@ttt-productions/ttt-core 0.78.22 → 0.78.24

package/dist/doc-schemas/safety/evidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../../src/doc-schemas/safety/evidence.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,mBAAmB;AACnB,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,iFAAiF;AACjF,uCAAuC;AACvC,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,4DAA4D;AAC5D,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,kFAAkF;AAClF,gBAAgB;AAChB,EAAE;AACF,mFAAmF;AACnF,gEAAgE;AAChE,EAAE;AACF,kFAAkF;AAClF,qEAAqE;AACrE,oFAAoF;AACpF,0EAA0E;AAC1E,mCAAmC;AAEnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,8EAA8E;AAC9E,kFAAkF;AAClF,gFAAgF;AAChF,sFAAsF;AACtF,mDAAmD;AACnD,8EAA8E;AAE9E,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,kDAAkD;AAClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,8EAA8E;AAC9E,wEAAwE;AACxE,mFAAmF;AACnF,8EAA8E;AAE9E;;qEAEqE;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC;IACnD,OAAO;IACP,eAAe;IACf,cAAc;CACf,CAAC,CAAC;AAGH;8CAC8C;AAC9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,6CAA6C;AAC7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;kCACkC;AAClC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;CACjF,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,mCAAmC;AACnC,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,IAAI,CAAC;IACzD,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,OAAO;CACR,CAAC,CAAC;AAGH,wEAAwE;AACxE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,QAAQ,EAAE,oCAAoC;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,2CAA2C;AAC3C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,oFAAoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,yEAAyE;AACzE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,8BAA8B,EAAE,4CAA4C;IACxF,QAAQ,EAAE,8BAA8B,CAAC,QAAQ,EAAE,EAAE,uCAAuC;IAC5F,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,EAAE,aAAa;IACrG,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE,EAAE,uCAAuC;IACvF,aAAa,EAAE,mCAAmC,CAAC,QAAQ,EAAE,EAAE,+CAA+C;IAC9G,YAAY,EAAE,kCAAkC,CAAC,QAAQ,EAAE,EAAE,8CAA8C;IAC3G,mFAAmF;IACnF,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,6CAA6C;IAC3H,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,8BAA8B,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IAC1E,YAAY,EAAE,0BAA0B,CAAC,QAAQ,EAAE,EAAE,aAAa;IAClE,QAAQ,EAAE,8BAA8B,CAAC,QAAQ,EAAE,EAAE,mDAAmD;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;CAC9E,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACnC,+EAA+E;IAC/E,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAChC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,0CAA0C,EAAE,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAChC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,kCAAkC,EAAE,CAAC,CAAC;IAEvG,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,eAAe;QACf,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAC9E,gFAAgF;AAChF,0FAA0F;AAC1F,iEAAiE;AACjE,kGAAkG;AAClG,gFAAgF;AAChF,uEAAuE;AACvE,2DAA2D;AAC3D,8EAA8E;AAE9E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,SAAS;IACT,QAAQ;IACR,aAAa;CACd,CAAC,CAAC;AAGH;oBACoB;AACpB,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAGH;;8DAE8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,4BAA4B;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mCAAmC;IACjE,MAAM,EAAE,6BAA6B;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,6BAA6B;IACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0BAA0B;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,iBAAiB;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAGjF,kCAAkC;AAClC,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAG7F;6BAC6B;AAC7B,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,+BAA+B;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,uCAAuC;CACtD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,sDAAsD;AACtD,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAGvF,sDAAsD;AACtD,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAGlF;;;;;;;;;kFASkF;AAClF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,8FAA8F;IAC9F,iGAAiG;IACjG,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,qCAAqC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,qCAAqC;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — the evidence cluster (Appendix A §A4, Finding-H5 / Finding-M2).\n//\n// Two collections:\n//   - `safetyEvidenceManifests/{manifestId}` = SafetyEvidenceManifestV1 — an\n//     IMMUTABLE, versioned manifest. Finding-H5: a manifest is NO LONGER\n//     media-shaped — a `sourceKind` discriminator ('media'|'communication'|\n//     'externalFact') selects WHICH sub-object is present. No manifest may carry\n//     a null/placeholder media object.\n//   - `safetyEvidenceJobs/{jobId}` = SafetyEvidenceJobV1 — the capture/verify/\n//     disposition saga row (Finding-M2: `commandId` + terminal timestamps; the\n//     `verified` status is disambiguated as a (phase, status) PAIR, never a bare\n//     status) with two subcollections: …/items/{itemId} and\n//     …/disposition/{locationId}.\n//\n// Every shape here is transcribed verbatim from docs/code_changes_needed/\n// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A4 — no invented values, no\n// placeholders.\n//\n// SHARED media lineage comes from ../media-assets.js (the single canonical lineage\n// used by media, CSAM, and safety); it is NEVER redefined here.\n//\n// Collection note: this cluster introduces TWO NEW Firestore collections plus two\n// subcollections under `safetyEvidenceJobs`. Wiring collections.ts /\n// path-builders.ts / registry.ts is deferred to the app leg (the orchestrator binds\n// the schemas + path builders there); the deterministic doc-id shapes are\n// documented on each schema below.\n\nimport { z } from 'zod';\nimport { MediaOriginLineageV1Schema } from '../media-assets.js';\n\n// ===========================================================================\n// §A4 manifest / communication array caps — the ONE named declaration (ARCH-102).\n// Every `.max(...)` bound below derives from these; the app's evidence-manifest\n// writer imports the SAME constants for its `bound(...)` checks so the schema and the\n// writer can never drift to two different numbers.\n// ===========================================================================\n\n/** MAX variants[] on a media manifest (§A4). */\nexport const MAX_MANIFEST_VARIANTS = 64;\n/** MAX provenanceRefs[] (eventProvenance ids promoted into the case) on a manifest (§A4). */\nexport const MAX_MANIFEST_PROVENANCE_REFS = 64;\n/** MAX ncmecReceiptRefs[] on a manifest (§A4). */\nexport const MAX_MANIFEST_NCMEC_RECEIPTS = 32;\n/** MAX attachmentItemIds[] on a communication manifest (§A4). */\nexport const MAX_COMMUNICATION_ATTACHMENTS = 256;\n\n// ===========================================================================\n// §A4 — safetyEvidenceManifests/{manifestId} = SafetyEvidenceManifestV1\n// (Finding-H5). IMMUTABLE, versioned. `sourceKind` selects the present sub-object.\n// ===========================================================================\n\n/** The source-kind discriminator (Finding-H5). Selects WHICH sub-object is present\n * on the manifest: `media` → original/variants/lineage/evidenceCopy;\n * `communication` → communication; `externalFact` → externalFact. */\nexport const SafetyEvidenceSourceKindSchema = z.enum([\n  'media',\n  'communication',\n  'externalFact',\n]);\nexport type SafetyEvidenceSourceKind = z.infer<typeof SafetyEvidenceSourceKindSchema>;\n\n/** §A4 `original` — present ONLY when sourceKind='media'. The captured original\n * object descriptor (never a serving URL). */\nexport const SafetyEvidenceOriginalV1Schema = z.object({\n  bucket: z.string().min(1),\n  key: z.string().min(1),\n  generation: z.string().min(1),\n  contentType: z.string().min(1),\n  filename: z.string().min(1).optional(),\n  sizeBytes: z.number(),\n  md5: z.string().min(1),\n  sha256: z.string().min(1),\n  capturedAt: z.number(),\n}).strict();\nexport type SafetyEvidenceOriginalV1 = z.infer<typeof SafetyEvidenceOriginalV1Schema>;\n\n/** §A4 `variants[]` — media only; MAX 64. */\nexport const SafetyEvidenceVariantV1Schema = z.object({\n  variantKey: z.string().min(1),\n  sha256: z.string().min(1),\n  sizeBytes: z.number(),\n}).strict();\nexport type SafetyEvidenceVariantV1 = z.infer<typeof SafetyEvidenceVariantV1Schema>;\n\n/** §A4 `communication` — present ONLY when sourceKind='communication'.\n * `attachmentItemIds` MAX 256. */\nexport const SafetyEvidenceCommunicationV1Schema = z.object({\n  channelId: z.string().min(1),\n  messageSeqStart: z.number(),\n  messageSeqEnd: z.number(),\n  transcriptObjectRef: z.string().min(1),\n  attachmentItemIds: z.array(z.string().min(1)).max(MAX_COMMUNICATION_ATTACHMENTS),\n}).strict();\nexport type SafetyEvidenceCommunicationV1 = z.infer<typeof SafetyEvidenceCommunicationV1Schema>;\n\n/** §A4 externalFact `factKind`. */\nexport const SafetyEvidenceExternalFactKindSchema = z.enum([\n  'lawEnforcement',\n  'thirdPartyReport',\n  'operatorKnowledge',\n  'other',\n]);\nexport type SafetyEvidenceExternalFactKind = z.infer<typeof SafetyEvidenceExternalFactKindSchema>;\n\n/** §A4 `externalFact` — present ONLY when sourceKind='externalFact'. */\nexport const SafetyEvidenceExternalFactV1Schema = z.object({\n  factKind: SafetyEvidenceExternalFactKindSchema,\n  narrativeRef: z.string().min(1),\n  establishedActualKnowledgeAt: z.number().optional(),\n  sourceContactRef: z.string().min(1).optional(),\n}).strict();\nexport type SafetyEvidenceExternalFactV1 = z.infer<typeof SafetyEvidenceExternalFactV1Schema>;\n\n/** §A4 `detector` — never the raw hash. */\nexport const SafetyEvidenceDetectorV1Schema = z.object({\n  source: z.string().min(1),\n  listId: z.string().min(1),\n  sdkVersion: z.string().min(1),\n  requestTraceId: z.string().min(1),\n  matchResult: z.string().min(1),\n}).strict();\nexport type SafetyEvidenceDetectorV1 = z.infer<typeof SafetyEvidenceDetectorV1Schema>;\n\n/** §A4 `evidenceCopy` — media only; the verified evidence-vault copy descriptor. */\nexport const SafetyEvidenceCopyV1Schema = z.object({\n  destinationBucket: z.string().min(1),\n  destinationKey: z.string().min(1),\n  keyVersion: z.string().min(1),\n  verifyMethod: z.string().min(1),\n  verifyResult: z.string().min(1),\n}).strict();\nexport type SafetyEvidenceCopyV1 = z.infer<typeof SafetyEvidenceCopyV1Schema>;\n\n/** §A4 `reporter` — restricted; segregated from ordinary admin views. */\nexport const SafetyEvidenceReporterV1Schema = z.object({\n  reporterUidRef: z.string().min(1),\n  narrativeRef: z.string().min(1),\n}).strict();\nexport type SafetyEvidenceReporterV1 = z.infer<typeof SafetyEvidenceReporterV1Schema>;\n\n/**\n * `safetyEvidenceManifests/{manifestId}` — IMMUTABLE, versioned\n * SafetyEvidenceManifestV1 (Finding-H5). Doc id is the deterministic `manifestId`.\n *\n * **Invariant (H5) — enforced by the superRefine below:** no manifest may require a\n * null/placeholder media object. The sub-objects are present ONLY for their matching\n * `sourceKind`:\n *   - sourceKind='media'         → `original` + `lineage` REQUIRED; `variants`/\n *                                  `evidenceCopy` allowed; `communication`/\n *                                  `externalFact` MUST be absent.\n *   - sourceKind='communication' → `communication` REQUIRED; `original`/`variants`/\n *                                  `lineage`/`evidenceCopy`/`externalFact` MUST be absent.\n *   - sourceKind='externalFact'  → `externalFact` REQUIRED; `original`/`variants`/\n *                                  `lineage`/`evidenceCopy`/`communication` MUST be absent.\n *\n * Lineage-keyed auto-action + dedup (incident-wide blocking by `rootIngestId`,\n * auto-ban of `originatingUploaderUid`) apply ONLY to sourceKind='media' — a\n * communication/externalFact manifest carries no lineage and is multi-subject via\n * the case `…/accounts` subcollection (`subjectAccountsRef`), never a synthesized\n * uploader.\n */\nexport const SafetyEvidenceManifestV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  manifestId: z.string().min(1),\n  caseId: z.string().min(1),\n  createdAt: z.number(),\n  sourceKind: SafetyEvidenceSourceKindSchema, // REQUIRED — selects the present sub-object\n  original: SafetyEvidenceOriginalV1Schema.optional(), // present ONLY when sourceKind='media'\n  variants: z.array(SafetyEvidenceVariantV1Schema).max(MAX_MANIFEST_VARIANTS).optional(), // media only\n  lineage: MediaOriginLineageV1Schema.optional(), // present ONLY when sourceKind='media'\n  communication: SafetyEvidenceCommunicationV1Schema.optional(), // present ONLY when sourceKind='communication'\n  externalFact: SafetyEvidenceExternalFactV1Schema.optional(), // present ONLY when sourceKind='externalFact'\n  // multi-subject lives in the case childSafetyCases/{caseId}/accounts subcollection\n  // (no fake uploader on the manifest); this points at …/accounts:\n  subjectAccountsRef: z.string().min(1),\n  provenanceRefs: z.array(z.string().min(1)).max(MAX_MANIFEST_PROVENANCE_REFS), // eventProvenance ids promoted into the case\n  contentDocSnapshotRef: z.string().min(1).optional(),\n  contentDocRevision: z.number().optional(),\n  detector: SafetyEvidenceDetectorV1Schema.optional(), // never the raw hash\n  evidenceCopy: SafetyEvidenceCopyV1Schema.optional(), // media only\n  reporter: SafetyEvidenceReporterV1Schema.optional(), // restricted; segregated from ordinary admin views\n  ncmecReceiptRefs: z.array(z.string().min(1)).max(MAX_MANIFEST_NCMEC_RECEIPTS),\n}).strict().superRefine((val, ctx) => {\n  // H5 invariant: the sourceKind→present-object set. `media` requires original +\n  // lineage and forbids communication/externalFact; `communication` requires\n  // communication and forbids all media-only fields + externalFact; `externalFact`\n  // requires externalFact and forbids all media-only fields + communication.\n  const present = (field: string) =>\n    ctx.addIssue({ code: 'custom', path: [field], message: `${field} is only allowed when sourceKind matches` });\n  const missing = (field: string) =>\n    ctx.addIssue({ code: 'custom', path: [field], message: `${field} is required for this sourceKind` });\n\n  if (val.sourceKind === 'media') {\n    if (val.original === undefined) missing('original');\n    if (val.lineage === undefined) missing('lineage');\n    if (val.communication !== undefined) present('communication');\n    if (val.externalFact !== undefined) present('externalFact');\n  } else if (val.sourceKind === 'communication') {\n    if (val.communication === undefined) missing('communication');\n    if (val.original !== undefined) present('original');\n    if (val.variants !== undefined) present('variants');\n    if (val.lineage !== undefined) present('lineage');\n    if (val.evidenceCopy !== undefined) present('evidenceCopy');\n    if (val.externalFact !== undefined) present('externalFact');\n  } else {\n    // externalFact\n    if (val.externalFact === undefined) missing('externalFact');\n    if (val.original !== undefined) present('original');\n    if (val.variants !== undefined) present('variants');\n    if (val.lineage !== undefined) present('lineage');\n    if (val.evidenceCopy !== undefined) present('evidenceCopy');\n    if (val.communication !== undefined) present('communication');\n  }\n});\nexport type SafetyEvidenceManifestV1 = z.infer<typeof SafetyEvidenceManifestV1Schema>;\n\n// ===========================================================================\n// §A4 — safetyEvidenceJobs/{jobId} = SafetyEvidenceJobV1 (Finding-M2).\n// `verified` is disambiguated as a (phase, status) PAIR, never a bare status.\n// `commandId` is deterministic per (jobId, phase). One worker per phase drives:\n//   capture worker      → (capture: pending → running → verified) | (capture: deadLetter)\n//   verify worker       → (verify: pending → running → verified)\n//   disposition worker  → (disposition: pending → running → disposed) | (disposition: deadLetter)\n// (disposition runs only after preservationStatus=dispositionPending). Terminal\n// timestamps: completedAt on (capture|verify, verified), disposedAt on\n// (disposition, disposed), deadLetterAt on any deadLetter.\n// ===========================================================================\n\n/** §A4 job phase — one worker per phase. */\nexport const SafetyEvidenceJobPhaseSchema = z.enum([\n  'capture',\n  'verify',\n  'disposition',\n]);\nexport type SafetyEvidenceJobPhase = z.infer<typeof SafetyEvidenceJobPhaseSchema>;\n\n/** §A4 job status — disambiguated by the (phase, status) pairing rules above; never\n * a bare status. */\nexport const SafetyEvidenceJobStatusSchema = z.enum([\n  'pending',\n  'running',\n  'verified',\n  'disposed',\n  'deadLetter',\n]);\nexport type SafetyEvidenceJobStatus = z.infer<typeof SafetyEvidenceJobStatusSchema>;\n\n/** `safetyEvidenceJobs/{jobId}` — the capture/verify/disposition saga row\n * (Finding-M2). Doc id is the deterministic `jobId`. `commandId` is deterministic\n * per (jobId, phase) — idempotent + replayed by commandId. */\nexport const SafetyEvidenceJobV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  jobId: z.string().min(1),\n  caseId: z.string().min(1),\n  phase: SafetyEvidenceJobPhaseSchema,\n  commandId: z.string().min(1), // deterministic per (jobId, phase)\n  status: SafetyEvidenceJobStatusSchema,\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  leaseOwner: z.string().min(1).optional(),\n  leaseExpiresAt: z.number().optional(),\n  lastErrorCode: z.string().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  completedAt: z.number().optional(), // (capture|verify, verified)\n  disposedAt: z.number().optional(), // (disposition, disposed)\n  deadLetterAt: z.number().optional(), // any deadLetter\n}).strict();\nexport type SafetyEvidenceJobV1 = z.infer<typeof SafetyEvidenceJobV1Schema>;\n\n// ===========================================================================\n// §A4 subcollections under a job\n// ===========================================================================\n\n/** §A4 job-item role — the source object vs the destination (evidence-copy) object. */\nexport const SafetyEvidenceJobItemRoleSchema = z.enum(['source', 'destination']);\nexport type SafetyEvidenceJobItemRole = z.infer<typeof SafetyEvidenceJobItemRoleSchema>;\n\n/** §A4 job-item verify result. */\nexport const SafetyEvidenceJobItemVerifyResultSchema = z.enum(['pending', 'ok', 'mismatch']);\nexport type SafetyEvidenceJobItemVerifyResult = z.infer<typeof SafetyEvidenceJobItemVerifyResultSchema>;\n\n/** `safetyEvidenceJobs/{jobId}/items/{itemId}` — per-object source/destination row.\n * Doc id is the `itemId`. */\nexport const SafetyEvidenceJobItemV1Schema = z.object({\n  role: SafetyEvidenceJobItemRoleSchema,\n  bucket: z.string().min(1),\n  key: z.string().min(1),\n  generation: z.string().min(1).optional(),\n  sizeBytes: z.number(),\n  sha256: z.string().min(1),\n  md5: z.string().min(1).optional(),\n  verifyResult: SafetyEvidenceJobItemVerifyResultSchema,\n}).strict();\nexport type SafetyEvidenceJobItemV1 = z.infer<typeof SafetyEvidenceJobItemV1Schema>;\n\n/** §A4 disposition method (per evidence location). */\nexport const SafetyEvidenceDispositionMethodSchema = z.enum(['delete', 'cryptoErase']);\nexport type SafetyEvidenceDispositionMethod = z.infer<typeof SafetyEvidenceDispositionMethodSchema>;\n\n/** §A4 disposition result (per evidence location). */\nexport const SafetyEvidenceDispositionResultSchema = z.enum(['gone', 'leftover']);\nexport type SafetyEvidenceDispositionResult = z.infer<typeof SafetyEvidenceDispositionResultSchema>;\n\n/** `safetyEvidenceJobs/{jobId}/disposition/{locationId}` — per-evidence-location\n * deletion-verification record. Doc id is the `locationId`.\n *\n * [M-5] This IS the durable hard-deletion attestation body: the disposition worker runs only after\n * the case reaches `preservationStatus:'dispositionPending'` (every hold ref released + a reviewed\n * disposition job), and records `method` + `verifiedAt` + `result`. Because soft-delete is DISABLED\n * on the evidence bucket, `result:'gone'` attests a verified TRUE hard-deletion (there is no\n * soft-delete/lifecycle tombstone to model — no `softDeletedAt`/`hardDeleteTime`). `generation`\n * pins the exact object generation that was destroyed, so a later object re-created at the same\n * bucket/key (a new generation) is never falsely attested as this destruction. */\nexport const SafetyEvidenceDispositionV1Schema = z.object({\n  bucket: z.string().min(1),\n  key: z.string().min(1),\n  // [M-5] the exact object generation this record attests destroyed — pins the attestation to a\n  // single immutable object version so a same-key re-upload (new generation) is not covered by it.\n  // Optional: an object with no generation concept (or a leftover with none read) omits it.\n  generation: z.string().min(1).optional(),\n  method: SafetyEvidenceDispositionMethodSchema,\n  verifiedAt: z.number(),\n  result: SafetyEvidenceDispositionResultSchema,\n  leftoverDetail: z.string().min(1).optional(),\n}).strict();\nexport type SafetyEvidenceDispositionV1 = z.infer<typeof SafetyEvidenceDispositionV1Schema>;\n"]}
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../../src/doc-schemas/safety/evidence.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,mBAAmB;AACnB,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,iFAAiF;AACjF,uCAAuC;AACvC,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,4DAA4D;AAC5D,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,mFAAmF;AACnF,8DAA8D;AAC9D,EAAE;AACF,mFAAmF;AACnF,gEAAgE;AAChE,EAAE;AACF,kFAAkF;AAClF,qEAAqE;AACrE,oFAAoF;AACpF,0EAA0E;AAC1E,mCAAmC;AAEnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,8EAA8E;AAC9E,kFAAkF;AAClF,gFAAgF;AAChF,sFAAsF;AACtF,mDAAmD;AACnD,8EAA8E;AAE9E,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,kDAAkD;AAClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,8EAA8E;AAC9E,wEAAwE;AACxE,mFAAmF;AACnF,8EAA8E;AAE9E;;qEAEqE;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC;IACnD,OAAO;IACP,eAAe;IACf,cAAc;CACf,CAAC,CAAC;AAGH;8CAC8C;AAC9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,6CAA6C;AAC7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;kCACkC;AAClC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;CACjF,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,mCAAmC;AACnC,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,IAAI,CAAC;IACzD,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,OAAO;CACR,CAAC,CAAC;AAGH,wEAAwE;AACxE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,QAAQ,EAAE,oCAAoC;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,2CAA2C;AAC3C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,oFAAoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,yEAAyE;AACzE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,8BAA8B,EAAE,4CAA4C;IACxF,QAAQ,EAAE,8BAA8B,CAAC,QAAQ,EAAE,EAAE,uCAAuC;IAC5F,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,EAAE,aAAa;IACrG,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE,EAAE,uCAAuC;IACvF,aAAa,EAAE,mCAAmC,CAAC,QAAQ,EAAE,EAAE,+CAA+C;IAC9G,YAAY,EAAE,kCAAkC,CAAC,QAAQ,EAAE,EAAE,8CAA8C;IAC3G,mFAAmF;IACnF,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,6CAA6C;IAC3H,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,8BAA8B,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IAC1E,YAAY,EAAE,0BAA0B,CAAC,QAAQ,EAAE,EAAE,aAAa;IAClE,QAAQ,EAAE,8BAA8B,CAAC,QAAQ,EAAE,EAAE,mDAAmD;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;CAC9E,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACnC,+EAA+E;IAC/E,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAChC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,0CAA0C,EAAE,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAChC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,kCAAkC,EAAE,CAAC,CAAC;IAEvG,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,eAAe;QACf,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAC9E,gFAAgF;AAChF,0FAA0F;AAC1F,iEAAiE;AACjE,kGAAkG;AAClG,gFAAgF;AAChF,uEAAuE;AACvE,2DAA2D;AAC3D,8EAA8E;AAE9E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,SAAS;IACT,QAAQ;IACR,aAAa;CACd,CAAC,CAAC;AAGH;oBACoB;AACpB,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAGH;;8DAE8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,4BAA4B;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mCAAmC;IACjE,MAAM,EAAE,6BAA6B;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,6BAA6B;IACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0BAA0B;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,iBAAiB;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAGjF,kCAAkC;AAClC,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAG7F;6BAC6B;AAC7B,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,+BAA+B;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,uCAAuC;CACtD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,sDAAsD;AACtD,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAGvF,sDAAsD;AACtD,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAGlF;;;;;;;;;kFASkF;AAClF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,8FAA8F;IAC9F,iGAAiG;IACjG,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,qCAAqC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,qCAAqC;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — the evidence cluster (Appendix A §A4, Finding-H5 / Finding-M2).\n//\n// Two collections:\n//   - `safetyEvidenceManifests/{manifestId}` = SafetyEvidenceManifestV1 — an\n//     IMMUTABLE, versioned manifest. Finding-H5: a manifest is NO LONGER\n//     media-shaped — a `sourceKind` discriminator ('media'|'communication'|\n//     'externalFact') selects WHICH sub-object is present. No manifest may carry\n//     a null/placeholder media object.\n//   - `safetyEvidenceJobs/{jobId}` = SafetyEvidenceJobV1 — the capture/verify/\n//     disposition saga row (Finding-M2: `commandId` + terminal timestamps; the\n//     `verified` status is disambiguated as a (phase, status) PAIR, never a bare\n//     status) with two subcollections: …/items/{itemId} and\n//     …/disposition/{locationId}.\n//\n// Every shape here is transcribed verbatim from the frozen Trust & Safety spec\n// (Appendix A §A4) — no invented values, no placeholders; the durable design owner\n// is ttt-prod docs/design/safety-evidence-control-profile.md.\n//\n// SHARED media lineage comes from ../media-assets.js (the single canonical lineage\n// used by media, CSAM, and safety); it is NEVER redefined here.\n//\n// Collection note: this cluster introduces TWO NEW Firestore collections plus two\n// subcollections under `safetyEvidenceJobs`. Wiring collections.ts /\n// path-builders.ts / registry.ts is deferred to the app leg (the orchestrator binds\n// the schemas + path builders there); the deterministic doc-id shapes are\n// documented on each schema below.\n\nimport { z } from 'zod';\nimport { MediaOriginLineageV1Schema } from '../media-assets.js';\n\n// ===========================================================================\n// §A4 manifest / communication array caps — the ONE named declaration (ARCH-102).\n// Every `.max(...)` bound below derives from these; the app's evidence-manifest\n// writer imports the SAME constants for its `bound(...)` checks so the schema and the\n// writer can never drift to two different numbers.\n// ===========================================================================\n\n/** MAX variants[] on a media manifest (§A4). */\nexport const MAX_MANIFEST_VARIANTS = 64;\n/** MAX provenanceRefs[] (eventProvenance ids promoted into the case) on a manifest (§A4). */\nexport const MAX_MANIFEST_PROVENANCE_REFS = 64;\n/** MAX ncmecReceiptRefs[] on a manifest (§A4). */\nexport const MAX_MANIFEST_NCMEC_RECEIPTS = 32;\n/** MAX attachmentItemIds[] on a communication manifest (§A4). */\nexport const MAX_COMMUNICATION_ATTACHMENTS = 256;\n\n// ===========================================================================\n// §A4 — safetyEvidenceManifests/{manifestId} = SafetyEvidenceManifestV1\n// (Finding-H5). IMMUTABLE, versioned. `sourceKind` selects the present sub-object.\n// ===========================================================================\n\n/** The source-kind discriminator (Finding-H5). Selects WHICH sub-object is present\n * on the manifest: `media` → original/variants/lineage/evidenceCopy;\n * `communication` → communication; `externalFact` → externalFact. */\nexport const SafetyEvidenceSourceKindSchema = z.enum([\n  'media',\n  'communication',\n  'externalFact',\n]);\nexport type SafetyEvidenceSourceKind = z.infer<typeof SafetyEvidenceSourceKindSchema>;\n\n/** §A4 `original` — present ONLY when sourceKind='media'. The captured original\n * object descriptor (never a serving URL). */\nexport const SafetyEvidenceOriginalV1Schema = z.object({\n  bucket: z.string().min(1),\n  key: z.string().min(1),\n  generation: z.string().min(1),\n  contentType: z.string().min(1),\n  filename: z.string().min(1).optional(),\n  sizeBytes: z.number(),\n  md5: z.string().min(1),\n  sha256: z.string().min(1),\n  capturedAt: z.number(),\n}).strict();\nexport type SafetyEvidenceOriginalV1 = z.infer<typeof SafetyEvidenceOriginalV1Schema>;\n\n/** §A4 `variants[]` — media only; MAX 64. */\nexport const SafetyEvidenceVariantV1Schema = z.object({\n  variantKey: z.string().min(1),\n  sha256: z.string().min(1),\n  sizeBytes: z.number(),\n}).strict();\nexport type SafetyEvidenceVariantV1 = z.infer<typeof SafetyEvidenceVariantV1Schema>;\n\n/** §A4 `communication` — present ONLY when sourceKind='communication'.\n * `attachmentItemIds` MAX 256. */\nexport const SafetyEvidenceCommunicationV1Schema = z.object({\n  channelId: z.string().min(1),\n  messageSeqStart: z.number(),\n  messageSeqEnd: z.number(),\n  transcriptObjectRef: z.string().min(1),\n  attachmentItemIds: z.array(z.string().min(1)).max(MAX_COMMUNICATION_ATTACHMENTS),\n}).strict();\nexport type SafetyEvidenceCommunicationV1 = z.infer<typeof SafetyEvidenceCommunicationV1Schema>;\n\n/** §A4 externalFact `factKind`. */\nexport const SafetyEvidenceExternalFactKindSchema = z.enum([\n  'lawEnforcement',\n  'thirdPartyReport',\n  'operatorKnowledge',\n  'other',\n]);\nexport type SafetyEvidenceExternalFactKind = z.infer<typeof SafetyEvidenceExternalFactKindSchema>;\n\n/** §A4 `externalFact` — present ONLY when sourceKind='externalFact'. */\nexport const SafetyEvidenceExternalFactV1Schema = z.object({\n  factKind: SafetyEvidenceExternalFactKindSchema,\n  narrativeRef: z.string().min(1),\n  establishedActualKnowledgeAt: z.number().optional(),\n  sourceContactRef: z.string().min(1).optional(),\n}).strict();\nexport type SafetyEvidenceExternalFactV1 = z.infer<typeof SafetyEvidenceExternalFactV1Schema>;\n\n/** §A4 `detector` — never the raw hash. */\nexport const SafetyEvidenceDetectorV1Schema = z.object({\n  source: z.string().min(1),\n  listId: z.string().min(1),\n  sdkVersion: z.string().min(1),\n  requestTraceId: z.string().min(1),\n  matchResult: z.string().min(1),\n}).strict();\nexport type SafetyEvidenceDetectorV1 = z.infer<typeof SafetyEvidenceDetectorV1Schema>;\n\n/** §A4 `evidenceCopy` — media only; the verified evidence-vault copy descriptor. */\nexport const SafetyEvidenceCopyV1Schema = z.object({\n  destinationBucket: z.string().min(1),\n  destinationKey: z.string().min(1),\n  keyVersion: z.string().min(1),\n  verifyMethod: z.string().min(1),\n  verifyResult: z.string().min(1),\n}).strict();\nexport type SafetyEvidenceCopyV1 = z.infer<typeof SafetyEvidenceCopyV1Schema>;\n\n/** §A4 `reporter` — restricted; segregated from ordinary admin views. */\nexport const SafetyEvidenceReporterV1Schema = z.object({\n  reporterUidRef: z.string().min(1),\n  narrativeRef: z.string().min(1),\n}).strict();\nexport type SafetyEvidenceReporterV1 = z.infer<typeof SafetyEvidenceReporterV1Schema>;\n\n/**\n * `safetyEvidenceManifests/{manifestId}` — IMMUTABLE, versioned\n * SafetyEvidenceManifestV1 (Finding-H5). Doc id is the deterministic `manifestId`.\n *\n * **Invariant (H5) — enforced by the superRefine below:** no manifest may require a\n * null/placeholder media object. The sub-objects are present ONLY for their matching\n * `sourceKind`:\n *   - sourceKind='media'         → `original` + `lineage` REQUIRED; `variants`/\n *                                  `evidenceCopy` allowed; `communication`/\n *                                  `externalFact` MUST be absent.\n *   - sourceKind='communication' → `communication` REQUIRED; `original`/`variants`/\n *                                  `lineage`/`evidenceCopy`/`externalFact` MUST be absent.\n *   - sourceKind='externalFact'  → `externalFact` REQUIRED; `original`/`variants`/\n *                                  `lineage`/`evidenceCopy`/`communication` MUST be absent.\n *\n * Lineage-keyed auto-action + dedup (incident-wide blocking by `rootIngestId`,\n * auto-ban of `originatingUploaderUid`) apply ONLY to sourceKind='media' — a\n * communication/externalFact manifest carries no lineage and is multi-subject via\n * the case `…/accounts` subcollection (`subjectAccountsRef`), never a synthesized\n * uploader.\n */\nexport const SafetyEvidenceManifestV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  manifestId: z.string().min(1),\n  caseId: z.string().min(1),\n  createdAt: z.number(),\n  sourceKind: SafetyEvidenceSourceKindSchema, // REQUIRED — selects the present sub-object\n  original: SafetyEvidenceOriginalV1Schema.optional(), // present ONLY when sourceKind='media'\n  variants: z.array(SafetyEvidenceVariantV1Schema).max(MAX_MANIFEST_VARIANTS).optional(), // media only\n  lineage: MediaOriginLineageV1Schema.optional(), // present ONLY when sourceKind='media'\n  communication: SafetyEvidenceCommunicationV1Schema.optional(), // present ONLY when sourceKind='communication'\n  externalFact: SafetyEvidenceExternalFactV1Schema.optional(), // present ONLY when sourceKind='externalFact'\n  // multi-subject lives in the case childSafetyCases/{caseId}/accounts subcollection\n  // (no fake uploader on the manifest); this points at …/accounts:\n  subjectAccountsRef: z.string().min(1),\n  provenanceRefs: z.array(z.string().min(1)).max(MAX_MANIFEST_PROVENANCE_REFS), // eventProvenance ids promoted into the case\n  contentDocSnapshotRef: z.string().min(1).optional(),\n  contentDocRevision: z.number().optional(),\n  detector: SafetyEvidenceDetectorV1Schema.optional(), // never the raw hash\n  evidenceCopy: SafetyEvidenceCopyV1Schema.optional(), // media only\n  reporter: SafetyEvidenceReporterV1Schema.optional(), // restricted; segregated from ordinary admin views\n  ncmecReceiptRefs: z.array(z.string().min(1)).max(MAX_MANIFEST_NCMEC_RECEIPTS),\n}).strict().superRefine((val, ctx) => {\n  // H5 invariant: the sourceKind→present-object set. `media` requires original +\n  // lineage and forbids communication/externalFact; `communication` requires\n  // communication and forbids all media-only fields + externalFact; `externalFact`\n  // requires externalFact and forbids all media-only fields + communication.\n  const present = (field: string) =>\n    ctx.addIssue({ code: 'custom', path: [field], message: `${field} is only allowed when sourceKind matches` });\n  const missing = (field: string) =>\n    ctx.addIssue({ code: 'custom', path: [field], message: `${field} is required for this sourceKind` });\n\n  if (val.sourceKind === 'media') {\n    if (val.original === undefined) missing('original');\n    if (val.lineage === undefined) missing('lineage');\n    if (val.communication !== undefined) present('communication');\n    if (val.externalFact !== undefined) present('externalFact');\n  } else if (val.sourceKind === 'communication') {\n    if (val.communication === undefined) missing('communication');\n    if (val.original !== undefined) present('original');\n    if (val.variants !== undefined) present('variants');\n    if (val.lineage !== undefined) present('lineage');\n    if (val.evidenceCopy !== undefined) present('evidenceCopy');\n    if (val.externalFact !== undefined) present('externalFact');\n  } else {\n    // externalFact\n    if (val.externalFact === undefined) missing('externalFact');\n    if (val.original !== undefined) present('original');\n    if (val.variants !== undefined) present('variants');\n    if (val.lineage !== undefined) present('lineage');\n    if (val.evidenceCopy !== undefined) present('evidenceCopy');\n    if (val.communication !== undefined) present('communication');\n  }\n});\nexport type SafetyEvidenceManifestV1 = z.infer<typeof SafetyEvidenceManifestV1Schema>;\n\n// ===========================================================================\n// §A4 — safetyEvidenceJobs/{jobId} = SafetyEvidenceJobV1 (Finding-M2).\n// `verified` is disambiguated as a (phase, status) PAIR, never a bare status.\n// `commandId` is deterministic per (jobId, phase). One worker per phase drives:\n//   capture worker      → (capture: pending → running → verified) | (capture: deadLetter)\n//   verify worker       → (verify: pending → running → verified)\n//   disposition worker  → (disposition: pending → running → disposed) | (disposition: deadLetter)\n// (disposition runs only after preservationStatus=dispositionPending). Terminal\n// timestamps: completedAt on (capture|verify, verified), disposedAt on\n// (disposition, disposed), deadLetterAt on any deadLetter.\n// ===========================================================================\n\n/** §A4 job phase — one worker per phase. */\nexport const SafetyEvidenceJobPhaseSchema = z.enum([\n  'capture',\n  'verify',\n  'disposition',\n]);\nexport type SafetyEvidenceJobPhase = z.infer<typeof SafetyEvidenceJobPhaseSchema>;\n\n/** §A4 job status — disambiguated by the (phase, status) pairing rules above; never\n * a bare status. */\nexport const SafetyEvidenceJobStatusSchema = z.enum([\n  'pending',\n  'running',\n  'verified',\n  'disposed',\n  'deadLetter',\n]);\nexport type SafetyEvidenceJobStatus = z.infer<typeof SafetyEvidenceJobStatusSchema>;\n\n/** `safetyEvidenceJobs/{jobId}` — the capture/verify/disposition saga row\n * (Finding-M2). Doc id is the deterministic `jobId`. `commandId` is deterministic\n * per (jobId, phase) — idempotent + replayed by commandId. */\nexport const SafetyEvidenceJobV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  jobId: z.string().min(1),\n  caseId: z.string().min(1),\n  phase: SafetyEvidenceJobPhaseSchema,\n  commandId: z.string().min(1), // deterministic per (jobId, phase)\n  status: SafetyEvidenceJobStatusSchema,\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  leaseOwner: z.string().min(1).optional(),\n  leaseExpiresAt: z.number().optional(),\n  lastErrorCode: z.string().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  completedAt: z.number().optional(), // (capture|verify, verified)\n  disposedAt: z.number().optional(), // (disposition, disposed)\n  deadLetterAt: z.number().optional(), // any deadLetter\n}).strict();\nexport type SafetyEvidenceJobV1 = z.infer<typeof SafetyEvidenceJobV1Schema>;\n\n// ===========================================================================\n// §A4 subcollections under a job\n// ===========================================================================\n\n/** §A4 job-item role — the source object vs the destination (evidence-copy) object. */\nexport const SafetyEvidenceJobItemRoleSchema = z.enum(['source', 'destination']);\nexport type SafetyEvidenceJobItemRole = z.infer<typeof SafetyEvidenceJobItemRoleSchema>;\n\n/** §A4 job-item verify result. */\nexport const SafetyEvidenceJobItemVerifyResultSchema = z.enum(['pending', 'ok', 'mismatch']);\nexport type SafetyEvidenceJobItemVerifyResult = z.infer<typeof SafetyEvidenceJobItemVerifyResultSchema>;\n\n/** `safetyEvidenceJobs/{jobId}/items/{itemId}` — per-object source/destination row.\n * Doc id is the `itemId`. */\nexport const SafetyEvidenceJobItemV1Schema = z.object({\n  role: SafetyEvidenceJobItemRoleSchema,\n  bucket: z.string().min(1),\n  key: z.string().min(1),\n  generation: z.string().min(1).optional(),\n  sizeBytes: z.number(),\n  sha256: z.string().min(1),\n  md5: z.string().min(1).optional(),\n  verifyResult: SafetyEvidenceJobItemVerifyResultSchema,\n}).strict();\nexport type SafetyEvidenceJobItemV1 = z.infer<typeof SafetyEvidenceJobItemV1Schema>;\n\n/** §A4 disposition method (per evidence location). */\nexport const SafetyEvidenceDispositionMethodSchema = z.enum(['delete', 'cryptoErase']);\nexport type SafetyEvidenceDispositionMethod = z.infer<typeof SafetyEvidenceDispositionMethodSchema>;\n\n/** §A4 disposition result (per evidence location). */\nexport const SafetyEvidenceDispositionResultSchema = z.enum(['gone', 'leftover']);\nexport type SafetyEvidenceDispositionResult = z.infer<typeof SafetyEvidenceDispositionResultSchema>;\n\n/** `safetyEvidenceJobs/{jobId}/disposition/{locationId}` — per-evidence-location\n * deletion-verification record. Doc id is the `locationId`.\n *\n * [M-5] This IS the durable hard-deletion attestation body: the disposition worker runs only after\n * the case reaches `preservationStatus:'dispositionPending'` (every hold ref released + a reviewed\n * disposition job), and records `method` + `verifiedAt` + `result`. Because soft-delete is DISABLED\n * on the evidence bucket, `result:'gone'` attests a verified TRUE hard-deletion (there is no\n * soft-delete/lifecycle tombstone to model — no `softDeletedAt`/`hardDeleteTime`). `generation`\n * pins the exact object generation that was destroyed, so a later object re-created at the same\n * bucket/key (a new generation) is never falsely attested as this destruction. */\nexport const SafetyEvidenceDispositionV1Schema = z.object({\n  bucket: z.string().min(1),\n  key: z.string().min(1),\n  // [M-5] the exact object generation this record attests destroyed — pins the attestation to a\n  // single immutable object version so a same-key re-upload (new generation) is not covered by it.\n  // Optional: an object with no generation concept (or a leftover with none read) omits it.\n  generation: z.string().min(1).optional(),\n  method: SafetyEvidenceDispositionMethodSchema,\n  verifiedAt: z.number(),\n  result: SafetyEvidenceDispositionResultSchema,\n  leftoverDetail: z.string().min(1).optional(),\n}).strict();\nexport type SafetyEvidenceDispositionV1 = z.infer<typeof SafetyEvidenceDispositionV1Schema>;\n"]}

package/dist/doc-schemas/safety/foundation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"foundation.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/safety/foundation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;gFACgF;AAChF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;EAa7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,0EAGO,CAAC;AAE7C,gEAAgE;AAChE,eAAO,MAAM,mBAAmB;;;EAA0C,CAAC;AAC3E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;qEAEqE;AACrE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;EA2BnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;oFAGoF;AACpF,eAAO,MAAM,sBAAsB,yDAGe,CAAC;AAEnD;mFACmF;AACnF,eAAO,MAAM,+BAA+B,iOAaM,CAAC;AACnD,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAO1F;wEACwE;AACxE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA2BhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,kFAAkF;AAClF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;EAsBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF;mFACmF;AACnF,eAAO,MAAM,uBAAuB;;;;;EAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;0FAG0F;AAC1F,eAAO,MAAM,iCAAiC;;;;;;;;EAS5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;yDACyD;AACzD,eAAO,MAAM,wCAAwC,0DAGM,CAAC;AAE5D;kGACkG;AAClG,eAAO,MAAM,qCAAqC,8IAMS,CAAC;AAE5D;;;;;0FAK0F;AAC1F,eAAO,MAAM,uCAAuC,EAAE,MAAM,CAC1D,iBAAiB,EACjB,SAAS,2BAA2B,EAAE,CAMvC,CAAC;AAEF;;+FAE+F;AAC/F,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE;IAAE,WAAW,EAAE,iBAAiB,CAAC;IAAC,qBAAqB,EAAE,2BAA2B,CAAA;CAAE,EAC7F,GAAG,EAAE,CAAC,CAAC,aAAa,GACnB,IAAI,CAQN;AAED;;;;;oFAKoF;AACpF,wBAAgB,mCAAmC,CACjD,KAAK,EAAE;IAAE,WAAW,EAAE,iBAAiB,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC1E,GAAG,EAAE,CAAC,CAAC,aAAa,GACnB,IAAI,CASN;AAYD,mFAAmF;AACnF,eAAO,MAAM,8BAA8B;;;EAAmC,CAAC;AAC/E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,oEAAoE;AACpE,eAAO,MAAM,yBAAyB;;;;;;;;;kBAM3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;4CAQ4C;AAC5C,eAAO,MAAM,0BAA0B;;;EAGrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E,eAAO,MAAM,4BAA4B;;;;;;;;;EASvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB;;;;;;EAWhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sDAAsD;AACtD,eAAO,MAAM,uBAAuB;;;;EAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAOxE,eAAO,MAAM,8BAA8B;;;;;;EAMzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAQtF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;EAa9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,kFAAkF;AAClF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;EAapC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,kFAAkF;AAClF,eAAO,MAAM,gCAAgC;;;;;;;;;EAS3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;6BAC6B;AAC7B,eAAO,MAAM,iCAAiC;;;;;;;;;;;;EAY5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,qEAAqE;AACrE,eAAO,MAAM,6BAA6B;;;EAAyD,CAAC;AACpG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qDAAqD;AACrD,eAAO,MAAM,kCAAkC;;;EAAqC,CAAC;AACrF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,8BAA8B;;;;;EAA4D,CAAC;AACxG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;+EAE+E;AAC/E,eAAO,MAAM,4BAA4B;;;;;;;EAOvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,mCAAmC;AACnC,eAAO,MAAM,oBAAoB;;;;;;;;;;;EAW/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,sBAAsB;;;;;EAA0D,CAAC;AAC9F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,kFAAkF;AAClF,eAAO,MAAM,kCAAkC;;;;EAI7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,uBAAuB;;;;;;;;EAQlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,uBAAuB;;;;;;;;EAQlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B;;;;EAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;0CAQ0C;AAC1C,eAAO,MAAM,wBAAwB;;;;;;;;EAQnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,0DAA0D;AAC1D,eAAO,MAAM,+BAA+B;;;;;EAK1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAOxF,eAAO,MAAM,yBAAyB;;;;;EAAkE,CAAC;AACzG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,wBAAwB;;;;;EAKnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;kBAMhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;0CAK0C;AAC1C,eAAO,MAAM,8BAA8B;;;;EAAwC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"foundation.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/safety/foundation.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;gFACgF;AAChF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;EAa7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,0EAGO,CAAC;AAE7C,gEAAgE;AAChE,eAAO,MAAM,mBAAmB;;;EAA0C,CAAC;AAC3E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;qEAEqE;AACrE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;EA2BnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;oFAGoF;AACpF,eAAO,MAAM,sBAAsB,yDAGe,CAAC;AAEnD;mFACmF;AACnF,eAAO,MAAM,+BAA+B,iOAaM,CAAC;AACnD,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAO1F;wEACwE;AACxE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA2BhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,kFAAkF;AAClF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;EAsBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF;mFACmF;AACnF,eAAO,MAAM,uBAAuB;;;;;EAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;0FAG0F;AAC1F,eAAO,MAAM,iCAAiC;;;;;;;;EAS5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;yDACyD;AACzD,eAAO,MAAM,wCAAwC,0DAGM,CAAC;AAE5D;kGACkG;AAClG,eAAO,MAAM,qCAAqC,8IAMS,CAAC;AAE5D;;;;;0FAK0F;AAC1F,eAAO,MAAM,uCAAuC,EAAE,MAAM,CAC1D,iBAAiB,EACjB,SAAS,2BAA2B,EAAE,CAMvC,CAAC;AAEF;;+FAE+F;AAC/F,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE;IAAE,WAAW,EAAE,iBAAiB,CAAC;IAAC,qBAAqB,EAAE,2BAA2B,CAAA;CAAE,EAC7F,GAAG,EAAE,CAAC,CAAC,aAAa,GACnB,IAAI,CAQN;AAED;;;;;oFAKoF;AACpF,wBAAgB,mCAAmC,CACjD,KAAK,EAAE;IAAE,WAAW,EAAE,iBAAiB,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC1E,GAAG,EAAE,CAAC,CAAC,aAAa,GACnB,IAAI,CASN;AAYD,mFAAmF;AACnF,eAAO,MAAM,8BAA8B;;;EAAmC,CAAC;AAC/E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,oEAAoE;AACpE,eAAO,MAAM,yBAAyB;;;;;;;;;kBAM3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;4CAQ4C;AAC5C,eAAO,MAAM,0BAA0B;;;EAGrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E,eAAO,MAAM,4BAA4B;;;;;;;;;EASvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB;;;;;;EAWhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sDAAsD;AACtD,eAAO,MAAM,uBAAuB;;;;EAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAOxE,eAAO,MAAM,8BAA8B;;;;;;EAMzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAQtF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;EAa9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,kFAAkF;AAClF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;EAapC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,kFAAkF;AAClF,eAAO,MAAM,gCAAgC;;;;;;;;;EAS3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;6BAC6B;AAC7B,eAAO,MAAM,iCAAiC;;;;;;;;;;;;EAY5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,qEAAqE;AACrE,eAAO,MAAM,6BAA6B;;;EAAyD,CAAC;AACpG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qDAAqD;AACrD,eAAO,MAAM,kCAAkC;;;EAAqC,CAAC;AACrF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,8BAA8B;;;;;EAA4D,CAAC;AACxG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;+EAE+E;AAC/E,eAAO,MAAM,4BAA4B;;;;;;;EAOvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,mCAAmC;AACnC,eAAO,MAAM,oBAAoB;;;;;;;;;;;EAW/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,sBAAsB;;;;;EAA0D,CAAC;AAC9F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,kFAAkF;AAClF,eAAO,MAAM,kCAAkC;;;;EAI7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,uBAAuB;;;;;;;;EAQlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,uBAAuB;;;;;;;;EAQlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B;;;;EAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;0CAQ0C;AAC1C,eAAO,MAAM,wBAAwB;;;;;;;;EAQnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,0DAA0D;AAC1D,eAAO,MAAM,+BAA+B;;;;;EAK1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAOxF,eAAO,MAAM,yBAAyB;;;;;EAAkE,CAAC;AACzG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,wBAAwB;;;;;EAKnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;kBAMhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;0CAK0C;AAC1C,eAAO,MAAM,8BAA8B;;;;EAAwC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/doc-schemas/safety/foundation.js

@@ -4,9 +4,11 @@
 // than one T&S cluster (report spine, case spine, holds, evidence, sagas,
 // NCMEC, NCII). Cluster document-schema files import their value sets from
 // HERE so two clusters can never define the same enum with drifting values.
-// Every value is transcribed verbatim from docs/code_changes_needed/
-// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A (the frozen spec) — no
-// invented values, no placeholders.
+// Every value is transcribed verbatim from the frozen Trust & Safety spec
+// (Appendix A) — no invented values, no placeholders; the durable design owners
+// are ttt-prod docs/design/csam-detection-and-response.md,
+// docs/design/content-moderation-and-reporting.md, and
+// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.
 //
 // Cross-boundary: these types are consumed by both functions/src and src/ in
 // ttt-prod, so they live in ttt-core (the single source of truth for the

package/dist/doc-schemas/safety/foundation.js.map

@@ -1 +1 @@
-{"version":3,"file":"foundation.js","sourceRoot":"","sources":["../../../src/doc-schemas/safety/foundation.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,qEAAqE;AACrE,4EAA4E;AAC5E,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,wBAAwB;AAExB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;gFACgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,MAAM;IACN,YAAY;IACZ,aAAa;IACb,qBAAqB;IACrB,gBAAgB;IAChB,WAAW;IACX,eAAe;IACf,uBAAuB;IACvB,sBAAsB,EAAE,oCAAoC;IAC5D,qCAAqC,EAAE,6BAA6B;IACpE,sCAAsC;IACtC,OAAO;CACR,CAAC,CAAC;AAGH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,sBAAsB;IACtB,qCAAqC;CACK,CAAC;AAE7C,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;qEAEqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,UAAU;IACV,aAAa;IACb,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,sBAAsB;IACtB,oBAAoB;IACpB,uFAAuF;IACvF,kFAAkF;IAClF,+EAA+E;IAC/E,oFAAoF;IACpF,uDAAuD;IACvD,oBAAoB;IACpB,mBAAmB;IACnB,4FAA4F;IAC5F,+FAA+F;IAC/F,2FAA2F;IAC3F,oGAAoG;IACpG,yCAAyC;IACzC,uBAAuB;IACvB,UAAU;IACV,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAGH;;;oFAGoF;AACpF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,oBAAoB;IACpB,sBAAsB;CAC0B,CAAC;AAEnD;mFACmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,qBAAqB;IACrB,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,qBAAqB;IACrB,YAAY;IACZ,iBAAiB;IACjB,mBAAmB;IACnB,uBAAuB;IACvB,aAAa;IACb,iFAAiF;IACjF,oBAAoB;CAC4B,CAAC;AAGnD,8EAA8E;AAC9E,+EAA+E;AAC/E,mEAAmE;AACnE,8EAA8E;AAE9E;wEACwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAChE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1H,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACjF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACpH,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACnG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7I,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACvF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrH,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACnF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACjF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1H,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACxH,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrJ,qFAAqF;IACrF,yFAAyF;IACzF,mFAAmF;IACnF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACtH,iEAAiE;IACjE,wFAAwF;IACxF,yFAAyF;IACzF,sBAAsB;IACtB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5H,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACrF,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,cAAc;IACd,UAAU;IACV,YAAY;IACZ,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,WAAW;IACX,WAAW;IACX,UAAU;IACV,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,+FAA+F;IAC/F,kBAAkB;IAClB,gFAAgF;IAChF,kBAAkB;IAClB,KAAK;IACL,gBAAgB;CACjB,CAAC,CAAC;AAGH,mFAAmF;AACnF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,uBAAuB;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;mFACmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,8BAA8B;CAC/B,CAAC,CAAC;AAGH;;;0FAG0F;AAC1F,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC;IACtD,mBAAmB;IACnB,4BAA4B;IAC5B,wBAAwB;IACxB,oBAAoB;IACpB,8BAA8B;IAC9B,0EAA0E;IAC1E,uBAAuB,EAAE,uCAAuC;IAChE,oBAAoB,EAAE,uBAAuB;CAC9C,CAAC,CAAC;AAGH;yDACyD;AACzD,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,uBAAuB;IACvB,oBAAoB;CACqC,CAAC;AAE5D;kGACkG;AAClG,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,mBAAmB;IACnB,4BAA4B;IAC5B,wBAAwB;IACxB,oBAAoB;IACpB,8BAA8B;CAC2B,CAAC;AAE5D;;;;;0FAK0F;AAC1F,MAAM,CAAC,MAAM,uCAAuC,GAGhD;IACF,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,wCAAwC;IACxD,WAAW,EAAE,qCAAqC;IAClD,4BAA4B,EAAE,qCAAqC;CACpE,CAAC;AAEF;;+FAE+F;AAC/F,MAAM,UAAU,iCAAiC,CAC/C,KAA6F,EAC7F,GAAoB;IAEpB,IAAI,CAAC,uCAAuC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,uBAAuB,CAAC;YAC/B,OAAO,EAAE,gBAAgB,KAAK,CAAC,qBAAqB,mCAAmC,KAAK,CAAC,WAAW,IAAI;SAC7G,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;oFAKoF;AACpF,MAAM,UAAU,mCAAmC,CACjD,KAA0E,EAC1E,GAAoB;IAEpB,IAAI,KAAK,CAAC,WAAW,KAAK,gBAAgB,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EACL,qGAAqG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,mFAAmF;AACnF,mFAAmF;AACnF,iFAAiF;AACjF,mFAAmF;AACnF,6CAA6C;AAC7C,8EAA8E;AAE9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAG/E,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,8BAA8B;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;;;;;;4CAQ4C;AAC5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,sBAAsB;IACtB,WAAW;CACZ,CAAC,CAAC;AAGH,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,kBAAkB;IAClB,SAAS;IACT,qBAAqB;IACrB,eAAe;IACf,sBAAsB;CACvB,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,sBAAsB;IACtB,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,mFAAmF;IACnF,sEAAsE;IACtE,gBAAgB;CACjB,CAAC,CAAC;AAGH,sDAAsD;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,aAAa;IACb,uBAAuB;IACvB,qBAAqB;CACtB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC;IACnD,qBAAqB;IACrB,sBAAsB;IACtB,oBAAoB;IACpB,qBAAqB;IACrB,2BAA2B;CAC5B,CAAC,CAAC;AAGH,8EAA8E;AAC9E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC;IACxD,WAAW;IACX,yBAAyB;IACzB,gCAAgC;IAChC,0BAA0B;IAC1B,uBAAuB;IACvB,cAAc;IACd,cAAc;IACd,2BAA2B;IAC3B,qBAAqB;IACrB,6BAA6B;IAC7B,qBAAqB;IACrB,uBAAuB;CACxB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,eAAe;IACf,cAAc;IACd,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,gBAAgB;IAChB,wBAAwB;IACxB,mBAAmB;IACnB,eAAe;IACf,qBAAqB;IACrB,iBAAiB;IACjB,wBAAwB;CACzB,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC;IACrD,qBAAqB;IACrB,6BAA6B;IAC7B,uBAAuB;IACvB,qBAAqB;IACrB,4BAA4B;IAC5B,qBAAqB;IACrB,aAAa;IACb,iBAAiB;CAClB,CAAC,CAAC;AAGH;6BAC6B;AAC7B,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC;IACtD,kBAAkB;IAClB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,sDAAsD;IACtD,yBAAyB;IACzB,2CAA2C;IAC3C,gCAAgC;IAChC,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;CACvB,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAGpG,qDAAqD;AACrD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;AAGrF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAGxG;;+EAE+E;AAC/E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,WAAW;IACX,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAC;AAGH,mCAAmC;AACnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,gBAAgB;IAChB,qBAAqB;IACrB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,uBAAuB;IACvB,0BAA0B;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG9F,kFAAkF;AAClF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC;IACvD,WAAW;IACX,gCAAgC;IAChC,kBAAkB;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,UAAU;IACV,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,SAAS;IACT,cAAc;IACd,gBAAgB;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,SAAS;IACT,SAAS;IACT,YAAY;IACZ,cAAc;IACd,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,2BAA2B;IAC3B,2BAA2B;IAC3B,0BAA0B;CAC3B,CAAC,CAAC;AAGH;;;;;;;;0CAQ0C;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,MAAM;IACN,mBAAmB;IACnB,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAGH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM;IACN,mBAAmB;IACnB,QAAQ;IACR,2BAA2B;CAC5B,CAAC,CAAC;AAGH,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAGzG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,aAAa;IACb,aAAa;IACb,mBAAmB;IACnB,oBAAoB;CACrB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,yBAAyB;IAC1C,cAAc,EAAE,wBAAwB;IACxC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;;;0CAK0C;AAC1C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC","sourcesContent":["// Trust & Safety — shared foundation enums + the canonical target locator.\n//\n// This file is the SINGLE SOURCE for every enum and locator that crosses more\n// than one T&S cluster (report spine, case spine, holds, evidence, sagas,\n// NCMEC, NCII). Cluster document-schema files import their value sets from\n// HERE so two clusters can never define the same enum with drifting values.\n// Every value is transcribed verbatim from docs/code_changes_needed/\n// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A (the frozen spec) — no\n// invented values, no placeholders.\n//\n// Cross-boundary: these types are consumed by both functions/src and src/ in\n// ttt-prod, so they live in ttt-core (the single source of truth for the\n// backend↔frontend boundary) and surface on the `@ttt-productions/ttt-core/\n// doc-schemas` subpath.\n\nimport { z } from 'zod';\nimport {\n  MAX_SAFETY_RESOLUTION_SUMMARY_LENGTH,\n  MAX_SAFETY_ADMIN_NOTE_LENGTH,\n} from '../../constants/business.js';\n\n// ===========================================================================\n// A1 — Report reasons + reportable item types\n// ===========================================================================\n\n/** The controlling report-reason taxonomy (fixes the client/server drift\n * TS-032). The two protected reasons fork into a childSafetyCase / nciiCase. */\nexport const ReportReasonSchema = z.enum([\n  'Spam',\n  'Harassment',\n  'Hate Speech',\n  'Violence or Threats',\n  'Sexual Content',\n  'Self-Harm',\n  'Impersonation',\n  'Intellectual Property',\n  'Child Safety Concern', // → protected fork: childSafetyCase\n  'Nonconsensual Intimate Image (NCII)', // → protected fork: nciiCase\n  'Not related to on-site entertainment',\n  'Other',\n]);\nexport type ReportReason = z.infer<typeof ReportReasonSchema>;\n\n/** The two reasons that take the mandatory in-process protected branch. */\nexport const PROTECTED_REPORT_REASONS = [\n  'Child Safety Concern',\n  'Nonconsensual Intimate Image (NCII)',\n] as const satisfies readonly ReportReason[];\n\n/** Which protected fork a protected-reason report committed. */\nexport const ProtectedForkSchema = z.enum(['childSafetyCase', 'nciiCase']);\nexport type ProtectedFork = z.infer<typeof ProtectedForkSchema>;\n\n/** EXACTLY the `reportableItems` keys in ttt-prod src/lib/report-config.ts. A\n * ttt-prod CI test asserts this enum and `reportableItems` stay in sync (the\n * sync test lives app-side because report-config.ts is app-side). */\nexport const ReportableItemTypeSchema = z.enum([\n  'username',\n  'craft-skill',\n  'commission-listing',\n  'commission-proposal',\n  'square-streetz-post',\n  'profile-picture',\n  'guild-invite-message',\n  'guild-chat-message',\n  // A single message in a WORK-PARTY admin correspondence thread (pendingAdminDispatches\n  // partyKind 'workProject' — the one multi-member chat surface transported through\n  // Firestore `conversationMessages`). The resolver enforces the work-party kind\n  // server-side; user↔admin support threads are NOT reportable (an admin is already a\n  // participant in every thread — DJ ruling 2026-07-13).\n  'admin-work-message',\n  'hall-library-item',\n  // [EUAS-017] a single Hall sub-item (a Tale chapter / Tune track / Television episode). The\n  // `hallItem` TargetLocatorV1 already carries an optional `subItemId`; the report UI passes the\n  // sub-item id + its parent hall item, and the resolver derives the canonical sub-item path\n  // server-side. Admins can already hide a single sub-item (runSetHallSubItemHidden) — this makes the\n  // matching user-facing report reachable.\n  'hall-library-sub-item',\n  'audition',\n  'audition-entry',\n  'work-project',\n  'work-asset',\n  'work-realm',\n]);\nexport type ReportableItemType = z.infer<typeof ReportableItemTypeSchema>;\n\n/** The DO-transported chat report types — no Firestore message doc / owner exists to\n * hold at intake (H-04 V1); the resolver goes through the signed chat-Worker context\n * read. `admin-work-message` is NOT here: its messages are Firestore docs. Derived\n * subset — compile-linked to the canonical enum, never a re-declared string set. */\nexport const CHAT_REPORT_ITEM_TYPES = [\n  'guild-chat-message',\n  'guild-invite-message',\n] as const satisfies readonly ReportableItemType[];\n\n/** Item types whose report work-view renders the content-action (moderate) panel —\n * the backend moderation cores accept these. Compile-linked subset of the enum. */\nexport const CONTENT_ACTION_PANEL_ITEM_TYPES = [\n  'square-streetz-post',\n  'audition',\n  'audition-entry',\n  'commission-listing',\n  'commission-proposal',\n  'work-asset',\n  'profile-picture',\n  'hall-library-item',\n  'hall-library-sub-item',\n  'craft-skill',\n  // Work-party admin correspondence message — single-doc hidden flip (2026-07-13).\n  'admin-work-message',\n] as const satisfies readonly ReportableItemType[];\nexport type ContentActionPanelItemType = (typeof CONTENT_ACTION_PANEL_ITEM_TYPES)[number];\n\n// ===========================================================================\n// A11 — Target locator (the ONE typed locator used by allegations, temp holds,\n// removal targets, and the report resolver) + privacy-safe summary\n// ===========================================================================\n\n/** Discriminated locator — replaces every all-optional `contentRef`. Every\n * hideable surface in report-config.ts has a typed locator ([H-02]). */\nexport const TargetLocatorV1Schema = z.discriminatedUnion('kind', [\n  z.object({ kind: z.literal('mediaAsset'), mediaAssetId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('hallItem'), hallItemId: z.string().min(1), subItemId: z.string().min(1).optional() }).strict(),\n  z.object({ kind: z.literal('squarePost'), postId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('profileImage'), profileUid: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('username'), profileUid: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('craftSkill'), profileUid: z.string().min(1), craftSkillId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('commissionListing'), commissionListingId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('commissionProposal'), commissionListingId: z.string().min(1), commissionProposalId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('workProject'), workProjectId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('workAsset'), workProjectId: z.string().min(1), workAssetId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('workRealm'), workRealmId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('audition'), auditionId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('auditionEntry'), auditionId: z.string().min(1), auditionEntryId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('guildInviteMessage'), channelId: z.string().min(1), messageId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('chatAttachment'), channelId: z.string().min(1), messageId: z.string().min(1), attachmentId: z.string().min(1) }).strict(),\n  // [H-04 V1] Plain guild chat message (text-only or Worker-unresolved). Distinct from\n  // `chatAttachment` (which carries an actual attachment id) so a text-only protected chat\n  // report has a clean, unambiguous locator without misusing the attachment variant.\n  z.object({ kind: z.literal('guildChatMessage'), channelId: z.string().min(1), messageId: z.string().min(1) }).strict(),\n  // A work-party admin correspondence message — a Firestore doc at\n  // pendingAdminDispatches/{adminDispatchId}/conversationMessages/{messageId} (unlike the\n  // DO-addressed guildChatMessage/guildInviteMessage locators, messageId here is a doc id,\n  // not a numeric seq).\n  z.object({ kind: z.literal('adminWorkMessage'), adminDispatchId: z.string().min(1), messageId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('url'), url: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('additionalText'), textRef: z.string().min(1) }).strict(),\n]);\nexport type TargetLocatorV1 = z.infer<typeof TargetLocatorV1Schema>;\n\n/** The set of locator discriminants — used wherever only the `kind` is needed. */\nexport const TargetLocatorKindSchema = z.enum([\n  'mediaAsset',\n  'hallItem',\n  'squarePost',\n  'profileImage',\n  'username',\n  'craftSkill',\n  'commissionListing',\n  'commissionProposal',\n  'workProject',\n  'workAsset',\n  'workRealm',\n  'audition',\n  'auditionEntry',\n  'guildInviteMessage',\n  'chatAttachment',\n  // [H-04 V1] Plain guild chat message locator (text-only / Worker-unresolved protected report).\n  'guildChatMessage',\n  // Work-party admin correspondence message (Firestore conversationMessages doc).\n  'adminWorkMessage',\n  'url',\n  'additionalText',\n]);\nexport type TargetLocatorKind = z.infer<typeof TargetLocatorKindSchema>;\n\n/** Privacy-safe summary ONLY — no narrative / PII; used on roots + public rows. */\nexport const TargetLocatorSummaryV1Schema = z.object({\n  kind: TargetLocatorKindSchema,\n  surfaceLabel: z.string(),\n  hasResolvedTarget: z.boolean(),\n}).strict();\nexport type TargetLocatorSummaryV1 = z.infer<typeof TargetLocatorSummaryV1Schema>;\n\n// ===========================================================================\n// A9 — Reporting determination + NCMEC submission state\n// ===========================================================================\n\n/** Case-level reporting determination (Finding-H6). The ONLY carrier of \"no\n * NCMEC report required\" — `notRequired` was removed from NcmecSubmissionState. */\nexport const ReportDispositionSchema = z.enum([\n  'undetermined',\n  'reportRequired',\n  'notRequired',\n  'correctedNoApparentViolation',\n]);\nexport type ReportDisposition = z.infer<typeof ReportDispositionSchema>;\n\n/** Reason codes for the privileged setReportDisposition command (§A9). The first five are the\n * not-required / exception reasons (no NCMEC report ever arose, or a triggering signal was\n * corrected); the last two are the report-required reasons (a report IS legally required). The\n * disposition↔reason pairing is enforced by the ONE cross-field rule below (ARCH-102). */\nexport const ReportDispositionReasonCodeSchema = z.enum([\n  'outOfScopeNotCsea',\n  'basisInvalidatedFalseMatch',\n  'duplicateOfFiledReport',\n  'leDirectedNoReport',\n  'nonReportableSafetyConfirmed',\n  // Report-required reasons — valid ONLY with disposition 'reportRequired'.\n  'apparentCsamConfirmed', // human review confirmed apparent CSAM\n  'hashMatchValidated', // validated hash match\n]);\nexport type ReportDispositionReasonCode = z.infer<typeof ReportDispositionReasonCodeSchema>;\n\n/** The reason codes that ASSERT a reporting obligation — legal ONLY with 'reportRequired'.\n * Compile-linked subset of the canonical reason enum. */\nexport const REPORT_REQUIRED_DISPOSITION_REASON_CODES = [\n  'apparentCsamConfirmed',\n  'hashMatchValidated',\n] as const satisfies readonly ReportDispositionReasonCode[];\n\n/** The not-required / exception reason codes — legal with every disposition that does NOT assert a\n * reporting obligation ('notRequired', 'correctedNoApparentViolation'). Compile-linked subset. */\nexport const NOT_REQUIRED_DISPOSITION_REASON_CODES = [\n  'outOfScopeNotCsea',\n  'basisInvalidatedFalseMatch',\n  'duplicateOfFiledReport',\n  'leDirectedNoReport',\n  'nonReportableSafetyConfirmed',\n] as const satisfies readonly ReportDispositionReasonCode[];\n\n/** The ONE cross-field pairing (§A9, ARCH-102): which reason codes each disposition permits.\n * Declared HERE once; both the setReportDisposition input (case.ts) and the SafetyDispositionAction\n * console command (admin.ts) apply `refineReportDispositionReasonCode` derived from this map rather\n * than re-declaring the pairing. 'undetermined' is the initial state, never an operator-settable\n * target, so it permits NO reason code (the operator command excludes it). Typed as an exhaustive\n * Record so a new disposition fails to compile until its permitted codes are declared. */\nexport const REPORT_DISPOSITION_ALLOWED_REASON_CODES: Record<\n  ReportDisposition,\n  readonly ReportDispositionReasonCode[]\n> = {\n  undetermined: [],\n  reportRequired: REPORT_REQUIRED_DISPOSITION_REASON_CODES,\n  notRequired: NOT_REQUIRED_DISPOSITION_REASON_CODES,\n  correctedNoApparentViolation: NOT_REQUIRED_DISPOSITION_REASON_CODES,\n};\n\n/** Shared cross-field refinement enforcing the disposition↔reason pairing above. Applied by BOTH\n * the setReportDisposition input schemas and the SafetyDispositionAction console command so the\n * rule lives in exactly one place. Reports the failure on the `dispositionReasonCode` path. */\nexport function refineReportDispositionReasonCode(\n  value: { disposition: ReportDisposition; dispositionReasonCode: ReportDispositionReasonCode },\n  ctx: z.RefinementCtx,\n): void {\n  if (!REPORT_DISPOSITION_ALLOWED_REASON_CODES[value.disposition].includes(value.dispositionReasonCode)) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      path: ['dispositionReasonCode'],\n      message: `Reason code '${value.dispositionReasonCode}' is not valid for disposition '${value.disposition}'.`,\n    });\n  }\n}\n\n/** Shared cross-field rule (§A9): disposition 'reportRequired' MUST carry at least one evidence ref —\n * a reporting obligation can only be asserted once the evidence has been revealed. Every OTHER\n * disposition ('notRequired', 'correctedNoApparentViolation', 'undetermined') MAY leave evidenceRefs\n * empty. Declared HERE once (ARCH-102) and applied — alongside refineReportDispositionReasonCode — by\n * BOTH the setReportDisposition input schemas (case.ts) and the SafetyStagedAction console command\n * (admin.ts), never re-declared. Reports the failure on the `evidenceRefs` path. */\nexport function refineReportDispositionEvidenceRefs(\n  value: { disposition: ReportDisposition; evidenceRefs: readonly string[] },\n  ctx: z.RefinementCtx,\n): void {\n  if (value.disposition === 'reportRequired' && value.evidenceRefs.length === 0) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      path: ['evidenceRefs'],\n      message:\n        \"Disposition 'reportRequired' requires at least one evidence ref (evidence must have been revealed).\",\n    });\n  }\n}\n\n// ===========================================================================\n// [EUAS-008] Structured safety-case CLOSURE record — the operator's terminal\n// determination persisted when a CSAM / NCII case is closed via the guided\n// resolution flow (resolveAdminTask). Embedded on the NCII case (`closure`) and on\n// a child-safety `decisions/{id}` row (kind `caseClosed`) so both case types carry\n// the SAME structured outcome/summary/note + actor/timestamp — not just a status\n// flip. This does NOT replace the case lifecycle's own terminal status; it records\n// WHO closed it, WHY, and with what outcome.\n// ===========================================================================\n\n/** founded = a violation was substantiated; unfounded = no violation on review. */\nexport const SafetyCaseClosureOutcomeSchema = z.enum(['founded', 'unfounded']);\nexport type SafetyCaseClosureOutcome = z.infer<typeof SafetyCaseClosureOutcomeSchema>;\n\n/** The structured closure record written on a safety-case close. */\nexport const SafetyCaseClosureV1Schema = z.object({\n  outcome: SafetyCaseClosureOutcomeSchema,\n  resolutionSummary: z.string().min(1).max(MAX_SAFETY_RESOLUTION_SUMMARY_LENGTH),\n  adminNote: z.string().max(MAX_SAFETY_ADMIN_NOTE_LENGTH).optional(),\n  closedByUid: z.string().min(1),\n  closedAt: z.number(),\n}).strict();\nexport type SafetyCaseClosureV1 = z.infer<typeof SafetyCaseClosureV1Schema>;\n\n/** NCMEC submission lifecycle — MANUAL-PORTAL model (§A9). NO `notRequired` (that is\n * ReportDisposition). There is no automated ispws API: a report-needed obligation sits in\n * `awaitingManualFiling` from enqueue until the operator files on the NCMEC portal and records the\n * confirmation (markNcmecPortalComplete → `completed`). Jobs are born `awaitingManualFiling`; the\n * case-list `ncmecStatus` projection uses the same value (no separate `queued` state). There is no\n * in-app retraction — corrections are portal-manual (correction-lifecycle decision). The old\n * API-drive states\n * (opening/open/uploading/addingFileDetails/finishing/retryableFailure/ambiguousResult/permanentFailure)\n * were removed with the live-API client. */\nexport const NcmecSubmissionStateSchema = z.enum([\n  'awaitingManualFiling',\n  'completed',\n]);\nexport type NcmecSubmissionState = z.infer<typeof NcmecSubmissionStateSchema>;\n\n// ===========================================================================\n// A3 — Safety-hold + resource-command vocabularies (the ONE destructive-guard\n// authority). The NCII/storage resource types live in THIS enum (H1 fix).\n// ===========================================================================\n\nexport const SafetyHoldResourceTypeSchema = z.enum([\n  'contentDoc',\n  'mediaAsset',\n  'account',\n  'chatMessageRange',\n  'channel',\n  'nciiTemporaryTarget',\n  'storageObject',\n  'reportEvidenceObject',\n]);\nexport type SafetyHoldResourceType = z.infer<typeof SafetyHoldResourceTypeSchema>;\n\n/** Lifecycle/retention regime governed by the A3 compatibility matrix. */\nexport const SafetyHoldClassSchema = z.enum([\n  'childSafety',\n  'nciiTemporary',\n  'legalRetention',\n  'preservationEvidence',\n  // An OPEN ordinary (non-protected) content report places an account-level hold\n  // (resourceType 'account', ownerUid = the reported user) so a user can't delete\n  // their data out from under an unreviewed report (e.g. a DMCA/IP complaint, then\n  // delete-to-clear-tracks). blocksDeletion + blocksAnonymization; released when the\n  // report group's admin close-out resolves it. Durable (no expiresAt).\n  'ordinaryReport',\n]);\nexport type SafetyHoldClass = z.infer<typeof SafetyHoldClassSchema>;\n\n/** Resource-scoped destructive command kinds (A3). */\nexport const SafetyCommandKindSchema = z.enum([\n  'nciiRemoval',\n  'csamActiveByteRemoval',\n  'evidenceDisposition',\n]);\nexport type SafetyCommandKind = z.infer<typeof SafetyCommandKindSchema>;\n\n// ===========================================================================\n// Reviewer-capability matrix (§A11 [M4] + §A9). One solo operator holds all\n// at launch; every privileged command checks the SPECIFIC capability + reauth.\n// ===========================================================================\n\nexport const SafetyReviewerCapabilitySchema = z.enum([\n  'nciiRequestReviewer',\n  'nciiEvidenceReviewer',\n  'nciiAppealReviewer',\n  'childSafetyReviewer',\n  'legalDispositionAuthority',\n]);\nexport type SafetyReviewerCapability = z.infer<typeof SafetyReviewerCapabilitySchema>;\n\n// ===========================================================================\n// A7 — Registration-completion outcome (DOMAIN enum; replaces the unsafe\n// generic gRPC retryable/terminal code lists). Only a domain outcome feeds the\n// orphan-Auth deletion policy.\n// ===========================================================================\n\nexport const RegistrationCompletionOutcomeSchema = z.enum([\n  'completed',\n  'alreadyCompletedSameUid',\n  'retryableInfrastructureFailure',\n  'reauthenticationRequired',\n  'appCheckRetryRequired',\n  'nonceExpired',\n  'nonceUnknown',\n  'nonceConsumedDifferentUid',\n  'sessionHashMismatch',\n  'attestationSignatureInvalid',\n  'privateDataConflict',\n  'policyVersionRejected',\n]);\nexport type RegistrationCompletionOutcome = z.infer<typeof RegistrationCompletionOutcomeSchema>;\n\n// ===========================================================================\n// A11 — NCII / TAKE IT DOWN shared vocabularies (consumed by BOTH NCII clusters)\n// ===========================================================================\n\n/** Closed enum of required field codes — completeness + public missing-fields. */\nexport const TakeItDownFieldCodeSchema = z.enum([\n  'requesterName',\n  'contactEmail',\n  'contactPhone',\n  'requesterRole',\n  'electronicSignature',\n  'authorityBasis',\n  'authorityCertification',\n  'authorityEvidence',\n  'targetLocator',\n  'nonconsentStatement',\n  'supportingFacts',\n  'goodFaithCertification',\n]);\nexport type TakeItDownFieldCode = z.infer<typeof TakeItDownFieldCodeSchema>;\n\n/** Closed PUBLIC-SAFE reason codes — never reveal evidence/uploader/crossover. */\nexport const TakeItDownPublicReasonCodeSchema = z.enum([\n  'needMoreInformation',\n  'couldNotVerifyRequesterRole',\n  'couldNotLocateContent',\n  'outsideCoveredScope',\n  'duplicateOfExistingRequest',\n  'removedSuccessfully',\n  'underReview',\n  'closedSeeNotice',\n]);\nexport type TakeItDownPublicReasonCode = z.infer<typeof TakeItDownPublicReasonCodeSchema>;\n\n/** Validity-failure reason codes ([H2]). `incomplete` is a COMPLETENESS state,\n * NEVER a validity state. */\nexport const TakeItDownInvalidReasonCodeSchema = z.enum([\n  'missingSignature',\n  'missingLocator',\n  'missingNonconsentStatement',\n  'missingContactInformation',\n  'requesterNotDepictedPersonOrAuthorizedRepresentative',\n  'authorityNotEstablished',\n  'locatorNotResolvableAfterReasonableEffort',\n  'requestOutsideCoveredDepiction',\n  'duplicateSuperseded',\n  'fraudulentOrBadFaith',\n  'otherCounselApproved',\n]);\nexport type TakeItDownInvalidReasonCode = z.infer<typeof TakeItDownInvalidReasonCodeSchema>;\n\n/** Requester role (depicted person vs authorized representative). */\nexport const TakeItDownRequesterRoleSchema = z.enum(['depictedPerson', 'authorizedRepresentative']);\nexport type TakeItDownRequesterRole = z.infer<typeof TakeItDownRequesterRoleSchema>;\n\n/** Two-axis state: completeness vs validity (H2). */\nexport const TakeItDownCompletenessStatusSchema = z.enum(['incomplete', 'complete']);\nexport type TakeItDownCompletenessStatus = z.infer<typeof TakeItDownCompletenessStatusSchema>;\n\nexport const TakeItDownValidityStatusSchema = z.enum(['pending', 'valid', 'invalid', 'unableToLocate']);\nexport type TakeItDownValidityStatus = z.infer<typeof TakeItDownValidityStatusSchema>;\n\n/** The public no-login status-page status set (root + statusProjection). No\n * appeal model — no `appealedCorrected` (the appeal/reinstatement flow was\n * removed; protected reports have no uploader appeal/notice/reinstatement). */\nexport const TakeItDownPublicStatusSchema = z.enum([\n  'received',\n  'needsMoreInfo',\n  'validInProgress',\n  'completed',\n  'unableToLocate',\n  'invalidGeneralReason',\n]);\nexport type TakeItDownPublicStatus = z.infer<typeof TakeItDownPublicStatusSchema>;\n\n/** Request action types ([L1]). */\nexport const NciiActionTypeSchema = z.enum([\n  'intakeReceived',\n  'completenessDecided',\n  'validityDecided',\n  'tempHoldPlaced',\n  'tempHoldReleased',\n  'removalStarted',\n  'removalCompleted',\n  'hashBlockReversed',\n  'childSafetyCaseLinked',\n  'legalDispositionRecorded',\n]);\nexport type NciiActionType = z.infer<typeof NciiActionTypeSchema>;\n\nexport const NciiActionResultSchema = z.enum(['succeeded', 'failed', 'deferred', 'rejected']);\nexport type NciiActionResult = z.infer<typeof NciiActionResultSchema>;\n\n/** Honest derived completion ([H4]) — never 'completed' for a partial failure. */\nexport const NciiRemovalCompletionOutcomeSchema = z.enum([\n  'completed',\n  'completedWithApprovedException',\n  'unableToComplete',\n]);\nexport type NciiRemovalCompletionOutcome = z.infer<typeof NciiRemovalCompletionOutcomeSchema>;\n\nexport const NciiTargetSurfaceSchema = z.enum([\n  'original',\n  'hallCopy',\n  'profileMedia',\n  'chatAttachment',\n  'variant',\n  'cacheServing',\n  'exactHashMatch',\n]);\nexport type NciiTargetSurface = z.infer<typeof NciiTargetSurfaceSchema>;\n\nexport const NciiTargetOutcomeSchema = z.enum([\n  'pending',\n  'removed',\n  'tombstoned',\n  'verifiedGone',\n  'leftoverRetrying',\n  'unableToComplete',\n  'terminalException',\n]);\nexport type NciiTargetOutcome = z.infer<typeof NciiTargetOutcomeSchema>;\n\n/** CLOSED terminal-exception enum — a technical outage is NOT an exception. */\nexport const NciiTerminalExceptionSchema = z.enum([\n  'legallyPermittedRetention',\n  'contentNotPresentVerified',\n  'counselApprovedException',\n]);\nexport type NciiTerminalException = z.infer<typeof NciiTerminalExceptionSchema>;\n\n/** Internal operational case status ([H7]).\n *\n * [R12] close-lifecycle states: clicking **Close** (after the strict-closable gate passes)\n * applies the staged actions and moves the case to `processing` — it STAYS pinned/in-queue,\n * NEVER cleared on the click. The NCII removal worker flips the case to the terminal `closed`\n * ONLY on VERIFIED removal completion (clearing the pin via onSafetyCaseClosed). If the\n * removal saga exhausts its retries (dead-letter), the case moves to `failed` — kept pinned,\n * surfaced in the Safety Console failed-jobs view, with a Restart that re-arms the job. Both\n * are explicit values (never derived). */\nexport const NciiInternalStatusSchema = z.enum([\n  'open',\n  'removalInProgress',\n  'processing',\n  'failed',\n  'removed',\n  'rejected',\n  'closed',\n]);\nexport type NciiInternalStatus = z.infer<typeof NciiInternalStatusSchema>;\n\n/** Child-safety linkage status on an NCII case ([H7]). */\nexport const NciiChildSafetyLinkStatusSchema = z.enum([\n  'none',\n  'assessmentPending',\n  'linked',\n  'resolvedNoChildSafetyCase',\n]);\nexport type NciiChildSafetyLinkStatus = z.infer<typeof NciiChildSafetyLinkStatusSchema>;\n\n// ===========================================================================\n// A11 [F4] — child-safety crossover (possible-minor ≠ automatic CSAM).\n// Embedded on nciiCases. childSafetyCaseId lives HERE (one canonical place).\n// ===========================================================================\n\nexport const NciiMinorAssessmentSchema = z.enum(['adult', 'unknown', 'possibleMinor', 'confirmedMinor']);\nexport type NciiMinorAssessment = z.infer<typeof NciiMinorAssessmentSchema>;\n\nexport const NciiCsamAssessmentSchema = z.enum([\n  'notAssessed',\n  'notApparent',\n  'apparentViolation',\n  'validatedHashMatch',\n]);\nexport type NciiCsamAssessment = z.infer<typeof NciiCsamAssessmentSchema>;\n\nexport const NciiChildSafetyCrossoverSchema = z.object({\n  minorAssessment: NciiMinorAssessmentSchema,\n  csamAssessment: NciiCsamAssessmentSchema,\n  childSafetyCaseId: z.string().min(1).optional(),\n  assessedByUid: z.string().min(1).optional(),\n  assessedAt: z.number().optional(),\n}).strict();\nexport type NciiChildSafetyCrossover = z.infer<typeof NciiChildSafetyCrossoverSchema>;\n\n/** [H-2] Per-leg lifecycle status for the possible-minor crossover side-effects (serving-deny,\n * PhotoDNA) persisted on the crossover child-safety case (see ChildSafetyCaseV1.crossoverLegs).\n * `pending` is the in-transaction initial marker the assessment writes before the post-commit leg\n * runs; the leg then flips it to `done` (succeeded) or `failed` (captureException'd, awaiting a\n * reconcile/replay). A leg is ABSENT (not `pending`) when it never applied — an external / no-media\n * target has no bytes to deny or scan. */\nexport const SafetyCrossoverLegStatusSchema = z.enum(['pending', 'done', 'failed']);\nexport type SafetyCrossoverLegStatus = z.infer<typeof SafetyCrossoverLegStatusSchema>;\n"]}
+{"version":3,"file":"foundation.js","sourceRoot":"","sources":["../../../src/doc-schemas/safety/foundation.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAChF,2DAA2D;AAC3D,uDAAuD;AACvD,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,wBAAwB;AAExB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;gFACgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,MAAM;IACN,YAAY;IACZ,aAAa;IACb,qBAAqB;IACrB,gBAAgB;IAChB,WAAW;IACX,eAAe;IACf,uBAAuB;IACvB,sBAAsB,EAAE,oCAAoC;IAC5D,qCAAqC,EAAE,6BAA6B;IACpE,sCAAsC;IACtC,OAAO;CACR,CAAC,CAAC;AAGH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,sBAAsB;IACtB,qCAAqC;CACK,CAAC;AAE7C,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;qEAEqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,UAAU;IACV,aAAa;IACb,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,sBAAsB;IACtB,oBAAoB;IACpB,uFAAuF;IACvF,kFAAkF;IAClF,+EAA+E;IAC/E,oFAAoF;IACpF,uDAAuD;IACvD,oBAAoB;IACpB,mBAAmB;IACnB,4FAA4F;IAC5F,+FAA+F;IAC/F,2FAA2F;IAC3F,oGAAoG;IACpG,yCAAyC;IACzC,uBAAuB;IACvB,UAAU;IACV,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAGH;;;oFAGoF;AACpF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,oBAAoB;IACpB,sBAAsB;CAC0B,CAAC;AAEnD;mFACmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,qBAAqB;IACrB,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,qBAAqB;IACrB,YAAY;IACZ,iBAAiB;IACjB,mBAAmB;IACnB,uBAAuB;IACvB,aAAa;IACb,iFAAiF;IACjF,oBAAoB;CAC4B,CAAC;AAGnD,8EAA8E;AAC9E,+EAA+E;AAC/E,mEAAmE;AACnE,8EAA8E;AAE9E;wEACwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAChE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1H,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACjF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACpH,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACnG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7I,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACvF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrH,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACnF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACjF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1H,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACxH,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrJ,qFAAqF;IACrF,yFAAyF;IACzF,mFAAmF;IACnF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACtH,iEAAiE;IACjE,wFAAwF;IACxF,yFAAyF;IACzF,sBAAsB;IACtB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5H,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACrF,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,cAAc;IACd,UAAU;IACV,YAAY;IACZ,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,WAAW;IACX,WAAW;IACX,UAAU;IACV,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,+FAA+F;IAC/F,kBAAkB;IAClB,gFAAgF;IAChF,kBAAkB;IAClB,KAAK;IACL,gBAAgB;CACjB,CAAC,CAAC;AAGH,mFAAmF;AACnF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,uBAAuB;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;mFACmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,8BAA8B;CAC/B,CAAC,CAAC;AAGH;;;0FAG0F;AAC1F,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC;IACtD,mBAAmB;IACnB,4BAA4B;IAC5B,wBAAwB;IACxB,oBAAoB;IACpB,8BAA8B;IAC9B,0EAA0E;IAC1E,uBAAuB,EAAE,uCAAuC;IAChE,oBAAoB,EAAE,uBAAuB;CAC9C,CAAC,CAAC;AAGH;yDACyD;AACzD,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,uBAAuB;IACvB,oBAAoB;CACqC,CAAC;AAE5D;kGACkG;AAClG,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,mBAAmB;IACnB,4BAA4B;IAC5B,wBAAwB;IACxB,oBAAoB;IACpB,8BAA8B;CAC2B,CAAC;AAE5D;;;;;0FAK0F;AAC1F,MAAM,CAAC,MAAM,uCAAuC,GAGhD;IACF,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,wCAAwC;IACxD,WAAW,EAAE,qCAAqC;IAClD,4BAA4B,EAAE,qCAAqC;CACpE,CAAC;AAEF;;+FAE+F;AAC/F,MAAM,UAAU,iCAAiC,CAC/C,KAA6F,EAC7F,GAAoB;IAEpB,IAAI,CAAC,uCAAuC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,uBAAuB,CAAC;YAC/B,OAAO,EAAE,gBAAgB,KAAK,CAAC,qBAAqB,mCAAmC,KAAK,CAAC,WAAW,IAAI;SAC7G,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;oFAKoF;AACpF,MAAM,UAAU,mCAAmC,CACjD,KAA0E,EAC1E,GAAoB;IAEpB,IAAI,KAAK,CAAC,WAAW,KAAK,gBAAgB,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EACL,qGAAqG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,mFAAmF;AACnF,mFAAmF;AACnF,iFAAiF;AACjF,mFAAmF;AACnF,6CAA6C;AAC7C,8EAA8E;AAE9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAG/E,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,8BAA8B;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;;;;;;4CAQ4C;AAC5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,sBAAsB;IACtB,WAAW;CACZ,CAAC,CAAC;AAGH,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,kBAAkB;IAClB,SAAS;IACT,qBAAqB;IACrB,eAAe;IACf,sBAAsB;CACvB,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,sBAAsB;IACtB,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,mFAAmF;IACnF,sEAAsE;IACtE,gBAAgB;CACjB,CAAC,CAAC;AAGH,sDAAsD;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,aAAa;IACb,uBAAuB;IACvB,qBAAqB;CACtB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC;IACnD,qBAAqB;IACrB,sBAAsB;IACtB,oBAAoB;IACpB,qBAAqB;IACrB,2BAA2B;CAC5B,CAAC,CAAC;AAGH,8EAA8E;AAC9E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC;IACxD,WAAW;IACX,yBAAyB;IACzB,gCAAgC;IAChC,0BAA0B;IAC1B,uBAAuB;IACvB,cAAc;IACd,cAAc;IACd,2BAA2B;IAC3B,qBAAqB;IACrB,6BAA6B;IAC7B,qBAAqB;IACrB,uBAAuB;CACxB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,eAAe;IACf,cAAc;IACd,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,gBAAgB;IAChB,wBAAwB;IACxB,mBAAmB;IACnB,eAAe;IACf,qBAAqB;IACrB,iBAAiB;IACjB,wBAAwB;CACzB,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC;IACrD,qBAAqB;IACrB,6BAA6B;IAC7B,uBAAuB;IACvB,qBAAqB;IACrB,4BAA4B;IAC5B,qBAAqB;IACrB,aAAa;IACb,iBAAiB;CAClB,CAAC,CAAC;AAGH;6BAC6B;AAC7B,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC;IACtD,kBAAkB;IAClB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,sDAAsD;IACtD,yBAAyB;IACzB,2CAA2C;IAC3C,gCAAgC;IAChC,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;CACvB,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAGpG,qDAAqD;AACrD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;AAGrF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAGxG;;+EAE+E;AAC/E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,WAAW;IACX,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAC;AAGH,mCAAmC;AACnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,gBAAgB;IAChB,qBAAqB;IACrB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,uBAAuB;IACvB,0BAA0B;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG9F,kFAAkF;AAClF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC;IACvD,WAAW;IACX,gCAAgC;IAChC,kBAAkB;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,UAAU;IACV,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,SAAS;IACT,cAAc;IACd,gBAAgB;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,SAAS;IACT,SAAS;IACT,YAAY;IACZ,cAAc;IACd,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,2BAA2B;IAC3B,2BAA2B;IAC3B,0BAA0B;CAC3B,CAAC,CAAC;AAGH;;;;;;;;0CAQ0C;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,MAAM;IACN,mBAAmB;IACnB,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAGH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM;IACN,mBAAmB;IACnB,QAAQ;IACR,2BAA2B;CAC5B,CAAC,CAAC;AAGH,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAGzG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,aAAa;IACb,aAAa;IACb,mBAAmB;IACnB,oBAAoB;CACrB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,yBAAyB;IAC1C,cAAc,EAAE,wBAAwB;IACxC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;;;0CAK0C;AAC1C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC","sourcesContent":["// Trust & Safety — shared foundation enums + the canonical target locator.\n//\n// This file is the SINGLE SOURCE for every enum and locator that crosses more\n// than one T&S cluster (report spine, case spine, holds, evidence, sagas,\n// NCMEC, NCII). Cluster document-schema files import their value sets from\n// HERE so two clusters can never define the same enum with drifting values.\n// Every value is transcribed verbatim from the frozen Trust & Safety spec\n// (Appendix A) — no invented values, no placeholders; the durable design owners\n// are ttt-prod docs/design/csam-detection-and-response.md,\n// docs/design/content-moderation-and-reporting.md, and\n// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.\n//\n// Cross-boundary: these types are consumed by both functions/src and src/ in\n// ttt-prod, so they live in ttt-core (the single source of truth for the\n// backend↔frontend boundary) and surface on the `@ttt-productions/ttt-core/\n// doc-schemas` subpath.\n\nimport { z } from 'zod';\nimport {\n  MAX_SAFETY_RESOLUTION_SUMMARY_LENGTH,\n  MAX_SAFETY_ADMIN_NOTE_LENGTH,\n} from '../../constants/business.js';\n\n// ===========================================================================\n// A1 — Report reasons + reportable item types\n// ===========================================================================\n\n/** The controlling report-reason taxonomy (fixes the client/server drift\n * TS-032). The two protected reasons fork into a childSafetyCase / nciiCase. */\nexport const ReportReasonSchema = z.enum([\n  'Spam',\n  'Harassment',\n  'Hate Speech',\n  'Violence or Threats',\n  'Sexual Content',\n  'Self-Harm',\n  'Impersonation',\n  'Intellectual Property',\n  'Child Safety Concern', // → protected fork: childSafetyCase\n  'Nonconsensual Intimate Image (NCII)', // → protected fork: nciiCase\n  'Not related to on-site entertainment',\n  'Other',\n]);\nexport type ReportReason = z.infer<typeof ReportReasonSchema>;\n\n/** The two reasons that take the mandatory in-process protected branch. */\nexport const PROTECTED_REPORT_REASONS = [\n  'Child Safety Concern',\n  'Nonconsensual Intimate Image (NCII)',\n] as const satisfies readonly ReportReason[];\n\n/** Which protected fork a protected-reason report committed. */\nexport const ProtectedForkSchema = z.enum(['childSafetyCase', 'nciiCase']);\nexport type ProtectedFork = z.infer<typeof ProtectedForkSchema>;\n\n/** EXACTLY the `reportableItems` keys in ttt-prod src/lib/report-config.ts. A\n * ttt-prod CI test asserts this enum and `reportableItems` stay in sync (the\n * sync test lives app-side because report-config.ts is app-side). */\nexport const ReportableItemTypeSchema = z.enum([\n  'username',\n  'craft-skill',\n  'commission-listing',\n  'commission-proposal',\n  'square-streetz-post',\n  'profile-picture',\n  'guild-invite-message',\n  'guild-chat-message',\n  // A single message in a WORK-PARTY admin correspondence thread (pendingAdminDispatches\n  // partyKind 'workProject' — the one multi-member chat surface transported through\n  // Firestore `conversationMessages`). The resolver enforces the work-party kind\n  // server-side; user↔admin support threads are NOT reportable (an admin is already a\n  // participant in every thread — DJ ruling 2026-07-13).\n  'admin-work-message',\n  'hall-library-item',\n  // [EUAS-017] a single Hall sub-item (a Tale chapter / Tune track / Television episode). The\n  // `hallItem` TargetLocatorV1 already carries an optional `subItemId`; the report UI passes the\n  // sub-item id + its parent hall item, and the resolver derives the canonical sub-item path\n  // server-side. Admins can already hide a single sub-item (runSetHallSubItemHidden) — this makes the\n  // matching user-facing report reachable.\n  'hall-library-sub-item',\n  'audition',\n  'audition-entry',\n  'work-project',\n  'work-asset',\n  'work-realm',\n]);\nexport type ReportableItemType = z.infer<typeof ReportableItemTypeSchema>;\n\n/** The DO-transported chat report types — no Firestore message doc / owner exists to\n * hold at intake (H-04 V1); the resolver goes through the signed chat-Worker context\n * read. `admin-work-message` is NOT here: its messages are Firestore docs. Derived\n * subset — compile-linked to the canonical enum, never a re-declared string set. */\nexport const CHAT_REPORT_ITEM_TYPES = [\n  'guild-chat-message',\n  'guild-invite-message',\n] as const satisfies readonly ReportableItemType[];\n\n/** Item types whose report work-view renders the content-action (moderate) panel —\n * the backend moderation cores accept these. Compile-linked subset of the enum. */\nexport const CONTENT_ACTION_PANEL_ITEM_TYPES = [\n  'square-streetz-post',\n  'audition',\n  'audition-entry',\n  'commission-listing',\n  'commission-proposal',\n  'work-asset',\n  'profile-picture',\n  'hall-library-item',\n  'hall-library-sub-item',\n  'craft-skill',\n  // Work-party admin correspondence message — single-doc hidden flip (2026-07-13).\n  'admin-work-message',\n] as const satisfies readonly ReportableItemType[];\nexport type ContentActionPanelItemType = (typeof CONTENT_ACTION_PANEL_ITEM_TYPES)[number];\n\n// ===========================================================================\n// A11 — Target locator (the ONE typed locator used by allegations, temp holds,\n// removal targets, and the report resolver) + privacy-safe summary\n// ===========================================================================\n\n/** Discriminated locator — replaces every all-optional `contentRef`. Every\n * hideable surface in report-config.ts has a typed locator ([H-02]). */\nexport const TargetLocatorV1Schema = z.discriminatedUnion('kind', [\n  z.object({ kind: z.literal('mediaAsset'), mediaAssetId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('hallItem'), hallItemId: z.string().min(1), subItemId: z.string().min(1).optional() }).strict(),\n  z.object({ kind: z.literal('squarePost'), postId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('profileImage'), profileUid: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('username'), profileUid: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('craftSkill'), profileUid: z.string().min(1), craftSkillId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('commissionListing'), commissionListingId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('commissionProposal'), commissionListingId: z.string().min(1), commissionProposalId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('workProject'), workProjectId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('workAsset'), workProjectId: z.string().min(1), workAssetId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('workRealm'), workRealmId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('audition'), auditionId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('auditionEntry'), auditionId: z.string().min(1), auditionEntryId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('guildInviteMessage'), channelId: z.string().min(1), messageId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('chatAttachment'), channelId: z.string().min(1), messageId: z.string().min(1), attachmentId: z.string().min(1) }).strict(),\n  // [H-04 V1] Plain guild chat message (text-only or Worker-unresolved). Distinct from\n  // `chatAttachment` (which carries an actual attachment id) so a text-only protected chat\n  // report has a clean, unambiguous locator without misusing the attachment variant.\n  z.object({ kind: z.literal('guildChatMessage'), channelId: z.string().min(1), messageId: z.string().min(1) }).strict(),\n  // A work-party admin correspondence message — a Firestore doc at\n  // pendingAdminDispatches/{adminDispatchId}/conversationMessages/{messageId} (unlike the\n  // DO-addressed guildChatMessage/guildInviteMessage locators, messageId here is a doc id,\n  // not a numeric seq).\n  z.object({ kind: z.literal('adminWorkMessage'), adminDispatchId: z.string().min(1), messageId: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('url'), url: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal('additionalText'), textRef: z.string().min(1) }).strict(),\n]);\nexport type TargetLocatorV1 = z.infer<typeof TargetLocatorV1Schema>;\n\n/** The set of locator discriminants — used wherever only the `kind` is needed. */\nexport const TargetLocatorKindSchema = z.enum([\n  'mediaAsset',\n  'hallItem',\n  'squarePost',\n  'profileImage',\n  'username',\n  'craftSkill',\n  'commissionListing',\n  'commissionProposal',\n  'workProject',\n  'workAsset',\n  'workRealm',\n  'audition',\n  'auditionEntry',\n  'guildInviteMessage',\n  'chatAttachment',\n  // [H-04 V1] Plain guild chat message locator (text-only / Worker-unresolved protected report).\n  'guildChatMessage',\n  // Work-party admin correspondence message (Firestore conversationMessages doc).\n  'adminWorkMessage',\n  'url',\n  'additionalText',\n]);\nexport type TargetLocatorKind = z.infer<typeof TargetLocatorKindSchema>;\n\n/** Privacy-safe summary ONLY — no narrative / PII; used on roots + public rows. */\nexport const TargetLocatorSummaryV1Schema = z.object({\n  kind: TargetLocatorKindSchema,\n  surfaceLabel: z.string(),\n  hasResolvedTarget: z.boolean(),\n}).strict();\nexport type TargetLocatorSummaryV1 = z.infer<typeof TargetLocatorSummaryV1Schema>;\n\n// ===========================================================================\n// A9 — Reporting determination + NCMEC submission state\n// ===========================================================================\n\n/** Case-level reporting determination (Finding-H6). The ONLY carrier of \"no\n * NCMEC report required\" — `notRequired` was removed from NcmecSubmissionState. */\nexport const ReportDispositionSchema = z.enum([\n  'undetermined',\n  'reportRequired',\n  'notRequired',\n  'correctedNoApparentViolation',\n]);\nexport type ReportDisposition = z.infer<typeof ReportDispositionSchema>;\n\n/** Reason codes for the privileged setReportDisposition command (§A9). The first five are the\n * not-required / exception reasons (no NCMEC report ever arose, or a triggering signal was\n * corrected); the last two are the report-required reasons (a report IS legally required). The\n * disposition↔reason pairing is enforced by the ONE cross-field rule below (ARCH-102). */\nexport const ReportDispositionReasonCodeSchema = z.enum([\n  'outOfScopeNotCsea',\n  'basisInvalidatedFalseMatch',\n  'duplicateOfFiledReport',\n  'leDirectedNoReport',\n  'nonReportableSafetyConfirmed',\n  // Report-required reasons — valid ONLY with disposition 'reportRequired'.\n  'apparentCsamConfirmed', // human review confirmed apparent CSAM\n  'hashMatchValidated', // validated hash match\n]);\nexport type ReportDispositionReasonCode = z.infer<typeof ReportDispositionReasonCodeSchema>;\n\n/** The reason codes that ASSERT a reporting obligation — legal ONLY with 'reportRequired'.\n * Compile-linked subset of the canonical reason enum. */\nexport const REPORT_REQUIRED_DISPOSITION_REASON_CODES = [\n  'apparentCsamConfirmed',\n  'hashMatchValidated',\n] as const satisfies readonly ReportDispositionReasonCode[];\n\n/** The not-required / exception reason codes — legal with every disposition that does NOT assert a\n * reporting obligation ('notRequired', 'correctedNoApparentViolation'). Compile-linked subset. */\nexport const NOT_REQUIRED_DISPOSITION_REASON_CODES = [\n  'outOfScopeNotCsea',\n  'basisInvalidatedFalseMatch',\n  'duplicateOfFiledReport',\n  'leDirectedNoReport',\n  'nonReportableSafetyConfirmed',\n] as const satisfies readonly ReportDispositionReasonCode[];\n\n/** The ONE cross-field pairing (§A9, ARCH-102): which reason codes each disposition permits.\n * Declared HERE once; both the setReportDisposition input (case.ts) and the SafetyDispositionAction\n * console command (admin.ts) apply `refineReportDispositionReasonCode` derived from this map rather\n * than re-declaring the pairing. 'undetermined' is the initial state, never an operator-settable\n * target, so it permits NO reason code (the operator command excludes it). Typed as an exhaustive\n * Record so a new disposition fails to compile until its permitted codes are declared. */\nexport const REPORT_DISPOSITION_ALLOWED_REASON_CODES: Record<\n  ReportDisposition,\n  readonly ReportDispositionReasonCode[]\n> = {\n  undetermined: [],\n  reportRequired: REPORT_REQUIRED_DISPOSITION_REASON_CODES,\n  notRequired: NOT_REQUIRED_DISPOSITION_REASON_CODES,\n  correctedNoApparentViolation: NOT_REQUIRED_DISPOSITION_REASON_CODES,\n};\n\n/** Shared cross-field refinement enforcing the disposition↔reason pairing above. Applied by BOTH\n * the setReportDisposition input schemas and the SafetyDispositionAction console command so the\n * rule lives in exactly one place. Reports the failure on the `dispositionReasonCode` path. */\nexport function refineReportDispositionReasonCode(\n  value: { disposition: ReportDisposition; dispositionReasonCode: ReportDispositionReasonCode },\n  ctx: z.RefinementCtx,\n): void {\n  if (!REPORT_DISPOSITION_ALLOWED_REASON_CODES[value.disposition].includes(value.dispositionReasonCode)) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      path: ['dispositionReasonCode'],\n      message: `Reason code '${value.dispositionReasonCode}' is not valid for disposition '${value.disposition}'.`,\n    });\n  }\n}\n\n/** Shared cross-field rule (§A9): disposition 'reportRequired' MUST carry at least one evidence ref —\n * a reporting obligation can only be asserted once the evidence has been revealed. Every OTHER\n * disposition ('notRequired', 'correctedNoApparentViolation', 'undetermined') MAY leave evidenceRefs\n * empty. Declared HERE once (ARCH-102) and applied — alongside refineReportDispositionReasonCode — by\n * BOTH the setReportDisposition input schemas (case.ts) and the SafetyStagedAction console command\n * (admin.ts), never re-declared. Reports the failure on the `evidenceRefs` path. */\nexport function refineReportDispositionEvidenceRefs(\n  value: { disposition: ReportDisposition; evidenceRefs: readonly string[] },\n  ctx: z.RefinementCtx,\n): void {\n  if (value.disposition === 'reportRequired' && value.evidenceRefs.length === 0) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      path: ['evidenceRefs'],\n      message:\n        \"Disposition 'reportRequired' requires at least one evidence ref (evidence must have been revealed).\",\n    });\n  }\n}\n\n// ===========================================================================\n// [EUAS-008] Structured safety-case CLOSURE record — the operator's terminal\n// determination persisted when a CSAM / NCII case is closed via the guided\n// resolution flow (resolveAdminTask). Embedded on the NCII case (`closure`) and on\n// a child-safety `decisions/{id}` row (kind `caseClosed`) so both case types carry\n// the SAME structured outcome/summary/note + actor/timestamp — not just a status\n// flip. This does NOT replace the case lifecycle's own terminal status; it records\n// WHO closed it, WHY, and with what outcome.\n// ===========================================================================\n\n/** founded = a violation was substantiated; unfounded = no violation on review. */\nexport const SafetyCaseClosureOutcomeSchema = z.enum(['founded', 'unfounded']);\nexport type SafetyCaseClosureOutcome = z.infer<typeof SafetyCaseClosureOutcomeSchema>;\n\n/** The structured closure record written on a safety-case close. */\nexport const SafetyCaseClosureV1Schema = z.object({\n  outcome: SafetyCaseClosureOutcomeSchema,\n  resolutionSummary: z.string().min(1).max(MAX_SAFETY_RESOLUTION_SUMMARY_LENGTH),\n  adminNote: z.string().max(MAX_SAFETY_ADMIN_NOTE_LENGTH).optional(),\n  closedByUid: z.string().min(1),\n  closedAt: z.number(),\n}).strict();\nexport type SafetyCaseClosureV1 = z.infer<typeof SafetyCaseClosureV1Schema>;\n\n/** NCMEC submission lifecycle — MANUAL-PORTAL model (§A9). NO `notRequired` (that is\n * ReportDisposition). There is no automated ispws API: a report-needed obligation sits in\n * `awaitingManualFiling` from enqueue until the operator files on the NCMEC portal and records the\n * confirmation (markNcmecPortalComplete → `completed`). Jobs are born `awaitingManualFiling`; the\n * case-list `ncmecStatus` projection uses the same value (no separate `queued` state). There is no\n * in-app retraction — corrections are portal-manual (correction-lifecycle decision). The old\n * API-drive states\n * (opening/open/uploading/addingFileDetails/finishing/retryableFailure/ambiguousResult/permanentFailure)\n * were removed with the live-API client. */\nexport const NcmecSubmissionStateSchema = z.enum([\n  'awaitingManualFiling',\n  'completed',\n]);\nexport type NcmecSubmissionState = z.infer<typeof NcmecSubmissionStateSchema>;\n\n// ===========================================================================\n// A3 — Safety-hold + resource-command vocabularies (the ONE destructive-guard\n// authority). The NCII/storage resource types live in THIS enum (H1 fix).\n// ===========================================================================\n\nexport const SafetyHoldResourceTypeSchema = z.enum([\n  'contentDoc',\n  'mediaAsset',\n  'account',\n  'chatMessageRange',\n  'channel',\n  'nciiTemporaryTarget',\n  'storageObject',\n  'reportEvidenceObject',\n]);\nexport type SafetyHoldResourceType = z.infer<typeof SafetyHoldResourceTypeSchema>;\n\n/** Lifecycle/retention regime governed by the A3 compatibility matrix. */\nexport const SafetyHoldClassSchema = z.enum([\n  'childSafety',\n  'nciiTemporary',\n  'legalRetention',\n  'preservationEvidence',\n  // An OPEN ordinary (non-protected) content report places an account-level hold\n  // (resourceType 'account', ownerUid = the reported user) so a user can't delete\n  // their data out from under an unreviewed report (e.g. a DMCA/IP complaint, then\n  // delete-to-clear-tracks). blocksDeletion + blocksAnonymization; released when the\n  // report group's admin close-out resolves it. Durable (no expiresAt).\n  'ordinaryReport',\n]);\nexport type SafetyHoldClass = z.infer<typeof SafetyHoldClassSchema>;\n\n/** Resource-scoped destructive command kinds (A3). */\nexport const SafetyCommandKindSchema = z.enum([\n  'nciiRemoval',\n  'csamActiveByteRemoval',\n  'evidenceDisposition',\n]);\nexport type SafetyCommandKind = z.infer<typeof SafetyCommandKindSchema>;\n\n// ===========================================================================\n// Reviewer-capability matrix (§A11 [M4] + §A9). One solo operator holds all\n// at launch; every privileged command checks the SPECIFIC capability + reauth.\n// ===========================================================================\n\nexport const SafetyReviewerCapabilitySchema = z.enum([\n  'nciiRequestReviewer',\n  'nciiEvidenceReviewer',\n  'nciiAppealReviewer',\n  'childSafetyReviewer',\n  'legalDispositionAuthority',\n]);\nexport type SafetyReviewerCapability = z.infer<typeof SafetyReviewerCapabilitySchema>;\n\n// ===========================================================================\n// A7 — Registration-completion outcome (DOMAIN enum; replaces the unsafe\n// generic gRPC retryable/terminal code lists). Only a domain outcome feeds the\n// orphan-Auth deletion policy.\n// ===========================================================================\n\nexport const RegistrationCompletionOutcomeSchema = z.enum([\n  'completed',\n  'alreadyCompletedSameUid',\n  'retryableInfrastructureFailure',\n  'reauthenticationRequired',\n  'appCheckRetryRequired',\n  'nonceExpired',\n  'nonceUnknown',\n  'nonceConsumedDifferentUid',\n  'sessionHashMismatch',\n  'attestationSignatureInvalid',\n  'privateDataConflict',\n  'policyVersionRejected',\n]);\nexport type RegistrationCompletionOutcome = z.infer<typeof RegistrationCompletionOutcomeSchema>;\n\n// ===========================================================================\n// A11 — NCII / TAKE IT DOWN shared vocabularies (consumed by BOTH NCII clusters)\n// ===========================================================================\n\n/** Closed enum of required field codes — completeness + public missing-fields. */\nexport const TakeItDownFieldCodeSchema = z.enum([\n  'requesterName',\n  'contactEmail',\n  'contactPhone',\n  'requesterRole',\n  'electronicSignature',\n  'authorityBasis',\n  'authorityCertification',\n  'authorityEvidence',\n  'targetLocator',\n  'nonconsentStatement',\n  'supportingFacts',\n  'goodFaithCertification',\n]);\nexport type TakeItDownFieldCode = z.infer<typeof TakeItDownFieldCodeSchema>;\n\n/** Closed PUBLIC-SAFE reason codes — never reveal evidence/uploader/crossover. */\nexport const TakeItDownPublicReasonCodeSchema = z.enum([\n  'needMoreInformation',\n  'couldNotVerifyRequesterRole',\n  'couldNotLocateContent',\n  'outsideCoveredScope',\n  'duplicateOfExistingRequest',\n  'removedSuccessfully',\n  'underReview',\n  'closedSeeNotice',\n]);\nexport type TakeItDownPublicReasonCode = z.infer<typeof TakeItDownPublicReasonCodeSchema>;\n\n/** Validity-failure reason codes ([H2]). `incomplete` is a COMPLETENESS state,\n * NEVER a validity state. */\nexport const TakeItDownInvalidReasonCodeSchema = z.enum([\n  'missingSignature',\n  'missingLocator',\n  'missingNonconsentStatement',\n  'missingContactInformation',\n  'requesterNotDepictedPersonOrAuthorizedRepresentative',\n  'authorityNotEstablished',\n  'locatorNotResolvableAfterReasonableEffort',\n  'requestOutsideCoveredDepiction',\n  'duplicateSuperseded',\n  'fraudulentOrBadFaith',\n  'otherCounselApproved',\n]);\nexport type TakeItDownInvalidReasonCode = z.infer<typeof TakeItDownInvalidReasonCodeSchema>;\n\n/** Requester role (depicted person vs authorized representative). */\nexport const TakeItDownRequesterRoleSchema = z.enum(['depictedPerson', 'authorizedRepresentative']);\nexport type TakeItDownRequesterRole = z.infer<typeof TakeItDownRequesterRoleSchema>;\n\n/** Two-axis state: completeness vs validity (H2). */\nexport const TakeItDownCompletenessStatusSchema = z.enum(['incomplete', 'complete']);\nexport type TakeItDownCompletenessStatus = z.infer<typeof TakeItDownCompletenessStatusSchema>;\n\nexport const TakeItDownValidityStatusSchema = z.enum(['pending', 'valid', 'invalid', 'unableToLocate']);\nexport type TakeItDownValidityStatus = z.infer<typeof TakeItDownValidityStatusSchema>;\n\n/** The public no-login status-page status set (root + statusProjection). No\n * appeal model — no `appealedCorrected` (the appeal/reinstatement flow was\n * removed; protected reports have no uploader appeal/notice/reinstatement). */\nexport const TakeItDownPublicStatusSchema = z.enum([\n  'received',\n  'needsMoreInfo',\n  'validInProgress',\n  'completed',\n  'unableToLocate',\n  'invalidGeneralReason',\n]);\nexport type TakeItDownPublicStatus = z.infer<typeof TakeItDownPublicStatusSchema>;\n\n/** Request action types ([L1]). */\nexport const NciiActionTypeSchema = z.enum([\n  'intakeReceived',\n  'completenessDecided',\n  'validityDecided',\n  'tempHoldPlaced',\n  'tempHoldReleased',\n  'removalStarted',\n  'removalCompleted',\n  'hashBlockReversed',\n  'childSafetyCaseLinked',\n  'legalDispositionRecorded',\n]);\nexport type NciiActionType = z.infer<typeof NciiActionTypeSchema>;\n\nexport const NciiActionResultSchema = z.enum(['succeeded', 'failed', 'deferred', 'rejected']);\nexport type NciiActionResult = z.infer<typeof NciiActionResultSchema>;\n\n/** Honest derived completion ([H4]) — never 'completed' for a partial failure. */\nexport const NciiRemovalCompletionOutcomeSchema = z.enum([\n  'completed',\n  'completedWithApprovedException',\n  'unableToComplete',\n]);\nexport type NciiRemovalCompletionOutcome = z.infer<typeof NciiRemovalCompletionOutcomeSchema>;\n\nexport const NciiTargetSurfaceSchema = z.enum([\n  'original',\n  'hallCopy',\n  'profileMedia',\n  'chatAttachment',\n  'variant',\n  'cacheServing',\n  'exactHashMatch',\n]);\nexport type NciiTargetSurface = z.infer<typeof NciiTargetSurfaceSchema>;\n\nexport const NciiTargetOutcomeSchema = z.enum([\n  'pending',\n  'removed',\n  'tombstoned',\n  'verifiedGone',\n  'leftoverRetrying',\n  'unableToComplete',\n  'terminalException',\n]);\nexport type NciiTargetOutcome = z.infer<typeof NciiTargetOutcomeSchema>;\n\n/** CLOSED terminal-exception enum — a technical outage is NOT an exception. */\nexport const NciiTerminalExceptionSchema = z.enum([\n  'legallyPermittedRetention',\n  'contentNotPresentVerified',\n  'counselApprovedException',\n]);\nexport type NciiTerminalException = z.infer<typeof NciiTerminalExceptionSchema>;\n\n/** Internal operational case status ([H7]).\n *\n * [R12] close-lifecycle states: clicking **Close** (after the strict-closable gate passes)\n * applies the staged actions and moves the case to `processing` — it STAYS pinned/in-queue,\n * NEVER cleared on the click. The NCII removal worker flips the case to the terminal `closed`\n * ONLY on VERIFIED removal completion (clearing the pin via onSafetyCaseClosed). If the\n * removal saga exhausts its retries (dead-letter), the case moves to `failed` — kept pinned,\n * surfaced in the Safety Console failed-jobs view, with a Restart that re-arms the job. Both\n * are explicit values (never derived). */\nexport const NciiInternalStatusSchema = z.enum([\n  'open',\n  'removalInProgress',\n  'processing',\n  'failed',\n  'removed',\n  'rejected',\n  'closed',\n]);\nexport type NciiInternalStatus = z.infer<typeof NciiInternalStatusSchema>;\n\n/** Child-safety linkage status on an NCII case ([H7]). */\nexport const NciiChildSafetyLinkStatusSchema = z.enum([\n  'none',\n  'assessmentPending',\n  'linked',\n  'resolvedNoChildSafetyCase',\n]);\nexport type NciiChildSafetyLinkStatus = z.infer<typeof NciiChildSafetyLinkStatusSchema>;\n\n// ===========================================================================\n// A11 [F4] — child-safety crossover (possible-minor ≠ automatic CSAM).\n// Embedded on nciiCases. childSafetyCaseId lives HERE (one canonical place).\n// ===========================================================================\n\nexport const NciiMinorAssessmentSchema = z.enum(['adult', 'unknown', 'possibleMinor', 'confirmedMinor']);\nexport type NciiMinorAssessment = z.infer<typeof NciiMinorAssessmentSchema>;\n\nexport const NciiCsamAssessmentSchema = z.enum([\n  'notAssessed',\n  'notApparent',\n  'apparentViolation',\n  'validatedHashMatch',\n]);\nexport type NciiCsamAssessment = z.infer<typeof NciiCsamAssessmentSchema>;\n\nexport const NciiChildSafetyCrossoverSchema = z.object({\n  minorAssessment: NciiMinorAssessmentSchema,\n  csamAssessment: NciiCsamAssessmentSchema,\n  childSafetyCaseId: z.string().min(1).optional(),\n  assessedByUid: z.string().min(1).optional(),\n  assessedAt: z.number().optional(),\n}).strict();\nexport type NciiChildSafetyCrossover = z.infer<typeof NciiChildSafetyCrossoverSchema>;\n\n/** [H-2] Per-leg lifecycle status for the possible-minor crossover side-effects (serving-deny,\n * PhotoDNA) persisted on the crossover child-safety case (see ChildSafetyCaseV1.crossoverLegs).\n * `pending` is the in-transaction initial marker the assessment writes before the post-commit leg\n * runs; the leg then flips it to `done` (succeeded) or `failed` (captureException'd, awaiting a\n * reconcile/replay). A leg is ABSENT (not `pending`) when it never applied — an external / no-media\n * target has no bytes to deny or scan. */\nexport const SafetyCrossoverLegStatusSchema = z.enum(['pending', 'done', 'failed']);\nexport type SafetyCrossoverLegStatus = z.infer<typeof SafetyCrossoverLegStatusSchema>;\n"]}

package/dist/doc-schemas/safety/holds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"holds.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/safety/holds.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,yEAAyE;AACzE,eAAO,MAAM,wBAAwB;;;EAAiC,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;oCAEoC;AACpC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwBvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAUpE;0DAC0D;AAC1D,eAAO,MAAM,0BAA0B;;;;;;;;;kBAS5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAW9E;;mDAEmD;AACnD,eAAO,MAAM,gCAAgC;;;;;EAK3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;kCAEkC;AAClC,eAAO,MAAM,0CAA0C;;;;;kBAW5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;uCAGuC;AACvC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkB/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAQpF;qFACqF;AACrF,eAAO,MAAM,8CAA8C;;;;kBAIhD,CAAC;AACZ,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAEtH;wEACwE;AACxE,eAAO,MAAM,sCAAsC;;;;;;;;;;kBAIxC,CAAC;AACZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC"}
+{"version":3,"file":"holds.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/safety/holds.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,yEAAyE;AACzE,eAAO,MAAM,wBAAwB;;;EAAiC,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;oCAEoC;AACpC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwBvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAUpE;0DAC0D;AAC1D,eAAO,MAAM,0BAA0B;;;;;;;;;kBAS5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAW9E;;mDAEmD;AACnD,eAAO,MAAM,gCAAgC;;;;;EAK3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;kCAEkC;AAClC,eAAO,MAAM,0CAA0C;;;;;kBAW5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;uCAGuC;AACvC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkB/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAQpF;qFACqF;AACrF,eAAO,MAAM,8CAA8C;;;;kBAIhD,CAAC;AACZ,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAEtH;wEACwE;AACxE,eAAO,MAAM,sCAAsC;;;;;;;;;;kBAIxC,CAAC;AACZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC"}

package/dist/doc-schemas/safety/holds.js

@@ -6,9 +6,10 @@
 // `safetyHoldResources/{resourceKeyHash}` aggregate carries per-flag counters for
 // O(1) destructive checks; and `safetyResourceCommands/{resourceKeyHash}__{commandId}`
 // is the resource-scoped destructive command that resolves the release-before-delete
-// race. Every shape here is transcribed verbatim from docs/code_changes_needed/
-// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A3 — no invented values, no
-// placeholders.
+// race. Every shape here is transcribed verbatim from the frozen Trust & Safety
+// spec (Appendix A §A3) — no invented values, no placeholders; the durable design
+// owners are ttt-prod docs/design/csam-detection-and-response.md and
+// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.
 //
 // SHARED enums come from ./foundation.js (the single source for every cross-cluster
 // enum); they are NEVER redefined here. The hold-ref/aggregate resource type uses

package/dist/doc-schemas/safety/holds.js.map

@@ -1 +1 @@
-{"version":3,"file":"holds.js","sourceRoot":"","sources":["../../../src/doc-schemas/safety/holds.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,wCAAwC;AACxC,EAAE;AACF,yFAAyF;AACzF,6EAA6E;AAC7E,kFAAkF;AAClF,uFAAuF;AACvF,qFAAqF;AACrF,gFAAgF;AAChF,kFAAkF;AAClF,gBAAgB;AAChB,EAAE;AACF,oFAAoF;AACpF,kFAAkF;AAClF,sFAAsF;AACtF,sFAAsF;AACtF,qDAAqD;AACrD,EAAE;AACF,oFAAoF;AACpF,kFAAkF;AAClF,oFAAoF;AACpF,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,8EAA8E;AAC9E,kDAAkD;AAClD,iFAAiF;AACjF,iFAAiF;AACjF,mEAAmE;AACnE,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAGvE;;oCAEoC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,YAAY,EAAE,4BAA4B;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,uFAAuF;IACvF,sFAAsF;IACtF,wFAAwF;IACxF,0FAA0F;IAC1F,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;IACrC,KAAK,EAAE,wBAAwB;IAC/B,SAAS,EAAE,qBAAqB,EAAE,+EAA+E;IACjH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,gEAAgE;IAC/G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,oHAAoH;IACtJ,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,2DAA2D;CAC5G,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,6CAA6C;AAC7C,yEAAyE;AACzE,+EAA+E;AAC/E,iFAAiF;AACjF,2DAA2D;AAC3D,8EAA8E;AAE9E;0DAC0D;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,6DAA6D;AAC7D,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,mFAAmF;AACnF,qEAAqE;AACrE,8EAA8E;AAE9E;;mDAEmD;AACnD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC;IACrD,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,QAAQ;CACT,CAAC,CAAC;AAGH;;kCAEkC;AAClC,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;8EAK0E;IAC1E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;uCAGuC;AACvC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mDAAmD;IACjF,WAAW,EAAE,uBAAuB;IACpC,YAAY,EAAE,uBAAuB,EAAE,qEAAqE;IAC5G,aAAa,EAAE,0CAA0C,EAAE,iDAAiD;IAC5G,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,gGAAgG;IACvJ,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,gCAAgC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,sEAAsE;AACtE,8EAA8E;AAE9E;qFACqF;AACrF,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;wEACwE;AACxE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,qBAAqB;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — safety holds + resource-scoped destructive commands (Appendix\n// A §A3, Finding-H1 / [C-01] / [M-05]).\n//\n// The SINGLE destructive-guard authority: a `safetyHoldRefs/{caseId}__{resourceKeyHash}`\n// row is the only doc that ever authorizes/denies a destructive byte-op; the\n// `safetyHoldResources/{resourceKeyHash}` aggregate carries per-flag counters for\n// O(1) destructive checks; and `safetyResourceCommands/{resourceKeyHash}__{commandId}`\n// is the resource-scoped destructive command that resolves the release-before-delete\n// race. Every shape here is transcribed verbatim from docs/code_changes_needed/\n// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A3 — no invented values, no\n// placeholders.\n//\n// SHARED enums come from ./foundation.js (the single source for every cross-cluster\n// enum); they are NEVER redefined here. The hold-ref/aggregate resource type uses\n// SafetyHoldResourceTypeSchema (the H1 enum that carries the NCII/storage types); the\n// resource-command's `resourceType` uses TargetLocatorKindSchema (the [C-01] serving-\n// vs-evidence resource = `TargetLocatorV1['kind']`).\n//\n// Collection note: this cluster introduces three NEW Firestore collections plus two\n// overflow subcollections under `safetyResourceCommands`. Wiring collections.ts /\n// path-builders.ts / registry.ts is deferred to the app leg (the orchestrator binds\n// the schemas + path builders there); the composite doc-id shapes are documented on\n// each schema below.\n\nimport { z } from 'zod';\nimport {\n  SafetyHoldResourceTypeSchema,\n  SafetyHoldClassSchema,\n  SafetyCommandKindSchema,\n  TargetLocatorKindSchema,\n} from './foundation.js';\n\n// ===========================================================================\n// A3 — safetyHoldRefs/{caseId}__{resourceKeyHash}\n// Mutable lifecycle row; the SINGLE destructive-guard hold authority (H1). Every\n// hold — child-safety AND NCII-temporary — is one of these refs; no other doc is\n// ever the authority. There is NO `holdSources[]` authority array.\n// ===========================================================================\n\n/** Lifecycle state of a hold ref. CAS release is on `state='active'`. */\nexport const SafetyHoldRefStateSchema = z.enum(['active', 'released']);\nexport type SafetyHoldRefState = z.infer<typeof SafetyHoldRefStateSchema>;\n\n/** `safetyHoldRefs/{caseId}__{resourceKeyHash}` — mutable lifecycle row; the SINGLE\n * destructive-guard hold authority (H1). Doc id is the deterministic composite\n * `{caseId}__{resourceKeyHash}`. */\nexport const SafetyHoldRefV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string().min(1),\n  resourceType: SafetyHoldResourceTypeSchema,\n  resourceId: z.string().min(1),\n  resourceKeyHash: z.string().min(1),\n  canonicalResourceKey: z.string().min(1),\n  // [C-07] The uid that OWNS the held resource (the content uploader / account subject),\n  // when one is resolvable. NOT load-bearing for the destructive guard (that reads ONLY\n  // the resourceKeyHash aggregate) — this is an admin-observability index so active holds\n  // can be listed per account (\"does this account have pending safety actions?\"). Optional:\n  // some resources have no single owning uid, and the `account` key already encodes the uid.\n  ownerUid: z.string().min(1).optional(),\n  blocksDeletion: z.boolean(),\n  blocksAnonymization: z.boolean(),\n  blocksReplacementCleanup: z.boolean(),\n  state: SafetyHoldRefStateSchema,\n  holdClass: SafetyHoldClassSchema, // lifecycle/retention regime; FULL set governed by the A3 compatibility matrix\n  createdAt: z.number(),\n  releasedAt: z.number().optional(),\n  releaseReason: z.string().optional(),\n  sourceRequestId: z.string().min(1).optional(), // the statutory request that created an nciiTemporary hold (H1)\n  expiresAt: z.number().optional(), // minimize-retention expiry for nciiTemporary holds; ABSENT for childSafety / legalRetention / preservationEvidence\n  releaseCommandId: z.string().min(1).optional(), // deterministic id of the CAS release/consume command (H1)\n}).strict();\nexport type SafetyHoldRefV1 = z.infer<typeof SafetyHoldRefV1Schema>;\n\n// ===========================================================================\n// A3 — safetyHoldResources/{resourceKeyHash}\n// Aggregate for O(1) destructive checks; per-flag counters. Create-ref +\n// increment in ONE tx; release decrements the exact ref's counters in the same\n// CAS transaction. Counters never go below zero. A destructive op is denied when\n// its relevant count > 0 and FAILS CLOSED on lookup error.\n// ===========================================================================\n\n/** `safetyHoldResources/{resourceKeyHash}` — aggregate per-flag counters for O(1)\n * destructive checks. Doc id is the `resourceKeyHash`. */\nexport const SafetyHoldResourceV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  resourceKeyHash: z.string().min(1),\n  canonicalResourceKey: z.string().min(1),\n  activeRefCount: z.number(),\n  blocksDeletionCount: z.number(),\n  blocksAnonymizationCount: z.number(),\n  blocksReplacementCleanupCount: z.number(),\n  updatedAt: z.number(),\n}).strict();\nexport type SafetyHoldResourceV1 = z.infer<typeof SafetyHoldResourceV1Schema>;\n\n// ===========================================================================\n// A3 — safetyResourceCommands/{resourceKeyHash}__{commandId}\n// Resource-scoped destructive command (the release-before-delete race fix).\n// `commandId` is deterministic per `(resourceKeyHash, commandKind)`, so every\n// compatible ref over the SAME bytes joins ONE command. Inline caps:\n// authorizedFor.requestIds MAX 64, bypassHoldRefIds MAX 256; overflow moves to the\n// child collections below and flips the matching `*Overflowed` flag.\n// ===========================================================================\n\n/** Command lifecycle state. The destructive byte-op runs ONLY under a command in\n * `authorized`/`executing`; a `failed` delete keeps the command + refs active for\n * idempotent retry (failed → re-lease → retry). */\nexport const SafetyResourceCommandStateSchema = z.enum([\n  'authorized',\n  'executing',\n  'verifiedRemoved',\n  'failed',\n]);\nexport type SafetyResourceCommandState = z.infer<typeof SafetyResourceCommandStateSchema>;\n\n/** The obligation(s) that authorized this destructive op. Overflow beyond\n * `requestIds` MAX 64 moves to the `authorizedRequests` child collection and sets\n * `requestIdsOverflowed=true`. */\nexport const SafetyResourceCommandAuthorizedForV1Schema = z.object({\n  requestIds: z.array(z.string().min(1)).max(64),\n  caseId: z.string().min(1).optional(),\n  /** Additional case ids this command is authorized to bypass SERVING holds for — the\n   *  LINKED child-safety case(s) in an NCII↔child-safety crossover (C-08). An\n   *  `nciiRemoval` command authorized for the NCII `caseId` may bypass the linked\n   *  child-safety case's hold on the SERVING resource so the 48h removal isn't stalled;\n   *  the evidence-vault preservation hold has a DISTINCT resource key and is never\n   *  bypassable. Bounded — a crossover links at most a handful of cases. */\n  linkedCaseIds: z.array(z.string().min(1)).max(32).optional(),\n  requestIdsOverflowed: z.boolean().optional(),\n}).strict();\nexport type SafetyResourceCommandAuthorizedForV1 = z.infer<typeof SafetyResourceCommandAuthorizedForV1Schema>;\n\n/** `safetyResourceCommands/{resourceKeyHash}__{commandId}` — resource-scoped\n * destructive command. Doc id is the deterministic composite\n * `{resourceKeyHash}__{commandId}` where `commandId` is deterministic per\n * `(resourceKeyHash, commandKind)`. */\nexport const SafetyResourceCommandV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  resourceKeyHash: z.string().min(1),\n  canonicalResourceKey: z.string().min(1),\n  commandId: z.string().min(1), // deterministic per (resourceKeyHash, commandKind)\n  commandKind: SafetyCommandKindSchema,\n  resourceType: TargetLocatorKindSchema, // [C-01] the SERVING vs evidence-vault resource this command targets\n  authorizedFor: SafetyResourceCommandAuthorizedForV1Schema, // overflow → authorizedRequests child collection\n  bypassHoldRefIds: z.array(z.string().min(1)).max(256), // ONLY the bypassable refs per the compatibility matrix; overflow → bypassRefs child collection\n  bypassHoldRefsOverflowed: z.boolean().optional(),\n  state: SafetyResourceCommandStateSchema,\n  attemptCount: z.number(),\n  leaseOwner: z.string().min(1).optional(),\n  leaseExpiresAt: z.number().optional(),\n  lastErrorCode: z.string().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  verifiedRemovedAt: z.number().optional(),\n}).strict();\nexport type SafetyResourceCommandV1 = z.infer<typeof SafetyResourceCommandV1Schema>;\n\n// ===========================================================================\n// A3 [M-05] — overflow child collections under a resource command (mirror the\n// `relatedAssets` overflow pattern). A `*Overflowed` flag means the inline array\n// is NOT the complete set and the child collection MUST be consulted.\n// ===========================================================================\n\n/** `safetyResourceCommands/{resourceKeyHash}__{commandId}/authorizedRequests/{requestId}`\n * — overflow beyond `authorizedFor.requestIds` MAX 64. Doc id is the `requestId`. */\nexport const SafetyResourceCommandAuthorizedRequestV1Schema = z.object({\n  requestId: z.string().min(1),\n  caseId: z.string().min(1).optional(),\n  addedAt: z.number(),\n}).strict();\nexport type SafetyResourceCommandAuthorizedRequestV1 = z.infer<typeof SafetyResourceCommandAuthorizedRequestV1Schema>;\n\n/** `safetyResourceCommands/{resourceKeyHash}__{commandId}/bypassRefs/{refId}` —\n * overflow beyond `bypassHoldRefIds` MAX 256. Doc id is the `refId`. */\nexport const SafetyResourceCommandBypassRefV1Schema = z.object({\n  refId: z.string().min(1),\n  holdClass: SafetyHoldClassSchema,\n  addedAt: z.number(),\n}).strict();\nexport type SafetyResourceCommandBypassRefV1 = z.infer<typeof SafetyResourceCommandBypassRefV1Schema>;\n"]}
+{"version":3,"file":"holds.js","sourceRoot":"","sources":["../../../src/doc-schemas/safety/holds.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,wCAAwC;AACxC,EAAE;AACF,yFAAyF;AACzF,6EAA6E;AAC7E,kFAAkF;AAClF,uFAAuF;AACvF,qFAAqF;AACrF,gFAAgF;AAChF,kFAAkF;AAClF,qEAAqE;AACrE,kEAAkE;AAClE,EAAE;AACF,oFAAoF;AACpF,kFAAkF;AAClF,sFAAsF;AACtF,sFAAsF;AACtF,qDAAqD;AACrD,EAAE;AACF,oFAAoF;AACpF,kFAAkF;AAClF,oFAAoF;AACpF,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,8EAA8E;AAC9E,kDAAkD;AAClD,iFAAiF;AACjF,iFAAiF;AACjF,mEAAmE;AACnE,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAGvE;;oCAEoC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,YAAY,EAAE,4BAA4B;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,uFAAuF;IACvF,sFAAsF;IACtF,wFAAwF;IACxF,0FAA0F;IAC1F,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;IACrC,KAAK,EAAE,wBAAwB;IAC/B,SAAS,EAAE,qBAAqB,EAAE,+EAA+E;IACjH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,gEAAgE;IAC/G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,oHAAoH;IACtJ,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,2DAA2D;CAC5G,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,6CAA6C;AAC7C,yEAAyE;AACzE,+EAA+E;AAC/E,iFAAiF;AACjF,2DAA2D;AAC3D,8EAA8E;AAE9E;0DAC0D;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,6DAA6D;AAC7D,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,mFAAmF;AACnF,qEAAqE;AACrE,8EAA8E;AAE9E;;mDAEmD;AACnD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC;IACrD,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,QAAQ;CACT,CAAC,CAAC;AAGH;;kCAEkC;AAClC,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;8EAK0E;IAC1E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;uCAGuC;AACvC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mDAAmD;IACjF,WAAW,EAAE,uBAAuB;IACpC,YAAY,EAAE,uBAAuB,EAAE,qEAAqE;IAC5G,aAAa,EAAE,0CAA0C,EAAE,iDAAiD;IAC5G,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,gGAAgG;IACvJ,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,gCAAgC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,sEAAsE;AACtE,8EAA8E;AAE9E;qFACqF;AACrF,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;wEACwE;AACxE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,qBAAqB;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — safety holds + resource-scoped destructive commands (Appendix\n// A §A3, Finding-H1 / [C-01] / [M-05]).\n//\n// The SINGLE destructive-guard authority: a `safetyHoldRefs/{caseId}__{resourceKeyHash}`\n// row is the only doc that ever authorizes/denies a destructive byte-op; the\n// `safetyHoldResources/{resourceKeyHash}` aggregate carries per-flag counters for\n// O(1) destructive checks; and `safetyResourceCommands/{resourceKeyHash}__{commandId}`\n// is the resource-scoped destructive command that resolves the release-before-delete\n// race. Every shape here is transcribed verbatim from the frozen Trust & Safety\n// spec (Appendix A §A3) — no invented values, no placeholders; the durable design\n// owners are ttt-prod docs/design/csam-detection-and-response.md and\n// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.\n//\n// SHARED enums come from ./foundation.js (the single source for every cross-cluster\n// enum); they are NEVER redefined here. The hold-ref/aggregate resource type uses\n// SafetyHoldResourceTypeSchema (the H1 enum that carries the NCII/storage types); the\n// resource-command's `resourceType` uses TargetLocatorKindSchema (the [C-01] serving-\n// vs-evidence resource = `TargetLocatorV1['kind']`).\n//\n// Collection note: this cluster introduces three NEW Firestore collections plus two\n// overflow subcollections under `safetyResourceCommands`. Wiring collections.ts /\n// path-builders.ts / registry.ts is deferred to the app leg (the orchestrator binds\n// the schemas + path builders there); the composite doc-id shapes are documented on\n// each schema below.\n\nimport { z } from 'zod';\nimport {\n  SafetyHoldResourceTypeSchema,\n  SafetyHoldClassSchema,\n  SafetyCommandKindSchema,\n  TargetLocatorKindSchema,\n} from './foundation.js';\n\n// ===========================================================================\n// A3 — safetyHoldRefs/{caseId}__{resourceKeyHash}\n// Mutable lifecycle row; the SINGLE destructive-guard hold authority (H1). Every\n// hold — child-safety AND NCII-temporary — is one of these refs; no other doc is\n// ever the authority. There is NO `holdSources[]` authority array.\n// ===========================================================================\n\n/** Lifecycle state of a hold ref. CAS release is on `state='active'`. */\nexport const SafetyHoldRefStateSchema = z.enum(['active', 'released']);\nexport type SafetyHoldRefState = z.infer<typeof SafetyHoldRefStateSchema>;\n\n/** `safetyHoldRefs/{caseId}__{resourceKeyHash}` — mutable lifecycle row; the SINGLE\n * destructive-guard hold authority (H1). Doc id is the deterministic composite\n * `{caseId}__{resourceKeyHash}`. */\nexport const SafetyHoldRefV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string().min(1),\n  resourceType: SafetyHoldResourceTypeSchema,\n  resourceId: z.string().min(1),\n  resourceKeyHash: z.string().min(1),\n  canonicalResourceKey: z.string().min(1),\n  // [C-07] The uid that OWNS the held resource (the content uploader / account subject),\n  // when one is resolvable. NOT load-bearing for the destructive guard (that reads ONLY\n  // the resourceKeyHash aggregate) — this is an admin-observability index so active holds\n  // can be listed per account (\"does this account have pending safety actions?\"). Optional:\n  // some resources have no single owning uid, and the `account` key already encodes the uid.\n  ownerUid: z.string().min(1).optional(),\n  blocksDeletion: z.boolean(),\n  blocksAnonymization: z.boolean(),\n  blocksReplacementCleanup: z.boolean(),\n  state: SafetyHoldRefStateSchema,\n  holdClass: SafetyHoldClassSchema, // lifecycle/retention regime; FULL set governed by the A3 compatibility matrix\n  createdAt: z.number(),\n  releasedAt: z.number().optional(),\n  releaseReason: z.string().optional(),\n  sourceRequestId: z.string().min(1).optional(), // the statutory request that created an nciiTemporary hold (H1)\n  expiresAt: z.number().optional(), // minimize-retention expiry for nciiTemporary holds; ABSENT for childSafety / legalRetention / preservationEvidence\n  releaseCommandId: z.string().min(1).optional(), // deterministic id of the CAS release/consume command (H1)\n}).strict();\nexport type SafetyHoldRefV1 = z.infer<typeof SafetyHoldRefV1Schema>;\n\n// ===========================================================================\n// A3 — safetyHoldResources/{resourceKeyHash}\n// Aggregate for O(1) destructive checks; per-flag counters. Create-ref +\n// increment in ONE tx; release decrements the exact ref's counters in the same\n// CAS transaction. Counters never go below zero. A destructive op is denied when\n// its relevant count > 0 and FAILS CLOSED on lookup error.\n// ===========================================================================\n\n/** `safetyHoldResources/{resourceKeyHash}` — aggregate per-flag counters for O(1)\n * destructive checks. Doc id is the `resourceKeyHash`. */\nexport const SafetyHoldResourceV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  resourceKeyHash: z.string().min(1),\n  canonicalResourceKey: z.string().min(1),\n  activeRefCount: z.number(),\n  blocksDeletionCount: z.number(),\n  blocksAnonymizationCount: z.number(),\n  blocksReplacementCleanupCount: z.number(),\n  updatedAt: z.number(),\n}).strict();\nexport type SafetyHoldResourceV1 = z.infer<typeof SafetyHoldResourceV1Schema>;\n\n// ===========================================================================\n// A3 — safetyResourceCommands/{resourceKeyHash}__{commandId}\n// Resource-scoped destructive command (the release-before-delete race fix).\n// `commandId` is deterministic per `(resourceKeyHash, commandKind)`, so every\n// compatible ref over the SAME bytes joins ONE command. Inline caps:\n// authorizedFor.requestIds MAX 64, bypassHoldRefIds MAX 256; overflow moves to the\n// child collections below and flips the matching `*Overflowed` flag.\n// ===========================================================================\n\n/** Command lifecycle state. The destructive byte-op runs ONLY under a command in\n * `authorized`/`executing`; a `failed` delete keeps the command + refs active for\n * idempotent retry (failed → re-lease → retry). */\nexport const SafetyResourceCommandStateSchema = z.enum([\n  'authorized',\n  'executing',\n  'verifiedRemoved',\n  'failed',\n]);\nexport type SafetyResourceCommandState = z.infer<typeof SafetyResourceCommandStateSchema>;\n\n/** The obligation(s) that authorized this destructive op. Overflow beyond\n * `requestIds` MAX 64 moves to the `authorizedRequests` child collection and sets\n * `requestIdsOverflowed=true`. */\nexport const SafetyResourceCommandAuthorizedForV1Schema = z.object({\n  requestIds: z.array(z.string().min(1)).max(64),\n  caseId: z.string().min(1).optional(),\n  /** Additional case ids this command is authorized to bypass SERVING holds for — the\n   *  LINKED child-safety case(s) in an NCII↔child-safety crossover (C-08). An\n   *  `nciiRemoval` command authorized for the NCII `caseId` may bypass the linked\n   *  child-safety case's hold on the SERVING resource so the 48h removal isn't stalled;\n   *  the evidence-vault preservation hold has a DISTINCT resource key and is never\n   *  bypassable. Bounded — a crossover links at most a handful of cases. */\n  linkedCaseIds: z.array(z.string().min(1)).max(32).optional(),\n  requestIdsOverflowed: z.boolean().optional(),\n}).strict();\nexport type SafetyResourceCommandAuthorizedForV1 = z.infer<typeof SafetyResourceCommandAuthorizedForV1Schema>;\n\n/** `safetyResourceCommands/{resourceKeyHash}__{commandId}` — resource-scoped\n * destructive command. Doc id is the deterministic composite\n * `{resourceKeyHash}__{commandId}` where `commandId` is deterministic per\n * `(resourceKeyHash, commandKind)`. */\nexport const SafetyResourceCommandV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  resourceKeyHash: z.string().min(1),\n  canonicalResourceKey: z.string().min(1),\n  commandId: z.string().min(1), // deterministic per (resourceKeyHash, commandKind)\n  commandKind: SafetyCommandKindSchema,\n  resourceType: TargetLocatorKindSchema, // [C-01] the SERVING vs evidence-vault resource this command targets\n  authorizedFor: SafetyResourceCommandAuthorizedForV1Schema, // overflow → authorizedRequests child collection\n  bypassHoldRefIds: z.array(z.string().min(1)).max(256), // ONLY the bypassable refs per the compatibility matrix; overflow → bypassRefs child collection\n  bypassHoldRefsOverflowed: z.boolean().optional(),\n  state: SafetyResourceCommandStateSchema,\n  attemptCount: z.number(),\n  leaseOwner: z.string().min(1).optional(),\n  leaseExpiresAt: z.number().optional(),\n  lastErrorCode: z.string().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  verifiedRemovedAt: z.number().optional(),\n}).strict();\nexport type SafetyResourceCommandV1 = z.infer<typeof SafetyResourceCommandV1Schema>;\n\n// ===========================================================================\n// A3 [M-05] — overflow child collections under a resource command (mirror the\n// `relatedAssets` overflow pattern). A `*Overflowed` flag means the inline array\n// is NOT the complete set and the child collection MUST be consulted.\n// ===========================================================================\n\n/** `safetyResourceCommands/{resourceKeyHash}__{commandId}/authorizedRequests/{requestId}`\n * — overflow beyond `authorizedFor.requestIds` MAX 64. Doc id is the `requestId`. */\nexport const SafetyResourceCommandAuthorizedRequestV1Schema = z.object({\n  requestId: z.string().min(1),\n  caseId: z.string().min(1).optional(),\n  addedAt: z.number(),\n}).strict();\nexport type SafetyResourceCommandAuthorizedRequestV1 = z.infer<typeof SafetyResourceCommandAuthorizedRequestV1Schema>;\n\n/** `safetyResourceCommands/{resourceKeyHash}__{commandId}/bypassRefs/{refId}` —\n * overflow beyond `bypassHoldRefIds` MAX 256. Doc id is the `refId`. */\nexport const SafetyResourceCommandBypassRefV1Schema = z.object({\n  refId: z.string().min(1),\n  holdClass: SafetyHoldClassSchema,\n  addedAt: z.number(),\n}).strict();\nexport type SafetyResourceCommandBypassRefV1 = z.infer<typeof SafetyResourceCommandBypassRefV1Schema>;\n"]}

package/dist/doc-schemas/safety/monitors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"monitors.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/safety/monitors.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB;;;;;yCAKyC;AACzC,eAAO,MAAM,0BAA0B;;;;;;;;;EASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;2BAC2B;AAC3B,eAAO,MAAM,2BAA2B;;;EAAqC,CAAC;AAC9E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,gCAAgC;AAChC,eAAO,MAAM,4BAA4B;;;;EAA2C,CAAC;AACrF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;yEAKyE;AACzE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAc1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAU1E,eAAO,MAAM,8BAA8B;;;;kBAIhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"monitors.d.ts","sourceRoot":"","sources":["../../../src/doc-schemas/safety/monitors.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB;;;;;yCAKyC;AACzC,eAAO,MAAM,0BAA0B;;;;;;;;;EASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;2BAC2B;AAC3B,eAAO,MAAM,2BAA2B;;;EAAqC,CAAC;AAC9E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,gCAAgC;AAChC,eAAO,MAAM,4BAA4B;;;;EAA2C,CAAC;AACrF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;yEAKyE;AACzE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAc1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAU1E,eAAO,MAAM,8BAA8B;;;;kBAIhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/doc-schemas/safety/monitors.js

@@ -10,9 +10,11 @@
 // and `requestId?` both optional). Arming or resolving one row MUST NOT read or
 // write another row (no cross-monitor coupling).
 //
-// Every shape here is transcribed verbatim from docs/code_changes_needed/
-// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A8 — no invented values, no
-// placeholders.
+// Every shape here is transcribed verbatim from the frozen Trust & Safety spec
+// (Appendix A §A8) — no invented values, no placeholders; the durable design owners
+// are ttt-prod docs/design/csam-detection-and-response.md and (for the [H4]
+// request-scoped removal deadline)
+// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.
 //
 // No cross-cluster foundation enums are consumed here; the monitor enums are
 // §A8-specific value sets and live in this file.

package/dist/doc-schemas/safety/monitors.js.map

@@ -1 +1 @@
-{"version":3,"file":"monitors.js","sourceRoot":"","sources":["../../../src/doc-schemas/safety/monitors.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,kFAAkF;AAClF,uFAAuF;AACvF,0DAA0D;AAC1D,+EAA+E;AAC/E,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,iDAAiD;AACjD,EAAE;AACF,0EAA0E;AAC1E,kFAAkF;AAClF,gBAAgB;AAChB,EAAE;AACF,6EAA6E;AAC7E,iDAAiD;AACjD,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,qBAAqB;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,iDAAiD;AACjD,yFAAyF;AACzF,4EAA4E;AAC5E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;;yCAKyC;AACzC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,WAAW;IACX,kBAAkB;IAClB,2BAA2B;IAC3B,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,sBAAsB;IACtB,qBAAqB;CACtB,CAAC,CAAC;AAGH;2BAC2B;AAC3B,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAG9E,gCAAgC;AAChC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAGrF;;;;;yEAKyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,mDAAmD;IAC5F,WAAW,EAAE,0BAA0B;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IACtF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,gFAAgF;IACjI,MAAM,EAAE,4BAA4B;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,0EAA0E;AAC1E,qEAAqE;AACrE,kFAAkF;AAClF,gFAAgF;AAChF,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — per-obligation SLA monitors + the global dead-man heartbeat\n// (Appendix A §A8, Finding-M1 / Finding-H4 / Finding-H2).\n//\n// One monitor ROW per distinct obligation (the single `safetySlaMonitor/{caseId}`\n// is removed). Most rows are case-scoped — `safetySlaMonitors/{caseId}__{monitorKind}`\n// — but the NCII removal deadline is REQUEST-scoped [H4]:\n// `safetySlaMonitors/{requestId}__nciiRemovalDeadline`, because each statutory\n// request owns its own 48h obligation and a monitor can never be resolved by\n// finishing a DIFFERENT linked request. ONE schema covers both shapes (`caseId?`\n// and `requestId?` both optional). Arming or resolving one row MUST NOT read or\n// write another row (no cross-monitor coupling).\n//\n// Every shape here is transcribed verbatim from docs/code_changes_needed/\n// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A8 — no invented values, no\n// placeholders.\n//\n// No cross-cluster foundation enums are consumed here; the monitor enums are\n// §A8-specific value sets and live in this file.\n//\n// Collection note: this cluster introduces ONE NEW Firestore collection\n// (`safetySlaMonitors`, two doc-id shapes) plus ONE singleton document\n// (`safetyMonitorHeartbeat/global`). Wiring collections.ts / path-builders.ts /\n// registry.ts is deferred to the app leg (the orchestrator binds the schemas +\n// path builders there); the composite + singleton doc-id shapes are documented on\n// each schema below.\n\nimport { z } from 'zod';\n\n// ===========================================================================\n// A8 — safetySlaMonitors/{caseId}__{monitorKind}\n//      AND the request-scoped variant safetySlaMonitors/{requestId}__nciiRemovalDeadline\n// One row per distinct obligation. Each fires the external (Sentry / Cloud-\n// Monitoring) alarm independently.\n// ===========================================================================\n\n/** The distinct obligation kinds. The two FIXED (non-operator-configurable)\n * headline urgent-tab countdowns are `photoDnaContract` (the CSAM 72h match-\n * reporting clock) and `nciiRemovalDeadline` (the NCII 48h statutory removal\n * clock). The rest are internal operational alarms on a CSAM/NCII case, never the\n * headline clock. Clocks + the urgent tab attach ONLY to PhotoDNA-hash detections\n * and cases reported as CSAM or NCII. */\nexport const SafetySlaMonitorKindSchema = z.enum([\n  'reviewDue',\n  'photoDnaContract',\n  'actualKnowledgeUnreported',\n  'ncmecRetry',\n  'quarantineStall',\n  'evidenceStall',\n  'accountActionPending',\n  'nciiRemovalDeadline',\n]);\nexport type SafetySlaMonitorKind = z.infer<typeof SafetySlaMonitorKindSchema>;\n\n/** [H2] nciiRemovalDeadline only: `provisional` on first facial-completeness,\n * `binding` once valid. */\nexport const SafetySlaMonitorStageSchema = z.enum(['provisional', 'binding']);\nexport type SafetySlaMonitorStage = z.infer<typeof SafetySlaMonitorStageSchema>;\n\n/** Monitor lifecycle status. */\nexport const SafetySlaMonitorStatusSchema = z.enum(['armed', 'overdue', 'resolved']);\nexport type SafetySlaMonitorStatus = z.infer<typeof SafetySlaMonitorStatusSchema>;\n\n/** `safetySlaMonitors/{caseId}__{monitorKind}` — per-obligation SLA monitor.\n * The `nciiRemovalDeadline` row is REQUEST-scoped [H4]: its doc id is the\n * composite `{requestId}__nciiRemovalDeadline` and it carries `requestId` (not\n * `caseId`). ONE schema covers both shapes — `caseId?` and `requestId?` are both\n * optional. The case `nciiCases/{caseId}.nciiRemovalDeadlineAt` is a\n * NON-authoritative projection of the minimum active request monitor. */\nexport const SafetySlaMonitorV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string().min(1).optional(),\n  requestId: z.string().min(1).optional(), // nciiRemovalDeadline rows are request-scoped [H4]\n  monitorKind: SafetySlaMonitorKindSchema,\n  armedAt: z.number(),\n  deadlineAt: z.number(),\n  escalationLevel: z.number(),\n  lastFiredAt: z.number().optional(),\n  monitorStage: SafetySlaMonitorStageSchema.optional(), // [H2] nciiRemovalDeadline only\n  basisSubmissionId: z.string().min(1).optional(), // [H2] the immutable TakeItDownSubmissionV1 whose receivedAt pins this deadline\n  status: SafetySlaMonitorStatusSchema,\n  resolvedAt: z.number().optional(),\n  resolutionBasis: z.string().optional(),\n}).strict();\nexport type SafetySlaMonitorV1 = z.infer<typeof SafetySlaMonitorV1Schema>;\n\n// ===========================================================================\n// A8 — safetyMonitorHeartbeat/global (global dead-man monitor; SINGLETON)\n// The scheduled monitor sweep stamps `lastRunAt`; a missed heartbeat\n// (now − lastRunAt > expectedIntervalMs) self-alarms out-of-band. Removes the old\n// per-case `heartbeatAt` — the heartbeat is GLOBAL, not per-case. Doc id is the\n// fixed singleton literal `global`.\n// ===========================================================================\n\nexport const SafetyMonitorHeartbeatV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  lastRunAt: z.number(),\n  expectedIntervalMs: z.number(),\n}).strict();\nexport type SafetyMonitorHeartbeatV1 = z.infer<typeof SafetyMonitorHeartbeatV1Schema>;\n"]}
+{"version":3,"file":"monitors.js","sourceRoot":"","sources":["../../../src/doc-schemas/safety/monitors.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,kFAAkF;AAClF,uFAAuF;AACvF,0DAA0D;AAC1D,+EAA+E;AAC/E,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,iDAAiD;AACjD,EAAE;AACF,+EAA+E;AAC/E,oFAAoF;AACpF,4EAA4E;AAC5E,mCAAmC;AACnC,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,iDAAiD;AACjD,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,qBAAqB;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,iDAAiD;AACjD,yFAAyF;AACzF,4EAA4E;AAC5E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;;yCAKyC;AACzC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,WAAW;IACX,kBAAkB;IAClB,2BAA2B;IAC3B,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,sBAAsB;IACtB,qBAAqB;CACtB,CAAC,CAAC;AAGH;2BAC2B;AAC3B,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAG9E,gCAAgC;AAChC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAGrF;;;;;yEAKyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,mDAAmD;IAC5F,WAAW,EAAE,0BAA0B;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IACtF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,gFAAgF;IACjI,MAAM,EAAE,4BAA4B;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,0EAA0E;AAC1E,qEAAqE;AACrE,kFAAkF;AAClF,gFAAgF;AAChF,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["// Trust & Safety — per-obligation SLA monitors + the global dead-man heartbeat\n// (Appendix A §A8, Finding-M1 / Finding-H4 / Finding-H2).\n//\n// One monitor ROW per distinct obligation (the single `safetySlaMonitor/{caseId}`\n// is removed). Most rows are case-scoped — `safetySlaMonitors/{caseId}__{monitorKind}`\n// — but the NCII removal deadline is REQUEST-scoped [H4]:\n// `safetySlaMonitors/{requestId}__nciiRemovalDeadline`, because each statutory\n// request owns its own 48h obligation and a monitor can never be resolved by\n// finishing a DIFFERENT linked request. ONE schema covers both shapes (`caseId?`\n// and `requestId?` both optional). Arming or resolving one row MUST NOT read or\n// write another row (no cross-monitor coupling).\n//\n// Every shape here is transcribed verbatim from the frozen Trust & Safety spec\n// (Appendix A §A8) — no invented values, no placeholders; the durable design owners\n// are ttt-prod docs/design/csam-detection-and-response.md and (for the [H4]\n// request-scoped removal deadline)\n// docs/design/nonconsensual-intimate-imagery-and-take-it-down.md.\n//\n// No cross-cluster foundation enums are consumed here; the monitor enums are\n// §A8-specific value sets and live in this file.\n//\n// Collection note: this cluster introduces ONE NEW Firestore collection\n// (`safetySlaMonitors`, two doc-id shapes) plus ONE singleton document\n// (`safetyMonitorHeartbeat/global`). Wiring collections.ts / path-builders.ts /\n// registry.ts is deferred to the app leg (the orchestrator binds the schemas +\n// path builders there); the composite + singleton doc-id shapes are documented on\n// each schema below.\n\nimport { z } from 'zod';\n\n// ===========================================================================\n// A8 — safetySlaMonitors/{caseId}__{monitorKind}\n//      AND the request-scoped variant safetySlaMonitors/{requestId}__nciiRemovalDeadline\n// One row per distinct obligation. Each fires the external (Sentry / Cloud-\n// Monitoring) alarm independently.\n// ===========================================================================\n\n/** The distinct obligation kinds. The two FIXED (non-operator-configurable)\n * headline urgent-tab countdowns are `photoDnaContract` (the CSAM 72h match-\n * reporting clock) and `nciiRemovalDeadline` (the NCII 48h statutory removal\n * clock). The rest are internal operational alarms on a CSAM/NCII case, never the\n * headline clock. Clocks + the urgent tab attach ONLY to PhotoDNA-hash detections\n * and cases reported as CSAM or NCII. */\nexport const SafetySlaMonitorKindSchema = z.enum([\n  'reviewDue',\n  'photoDnaContract',\n  'actualKnowledgeUnreported',\n  'ncmecRetry',\n  'quarantineStall',\n  'evidenceStall',\n  'accountActionPending',\n  'nciiRemovalDeadline',\n]);\nexport type SafetySlaMonitorKind = z.infer<typeof SafetySlaMonitorKindSchema>;\n\n/** [H2] nciiRemovalDeadline only: `provisional` on first facial-completeness,\n * `binding` once valid. */\nexport const SafetySlaMonitorStageSchema = z.enum(['provisional', 'binding']);\nexport type SafetySlaMonitorStage = z.infer<typeof SafetySlaMonitorStageSchema>;\n\n/** Monitor lifecycle status. */\nexport const SafetySlaMonitorStatusSchema = z.enum(['armed', 'overdue', 'resolved']);\nexport type SafetySlaMonitorStatus = z.infer<typeof SafetySlaMonitorStatusSchema>;\n\n/** `safetySlaMonitors/{caseId}__{monitorKind}` — per-obligation SLA monitor.\n * The `nciiRemovalDeadline` row is REQUEST-scoped [H4]: its doc id is the\n * composite `{requestId}__nciiRemovalDeadline` and it carries `requestId` (not\n * `caseId`). ONE schema covers both shapes — `caseId?` and `requestId?` are both\n * optional. The case `nciiCases/{caseId}.nciiRemovalDeadlineAt` is a\n * NON-authoritative projection of the minimum active request monitor. */\nexport const SafetySlaMonitorV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string().min(1).optional(),\n  requestId: z.string().min(1).optional(), // nciiRemovalDeadline rows are request-scoped [H4]\n  monitorKind: SafetySlaMonitorKindSchema,\n  armedAt: z.number(),\n  deadlineAt: z.number(),\n  escalationLevel: z.number(),\n  lastFiredAt: z.number().optional(),\n  monitorStage: SafetySlaMonitorStageSchema.optional(), // [H2] nciiRemovalDeadline only\n  basisSubmissionId: z.string().min(1).optional(), // [H2] the immutable TakeItDownSubmissionV1 whose receivedAt pins this deadline\n  status: SafetySlaMonitorStatusSchema,\n  resolvedAt: z.number().optional(),\n  resolutionBasis: z.string().optional(),\n}).strict();\nexport type SafetySlaMonitorV1 = z.infer<typeof SafetySlaMonitorV1Schema>;\n\n// ===========================================================================\n// A8 — safetyMonitorHeartbeat/global (global dead-man monitor; SINGLETON)\n// The scheduled monitor sweep stamps `lastRunAt`; a missed heartbeat\n// (now − lastRunAt > expectedIntervalMs) self-alarms out-of-band. Removes the old\n// per-case `heartbeatAt` — the heartbeat is GLOBAL, not per-case. Doc id is the\n// fixed singleton literal `global`.\n// ===========================================================================\n\nexport const SafetyMonitorHeartbeatV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  lastRunAt: z.number(),\n  expectedIntervalMs: z.number(),\n}).strict();\nexport type SafetyMonitorHeartbeatV1 = z.infer<typeof SafetyMonitorHeartbeatV1Schema>;\n"]}

package/dist/doc-schemas/safety/provenance.js

@@ -6,9 +6,9 @@
 // the evidence manifest (retentionClass='casePromoted', hold-governed). A scheduled
 // deletion worker enforces the routine TTLs with a hold-aware no-delete guard.
 //
-// Every shape here is transcribed verbatim from docs/code_changes_needed/
-// trust-and-safety/IMPLEMENTATION_PLAN.md Appendix A §A6 — no invented values, no
-// placeholders.
+// Every shape here is transcribed verbatim from the frozen Trust & Safety spec
+// (Appendix A §A6) — no invented values, no placeholders; the durable design owner
+// is ttt-prod docs/design/safety-evidence-control-profile.md.
 //
 // Collection note: this cluster introduces ONE NEW Firestore collection. Wiring
 // collections.ts / path-builders.ts / registry.ts is deferred to the app leg (the