'reversed']);\nexport type NciiBlockedHashStatus = z.infer<typeof NciiBlockedHashStatusSchema>;\n\n/** `nciiCases/{caseId}/blockedHashes/{hashId}` [F8] — exact-hash block. Doc id is\n * the `hashId`. */\nexport const NciiBlockedHashV1Schema = z.object({\n  hashId: z.string().min(1),\n  algorithm: z.literal('sha256'),\n  digest: z.string().min(1),\n  source: NciiBlockedHashSourceSchema,\n  createdAt: z.number(),\n  createdByUid: z.string().min(1),\n  status: NciiBlockedHashStatusSchema,\n  reversedAt: z.number().optional(),\n  reversedByUid: z.string().min(1).optional(),\n  reversalReason: z.string().optional(),\n}).strict();\nexport type NciiBlockedHashV1 = z.infer<typeof NciiBlockedHashV1Schema>;\n"]}
+{"version":3,"file":"cases.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/cases.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,YAAY;AACZ,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,2BAA2B;AAC3B,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,iEAAiE;AACjE,kCAAkC;AAClC,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,qFAAqF;AACrF,yDAAyD;AAEzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAG/D;;;;;gCAKgC;AAChC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,kBAAkB;IACxB,wCAAwC;IACxC,cAAc,EAAE,wBAAwB;IACxC,mCAAmC;IACnC,qBAAqB,EAAE,+BAA+B;IACtD,+FAA+F;IAC/F,SAAS,EAAE,8BAA8B;IACzC,oGAAoG;IACpG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,+FAA+F;IAC/F,qDAAqD;IACrD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,gGAAgG;IAChG,iGAAiG;IACjG,kEAAkE;IAClE,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC7C,qFAAqF;IACrF,oGAAoG;IACpG,sGAAsG;IACtG,6FAA6F;IAC7F,uBAAuB;IACvB,kBAAkB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;6CAC6C;AAC7C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,gGAAgG;IAChG,iGAAiG;IACjG,yFAAyF;IACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;0CAC0C;AAC1C,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,uDAAuD;AACvD,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;AAGtG;oCACoC;AACpC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AACjE,8EAA8E;AAE9E;mCACmC;AACnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,oBAAoB;CACrB,CAAC,CAAC;AAGH;;YAEY;AACZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAG1E;mBACmB;AACnB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,2BAA2B;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — NCII operational case (Appendix A §A11, concept (3)) + the\n// multi-hash block ([F8]).\n//\n// `nciiCases/{caseId}` — the internal operational record linking allegations +\n// requests; minimize-retention (NOT NCMEC, NOT 1-yr). It uses bounded CHILD-LINK\n// ROWS, never unbounded root arrays. Locked invariant [H7]: an NCII case NEVER\n// \"reclassifies to CSAM\" — a linked child-safety case independently owns\n// preservation / CyberTipline / child-safety account actions; child-safety\n// linkage can never close/pause/replace/delete the NCII request or its 48h\n// deadline.\n//\n// Every shape here is transcribed verbatim from the frozen Trust & Safety spec\n// (Appendix A §A11 (3) + [F8]) — no invented values, no placeholders; the durable\n// design owner is ttt-prod\n// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.\n//\n// SHARED enums come from ../safety/foundation.js (the single source for every\n// cross-cluster enum); they are NEVER redefined here. This cluster IMPORTS\n// NciiInternalStatusSchema, NciiChildSafetyLinkStatusSchema, and\n// NciiChildSafetyCrossoverSchema.\n//\n// Collection note: this cluster introduces a NEW Firestore collection plus child\n// subcollections (allegationLinks / requestLinks / removalActions / blockedHashes).\n// Wiring collections.ts / path-builders.ts / registry.ts is deferred to the app leg;\n// the doc-id shapes are documented on each schema below.\n\nimport { z } from 'zod';\nimport {\n  NciiInternalStatusSchema,\n  NciiChildSafetyLinkStatusSchema,\n  NciiChildSafetyCrossoverSchema,\n  SafetyCaseClosureV1Schema,\n  TargetLocatorV1Schema,\n} from '../safety/foundation.js';\n\n// ===========================================================================\n// §A11 (3) — nciiCases/{caseId}\n// ===========================================================================\n\n/** Case lane — adult NCII vs likeness/depiction. */\nexport const NciiCaseLaneSchema = z.enum(['ncii', 'likeness']);\nexport type NciiCaseLane = z.infer<typeof NciiCaseLaneSchema>;\n\n/** `nciiCases/{caseId}` — the operational record; minimize-retention; child-link\n * rows, never unbounded root arrays. Doc id `caseId` is a deterministic/assigned\n * id (z.string().min(1)). NO case-level `fileDeleteAfter` [M3]: a single\n * case-level timestamp could wrongly override a LATER-linked request, so each\n * evidence row owns its own `deleteAfter` and each request owns its own\n * PII/status/token schedule. */\nexport const NciiCaseV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string().min(1),\n  revision: z.number(),\n  lane: NciiCaseLaneSchema,\n  // [H7] internal operational case status\n  internalStatus: NciiInternalStatusSchema,\n  // [H7] child-safety linkage status\n  childSafetyLinkStatus: NciiChildSafetyLinkStatusSchema,\n  // [F4] the possible-minor assessment; childSafetyCaseId lives HERE ([H7], one canonical place)\n  crossover: NciiChildSafetyCrossoverSchema,\n  // OPTIONAL labeled repairable PROJECTION of crossover.childSafetyCaseId — never the source of truth\n  childSafetyCaseId: z.string().min(1).optional(),\n  // NON-AUTHORITATIVE projection of the minimum active request monitor ([H4]); source of truth =\n  // safetySlaMonitors/{requestId}__nciiRemovalDeadline\n  nciiRemovalDeadlineAt: z.number().optional(),\n  // [EUAS-008] the structured operator closure record, set when the case is closed via the guided\n  // resolution flow. The terminal `internalStatus: 'closed'` flip is the lifecycle status; THIS is\n  // who closed it, why, and with what outcome. Absent until closed.\n  closure: SafetyCaseClosureV1Schema.optional(),\n  // [F-014] Protected chat-report context recovery — parity with the child-safety case\n  // (doc-schemas/safety/case.ts). When an NCII case opens from a chat report while the chat Worker is\n  // unavailable, the immutable channel/message locator is preserved here and `contextResolutionPending`\n  // flags that surrounding context still needs an operator re-fetch. Both optional; absent for\n  // non-chat NCII cases.\n  chatMessageLocator: TargetLocatorV1Schema.optional(),\n  contextResolutionPending: z.boolean().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n}).strict();\nexport type NciiCaseV1 = z.infer<typeof NciiCaseV1Schema>;\n\n// ===========================================================================\n// §A11 (3) — child-link rows (bounded; NEVER root arrays)\n// ===========================================================================\n\n/** `nciiCases/{caseId}/allegationLinks/{allegationId}` — links an allegation to\n * the case. Doc id is the `allegationId`. */\nexport const NciiCaseAllegationLinkV1Schema = z.object({\n  allegationId: z.string().min(1),\n  linkedAt: z.number(),\n  linkedByUid: z.string().min(1),\n  // [EUAS-016/R4] The originating in-app report id, so a case close can flip the protected report\n  // root(s) terminal (the child-safety path resolves this via sourceSignals; NCII via this field).\n  // Optional for backward compat — a link written before this field simply yields no flip.\n  reportId: z.string().min(1).optional(),\n}).strict();\nexport type NciiCaseAllegationLinkV1 = z.infer<typeof NciiCaseAllegationLinkV1Schema>;\n\n/** `nciiCases/{caseId}/requestLinks/{requestId}` — links a statutory request to\n * the case. Doc id is the `requestId`. */\nexport const NciiCaseRequestLinkV1Schema = z.object({\n  requestId: z.string().min(1),\n  linkedAt: z.number(),\n  linkedByUid: z.string().min(1),\n}).strict();\nexport type NciiCaseRequestLinkV1 = z.infer<typeof NciiCaseRequestLinkV1Schema>;\n\n/** Removal-action method on a `removalActions` row. */\nexport const NciiCaseRemovalActionMethodSchema = z.enum(['tombstone', 'accountAction', 'assetBlock']);\nexport type NciiCaseRemovalActionMethod = z.infer<typeof NciiCaseRemovalActionMethodSchema>;\n\n/** `nciiCases/{caseId}/removalActions/{actionId}` — append-only removal-action\n * row. Doc id is the `actionId`. */\nexport const NciiCaseRemovalActionV1Schema = z.object({\n  at: z.number(),\n  actorId: z.string().min(1),\n  surface: z.string(),\n  targetItemType: z.string(),\n  targetItemId: z.string().min(1),\n  method: NciiCaseRemovalActionMethodSchema,\n  result: z.string(),\n}).strict();\nexport type NciiCaseRemovalActionV1 = z.infer<typeof NciiCaseRemovalActionV1Schema>;\n\n// ===========================================================================\n// §A11 (4) [F8] — nciiCases/{caseId}/blockedHashes/{hashId} (multi-hash block;\n// exact-hash blocks only; replaces the singular `reUploadBlock`)\n// ===========================================================================\n\n/** Provenance of a blocked exact hash. Transformed / non-identical content is\n * NEVER auto-claimed identical. */\nexport const NciiBlockedHashSourceSchema = z.enum([\n  'requestEvidence',\n  'platformOriginal',\n  'platformCopy',\n  'knownIdenticalCopy',\n]);\nexport type NciiBlockedHashSource = z.infer<typeof NciiBlockedHashSourceSchema>;\n\n/** Blocked-hash lifecycle. Reversal is restricted + audited; adult NCII hashes do\n * NOT enter the CSAM hash system unless child-safety criteria independently\n * apply. */\nexport const NciiBlockedHashStatusSchema = z.enum(['active', 'reversed']);\nexport type NciiBlockedHashStatus = z.infer<typeof NciiBlockedHashStatusSchema>;\n\n/** `nciiCases/{caseId}/blockedHashes/{hashId}` [F8] — exact-hash block. Doc id is\n * the `hashId`. */\nexport const NciiBlockedHashV1Schema = z.object({\n  hashId: z.string().min(1),\n  algorithm: z.literal('sha256'),\n  digest: z.string().min(1),\n  source: NciiBlockedHashSourceSchema,\n  createdAt: z.number(),\n  createdByUid: z.string().min(1),\n  status: NciiBlockedHashStatusSchema,\n  reversedAt: z.number().optional(),\n  reversedByUid: z.string().min(1).optional(),\n  reversalReason: z.string().optional(),\n}).strict();\nexport type NciiBlockedHashV1 = z.infer<typeof NciiBlockedHashV1Schema>;\n"]}

package/dist/doc-schemas/ncii/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/config.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,8EAA8E;AAC9E,eAAO,MAAM,oCAAoC,yCAAuC,CAAC;AACzF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;aAGa;AACb,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,0DAA0D;AAC1D,eAAO,MAAM,6BAA6B,EAAE,kBAiC3C,CAAC;AAYF;6CAC6C;AAC7C,eAAO,MAAM,oCAAoC,iCAA+B,CAAC;AACjF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;qCACqC;AACrC,eAAO,MAAM,uCAAuC;;;;;;;EAOlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;gFACgF;AAChF,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;kBAiB3C,CAAC;AACZ,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,0EAA0E;AAC1E,eAAO,MAAM,+CAA+C,EAAE,mCAgB7D,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/config.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,8EAA8E;AAC9E,eAAO,MAAM,oCAAoC,yCAAuC,CAAC;AACzF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;aAGa;AACb,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,0DAA0D;AAC1D,eAAO,MAAM,6BAA6B,EAAE,kBAiC3C,CAAC;AAYF;6CAC6C;AAC7C,eAAO,MAAM,oCAAoC,iCAA+B,CAAC;AACjF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;qCACqC;AACrC,eAAO,MAAM,uCAAuC;;;;;;;EAOlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;gFACgF;AAChF,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;kBAiB3C,CAAC;AACZ,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,0EAA0E;AAC1E,eAAO,MAAM,+CAA+C,EAAE,mCAgB7D,CAAC"}

package/dist/doc-schemas/ncii/config.js

@@ -11,9 +11,10 @@
 // uploads stay BLOCKED until `counselApproved` flips true at the pre-launch counsel
 // gate.
 //
-// Every value in the DEFAULT consts below is transcribed verbatim from
-// docs/code_changes_needed/trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11
-// [H6] / [H-17] / [H-18] — no invented values, no placeholders. The schemas pin
+// Every value in the DEFAULT consts below is transcribed verbatim from the frozen
+// Trust & Safety spec (Appendix A §A11 [H6] / [H-17] / [H-18]) — no invented values,
+// no placeholders; the durable design owner is ttt-prod
+// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md. The schemas pin
 // each literal-defaulted field where the spec fixes a single literal value
 // (`policyVersion`, `approvedBy`, `counselApproved`, the security-profile string
 // literals, etc.) so a config write cannot silently drift from the frozen posture.

package/dist/doc-schemas/ncii/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/config.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,qCAAqC;AACrC,6DAA6D;AAC7D,iFAAiF;AACjF,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,6EAA6E;AAC7E,oFAAoF;AACpF,QAAQ;AACR,EAAE;AACF,uEAAuE;AACvE,mFAAmF;AACnF,gFAAgF;AAChF,2EAA2E;AAC3E,iFAAiF;AACjF,mFAAmF;AACnF,EAAE;AACF,+EAA+E;AAC/E,6DAA6D;AAE7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,iEAAiE;AACjE,uBAAuB;AACvB,8EAA8E;AAE9E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAGzF;;;aAGa;AACb,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC9C,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,0BAA0B,EAAE,oCAAoC;IAChE,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3C,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE;IACvC,4BAA4B;IAC5B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,qCAAqC,EAAE,CAAC,CAAC,MAAM,EAAE;IACjD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9C,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,kGAAkG;IAClG,iGAAiG;IACjG,0EAA0E;IAC1E,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE;IACxC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,2EAA2E;IAC3E,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,wEAAwE;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE;IACvC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,gCAAgC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC9C,6FAA6F;IAC7F,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0DAA0D;AAC1D,MAAM,CAAC,MAAM,6BAA6B,GAAuB;IAC/D,aAAa,EAAE,oBAAoB;IACnC,yBAAyB,EAAE,EAAE;IAC7B,qBAAqB,EAAE,EAAE;IACzB,0BAA0B,EAAE,yBAAyB;IACrD,wBAAwB,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC;IAC3G,qGAAqG;IACrG,oGAAoG;IACpG,oGAAoG;IACpG,gBAAgB;IAChB,oBAAoB,EAAE,SAAS;IAC/B,0BAA0B,EAAE,CAAC;IAC7B,+BAA+B,EAAE,SAAS;IAC1C,wBAAwB,EAAE,EAAE;IAC5B,2BAA2B,EAAE,EAAE;IAC/B,oBAAoB,EAAE,EAAE;IACxB,qCAAqC,EAAE,EAAE;IACzC,qBAAqB,EAAE,GAAG;IAC1B,kCAAkC,EAAE,EAAE;IACtC,+FAA+F;IAC/F,4BAA4B,EAAE,IAAI,EAAE,8DAA8D;IAClG,uBAAuB,EAAE,EAAE,EAAE,2EAA2E;IACxG,sBAAsB,EAAE,EAAE;IAC1B,uBAAuB,EAAE,QAAQ;IACjC,yBAAyB,EAAE,KAAK;IAChC,sBAAsB,EAAE,GAAG;IAC3B,2BAA2B,EAAE,GAAG;IAChC,wBAAwB,EAAE,EAAE;IAC5B,uBAAuB,EAAE,KAAK;IAC9B,0BAA0B,EAAE,GAAG;IAC/B,gCAAgC,EAAE,IAAI;IACtC,UAAU,EAAE,uBAAuB;IACnC,eAAe,EAAE,KAAK;CACvB,CAAC;AAEF,8EAA8E;AAC9E,sDAAsD;AACtD,kDAAkD;AAClD,uCAAuC;AACvC,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,kEAAkE;AAClE,8EAA8E;AAE9E;6CAC6C;AAC7C,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAGjF;qCACqC;AACrC,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5D,gBAAgB;IAChB,oBAAoB;IACpB,kBAAkB;IAClB,kBAAkB;IAClB,yBAAyB;IACzB,qBAAqB;CACtB,CAAC,CAAC;AAGH;gFACgF;AAChF,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,oGAAoG;IACpG,oBAAoB,EAAE,oCAAoC;IAC1D,4FAA4F;IAC5F,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,+GAA+G;IAC/G,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE;IACzC,uEAAuE;IACvE,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC;IAC3E,yFAAyF;IACzF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,+FAA+F;IAC/F,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,kDAAkD,CAAC;IAC9E,uGAAuG;IACvG,gCAAgC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7C,mIAAmI;IACnI,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE;CACpC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0EAA0E;AAC1E,MAAM,CAAC,MAAM,+CAA+C,GAAwC;IAClG,oBAAoB,EAAE,iBAAiB;IACvC,0BAA0B,EAAE,GAAG;IAC/B,4BAA4B,EAAE,IAAI;IAClC,yBAAyB,EAAE;QACzB,gBAAgB;QAChB,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;QAClB,yBAAyB;QACzB,qBAAqB;KACtB;IACD,iBAAiB,EAAE,EAAE;IACrB,eAAe,EAAE,kDAAkD;IACnE,gCAAgC,EAAE,IAAI;IACtC,sBAAsB,EAAE,IAAI;CAC7B,CAAC","sourcesContent":["// Trust & Safety — NCII config singletons (Appendix A §A11 [H6] / [H-17] / [H-18]).\n//\n// Two `_config` singleton documents:\n//   - `_config/nciiPolicy`              → NciiPolicyConfigV1\n//   - `_config/privilegedReviewerSecurity` → PrivilegedReviewerSecurityProfileV1\n//\n// These are VERSIONED launch defaults. Qualified counsel must approve them before\n// uploads open and may increase, decrease, or otherwise modify them. Any change\n// increments the policy version and triggers a retention/configuration review. The\n// launch/config audit FAILS CLOSED if any value is missing or a placeholder;\n// uploads stay BLOCKED until `counselApproved` flips true at the pre-launch counsel\n// gate.\n//\n// Every value in the DEFAULT consts below is transcribed verbatim from\n// docs/code_changes_needed/trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11\n// [H6] / [H-17] / [H-18] — no invented values, no placeholders. The schemas pin\n// each literal-defaulted field where the spec fixes a single literal value\n// (`policyVersion`, `approvedBy`, `counselApproved`, the security-profile string\n// literals, etc.) so a config write cannot silently drift from the frozen posture.\n//\n// Collection note: these are `_config` singleton docs; wiring collections.ts /\n// path-builders.ts / registry.ts is deferred to the app leg.\n\nimport { z } from 'zod';\n\n// ===========================================================================\n// §A11 [H6] — NciiPolicyConfigV1 + DEFAULT_NCII_POLICY_CONFIG_V1\n// `_config/nciiPolicy`\n// ===========================================================================\n\n/** Blocked-hash retention policy — indefinite until an appeal reverses it. */\nexport const NciiBlockedHashRetentionPolicySchema = z.literal('indefiniteUntilReversed');\nexport type NciiBlockedHashRetentionPolicy = z.infer<typeof NciiBlockedHashRetentionPolicySchema>;\n\n/** `_config/nciiPolicy` = `NciiPolicyConfigV1` — the DJ-approved launch defaults.\n * Counsel ratifies (`counselApproved`) at the pre-launch gate; uploads stay\n * blocked until then. Any value missing/placeholder → the launch audit FAILS\n * CLOSED. */\nexport const NciiPolicyConfigV1Schema = z.object({\n  policyVersion: z.literal('ncii.2026-06-23.v1'),\n  requesterPiiRetentionDays: z.number(),\n  evidenceRetentionDays: z.number(),\n  blockedHashRetentionPolicy: NciiBlockedHashRetentionPolicySchema,\n  allowedEvidenceMimeTypes: z.array(z.string().min(1)),\n  maxEvidenceFileBytes: z.number(),\n  maxEvidenceFilesPerRequest: z.number(),\n  maxEvidenceTotalBytesPerRequest: z.number(),\n  uploadReservationMinutes: z.number(),\n  abandonedUploadCleanupHours: z.number(),\n  // [H1/M3] temp-hold values:\n  tempHoldInitialHours: z.number(),\n  tempHoldPendingValidityExtensionHours: z.number(),\n  tempHoldMaxTotalHours: z.number(),\n  incompleteInvalidReleaseDelayHours: z.number(),\n  // [NCII route rate-limit hardening — 2026-07-01, OPERATIONAL operator defaults, not legal-retention\n  // values; counsel may tune]. The public intake route returns 429 + Retry-After and NEVER discards a\n  // submission. App-Check is the PRIMARY defense with only a GENEROUS per-IP burst backstop (generous\n  // enough not to throttle a real VPN/shared-IP victim — per-IP was rejected for the evidence BYTES\n  // path; this is the HTTP route only). (The supplement route + status token were removed with the\n  // public post-submission tracking tail — the public flow is submit-only.)\n  intakeRateLimitWindowSeconds: z.number(),\n  intakeRateLimitMaxPerIp: z.number(),\n  // [H-07] dedup window for the deterministic initial-intake idempotency key\n  idempotencyWindowHours: z.number(),\n  // [M-10] evidence parser-hardening budgets (attacker-controlled bytes):\n  maxEvidenceDecodePixels: z.number(),\n  maxEvidenceImageDimension: z.number(),\n  maxEvidenceVideoFrames: z.number(),\n  maxEvidenceVideoDurationSec: z.number(),\n  evidenceParserTimeoutSec: z.number(),\n  evidenceScanCpuBudgetMs: z.number(),\n  evidenceScanMemoryBudgetMb: z.number(),\n  rejectArchiveAndPolyglotPayloads: z.boolean(),\n  approvedBy: z.literal('operatorLaunchDefault'),\n  // counselApproved flips true at the pre-launch counsel gate; uploads stay blocked until then\n  counselApproved: z.boolean(),\n}).strict();\nexport type NciiPolicyConfigV1 = z.infer<typeof NciiPolicyConfigV1Schema>;\n\n/** The frozen launch default for `_config/nciiPolicy`. */\nexport const DEFAULT_NCII_POLICY_CONFIG_V1: NciiPolicyConfigV1 = {\n  policyVersion: 'ncii.2026-06-23.v1',\n  requesterPiiRetentionDays: 90,\n  evidenceRetentionDays: 60,\n  blockedHashRetentionPolicy: 'indefiniteUntilReversed',\n  allowedEvidenceMimeTypes: ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'video/mp4', 'video/webm'],\n  // [H-01/R10] 100MB per file (was 500MB): the evidence-scan trigger downloads the whole object into a\n  // ~512MiB Function before scanning, so an allowed file must fit in memory. Total = 3×100MB = 300MB.\n  // Count stays 3. The storage.rules `nciiEvidence` per-file cap mirrors this 100MB (rules can't read\n  // this config).\n  maxEvidenceFileBytes: 104857600,\n  maxEvidenceFilesPerRequest: 3,\n  maxEvidenceTotalBytesPerRequest: 314572800,\n  uploadReservationMinutes: 30,\n  abandonedUploadCleanupHours: 24,\n  tempHoldInitialHours: 72,\n  tempHoldPendingValidityExtensionHours: 48,\n  tempHoldMaxTotalHours: 336,\n  incompleteInvalidReleaseDelayHours: 24,\n  // [NCII route rate-limit hardening — 2026-07-01 operator defaults; generous, counsel may tune]\n  intakeRateLimitWindowSeconds: 3600, // per source IP (secondary flood guard; App-Check is primary)\n  intakeRateLimitMaxPerIp: 20, // generous so a shared/VPN IP with several genuine victims isn't throttled\n  idempotencyWindowHours: 72,\n  maxEvidenceDecodePixels: 40000000,\n  maxEvidenceImageDimension: 12000,\n  maxEvidenceVideoFrames: 600,\n  maxEvidenceVideoDurationSec: 600,\n  evidenceParserTimeoutSec: 60,\n  evidenceScanCpuBudgetMs: 30000,\n  evidenceScanMemoryBudgetMb: 512,\n  rejectArchiveAndPolyglotPayloads: true,\n  approvedBy: 'operatorLaunchDefault',\n  counselApproved: false,\n};\n\n// ===========================================================================\n// §A11 [H-17] — PrivilegedReviewerSecurityProfileV1 +\n// DEFAULT_PRIVILEGED_REVIEWER_SECURITY_PROFILE_V1\n// `_config/privilegedReviewerSecurity`\n//\n// \"fresh reauth\" / \"two-step reauth\" for ANY privileged-reviewer capability means\n// a reauth that satisfies THIS profile — NEVER a bare password re-prompt. Enforced\n// even though one solo operator holds every capability at launch.\n// ===========================================================================\n\n/** The phishing-resistant second factor — password-only, SMS, and TOTP are NEVER\n * sufficient for a privileged capability. */\nexport const PrivilegedReviewerSecondFactorSchema = z.literal('passkeyWebAuthn');\nexport type PrivilegedReviewerSecondFactor = z.infer<typeof PrivilegedReviewerSecondFactorSchema>;\n\n/** The capabilities that require the passkey assertion + an explicit typed\n * confirmation (two-step reauth). */\nexport const PrivilegedTwoStepReauthCapabilitySchema = z.enum([\n  'evidenceReveal',\n  'ncmecCredentialUse',\n  'reverseHashBlock',\n  'legalDisposition',\n  'falsePositiveCorrection',\n  'ncmecManualFallback',\n]);\nexport type PrivilegedTwoStepReauthCapability = z.infer<typeof PrivilegedTwoStepReauthCapabilitySchema>;\n\n/** `_config/privilegedReviewerSecurity` = `PrivilegedReviewerSecurityProfileV1` —\n * what \"fresh reauth\" actually means for any privileged-reviewer capability. */\nexport const PrivilegedReviewerSecurityProfileV1Schema = z.object({\n  // phishing-resistant; password-only, SMS, and TOTP are NEVER sufficient for a privileged capability\n  requiredSecondFactor: PrivilegedReviewerSecondFactorSchema,\n  // a capability invocation needs a WebAuthn assertion at least this fresh; older → re-prompt\n  privilegedReauthTtlSeconds: z.number(),\n  // the privileged session is bound to the enrolled authenticator/device; separate from the ordinary app session\n  privilegedSessionDeviceBound: z.boolean(),\n  // these require the passkey assertion + an explicit typed confirmation\n  twoStepReauthCapabilities: z.array(PrivilegedTwoStepReauthCapabilitySchema),\n  // offline one-time break-glass codes, generated at enrollment, stored physically offline\n  recoveryCodeCount: z.number(),\n  // using one is logged, fires the external critical alarm, and forces enrolling a fresh passkey\n  recoveryCodeUse: z.literal('auditedHighSeverity+forcesReenroll+criticalAlarm'),\n  // lost-device: revoke ALL privileged sessions → forces re-enrollment before any capability works again\n  allowPrivilegedSessionRevocation: z.boolean(),\n  // each privileged-capability use writes an audit event (actor, capability, caseId, reauth method, before/after for evidence reads)\n  everyInvocationAudited: z.boolean(),\n}).strict();\nexport type PrivilegedReviewerSecurityProfileV1 = z.infer<typeof PrivilegedReviewerSecurityProfileV1Schema>;\n\n/** The frozen launch default for `_config/privilegedReviewerSecurity`. */\nexport const DEFAULT_PRIVILEGED_REVIEWER_SECURITY_PROFILE_V1: PrivilegedReviewerSecurityProfileV1 = {\n  requiredSecondFactor: 'passkeyWebAuthn',\n  privilegedReauthTtlSeconds: 300,\n  privilegedSessionDeviceBound: true,\n  twoStepReauthCapabilities: [\n    'evidenceReveal',\n    'ncmecCredentialUse',\n    'reverseHashBlock',\n    'legalDisposition',\n    'falsePositiveCorrection',\n    'ncmecManualFallback',\n  ],\n  recoveryCodeCount: 10,\n  recoveryCodeUse: 'auditedHighSeverity+forcesReenroll+criticalAlarm',\n  allowPrivilegedSessionRevocation: true,\n  everyInvocationAudited: true,\n};\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/config.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,qCAAqC;AACrC,6DAA6D;AAC7D,iFAAiF;AACjF,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,6EAA6E;AAC7E,oFAAoF;AACpF,QAAQ;AACR,EAAE;AACF,kFAAkF;AAClF,qFAAqF;AACrF,wDAAwD;AACxD,kFAAkF;AAClF,2EAA2E;AAC3E,iFAAiF;AACjF,mFAAmF;AACnF,EAAE;AACF,+EAA+E;AAC/E,6DAA6D;AAE7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,iEAAiE;AACjE,uBAAuB;AACvB,8EAA8E;AAE9E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAGzF;;;aAGa;AACb,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC9C,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,0BAA0B,EAAE,oCAAoC;IAChE,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3C,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE;IACvC,4BAA4B;IAC5B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,qCAAqC,EAAE,CAAC,CAAC,MAAM,EAAE;IACjD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9C,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,kGAAkG;IAClG,iGAAiG;IACjG,0EAA0E;IAC1E,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE;IACxC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,2EAA2E;IAC3E,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,wEAAwE;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE;IACvC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,gCAAgC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC9C,6FAA6F;IAC7F,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0DAA0D;AAC1D,MAAM,CAAC,MAAM,6BAA6B,GAAuB;IAC/D,aAAa,EAAE,oBAAoB;IACnC,yBAAyB,EAAE,EAAE;IAC7B,qBAAqB,EAAE,EAAE;IACzB,0BAA0B,EAAE,yBAAyB;IACrD,wBAAwB,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC;IAC3G,qGAAqG;IACrG,oGAAoG;IACpG,oGAAoG;IACpG,gBAAgB;IAChB,oBAAoB,EAAE,SAAS;IAC/B,0BAA0B,EAAE,CAAC;IAC7B,+BAA+B,EAAE,SAAS;IAC1C,wBAAwB,EAAE,EAAE;IAC5B,2BAA2B,EAAE,EAAE;IAC/B,oBAAoB,EAAE,EAAE;IACxB,qCAAqC,EAAE,EAAE;IACzC,qBAAqB,EAAE,GAAG;IAC1B,kCAAkC,EAAE,EAAE;IACtC,+FAA+F;IAC/F,4BAA4B,EAAE,IAAI,EAAE,8DAA8D;IAClG,uBAAuB,EAAE,EAAE,EAAE,2EAA2E;IACxG,sBAAsB,EAAE,EAAE;IAC1B,uBAAuB,EAAE,QAAQ;IACjC,yBAAyB,EAAE,KAAK;IAChC,sBAAsB,EAAE,GAAG;IAC3B,2BAA2B,EAAE,GAAG;IAChC,wBAAwB,EAAE,EAAE;IAC5B,uBAAuB,EAAE,KAAK;IAC9B,0BAA0B,EAAE,GAAG;IAC/B,gCAAgC,EAAE,IAAI;IACtC,UAAU,EAAE,uBAAuB;IACnC,eAAe,EAAE,KAAK;CACvB,CAAC;AAEF,8EAA8E;AAC9E,sDAAsD;AACtD,kDAAkD;AAClD,uCAAuC;AACvC,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,kEAAkE;AAClE,8EAA8E;AAE9E;6CAC6C;AAC7C,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAGjF;qCACqC;AACrC,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5D,gBAAgB;IAChB,oBAAoB;IACpB,kBAAkB;IAClB,kBAAkB;IAClB,yBAAyB;IACzB,qBAAqB;CACtB,CAAC,CAAC;AAGH;gFACgF;AAChF,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,oGAAoG;IACpG,oBAAoB,EAAE,oCAAoC;IAC1D,4FAA4F;IAC5F,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,+GAA+G;IAC/G,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE;IACzC,uEAAuE;IACvE,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC;IAC3E,yFAAyF;IACzF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,+FAA+F;IAC/F,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,kDAAkD,CAAC;IAC9E,uGAAuG;IACvG,gCAAgC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7C,mIAAmI;IACnI,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE;CACpC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0EAA0E;AAC1E,MAAM,CAAC,MAAM,+CAA+C,GAAwC;IAClG,oBAAoB,EAAE,iBAAiB;IACvC,0BAA0B,EAAE,GAAG;IAC/B,4BAA4B,EAAE,IAAI;IAClC,yBAAyB,EAAE;QACzB,gBAAgB;QAChB,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;QAClB,yBAAyB;QACzB,qBAAqB;KACtB;IACD,iBAAiB,EAAE,EAAE;IACrB,eAAe,EAAE,kDAAkD;IACnE,gCAAgC,EAAE,IAAI;IACtC,sBAAsB,EAAE,IAAI;CAC7B,CAAC","sourcesContent":["// Trust & Safety — NCII config singletons (Appendix A §A11 [H6] / [H-17] / [H-18]).\n//\n// Two `_config` singleton documents:\n//   - `_config/nciiPolicy`              → NciiPolicyConfigV1\n//   - `_config/privilegedReviewerSecurity` → PrivilegedReviewerSecurityProfileV1\n//\n// These are VERSIONED launch defaults. Qualified counsel must approve them before\n// uploads open and may increase, decrease, or otherwise modify them. Any change\n// increments the policy version and triggers a retention/configuration review. The\n// launch/config audit FAILS CLOSED if any value is missing or a placeholder;\n// uploads stay BLOCKED until `counselApproved` flips true at the pre-launch counsel\n// gate.\n//\n// Every value in the DEFAULT consts below is transcribed verbatim from the frozen\n// Trust & Safety spec (Appendix A §A11 [H6] / [H-17] / [H-18]) — no invented values,\n// no placeholders; the durable design owner is ttt-prod\n// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md. The schemas pin\n// each literal-defaulted field where the spec fixes a single literal value\n// (`policyVersion`, `approvedBy`, `counselApproved`, the security-profile string\n// literals, etc.) so a config write cannot silently drift from the frozen posture.\n//\n// Collection note: these are `_config` singleton docs; wiring collections.ts /\n// path-builders.ts / registry.ts is deferred to the app leg.\n\nimport { z } from 'zod';\n\n// ===========================================================================\n// §A11 [H6] — NciiPolicyConfigV1 + DEFAULT_NCII_POLICY_CONFIG_V1\n// `_config/nciiPolicy`\n// ===========================================================================\n\n/** Blocked-hash retention policy — indefinite until an appeal reverses it. */\nexport const NciiBlockedHashRetentionPolicySchema = z.literal('indefiniteUntilReversed');\nexport type NciiBlockedHashRetentionPolicy = z.infer<typeof NciiBlockedHashRetentionPolicySchema>;\n\n/** `_config/nciiPolicy` = `NciiPolicyConfigV1` — the DJ-approved launch defaults.\n * Counsel ratifies (`counselApproved`) at the pre-launch gate; uploads stay\n * blocked until then. Any value missing/placeholder → the launch audit FAILS\n * CLOSED. */\nexport const NciiPolicyConfigV1Schema = z.object({\n  policyVersion: z.literal('ncii.2026-06-23.v1'),\n  requesterPiiRetentionDays: z.number(),\n  evidenceRetentionDays: z.number(),\n  blockedHashRetentionPolicy: NciiBlockedHashRetentionPolicySchema,\n  allowedEvidenceMimeTypes: z.array(z.string().min(1)),\n  maxEvidenceFileBytes: z.number(),\n  maxEvidenceFilesPerRequest: z.number(),\n  maxEvidenceTotalBytesPerRequest: z.number(),\n  uploadReservationMinutes: z.number(),\n  abandonedUploadCleanupHours: z.number(),\n  // [H1/M3] temp-hold values:\n  tempHoldInitialHours: z.number(),\n  tempHoldPendingValidityExtensionHours: z.number(),\n  tempHoldMaxTotalHours: z.number(),\n  incompleteInvalidReleaseDelayHours: z.number(),\n  // [NCII route rate-limit hardening — 2026-07-01, OPERATIONAL operator defaults, not legal-retention\n  // values; counsel may tune]. The public intake route returns 429 + Retry-After and NEVER discards a\n  // submission. App-Check is the PRIMARY defense with only a GENEROUS per-IP burst backstop (generous\n  // enough not to throttle a real VPN/shared-IP victim — per-IP was rejected for the evidence BYTES\n  // path; this is the HTTP route only). (The supplement route + status token were removed with the\n  // public post-submission tracking tail — the public flow is submit-only.)\n  intakeRateLimitWindowSeconds: z.number(),\n  intakeRateLimitMaxPerIp: z.number(),\n  // [H-07] dedup window for the deterministic initial-intake idempotency key\n  idempotencyWindowHours: z.number(),\n  // [M-10] evidence parser-hardening budgets (attacker-controlled bytes):\n  maxEvidenceDecodePixels: z.number(),\n  maxEvidenceImageDimension: z.number(),\n  maxEvidenceVideoFrames: z.number(),\n  maxEvidenceVideoDurationSec: z.number(),\n  evidenceParserTimeoutSec: z.number(),\n  evidenceScanCpuBudgetMs: z.number(),\n  evidenceScanMemoryBudgetMb: z.number(),\n  rejectArchiveAndPolyglotPayloads: z.boolean(),\n  approvedBy: z.literal('operatorLaunchDefault'),\n  // counselApproved flips true at the pre-launch counsel gate; uploads stay blocked until then\n  counselApproved: z.boolean(),\n}).strict();\nexport type NciiPolicyConfigV1 = z.infer<typeof NciiPolicyConfigV1Schema>;\n\n/** The frozen launch default for `_config/nciiPolicy`. */\nexport const DEFAULT_NCII_POLICY_CONFIG_V1: NciiPolicyConfigV1 = {\n  policyVersion: 'ncii.2026-06-23.v1',\n  requesterPiiRetentionDays: 90,\n  evidenceRetentionDays: 60,\n  blockedHashRetentionPolicy: 'indefiniteUntilReversed',\n  allowedEvidenceMimeTypes: ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'video/mp4', 'video/webm'],\n  // [H-01/R10] 100MB per file (was 500MB): the evidence-scan trigger downloads the whole object into a\n  // ~512MiB Function before scanning, so an allowed file must fit in memory. Total = 3×100MB = 300MB.\n  // Count stays 3. The storage.rules `nciiEvidence` per-file cap mirrors this 100MB (rules can't read\n  // this config).\n  maxEvidenceFileBytes: 104857600,\n  maxEvidenceFilesPerRequest: 3,\n  maxEvidenceTotalBytesPerRequest: 314572800,\n  uploadReservationMinutes: 30,\n  abandonedUploadCleanupHours: 24,\n  tempHoldInitialHours: 72,\n  tempHoldPendingValidityExtensionHours: 48,\n  tempHoldMaxTotalHours: 336,\n  incompleteInvalidReleaseDelayHours: 24,\n  // [NCII route rate-limit hardening — 2026-07-01 operator defaults; generous, counsel may tune]\n  intakeRateLimitWindowSeconds: 3600, // per source IP (secondary flood guard; App-Check is primary)\n  intakeRateLimitMaxPerIp: 20, // generous so a shared/VPN IP with several genuine victims isn't throttled\n  idempotencyWindowHours: 72,\n  maxEvidenceDecodePixels: 40000000,\n  maxEvidenceImageDimension: 12000,\n  maxEvidenceVideoFrames: 600,\n  maxEvidenceVideoDurationSec: 600,\n  evidenceParserTimeoutSec: 60,\n  evidenceScanCpuBudgetMs: 30000,\n  evidenceScanMemoryBudgetMb: 512,\n  rejectArchiveAndPolyglotPayloads: true,\n  approvedBy: 'operatorLaunchDefault',\n  counselApproved: false,\n};\n\n// ===========================================================================\n// §A11 [H-17] — PrivilegedReviewerSecurityProfileV1 +\n// DEFAULT_PRIVILEGED_REVIEWER_SECURITY_PROFILE_V1\n// `_config/privilegedReviewerSecurity`\n//\n// \"fresh reauth\" / \"two-step reauth\" for ANY privileged-reviewer capability means\n// a reauth that satisfies THIS profile — NEVER a bare password re-prompt. Enforced\n// even though one solo operator holds every capability at launch.\n// ===========================================================================\n\n/** The phishing-resistant second factor — password-only, SMS, and TOTP are NEVER\n * sufficient for a privileged capability. */\nexport const PrivilegedReviewerSecondFactorSchema = z.literal('passkeyWebAuthn');\nexport type PrivilegedReviewerSecondFactor = z.infer<typeof PrivilegedReviewerSecondFactorSchema>;\n\n/** The capabilities that require the passkey assertion + an explicit typed\n * confirmation (two-step reauth). */\nexport const PrivilegedTwoStepReauthCapabilitySchema = z.enum([\n  'evidenceReveal',\n  'ncmecCredentialUse',\n  'reverseHashBlock',\n  'legalDisposition',\n  'falsePositiveCorrection',\n  'ncmecManualFallback',\n]);\nexport type PrivilegedTwoStepReauthCapability = z.infer<typeof PrivilegedTwoStepReauthCapabilitySchema>;\n\n/** `_config/privilegedReviewerSecurity` = `PrivilegedReviewerSecurityProfileV1` —\n * what \"fresh reauth\" actually means for any privileged-reviewer capability. */\nexport const PrivilegedReviewerSecurityProfileV1Schema = z.object({\n  // phishing-resistant; password-only, SMS, and TOTP are NEVER sufficient for a privileged capability\n  requiredSecondFactor: PrivilegedReviewerSecondFactorSchema,\n  // a capability invocation needs a WebAuthn assertion at least this fresh; older → re-prompt\n  privilegedReauthTtlSeconds: z.number(),\n  // the privileged session is bound to the enrolled authenticator/device; separate from the ordinary app session\n  privilegedSessionDeviceBound: z.boolean(),\n  // these require the passkey assertion + an explicit typed confirmation\n  twoStepReauthCapabilities: z.array(PrivilegedTwoStepReauthCapabilitySchema),\n  // offline one-time break-glass codes, generated at enrollment, stored physically offline\n  recoveryCodeCount: z.number(),\n  // using one is logged, fires the external critical alarm, and forces enrolling a fresh passkey\n  recoveryCodeUse: z.literal('auditedHighSeverity+forcesReenroll+criticalAlarm'),\n  // lost-device: revoke ALL privileged sessions → forces re-enrollment before any capability works again\n  allowPrivilegedSessionRevocation: z.boolean(),\n  // each privileged-capability use writes an audit event (actor, capability, caseId, reauth method, before/after for evidence reads)\n  everyInvocationAudited: z.boolean(),\n}).strict();\nexport type PrivilegedReviewerSecurityProfileV1 = z.infer<typeof PrivilegedReviewerSecurityProfileV1Schema>;\n\n/** The frozen launch default for `_config/privilegedReviewerSecurity`. */\nexport const DEFAULT_PRIVILEGED_REVIEWER_SECURITY_PROFILE_V1: PrivilegedReviewerSecurityProfileV1 = {\n  requiredSecondFactor: 'passkeyWebAuthn',\n  privilegedReauthTtlSeconds: 300,\n  privilegedSessionDeviceBound: true,\n  twoStepReauthCapabilities: [\n    'evidenceReveal',\n    'ncmecCredentialUse',\n    'reverseHashBlock',\n    'legalDisposition',\n    'falsePositiveCorrection',\n    'ncmecManualFallback',\n  ],\n  recoveryCodeCount: 10,\n  recoveryCodeUse: 'auditedHighSeverity+forcesReenroll+criticalAlarm',\n  allowPrivilegedSessionRevocation: true,\n  everyInvocationAudited: true,\n};\n"]}

package/dist/doc-schemas/ncii/holds.js

@@ -12,9 +12,9 @@
 // via `safetyHoldRefId`'s ref — NEVER this row. Expiry/release goes through the
 // A3 CAS release command (no silent TTL on an `active` ref).
 //
-// Every shape here is transcribed verbatim from docs/code_changes_needed/
-// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 — no invented values,
-// no placeholders.
+// Every shape here is transcribed verbatim from the frozen Trust & Safety spec
+// (Appendix A §A11) — no invented values, no placeholders; the durable design
+// owner is ttt-prod docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.
 //
 // SHARED enums + the locator come from ../safety/foundation.js (the single source
 // for every cross-cluster enum); they are NEVER redefined here. This cluster

package/dist/doc-schemas/ncii/holds.js.map

@@ -1 +1 @@
-{"version":3,"file":"holds.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/holds.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,+EAA+E;AAC/E,qEAAqE;AACrE,2CAA2C;AAC3C,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,6DAA6D;AAC7D,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,mBAAmB;AACnB,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,iCAAiC;AACjC,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,4EAA4E;AAC5E,kCAAkC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;oEACoE;AACpE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAGxF;;oDAEoD;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAC9C,sGAAsG;IACtG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,kEAAkE;IAClE,MAAM,EAAE,qBAAqB;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,mDAAmD;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,wEAAwE;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,6BAA6B;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — NCII temporary preservation holds (Appendix A §A11, the\n// synchronous public-intake snapshot + temporary NCII hold [H3]).\n//\n// `nciiTemporaryHolds/{holdId}` — a TEMPORARY, minimize-retention preservation\n// reference that BLOCKS destructive cleanup/replacement of a request target while\n// a request is being processed. This is NOT the 1-yr CSAM hold: exact purpose,\n// short expiry, extension rules for valid/pending, release rules for\n// incomplete/invalid, hold-aware deletion.\n//\n// NON-AUTHORITATIVE PROJECTION [H1]: this row is a workflow/projection only.\n// `assertNoBlockingSafetyHold` consults the §A3 `safetyHoldResources` aggregate\n// via `safetyHoldRefId`'s ref — NEVER this row. Expiry/release goes through the\n// A3 CAS release command (no silent TTL on an `active` ref).\n//\n// Every shape here is transcribed verbatim from docs/code_changes_needed/\n// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 — no invented values,\n// no placeholders.\n//\n// SHARED enums + the locator come from ../safety/foundation.js (the single source\n// for every cross-cluster enum); they are NEVER redefined here. This cluster\n// IMPORTS TargetLocatorV1Schema.\n//\n// Collection note: this cluster introduces a NEW Firestore collection; wiring\n// collections.ts / path-builders.ts / registry.ts is deferred to the app leg (the\n// orchestrator binds the schema + path builders there); the doc-id shape is\n// documented on the schema below.\n\nimport { z } from 'zod';\nimport { TargetLocatorV1Schema } from '../safety/foundation.js';\n\n// ===========================================================================\n// §A11 [H3] — nciiTemporaryHolds/{holdId}\n// ===========================================================================\n\n/** Temp-hold lifecycle. CAS release runs through the A3 command (no silent TTL on\n * an `active` ref). Extended while the request is valid/pending. */\nexport const NciiTemporaryHoldStatusSchema = z.enum(['active', 'extended', 'released']);\nexport type NciiTemporaryHoldStatus = z.infer<typeof NciiTemporaryHoldStatusSchema>;\n\n/** `nciiTemporaryHolds/{holdId}` — NON-AUTHORITATIVE workflow/projection of the\n * authoritative A3 hold (via `safetyHoldRefId`). Doc id `holdId` is a\n * deterministic/assigned id (z.string().min(1)). */\nexport const NciiTemporaryHoldV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  holdId: z.string().min(1),\n  requestId: z.string().min(1),\n  caseId: z.string().min(1).optional(),\n  resourceType: z.literal('nciiTemporaryTarget'),\n  // [H1] pointer to the AUTHORITATIVE safetyHoldRefs entry — this row is a NON-AUTHORITATIVE projection\n  safetyHoldRefId: z.string().min(1),\n  // [H4] the discriminated locator — NOT an all-optional contentRef\n  target: TargetLocatorV1Schema,\n  rootLineageRef: z.string().min(1).optional(),\n  contentHashes: z.array(z.string().min(1)).max(16).optional(),\n  ownerUid: z.string().min(1).optional(),\n  capturedRevision: z.number().optional(),\n  capturedGeneration: z.string().min(1).optional(),\n  // pointer to the immutable request-target snapshot\n  snapshotRef: z.string().min(1),\n  purpose: z.literal('nciiTemporaryPreservation'),\n  createdAt: z.number(),\n  // short minimize-retention expiry; extended while request valid/pending\n  expiresAt: z.number(),\n  status: NciiTemporaryHoldStatusSchema,\n  releasedAt: z.number().optional(),\n  releaseReason: z.string().optional(),\n}).strict();\nexport type NciiTemporaryHoldV1 = z.infer<typeof NciiTemporaryHoldV1Schema>;\n"]}
+{"version":3,"file":"holds.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/holds.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,+EAA+E;AAC/E,qEAAqE;AACrE,2CAA2C;AAC3C,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,6DAA6D;AAC7D,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,oFAAoF;AACpF,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,iCAAiC;AACjC,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,4EAA4E;AAC5E,kCAAkC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;oEACoE;AACpE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAGxF;;oDAEoD;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAC9C,sGAAsG;IACtG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,kEAAkE;IAClE,MAAM,EAAE,qBAAqB;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,mDAAmD;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,wEAAwE;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,6BAA6B;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — NCII temporary preservation holds (Appendix A §A11, the\n// synchronous public-intake snapshot + temporary NCII hold [H3]).\n//\n// `nciiTemporaryHolds/{holdId}` — a TEMPORARY, minimize-retention preservation\n// reference that BLOCKS destructive cleanup/replacement of a request target while\n// a request is being processed. This is NOT the 1-yr CSAM hold: exact purpose,\n// short expiry, extension rules for valid/pending, release rules for\n// incomplete/invalid, hold-aware deletion.\n//\n// NON-AUTHORITATIVE PROJECTION [H1]: this row is a workflow/projection only.\n// `assertNoBlockingSafetyHold` consults the §A3 `safetyHoldResources` aggregate\n// via `safetyHoldRefId`'s ref — NEVER this row. Expiry/release goes through the\n// A3 CAS release command (no silent TTL on an `active` ref).\n//\n// Every shape here is transcribed verbatim from the frozen Trust & Safety spec\n// (Appendix A §A11) — no invented values, no placeholders; the durable design\n// owner is ttt-prod docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.\n//\n// SHARED enums + the locator come from ../safety/foundation.js (the single source\n// for every cross-cluster enum); they are NEVER redefined here. This cluster\n// IMPORTS TargetLocatorV1Schema.\n//\n// Collection note: this cluster introduces a NEW Firestore collection; wiring\n// collections.ts / path-builders.ts / registry.ts is deferred to the app leg (the\n// orchestrator binds the schema + path builders there); the doc-id shape is\n// documented on the schema below.\n\nimport { z } from 'zod';\nimport { TargetLocatorV1Schema } from '../safety/foundation.js';\n\n// ===========================================================================\n// §A11 [H3] — nciiTemporaryHolds/{holdId}\n// ===========================================================================\n\n/** Temp-hold lifecycle. CAS release runs through the A3 command (no silent TTL on\n * an `active` ref). Extended while the request is valid/pending. */\nexport const NciiTemporaryHoldStatusSchema = z.enum(['active', 'extended', 'released']);\nexport type NciiTemporaryHoldStatus = z.infer<typeof NciiTemporaryHoldStatusSchema>;\n\n/** `nciiTemporaryHolds/{holdId}` — NON-AUTHORITATIVE workflow/projection of the\n * authoritative A3 hold (via `safetyHoldRefId`). Doc id `holdId` is a\n * deterministic/assigned id (z.string().min(1)). */\nexport const NciiTemporaryHoldV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  holdId: z.string().min(1),\n  requestId: z.string().min(1),\n  caseId: z.string().min(1).optional(),\n  resourceType: z.literal('nciiTemporaryTarget'),\n  // [H1] pointer to the AUTHORITATIVE safetyHoldRefs entry — this row is a NON-AUTHORITATIVE projection\n  safetyHoldRefId: z.string().min(1),\n  // [H4] the discriminated locator — NOT an all-optional contentRef\n  target: TargetLocatorV1Schema,\n  rootLineageRef: z.string().min(1).optional(),\n  contentHashes: z.array(z.string().min(1)).max(16).optional(),\n  ownerUid: z.string().min(1).optional(),\n  capturedRevision: z.number().optional(),\n  capturedGeneration: z.string().min(1).optional(),\n  // pointer to the immutable request-target snapshot\n  snapshotRef: z.string().min(1),\n  purpose: z.literal('nciiTemporaryPreservation'),\n  createdAt: z.number(),\n  // short minimize-retention expiry; extended while request valid/pending\n  expiresAt: z.number(),\n  status: NciiTemporaryHoldStatusSchema,\n  releasedAt: z.number().optional(),\n  releaseReason: z.string().optional(),\n}).strict();\nexport type NciiTemporaryHoldV1 = z.infer<typeof NciiTemporaryHoldV1Schema>;\n"]}

package/dist/doc-schemas/ncii/removal.js

@@ -17,9 +17,9 @@
 // the job's deterministic `jobId`); a `leftover`/`failed` target re-drives from
 // its last unverified sub-state.
 //
-// Every shape here is transcribed verbatim from docs/code_changes_needed/
-// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 [H4] — no invented
-// values, no placeholders.
+// Every shape here is transcribed verbatim from the frozen Trust & Safety spec
+// (Appendix A §A11 [H4]) — no invented values, no placeholders; the durable design
+// owner is ttt-prod docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.
 //
 // SHARED enums + the locator come from ../safety/foundation.js (the single source
 // for every cross-cluster enum); they are NEVER redefined here. This cluster

package/dist/doc-schemas/ncii/removal.js.map

@@ -1 +1 @@
-{"version":3,"file":"removal.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/removal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,0BAA0B;AAC1B,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,sEAAsE;AACtE,gFAAgF;AAChF,mBAAmB;AACnB,EAAE;AACF,kFAAkF;AAClF,8EAA8E;AAC9E,mFAAmF;AACnF,iFAAiF;AACjF,uDAAuD;AACvD,oFAAoF;AACpF,iFAAiF;AACjF,gFAAgF;AAChF,iCAAiC;AACjC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,2BAA2B;AAC3B,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,uFAAuF;AACvF,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AAC/E,gBAAgB;AAEhB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;+DAC+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,gBAAgB;IAChB,qBAAqB;IACrB,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAGH,uDAAuD;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,SAAS;IACT,SAAS;IACT,kBAAkB;IAClB,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AAGH,8EAA8E;AAC9E,iFAAiF;AACjF,sDAAsD;AACtD,8EAA8E;AAE9E;2DAC2D;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,uBAAuB;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,sCAAsC;AACtC,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAE9E;;;2CAG2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,uBAAuB;IAC/B,2DAA2D;IAC3D,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,8DAA8D;AAC9D,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAE9E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGxF,yBAAyB;AACzB,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnG,8BAA8B;AAC9B,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAGjG;;;;uDAIuD;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,8CAA8C;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,uBAAuB;IAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,gCAAgC;IAClD,YAAY,EAAE,4BAA4B;IAC1C,iBAAiB,EAAE,iCAAiC;IACpD,OAAO,EAAE,uBAAuB;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — NCII per-request removal deadline + durable removal saga\n// (Appendix A §A11 [H4]).\n//\n// The removal job is REQUEST-scoped, not case-scoped: the deadline monitor lives\n// at `safetySlaMonitors/{requestId}__nciiRemovalDeadline` and a monitor can never\n// be resolved by finishing a DIFFERENT linked request. The case-level\n// `nciiRemovalDeadlineAt` MAY mirror the minimum active deadline but is NOT the\n// source of truth.\n//\n// COMPLETION PREDICATE [H4]: completion is derived ONLY from verified target rows\n// + approved legal outcomes — a request is `completed` ONLY when the reported\n// target AND every known identical copy reaches `verificationState='verifiedGone'`\n// OR carries an approved `NciiTerminalException`. A partial technical failure is\n// the HONEST outcome `unableToComplete` (technical) or\n// `completedWithApprovedException` (counsel-approved) — NEVER ordinary `completed`.\n// A worker crash resumes idempotently (replay is idempotent by `targetKeyHash` +\n// the job's deterministic `jobId`); a `leftover`/`failed` target re-drives from\n// its last unverified sub-state.\n//\n// Every shape here is transcribed verbatim from docs/code_changes_needed/\n// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A11 [H4] — no invented\n// values, no placeholders.\n//\n// SHARED enums + the locator come from ../safety/foundation.js (the single source\n// for every cross-cluster enum); they are NEVER redefined here. This cluster\n// IMPORTS NciiTargetSurfaceSchema, NciiTargetOutcomeSchema, and TargetLocatorV1Schema.\n//\n// Collection note: this cluster introduces NEW Firestore collections (+ one child\n// subcollection under `nciiRemovalJobs`); wiring collections.ts / path-builders.ts\n// / registry.ts is deferred to the app leg (the orchestrator binds the schemas +\n// path builders there); the deterministic doc-id shapes are documented on each\n// schema below.\n\nimport { z } from 'zod';\nimport {\n  NciiTargetSurfaceSchema,\n  NciiTargetOutcomeSchema,\n  TargetLocatorV1Schema,\n} from '../safety/foundation.js';\n\n// ===========================================================================\n// §A11 [H4] — phase / status vocabularies for the removal saga\n// ===========================================================================\n\n/** The removal saga phase progression. `denyServing` precedes\n * `removeOrTombstone`; `verifyRemoval` precedes `complete`. */\nexport const NciiRemovalPhaseSchema = z.enum([\n  'resolveTargets',\n  'discoverKnownCopies',\n  'denyServing',\n  'removeOrTombstone',\n  'writeHashBlocks',\n  'verifyRemoval',\n  'complete',\n]);\nexport type NciiRemovalPhase = z.infer<typeof NciiRemovalPhaseSchema>;\n\n/** Top-level durable run status of the removal job. */\nexport const NciiRemovalStatusSchema = z.enum([\n  'pending',\n  'running',\n  'retryableFailure',\n  'deadLetter',\n  'completed',\n]);\nexport type NciiRemovalStatus = z.infer<typeof NciiRemovalStatusSchema>;\n\n// ===========================================================================\n// §A11 [H4] — NciiDiscoveryCursorV1 (typed resumable discovery cursor — never an\n// untyped blob). Embedded on NciiRemovalJobV1.cursor.\n// ===========================================================================\n\n/** Typed resumable discovery cursor. `phase` mirrors the job phase enum;\n * `lastSurface` is the cross-cluster NciiTargetSurface. */\nexport const NciiDiscoveryCursorV1Schema = z.object({\n  phase: NciiRemovalPhaseSchema,\n  lastSurface: NciiTargetSurfaceSchema,\n  lastCursorToken: z.string().min(1).optional(),\n}).strict();\nexport type NciiDiscoveryCursorV1 = z.infer<typeof NciiDiscoveryCursorV1Schema>;\n\n// ===========================================================================\n// §A11 [H4] — nciiRemovalJobs/{jobId}\n// Deterministic `jobId = sha256('ncii-removal-v1:' + requestId + ':' + caseId +\n// ':' + generation)` (racing workers create the SAME job — idempotent).\n// ===========================================================================\n\n/** `nciiRemovalJobs/{jobId}` — REQUEST-scoped durable removal saga. Doc id\n * `jobId` is deterministic:\n * `sha256('ncii-removal-v1:' + requestId + ':' + caseId + ':' + generation)`\n * (racing workers create the same job). */\nexport const NciiRemovalJobV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  // = sha256('ncii-removal-v1:' + requestId + ':' + caseId + ':' + generation)\n  jobId: z.string().min(1),\n  caseId: z.string().min(1),\n  requestId: z.string().min(1),\n  generation: z.number(),\n  phase: NciiRemovalPhaseSchema,\n  status: NciiRemovalStatusSchema,\n  // typed resumable discovery cursor — never an untyped blob\n  cursor: NciiDiscoveryCursorV1Schema.optional(),\n  leaseOwner: z.string().min(1).optional(),\n  leaseExpiresAt: z.number().optional(),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number().optional(),\n  lastErrorCode: z.string().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  completedAt: z.number().optional(),\n  deadLetterAt: z.number().optional(),\n}).strict();\nexport type NciiRemovalJobV1 = z.infer<typeof NciiRemovalJobV1Schema>;\n\n// ===========================================================================\n// §A11 [H4] — nciiRemovalJobs/{jobId}/targets/{targetKeyHash}\n// Per-target child row. `targetKeyHash` is the deterministic id derived from the\n// canonical locator. Per-target transitions are independent sub-state machines.\n// ===========================================================================\n\n/** Serving-deny sub-state. */\nexport const NciiTargetServingDenyStateSchema = z.enum(['pending', 'denied', 'failed']);\nexport type NciiTargetServingDenyState = z.infer<typeof NciiTargetServingDenyStateSchema>;\n\n/** Removal sub-state. */\nexport const NciiTargetRemovalStateSchema = z.enum(['pending', 'removed', 'tombstoned', 'failed']);\nexport type NciiTargetRemovalState = z.infer<typeof NciiTargetRemovalStateSchema>;\n\n/** Verification sub-state. */\nexport const NciiTargetVerificationStateSchema = z.enum(['pending', 'verifiedGone', 'leftover']);\nexport type NciiTargetVerificationState = z.infer<typeof NciiTargetVerificationStateSchema>;\n\n/** `nciiRemovalJobs/{jobId}/targets/{targetKeyHash}` — per-target removal row.\n * Doc id `targetKeyHash` is the deterministic id from the canonical locator.\n * Per-target transitions: `servingDeny (pending→denied | failed)`;\n * `removal (pending→removed | tombstoned | failed)`;\n * `verification (pending→verifiedGone | leftover)`. */\nexport const NciiRemovalTargetV1Schema = z.object({\n  // deterministic id from the canonical locator\n  targetKeyHash: z.string().min(1),\n  locator: TargetLocatorV1Schema,\n  surface: NciiTargetSurfaceSchema,\n  expectedGeneration: z.number().optional(),\n  servingDenyState: NciiTargetServingDenyStateSchema,\n  removalState: NciiTargetRemovalStateSchema,\n  verificationState: NciiTargetVerificationStateSchema,\n  outcome: NciiTargetOutcomeSchema,\n  attemptCount: z.number(),\n  leaseOwner: z.string().min(1).optional(),\n  leaseExpiresAt: z.number().optional(),\n  lastErrorCode: z.string().optional(),\n  updatedAt: z.number(),\n}).strict();\nexport type NciiRemovalTargetV1 = z.infer<typeof NciiRemovalTargetV1Schema>;\n"]}
+{"version":3,"file":"removal.js","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/removal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,0BAA0B;AAC1B,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,sEAAsE;AACtE,gFAAgF;AAChF,mBAAmB;AACnB,EAAE;AACF,kFAAkF;AAClF,8EAA8E;AAC9E,mFAAmF;AACnF,iFAAiF;AACjF,uDAAuD;AACvD,oFAAoF;AACpF,iFAAiF;AACjF,gFAAgF;AAChF,iCAAiC;AACjC,EAAE;AACF,+EAA+E;AAC/E,mFAAmF;AACnF,oFAAoF;AACpF,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,uFAAuF;AACvF,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AAC/E,gBAAgB;AAEhB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;+DAC+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,gBAAgB;IAChB,qBAAqB;IACrB,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAGH,uDAAuD;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,SAAS;IACT,SAAS;IACT,kBAAkB;IAClB,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AAGH,8EAA8E;AAC9E,iFAAiF;AACjF,sDAAsD;AACtD,8EAA8E;AAE9E;2DAC2D;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,uBAAuB;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,sCAAsC;AACtC,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAE9E;;;2CAG2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,uBAAuB;IAC/B,2DAA2D;IAC3D,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,8DAA8D;AAC9D,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAE9E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGxF,yBAAyB;AACzB,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnG,8BAA8B;AAC9B,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAGjG;;;;uDAIuD;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,8CAA8C;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,uBAAuB;IAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,gCAAgC;IAClD,YAAY,EAAE,4BAA4B;IAC1C,iBAAiB,EAAE,iCAAiC;IACpD,OAAO,EAAE,uBAAuB;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — NCII per-request removal deadline + durable removal saga\n// (Appendix A §A11 [H4]).\n//\n// The removal job is REQUEST-scoped, not case-scoped: the deadline monitor lives\n// at `safetySlaMonitors/{requestId}__nciiRemovalDeadline` and a monitor can never\n// be resolved by finishing a DIFFERENT linked request. The case-level\n// `nciiRemovalDeadlineAt` MAY mirror the minimum active deadline but is NOT the\n// source of truth.\n//\n// COMPLETION PREDICATE [H4]: completion is derived ONLY from verified target rows\n// + approved legal outcomes — a request is `completed` ONLY when the reported\n// target AND every known identical copy reaches `verificationState='verifiedGone'`\n// OR carries an approved `NciiTerminalException`. A partial technical failure is\n// the HONEST outcome `unableToComplete` (technical) or\n// `completedWithApprovedException` (counsel-approved) — NEVER ordinary `completed`.\n// A worker crash resumes idempotently (replay is idempotent by `targetKeyHash` +\n// the job's deterministic `jobId`); a `leftover`/`failed` target re-drives from\n// its last unverified sub-state.\n//\n// Every shape here is transcribed verbatim from the frozen Trust & Safety spec\n// (Appendix A §A11 [H4]) — no invented values, no placeholders; the durable design\n// owner is ttt-prod docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.\n//\n// SHARED enums + the locator come from ../safety/foundation.js (the single source\n// for every cross-cluster enum); they are NEVER redefined here. This cluster\n// IMPORTS NciiTargetSurfaceSchema, NciiTargetOutcomeSchema, and TargetLocatorV1Schema.\n//\n// Collection note: this cluster introduces NEW Firestore collections (+ one child\n// subcollection under `nciiRemovalJobs`); wiring collections.ts / path-builders.ts\n// / registry.ts is deferred to the app leg (the orchestrator binds the schemas +\n// path builders there); the deterministic doc-id shapes are documented on each\n// schema below.\n\nimport { z } from 'zod';\nimport {\n  NciiTargetSurfaceSchema,\n  NciiTargetOutcomeSchema,\n  TargetLocatorV1Schema,\n} from '../safety/foundation.js';\n\n// ===========================================================================\n// §A11 [H4] — phase / status vocabularies for the removal saga\n// ===========================================================================\n\n/** The removal saga phase progression. `denyServing` precedes\n * `removeOrTombstone`; `verifyRemoval` precedes `complete`. */\nexport const NciiRemovalPhaseSchema = z.enum([\n  'resolveTargets',\n  'discoverKnownCopies',\n  'denyServing',\n  'removeOrTombstone',\n  'writeHashBlocks',\n  'verifyRemoval',\n  'complete',\n]);\nexport type NciiRemovalPhase = z.infer<typeof NciiRemovalPhaseSchema>;\n\n/** Top-level durable run status of the removal job. */\nexport const NciiRemovalStatusSchema = z.enum([\n  'pending',\n  'running',\n  'retryableFailure',\n  'deadLetter',\n  'completed',\n]);\nexport type NciiRemovalStatus = z.infer<typeof NciiRemovalStatusSchema>;\n\n// ===========================================================================\n// §A11 [H4] — NciiDiscoveryCursorV1 (typed resumable discovery cursor — never an\n// untyped blob). Embedded on NciiRemovalJobV1.cursor.\n// ===========================================================================\n\n/** Typed resumable discovery cursor. `phase` mirrors the job phase enum;\n * `lastSurface` is the cross-cluster NciiTargetSurface. */\nexport const NciiDiscoveryCursorV1Schema = z.object({\n  phase: NciiRemovalPhaseSchema,\n  lastSurface: NciiTargetSurfaceSchema,\n  lastCursorToken: z.string().min(1).optional(),\n}).strict();\nexport type NciiDiscoveryCursorV1 = z.infer<typeof NciiDiscoveryCursorV1Schema>;\n\n// ===========================================================================\n// §A11 [H4] — nciiRemovalJobs/{jobId}\n// Deterministic `jobId = sha256('ncii-removal-v1:' + requestId + ':' + caseId +\n// ':' + generation)` (racing workers create the SAME job — idempotent).\n// ===========================================================================\n\n/** `nciiRemovalJobs/{jobId}` — REQUEST-scoped durable removal saga. Doc id\n * `jobId` is deterministic:\n * `sha256('ncii-removal-v1:' + requestId + ':' + caseId + ':' + generation)`\n * (racing workers create the same job). */\nexport const NciiRemovalJobV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  // = sha256('ncii-removal-v1:' + requestId + ':' + caseId + ':' + generation)\n  jobId: z.string().min(1),\n  caseId: z.string().min(1),\n  requestId: z.string().min(1),\n  generation: z.number(),\n  phase: NciiRemovalPhaseSchema,\n  status: NciiRemovalStatusSchema,\n  // typed resumable discovery cursor — never an untyped blob\n  cursor: NciiDiscoveryCursorV1Schema.optional(),\n  leaseOwner: z.string().min(1).optional(),\n  leaseExpiresAt: z.number().optional(),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number().optional(),\n  lastErrorCode: z.string().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  completedAt: z.number().optional(),\n  deadLetterAt: z.number().optional(),\n}).strict();\nexport type NciiRemovalJobV1 = z.infer<typeof NciiRemovalJobV1Schema>;\n\n// ===========================================================================\n// §A11 [H4] — nciiRemovalJobs/{jobId}/targets/{targetKeyHash}\n// Per-target child row. `targetKeyHash` is the deterministic id derived from the\n// canonical locator. Per-target transitions are independent sub-state machines.\n// ===========================================================================\n\n/** Serving-deny sub-state. */\nexport const NciiTargetServingDenyStateSchema = z.enum(['pending', 'denied', 'failed']);\nexport type NciiTargetServingDenyState = z.infer<typeof NciiTargetServingDenyStateSchema>;\n\n/** Removal sub-state. */\nexport const NciiTargetRemovalStateSchema = z.enum(['pending', 'removed', 'tombstoned', 'failed']);\nexport type NciiTargetRemovalState = z.infer<typeof NciiTargetRemovalStateSchema>;\n\n/** Verification sub-state. */\nexport const NciiTargetVerificationStateSchema = z.enum(['pending', 'verifiedGone', 'leftover']);\nexport type NciiTargetVerificationState = z.infer<typeof NciiTargetVerificationStateSchema>;\n\n/** `nciiRemovalJobs/{jobId}/targets/{targetKeyHash}` — per-target removal row.\n * Doc id `targetKeyHash` is the deterministic id from the canonical locator.\n * Per-target transitions: `servingDeny (pending→denied | failed)`;\n * `removal (pending→removed | tombstoned | failed)`;\n * `verification (pending→verifiedGone | leftover)`. */\nexport const NciiRemovalTargetV1Schema = z.object({\n  // deterministic id from the canonical locator\n  targetKeyHash: z.string().min(1),\n  locator: TargetLocatorV1Schema,\n  surface: NciiTargetSurfaceSchema,\n  expectedGeneration: z.number().optional(),\n  servingDenyState: NciiTargetServingDenyStateSchema,\n  removalState: NciiTargetRemovalStateSchema,\n  verificationState: NciiTargetVerificationStateSchema,\n  outcome: NciiTargetOutcomeSchema,\n  attemptCount: z.number(),\n  leaseOwner: z.string().min(1).optional(),\n  leaseExpiresAt: z.number().optional(),\n  lastErrorCode: z.string().optional(),\n  updatedAt: z.number(),\n}).strict();\nexport type NciiRemovalTargetV1 = z.infer<typeof NciiRemovalTargetV1Schema>;\n"]}

package/dist/doc-schemas/ncii/requests.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requests.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/requests.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAaL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AASjC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAuB/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAQpF,sEAAsE;AACtE,eAAO,MAAM,+BAA+B;;;EAA0C,CAAC;AACvF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,oFAAoF;AACpF,eAAO,MAAM,qCAAqC;;;;;;;kBAIvC,CAAC;AACZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;;iFAMiF;AACjF,eAAO,MAAM,8BAA8B;;;;;;EAMzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;8EAE8E;AAC9E,eAAO,MAAM,+BAA+B;;;;;;;;;;;kBAKjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;iBAKiB;AACjB,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;kBAM5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;kBAEkB;AAClB,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,gCAAgC;AAChC,eAAO,MAAM,mCAAmC;;;;EAA8C,CAAC;AAC/F,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;oFACoF;AACpF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAY9B,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF;sBACsB;AACtB,eAAO,MAAM,sCAAsC;;;;EAAiD,CAAC;AACrG,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;gCAEgC;AAChC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAYpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F;sEACsE;AACtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAUjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAiBxF;;;;4DAI4D;AAC5D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;kBAe5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAY9E,sEAAsE;AACtE,eAAO,MAAM,gCAAgC;;;;;;;;EAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;4EAC4E;AAC5E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;kBAavC,CAAC;AACZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AASpG,qFAAqF;AACrF,eAAO,MAAM,oCAAoC,sIAOE,CAAC;AAEpD;;;yEAGyE;AACzE,eAAO,MAAM,8CAA8C,kLAIR,CAAC;AAEpD;wDACwD;AACxD,eAAO,MAAM,0BAA0B,2CAGY,CAAC;AAEpD;;;;;;wFAMwF;AACxF,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,uBAAuB,GACrC,SAAS,mBAAmB,EAAE,CAIhC;AAED;;;;;;;;;+DAS+D;AAC/D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,aAAa,EAAE,uBAAuB,CAAC;IACvC,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACpD,GAAG;IAAE,MAAM,EAAE,YAAY,GAAG,UAAU,CAAC;IAAC,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAelF;AAYD;2DAC2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;mFAC+E;IAC/E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C;yEACqE;IACrE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,mBAAmB,EAAE,CAqBhF;AAED,wFAAwF;AACxF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;CACnD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,uBAAuB,CAOlF"}
+{"version":3,"file":"requests.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/ncii/requests.ts"],"names":[],"mappings":"AAsCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAaL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AASjC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAuB/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAQpF,sEAAsE;AACtE,eAAO,MAAM,+BAA+B;;;EAA0C,CAAC;AACvF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,oFAAoF;AACpF,eAAO,MAAM,qCAAqC;;;;;;;kBAIvC,CAAC;AACZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;;iFAMiF;AACjF,eAAO,MAAM,8BAA8B;;;;;;EAMzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;8EAE8E;AAC9E,eAAO,MAAM,+BAA+B;;;;;;;;;;;kBAKjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;iBAKiB;AACjB,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;kBAM5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;kBAEkB;AAClB,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,gCAAgC;AAChC,eAAO,MAAM,mCAAmC;;;;EAA8C,CAAC;AAC/F,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;oFACoF;AACpF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAY9B,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF;sBACsB;AACtB,eAAO,MAAM,sCAAsC;;;;EAAiD,CAAC;AACrG,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;gCAEgC;AAChC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAYpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F;sEACsE;AACtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAUjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAiBxF;;;;4DAI4D;AAC5D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;kBAe5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAY9E,sEAAsE;AACtE,eAAO,MAAM,gCAAgC;;;;;;;;EAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;4EAC4E;AAC5E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;kBAavC,CAAC;AACZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AASpG,qFAAqF;AACrF,eAAO,MAAM,oCAAoC,sIAOE,CAAC;AAEpD;;;yEAGyE;AACzE,eAAO,MAAM,8CAA8C,kLAIR,CAAC;AAEpD;wDACwD;AACxD,eAAO,MAAM,0BAA0B,2CAGY,CAAC;AAEpD;;;;;;wFAMwF;AACxF,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,uBAAuB,GACrC,SAAS,mBAAmB,EAAE,CAIhC;AAED;;;;;;;;;+DAS+D;AAC/D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,aAAa,EAAE,uBAAuB,CAAC;IACvC,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACpD,GAAG;IAAE,MAAM,EAAE,YAAY,GAAG,UAAU,CAAC;IAAC,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAelF;AAYD;2DAC2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;mFAC+E;IAC/E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C;yEACqE;IACrE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,mBAAmB,EAAE,CAqBhF;AAED,wFAAwF;AACxF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;CACnD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,uBAAuB,CAOlF"}