@ttt-productions/ttt-core 0.79.23 → 0.79.24

package/dist/constants/app-mode.d.ts

@@ -63,6 +63,9 @@ export interface TttLimits {
         SHORT_LINK_CLICK: RateLimitValue;
         FOLLOW: RateLimitValue;
         MENTION_HISTORY: RateLimitValue;
+        MEDIA_GRANT: RateLimitValue;
+        CHAT_GRANT: RateLimitValue;
+        OPERATOR_STEP_UP: RateLimitValue;
         ADMIN_MESSAGE_READ: RateLimitValue;
         USER_LOOKUP: RateLimitValue;
         NOTIFICATION_BROADCAST: RateLimitValue;

package/dist/constants/app-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-mode.d.ts","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,EAAE,OAAmB,CAAC;AAE3C,qDAAqD;AACrD,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,KAAG,CACM,CAAC;AAEvD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,GAAG,MAAM,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,yBAAyB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,WAAW,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,MAAM,CAAC;QAChC,uBAAuB,EAAE,MAAM,CAAC;QAChC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,oFAAoF;QACpF,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF;;qFAEiF;IACjF,YAAY,EAAE;QACZ,uEAAuE;QACvE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iEAAiE;QACjE,+BAA+B,EAAE,MAAM,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,wBAAwB,EAAE,MAAM,CAAC;QACjC,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,gFAAgF;IAChF,UAAU,EAAE;QACV,MAAM,EAAE,cAAc,CAAC;QACvB,YAAY,EAAE,cAAc,CAAC;QAC7B,aAAa,EAAE,cAAc,CAAC;QAC9B,IAAI,EAAE,cAAc,CAAC;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,YAAY,EAAE,cAAc,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC;QAC3B,aAAa,EAAE,cAAc,CAAC;QAC9B,UAAU,EAAE,cAAc,CAAC;QAC3B,cAAc,EAAE,cAAc,CAAC;QAC/B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,cAAc,CAAC;QACjC,MAAM,EAAE,cAAc,CAAC;QACvB,eAAe,EAAE,cAAc,CAAC;QAChC,kBAAkB,EAAE,cAAc,CAAC;QACnC,WAAW,EAAE,cAAc,CAAC;QAC5B,sBAAsB,EAAE,cAAc,CAAC;QACvC,oBAAoB,EAAE,cAAc,CAAC;QACrC,sBAAsB,EAAE,cAAc,CAAC;QACvC,QAAQ,EAAE,cAAc,CAAC;QACzB,iBAAiB,EAAE,cAAc,CAAC;QAClC,aAAa,EAAE,cAAc,CAAC;QAC9B,kBAAkB,EAAE,cAAc,CAAC;QACnC,cAAc,EAAE,cAAc,CAAC;QAC/B,eAAe,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,eAAO,MAAM,cAAc,EAAE,SAwF5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,SA8EzB,CAAC;AAEF;uEACuE;AACvE,eAAO,MAAM,aAAa,EAAE,SAA+C,CAAC"}
+{"version":3,"file":"app-mode.d.ts","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,EAAE,OAAmB,CAAC;AAE3C,qDAAqD;AACrD,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,KAAG,CACM,CAAC;AAEvD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,GAAG,MAAM,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,yBAAyB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,WAAW,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,MAAM,CAAC;QAChC,uBAAuB,EAAE,MAAM,CAAC;QAChC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,oFAAoF;QACpF,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF;;qFAEiF;IACjF,YAAY,EAAE;QACZ,uEAAuE;QACvE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iEAAiE;QACjE,+BAA+B,EAAE,MAAM,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,wBAAwB,EAAE,MAAM,CAAC;QACjC,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,gFAAgF;IAChF,UAAU,EAAE;QACV,MAAM,EAAE,cAAc,CAAC;QACvB,YAAY,EAAE,cAAc,CAAC;QAC7B,aAAa,EAAE,cAAc,CAAC;QAC9B,IAAI,EAAE,cAAc,CAAC;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,YAAY,EAAE,cAAc,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC;QAC3B,aAAa,EAAE,cAAc,CAAC;QAC9B,UAAU,EAAE,cAAc,CAAC;QAC3B,cAAc,EAAE,cAAc,CAAC;QAC/B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,cAAc,CAAC;QACjC,MAAM,EAAE,cAAc,CAAC;QACvB,eAAe,EAAE,cAAc,CAAC;QAChC,WAAW,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,WAAW,EAAE,cAAc,CAAC;QAC5B,sBAAsB,EAAE,cAAc,CAAC;QACvC,oBAAoB,EAAE,cAAc,CAAC;QACrC,sBAAsB,EAAE,cAAc,CAAC;QACvC,QAAQ,EAAE,cAAc,CAAC;QACzB,iBAAiB,EAAE,cAAc,CAAC;QAClC,aAAa,EAAE,cAAc,CAAC;QAC9B,kBAAkB,EAAE,cAAc,CAAC;QACnC,cAAc,EAAE,cAAc,CAAC;QAC/B,eAAe,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,eAAO,MAAM,cAAc,EAAE,SAoH5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,SAuFzB,CAAC;AAEF;uEACuE;AACvE,eAAO,MAAM,aAAa,EAAE,SAA+C,CAAC"}

package/dist/constants/app-mode.js

@@ -86,6 +86,34 @@ export const CHARTER_LIMITS = {
         SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },
         FOLLOW: { maxRequests: 20, window: '1 m' },
         MENTION_HISTORY: { maxRequests: 120, window: '1 h' },
+        // Scoped-media grant minting (createMediaGrant). Its OWN bucket — it used to charge
+        // MENTION_HISTORY, an unrelated surface, so neither limit meant what its name said and the
+        // two shared a budget sized for neither (BACKEND-013). Refresh-driven, not user-initiated:
+        // a grant is short-TTL (60 min work media, 15 min chat/folder scopes) and the client re-mints
+        // under expiry, so a browsing session naturally spends several per hour PER SCOPE (each work,
+        // each private file folder, each conversation). Cheap to serve (a Firestore permission read
+        // plus an HMAC sign — no third-party cost), and a false 429 breaks media rendering outright,
+        // so the ceiling is generous: it exists to stop a scripted grant-farming sweep, not to pace a
+        // real reader. 120/h charter.
+        MEDIA_GRANT: { maxRequests: 120, window: '1 h' },
+        // Realtime chat grant minting (mintChatGrant) — previously NO limiter at all (BACKEND-013),
+        // despite minting signed grants at concurrency: 20. Same refresh-driven shape as MEDIA_GRANT:
+        // a 15-minute grant TTL means ~4 mints/hour for the inbox plus ~4 per open channel, doubled
+        // again by socket reconnects on a flaky mobile network. It stays behind the per-channel
+        // authorizeChannelScope gate, so this bucket is a cost/DoS ceiling rather than the
+        // authorization boundary — sized to match MEDIA_GRANT so the two grant surfaces are paced
+        // alike and neither can be starved by the other (separate Redis prefixes).
+        CHAT_GRANT: { maxRequests: 120, window: '1 h' },
+        // Operator step-up TOTP verification (confirmOperatorStepUp / verifyOperatorStepUp) —
+        // previously unthrottled, so an attacker holding a stolen full-admin session could
+        // brute-force the 6-digit second factor guarding the safety console (BACKEND-013).
+        // DELIBERATELY THE TIGHTEST BUCKET IN THE SET: a real operator enrolls once and verifies
+        // roughly twice an hour (the grant window is 30 minutes), so 10/h absorbs every legitimate
+        // mistype while capping guessing at 10 attempts per hour against a code that rotates every
+        // 30 seconds. Mode-INVARIANT — this is an admin security control, not a cost driver, so it
+        // never loosens at the full-mode flip (same posture as MODERATION / BAN_ACTION / USER_LOOKUP).
+        // The lockout-after-N-failures behaviour is a separate app-side concern; this is the throttle.
+        OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },
         ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },
         // Admin exact-account lookup (searchPublicUsers / lookupUserByEmailOrUid) — a read, so a
         // generous per-minute bucket that still backstops a scripted enumeration sweep. Admin-only
@@ -167,6 +195,15 @@ export const FULL_LIMITS = {
         SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },
         FOLLOW: { maxRequests: 60, window: '1 m' },
         MENTION_HISTORY: { maxRequests: 120, window: '1 h' },
+        // 240/h (full): the same grant-minting buckets as charter, doubled with the surrounding
+        // content limits. Full mode raises the ceilings a grant is minted PER (250-guildmate guilds,
+        // 25 file folders, 1000 work files, 10 auditions), so one session legitimately touches more
+        // scopes and re-mints more often. See the CHARTER_LIMITS notes above.
+        MEDIA_GRANT: { maxRequests: 240, window: '1 h' },
+        CHAT_GRANT: { maxRequests: 240, window: '1 h' },
+        // Operator step-up stays at 10/h in BOTH modes — an admin second-factor throttle is a
+        // security control, not a cost lever, so it never loosens at the flip. See CHARTER_LIMITS.
+        OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },
         ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },
         // Admin exact-account lookup — same read bucket in both modes (see CHARTER_LIMITS note).
         USER_LOOKUP: { maxRequests: 30, window: '1 m' },

package/dist/constants/app-mode.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-mode.js","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,+DAA+D;AAC/D,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AAIzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAY,SAAS,CAAC;AAE3C,qDAAqD;AACrD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAI,OAAU,EAAE,IAAO,EAAK,EAAE,CACjD,QAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AA8EvD,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,cAAc,EAAE,CAAC;QACjB,oBAAoB,EAAE,CAAC;QACvB,yBAAyB,EAAE,EAAE;KAC9B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,GAAG;QACjB,uBAAuB,EAAE,aAAa,EAAE,UAAU;QAClD,uBAAuB,EAAE,CAAC;QAC1B,qBAAqB,EAAE,CAAC;QACxB,WAAW,EAAE,CAAC;QACd,+EAA+E;QAC/E,yDAAyD;QACzD,uBAAuB,EAAE,MAAM;QAC/B,aAAa,EAAE,CAAC;QAChB,qBAAqB,EAAE,CAAC;KACzB;IACD,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,wFAAwF;IACxF,uDAAuD;IACvD,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,WAAW,EAAE,UAAU;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,EAAE;IACrE,UAAU,EAAE;QACV,2EAA2E;QAC3E,iCAAiC;QACjC,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,8EAA8E;QAC9E,yEAAyE;QACzE,6EAA6E;QAC7E,+EAA+E;QAC/E,mFAAmF;QACnF,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,iCAAiC;QACjC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,yEAAyE;QACzE,6EAA6E;QAC7E,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,2FAA2F;QAC3F,8FAA8F;QAC9F,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,eAAe,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACJ,cAAc,EAAE,EAAE;QAClB,oBAAoB,EAAE,EAAE;QACxB,yBAAyB,EAAE,GAAG;KAC/B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,GAAG;QACjB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,IAAI;QAClB,uBAAuB,EAAE,cAAc,EAAE,SAAS;QAClD,uBAAuB,EAAE,EAAE;QAC3B,qBAAqB,EAAE,EAAE;QACzB,WAAW,EAAE,EAAE;QACf,8EAA8E;QAC9E,4EAA4E;QAC5E,yEAAyE;QACzE,uBAAuB,EAAE,OAAO;QAChC,aAAa,EAAE,EAAE;QACjB,qBAAqB,EAAE,EAAE;KAC1B;IACD,iFAAiF;IACjF,4EAA4E;IAC5E,sFAAsF;IACtF,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,aAAa,EAAE,QAAQ;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE;IACvE,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,gFAAgF;QAChF,6EAA6E;QAC7E,2EAA2E;QAC3E,mDAAmD;QACnD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gFAAgF;QAChF,8EAA8E;QAC9E,2DAA2D;QAC3D,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,uDAAuD;QACvD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,eAAe,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KACpD;CACF,CAAC;AAEF;uEACuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAc,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC","sourcesContent":["// App mode + the charter/full limit sets — the single published constant that\n// drives the whole app's cost posture. The flip to full-live is: change\n// APP_MODE → publish ttt-core → install in ttt-prod (root + functions) →\n// deploy. There is NO runtime mode flag and NO console toggle.\n// See ttt-prod docs/design/charter-season-and-app-mode.md.\n//\n// Only real cost/abuse drivers vary by mode: media specs (ttt-media-specs.ts),\n// rate-limit values, count caps, batch sizes. Text-length limits and payment\n// min/max are deliberately mode-invariant — with ONE ruled exception (DJ\n// 2026-07-13): chapter body content (maxChapterContentLength), because it\n// bounds threshold-review reading effort per item during charter season.\n\nexport type AppMode = 'charter' | 'full';\n\n/** The deployed mode. Changing this constant (and publishing) IS the flip. */\nexport const APP_MODE: AppMode = 'charter';\n\n/** Pick the active value for a mode-varied limit. */\nexport const byMode = <T>(charter: T, full: T): T =>\n  (APP_MODE as AppMode) === 'charter' ? charter : full;\n\n/** Upstash-style sliding-window duration, e.g. '1 h'. */\nexport type RateLimitWindow = `${number} ${'ms' | 's' | 'm' | 'h' | 'd'}`;\n\nexport interface RateLimitValue {\n  maxRequests: number;\n  window: RateLimitWindow;\n}\n\nexport interface TttLimits {\n  mode: AppMode;\n  user: {\n    maxCraftSkills: number;\n    maxOwnedWorkProjects: number;\n    maxAssociatedWorkProjects: number;\n  };\n  workProject: {\n    maxGuildSize: number;\n    maxFileFolders: number;\n    maxWorkFiles: number;\n    maxWorkFileStorageBytes: number;\n    maxWorkProjectAuditions: number;\n    maxCommissionListings: number;\n    maxChapters: number;\n    /** Chapter BODY length (chars) — the one mode-varied text limit (DJ 2026-07-13). */\n    maxChapterContentLength: number;\n    maxTuneTracks: number;\n    maxTelevisionEpisodes: number;\n  };\n  /** Conversation Files container caps — PER CONVERSATION (one guild-invite\n   *  conversation or one admin-support dispatch thread). Both scopes share one cap\n   *  set; guild chat channels have no Conversation Files. DJ ruling 2026-07-25. */\n  conversation: {\n    /** Published active Conversation Files allowed in one conversation. */\n    maxConversationFiles: number;\n    /** Published STORED-OUTPUT bytes allowed in one conversation. */\n    maxConversationFileStorageBytes: number;\n  };\n  hall: {\n    maxSubmitBatch: number;\n  };\n  batches: {\n    trendingFeedProcessLimit: number;\n    maxFeedbackSubmitters: number;\n  };\n  /** Values for the backend rate limiters. Prefixes/factory stay in functions. */\n  rateLimits: {\n    UPLOAD: RateLimitValue;\n    ADMIN_UPLOAD: RateLimitValue;\n    CONTENT_WRITE: RateLimitValue;\n    VOTE: RateLimitValue;\n    MODERATION: RateLimitValue;\n    SENSITIVE_ACTION: RateLimitValue;\n    DISPLAY_NAME_CHECK: RateLimitValue;\n    CHAT_MESSAGE: RateLimitValue;\n    ADMIN_TASK: RateLimitValue;\n    APPEAL_REVIEW: RateLimitValue;\n    BAN_ACTION: RateLimitValue;\n    SHARE_TRANSFER: RateLimitValue;\n    CONTENT_REPORT: RateLimitValue;\n    SHORT_LINK_CLICK: RateLimitValue;\n    FOLLOW: RateLimitValue;\n    MENTION_HISTORY: RateLimitValue;\n    ADMIN_MESSAGE_READ: RateLimitValue;\n    USER_LOOKUP: RateLimitValue;\n    NOTIFICATION_BROADCAST: RateLimitValue;\n    NOTIFICATION_ARCHIVE: RateLimitValue;\n    NOTIFICATION_MARK_SEEN: RateLimitValue;\n    FEEDBACK: RateLimitValue;\n    SHORT_LINK_CREATE: RateLimitValue;\n    INVITE_ACTION: RateLimitValue;\n    LIBRARY_SUBMISSION: RateLimitValue;\n    CHANNEL_CREATE: RateLimitValue;\n    CHECKOUT_CREATE: RateLimitValue;\n  };\n}\n\nexport const CHARTER_LIMITS: TttLimits = {\n  mode: 'charter',\n  user: {\n    maxCraftSkills: 8,\n    maxOwnedWorkProjects: 3,\n    maxAssociatedWorkProjects: 10,\n  },\n  workProject: {\n    maxGuildSize: 25,\n    maxFileFolders: 10,\n    maxWorkFiles: 100,\n    maxWorkFileStorageBytes: 2_684_354_560, // 2.5 GiB\n    maxWorkProjectAuditions: 3,\n    maxCommissionListings: 3,\n    maxChapters: 5,\n    // ~5,000 words — a full real chapter, while keeping the human threshold-review\n    // reading effort per item bounded during charter season.\n    maxChapterContentLength: 30_000,\n    maxTuneTracks: 5,\n    maxTelevisionEpisodes: 3,\n  },\n  // Conversation Files are QUOTA'D PER CONVERSATION (DJ ruling 2026-07-25). Counted on\n  // STORED OUTPUT bytes (what actually sits in R2 after transcode), never on raw upload\n  // bytes. Rationale: a per-file `maxBytes` cap alone bounds one upload but nothing stops\n  // unbounded accumulation across a long-running conversation — this is the abuse brake\n  // on that, and it is what `startUpload`'s reservation and the publication transfer both\n  // check. Charter: 10 files / 500 MiB per conversation.\n  conversation: {\n    maxConversationFiles: 10,\n    maxConversationFileStorageBytes: 524_288_000, // 500 MiB\n  },\n  hall: { maxSubmitBatch: 10 },\n  batches: { trendingFeedProcessLimit: 250, maxFeedbackSubmitters: 25 },\n  rateLimits: {\n    // Uploads are charged ONCE per upload (in startUpload); the processor-side\n    // check is a non-charging guard.\n    UPLOAD: { maxRequests: 15, window: '1 h' },\n    // A separate HIGHER bucket for uploads performed through the sanctioned admin\n    // authority path — never an exemption. Bulk admin setup work (creating 3\n    // auditions is ~5 uploads) exhausts the 15/h user bucket; 60/h covers a real\n    // bulk admin session while keeping a brake on a compromised admin token and on\n    // third-party quota/cost (Vision / Video Intelligence / R2). DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 60, window: '1 h' },\n    // General content-write throttle for the non-upload write callables (text posts,\n    // craft-skill edits, support-thread starts) that used to charge UPLOAD. Sharing\n    // the 15/h charter upload window meant heavy text posting blocked real uploads\n    // and vice versa; a separate 30/h bucket keeps each cost driver on its own\n    // ceiling. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 30, window: '1 h' },\n    VOTE: { maxRequests: 100, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 30/h: one bucket is shared by ~35 callables (register, become-artisan,\n    // create-work, invites, trades, appeals, …) — a real first-hour artisan does\n    // 10-15 legitimate sensitive actions; 5/h blocked the intended golden path\n    // (proven live by the hosted-dev E2E, 2026-07-07). DJ ruling 2026-07-08.\n    SENSITIVE_ACTION: { maxRequests: 30, window: '1 h' },\n    // 120/h (charter): checkDisplayNameAvailable is enforceAppCheck:true, so\n    // reCAPTCHA-Enterprise attestation is the real abuse gate — this bucket is a\n    // cost/DoS ceiling, not the security boundary. It is IP-keyed (pre-registration,\n    // no uid yet) and the register form fires it debounced-LIVE as you type, so one\n    // legit registrant spends ~3-8 checks and shared NAT/CGNAT multiplies that across\n    // everyone on the IP. The old 20/h false-rejected legitimate shared-IP users and\n    // could not fit a full hosted-dev E2E suite run on one IP. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 120, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 125, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 5, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 20, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup (searchPublicUsers / lookupUserByEmailOrUid) — a read, so a\n    // generous per-minute bucket that still backstops a scripted enumeration sweep. Admin-only\n    // and not a cost driver, so the value is the same in both modes (like MODERATION/ADMIN_TASK).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 30, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 10, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 5, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 5, window: '1 h' },\n  },\n};\n\nexport const FULL_LIMITS: TttLimits = {\n  mode: 'full',\n  user: {\n    maxCraftSkills: 24,\n    maxOwnedWorkProjects: 25,\n    maxAssociatedWorkProjects: 100,\n  },\n  workProject: {\n    maxGuildSize: 250,\n    maxFileFolders: 25,\n    maxWorkFiles: 1000,\n    maxWorkFileStorageBytes: 26_843_545_600, // 25 GiB\n    maxWorkProjectAuditions: 10,\n    maxCommissionListings: 10,\n    maxChapters: 50,\n    // The intentional design ceiling (~17,000 words; trivially inside Firestore's\n    // 1 MiB doc limit) — the audit trail deliberately stores field LENGTHS, not\n    // content, because chapters can be this large (runUpdateChapterDetails).\n    maxChapterContentLength: 100_000,\n    maxTuneTracks: 50,\n    maxTelevisionEpisodes: 25,\n  },\n  // 20 files / 1 GiB (full): the same per-conversation Conversation Files quota as\n  // charter, scaled for a public-launch conversation. Still a hard ceiling on\n  // unbounded R2 accumulation. See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n  conversation: {\n    maxConversationFiles: 20,\n    maxConversationFileStorageBytes: 1_073_741_824, // 1 GiB\n  },\n  hall: { maxSubmitBatch: 50 },\n  batches: { trendingFeedProcessLimit: 1000, maxFeedbackSubmitters: 100 },\n  rateLimits: {\n    UPLOAD: { maxRequests: 30, window: '1 h' },\n    // 120/h (full): the same sanctioned-admin-path upload bucket as charter, scaled\n    // with UPLOAD — always HIGHER than the user bucket, never an exemption, so a\n    // compromised admin token and third-party media cost stay bounded. See the\n    // CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 120, window: '1 h' },\n    // 60/h (full): the same non-upload content-write bucket as charter, scaled with\n    // UPLOAD so text writes and media uploads never consume each other's ceiling.\n    // See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 60, window: '1 h' },\n    VOTE: { maxRequests: 200, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 60/h: full-mode power users managing several works do dozens of legitimate\n    // management actions per hour; still a hard backstop against scripts.\n    // DJ ruling 2026-07-08 (charter 30 / full 60, single bucket; a bucket split\n    // is filed post-launch in ttt-prod docs/post-launch/).\n    SENSITIVE_ACTION: { maxRequests: 60, window: '1 h' },\n    // 300/h (full): same reasoning as the charter value above (App-Check-gated\n    // cost ceiling, IP-keyed, debounced-live). Public-launch CGNAT exposure is far\n    // larger — hundreds of concurrent legit registrants can sit behind one carrier\n    // IP — so err generous; the only cost of \"too high\" is trivial Firestore reads,\n    // while \"too low\" false-rejects real users. Raise on evidence (watch prod logs\n    // for legit 429s) rather than pre-emptively tightening. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 300, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 150, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 20, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 60, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup — same read bucket in both modes (see CHARTER_LIMITS note).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 60, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 20, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 20, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 20, window: '1 h' },\n  },\n};\n\n/** The resolved limit set for the deployed mode. Import THIS (or the alias\n * constants that re-export from it), never CHARTER_/FULL_ directly. */\nexport const ACTIVE_LIMITS: TttLimits = byMode(CHARTER_LIMITS, FULL_LIMITS);\n"]}
+{"version":3,"file":"app-mode.js","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,+DAA+D;AAC/D,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AAIzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAY,SAAS,CAAC;AAE3C,qDAAqD;AACrD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAI,OAAU,EAAE,IAAO,EAAK,EAAE,CACjD,QAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAiFvD,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,cAAc,EAAE,CAAC;QACjB,oBAAoB,EAAE,CAAC;QACvB,yBAAyB,EAAE,EAAE;KAC9B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,GAAG;QACjB,uBAAuB,EAAE,aAAa,EAAE,UAAU;QAClD,uBAAuB,EAAE,CAAC;QAC1B,qBAAqB,EAAE,CAAC;QACxB,WAAW,EAAE,CAAC;QACd,+EAA+E;QAC/E,yDAAyD;QACzD,uBAAuB,EAAE,MAAM;QAC/B,aAAa,EAAE,CAAC;QAChB,qBAAqB,EAAE,CAAC;KACzB;IACD,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,wFAAwF;IACxF,uDAAuD;IACvD,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,WAAW,EAAE,UAAU;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,EAAE;IACrE,UAAU,EAAE;QACV,2EAA2E;QAC3E,iCAAiC;QACjC,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,8EAA8E;QAC9E,yEAAyE;QACzE,6EAA6E;QAC7E,+EAA+E;QAC/E,mFAAmF;QACnF,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,iCAAiC;QACjC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,yEAAyE;QACzE,6EAA6E;QAC7E,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,oFAAoF;QACpF,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,8BAA8B;QAC9B,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,mFAAmF;QACnF,0FAA0F;QAC1F,2EAA2E;QAC3E,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,mFAAmF;QACnF,mFAAmF;QACnF,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,2FAA2F;QAC3F,8FAA8F;QAC9F,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,eAAe,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACJ,cAAc,EAAE,EAAE;QAClB,oBAAoB,EAAE,EAAE;QACxB,yBAAyB,EAAE,GAAG;KAC/B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,GAAG;QACjB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,IAAI;QAClB,uBAAuB,EAAE,cAAc,EAAE,SAAS;QAClD,uBAAuB,EAAE,EAAE;QAC3B,qBAAqB,EAAE,EAAE;QACzB,WAAW,EAAE,EAAE;QACf,8EAA8E;QAC9E,4EAA4E;QAC5E,yEAAyE;QACzE,uBAAuB,EAAE,OAAO;QAChC,aAAa,EAAE,EAAE;QACjB,qBAAqB,EAAE,EAAE;KAC1B;IACD,iFAAiF;IACjF,4EAA4E;IAC5E,sFAAsF;IACtF,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,aAAa,EAAE,QAAQ;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE;IACvE,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,gFAAgF;QAChF,6EAA6E;QAC7E,2EAA2E;QAC3E,mDAAmD;QACnD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gFAAgF;QAChF,8EAA8E;QAC9E,2DAA2D;QAC3D,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,uDAAuD;QACvD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,wFAAwF;QACxF,6FAA6F;QAC7F,4FAA4F;QAC5F,sEAAsE;QACtE,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,2FAA2F;QAC3F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,eAAe,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KACpD;CACF,CAAC;AAEF;uEACuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAc,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC","sourcesContent":["// App mode + the charter/full limit sets — the single published constant that\n// drives the whole app's cost posture. The flip to full-live is: change\n// APP_MODE → publish ttt-core → install in ttt-prod (root + functions) →\n// deploy. There is NO runtime mode flag and NO console toggle.\n// See ttt-prod docs/design/charter-season-and-app-mode.md.\n//\n// Only real cost/abuse drivers vary by mode: media specs (ttt-media-specs.ts),\n// rate-limit values, count caps, batch sizes. Text-length limits and payment\n// min/max are deliberately mode-invariant — with ONE ruled exception (DJ\n// 2026-07-13): chapter body content (maxChapterContentLength), because it\n// bounds threshold-review reading effort per item during charter season.\n\nexport type AppMode = 'charter' | 'full';\n\n/** The deployed mode. Changing this constant (and publishing) IS the flip. */\nexport const APP_MODE: AppMode = 'charter';\n\n/** Pick the active value for a mode-varied limit. */\nexport const byMode = <T>(charter: T, full: T): T =>\n  (APP_MODE as AppMode) === 'charter' ? charter : full;\n\n/** Upstash-style sliding-window duration, e.g. '1 h'. */\nexport type RateLimitWindow = `${number} ${'ms' | 's' | 'm' | 'h' | 'd'}`;\n\nexport interface RateLimitValue {\n  maxRequests: number;\n  window: RateLimitWindow;\n}\n\nexport interface TttLimits {\n  mode: AppMode;\n  user: {\n    maxCraftSkills: number;\n    maxOwnedWorkProjects: number;\n    maxAssociatedWorkProjects: number;\n  };\n  workProject: {\n    maxGuildSize: number;\n    maxFileFolders: number;\n    maxWorkFiles: number;\n    maxWorkFileStorageBytes: number;\n    maxWorkProjectAuditions: number;\n    maxCommissionListings: number;\n    maxChapters: number;\n    /** Chapter BODY length (chars) — the one mode-varied text limit (DJ 2026-07-13). */\n    maxChapterContentLength: number;\n    maxTuneTracks: number;\n    maxTelevisionEpisodes: number;\n  };\n  /** Conversation Files container caps — PER CONVERSATION (one guild-invite\n   *  conversation or one admin-support dispatch thread). Both scopes share one cap\n   *  set; guild chat channels have no Conversation Files. DJ ruling 2026-07-25. */\n  conversation: {\n    /** Published active Conversation Files allowed in one conversation. */\n    maxConversationFiles: number;\n    /** Published STORED-OUTPUT bytes allowed in one conversation. */\n    maxConversationFileStorageBytes: number;\n  };\n  hall: {\n    maxSubmitBatch: number;\n  };\n  batches: {\n    trendingFeedProcessLimit: number;\n    maxFeedbackSubmitters: number;\n  };\n  /** Values for the backend rate limiters. Prefixes/factory stay in functions. */\n  rateLimits: {\n    UPLOAD: RateLimitValue;\n    ADMIN_UPLOAD: RateLimitValue;\n    CONTENT_WRITE: RateLimitValue;\n    VOTE: RateLimitValue;\n    MODERATION: RateLimitValue;\n    SENSITIVE_ACTION: RateLimitValue;\n    DISPLAY_NAME_CHECK: RateLimitValue;\n    CHAT_MESSAGE: RateLimitValue;\n    ADMIN_TASK: RateLimitValue;\n    APPEAL_REVIEW: RateLimitValue;\n    BAN_ACTION: RateLimitValue;\n    SHARE_TRANSFER: RateLimitValue;\n    CONTENT_REPORT: RateLimitValue;\n    SHORT_LINK_CLICK: RateLimitValue;\n    FOLLOW: RateLimitValue;\n    MENTION_HISTORY: RateLimitValue;\n    MEDIA_GRANT: RateLimitValue;\n    CHAT_GRANT: RateLimitValue;\n    OPERATOR_STEP_UP: RateLimitValue;\n    ADMIN_MESSAGE_READ: RateLimitValue;\n    USER_LOOKUP: RateLimitValue;\n    NOTIFICATION_BROADCAST: RateLimitValue;\n    NOTIFICATION_ARCHIVE: RateLimitValue;\n    NOTIFICATION_MARK_SEEN: RateLimitValue;\n    FEEDBACK: RateLimitValue;\n    SHORT_LINK_CREATE: RateLimitValue;\n    INVITE_ACTION: RateLimitValue;\n    LIBRARY_SUBMISSION: RateLimitValue;\n    CHANNEL_CREATE: RateLimitValue;\n    CHECKOUT_CREATE: RateLimitValue;\n  };\n}\n\nexport const CHARTER_LIMITS: TttLimits = {\n  mode: 'charter',\n  user: {\n    maxCraftSkills: 8,\n    maxOwnedWorkProjects: 3,\n    maxAssociatedWorkProjects: 10,\n  },\n  workProject: {\n    maxGuildSize: 25,\n    maxFileFolders: 10,\n    maxWorkFiles: 100,\n    maxWorkFileStorageBytes: 2_684_354_560, // 2.5 GiB\n    maxWorkProjectAuditions: 3,\n    maxCommissionListings: 3,\n    maxChapters: 5,\n    // ~5,000 words — a full real chapter, while keeping the human threshold-review\n    // reading effort per item bounded during charter season.\n    maxChapterContentLength: 30_000,\n    maxTuneTracks: 5,\n    maxTelevisionEpisodes: 3,\n  },\n  // Conversation Files are QUOTA'D PER CONVERSATION (DJ ruling 2026-07-25). Counted on\n  // STORED OUTPUT bytes (what actually sits in R2 after transcode), never on raw upload\n  // bytes. Rationale: a per-file `maxBytes` cap alone bounds one upload but nothing stops\n  // unbounded accumulation across a long-running conversation — this is the abuse brake\n  // on that, and it is what `startUpload`'s reservation and the publication transfer both\n  // check. Charter: 10 files / 500 MiB per conversation.\n  conversation: {\n    maxConversationFiles: 10,\n    maxConversationFileStorageBytes: 524_288_000, // 500 MiB\n  },\n  hall: { maxSubmitBatch: 10 },\n  batches: { trendingFeedProcessLimit: 250, maxFeedbackSubmitters: 25 },\n  rateLimits: {\n    // Uploads are charged ONCE per upload (in startUpload); the processor-side\n    // check is a non-charging guard.\n    UPLOAD: { maxRequests: 15, window: '1 h' },\n    // A separate HIGHER bucket for uploads performed through the sanctioned admin\n    // authority path — never an exemption. Bulk admin setup work (creating 3\n    // auditions is ~5 uploads) exhausts the 15/h user bucket; 60/h covers a real\n    // bulk admin session while keeping a brake on a compromised admin token and on\n    // third-party quota/cost (Vision / Video Intelligence / R2). DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 60, window: '1 h' },\n    // General content-write throttle for the non-upload write callables (text posts,\n    // craft-skill edits, support-thread starts) that used to charge UPLOAD. Sharing\n    // the 15/h charter upload window meant heavy text posting blocked real uploads\n    // and vice versa; a separate 30/h bucket keeps each cost driver on its own\n    // ceiling. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 30, window: '1 h' },\n    VOTE: { maxRequests: 100, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 30/h: one bucket is shared by ~35 callables (register, become-artisan,\n    // create-work, invites, trades, appeals, …) — a real first-hour artisan does\n    // 10-15 legitimate sensitive actions; 5/h blocked the intended golden path\n    // (proven live by the hosted-dev E2E, 2026-07-07). DJ ruling 2026-07-08.\n    SENSITIVE_ACTION: { maxRequests: 30, window: '1 h' },\n    // 120/h (charter): checkDisplayNameAvailable is enforceAppCheck:true, so\n    // reCAPTCHA-Enterprise attestation is the real abuse gate — this bucket is a\n    // cost/DoS ceiling, not the security boundary. It is IP-keyed (pre-registration,\n    // no uid yet) and the register form fires it debounced-LIVE as you type, so one\n    // legit registrant spends ~3-8 checks and shared NAT/CGNAT multiplies that across\n    // everyone on the IP. The old 20/h false-rejected legitimate shared-IP users and\n    // could not fit a full hosted-dev E2E suite run on one IP. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 120, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 125, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 5, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 20, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // Scoped-media grant minting (createMediaGrant). Its OWN bucket — it used to charge\n    // MENTION_HISTORY, an unrelated surface, so neither limit meant what its name said and the\n    // two shared a budget sized for neither (BACKEND-013). Refresh-driven, not user-initiated:\n    // a grant is short-TTL (60 min work media, 15 min chat/folder scopes) and the client re-mints\n    // under expiry, so a browsing session naturally spends several per hour PER SCOPE (each work,\n    // each private file folder, each conversation). Cheap to serve (a Firestore permission read\n    // plus an HMAC sign — no third-party cost), and a false 429 breaks media rendering outright,\n    // so the ceiling is generous: it exists to stop a scripted grant-farming sweep, not to pace a\n    // real reader. 120/h charter.\n    MEDIA_GRANT: { maxRequests: 120, window: '1 h' },\n    // Realtime chat grant minting (mintChatGrant) — previously NO limiter at all (BACKEND-013),\n    // despite minting signed grants at concurrency: 20. Same refresh-driven shape as MEDIA_GRANT:\n    // a 15-minute grant TTL means ~4 mints/hour for the inbox plus ~4 per open channel, doubled\n    // again by socket reconnects on a flaky mobile network. It stays behind the per-channel\n    // authorizeChannelScope gate, so this bucket is a cost/DoS ceiling rather than the\n    // authorization boundary — sized to match MEDIA_GRANT so the two grant surfaces are paced\n    // alike and neither can be starved by the other (separate Redis prefixes).\n    CHAT_GRANT: { maxRequests: 120, window: '1 h' },\n    // Operator step-up TOTP verification (confirmOperatorStepUp / verifyOperatorStepUp) —\n    // previously unthrottled, so an attacker holding a stolen full-admin session could\n    // brute-force the 6-digit second factor guarding the safety console (BACKEND-013).\n    // DELIBERATELY THE TIGHTEST BUCKET IN THE SET: a real operator enrolls once and verifies\n    // roughly twice an hour (the grant window is 30 minutes), so 10/h absorbs every legitimate\n    // mistype while capping guessing at 10 attempts per hour against a code that rotates every\n    // 30 seconds. Mode-INVARIANT — this is an admin security control, not a cost driver, so it\n    // never loosens at the full-mode flip (same posture as MODERATION / BAN_ACTION / USER_LOOKUP).\n    // The lockout-after-N-failures behaviour is a separate app-side concern; this is the throttle.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup (searchPublicUsers / lookupUserByEmailOrUid) — a read, so a\n    // generous per-minute bucket that still backstops a scripted enumeration sweep. Admin-only\n    // and not a cost driver, so the value is the same in both modes (like MODERATION/ADMIN_TASK).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 30, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 10, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 5, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 5, window: '1 h' },\n  },\n};\n\nexport const FULL_LIMITS: TttLimits = {\n  mode: 'full',\n  user: {\n    maxCraftSkills: 24,\n    maxOwnedWorkProjects: 25,\n    maxAssociatedWorkProjects: 100,\n  },\n  workProject: {\n    maxGuildSize: 250,\n    maxFileFolders: 25,\n    maxWorkFiles: 1000,\n    maxWorkFileStorageBytes: 26_843_545_600, // 25 GiB\n    maxWorkProjectAuditions: 10,\n    maxCommissionListings: 10,\n    maxChapters: 50,\n    // The intentional design ceiling (~17,000 words; trivially inside Firestore's\n    // 1 MiB doc limit) — the audit trail deliberately stores field LENGTHS, not\n    // content, because chapters can be this large (runUpdateChapterDetails).\n    maxChapterContentLength: 100_000,\n    maxTuneTracks: 50,\n    maxTelevisionEpisodes: 25,\n  },\n  // 20 files / 1 GiB (full): the same per-conversation Conversation Files quota as\n  // charter, scaled for a public-launch conversation. Still a hard ceiling on\n  // unbounded R2 accumulation. See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n  conversation: {\n    maxConversationFiles: 20,\n    maxConversationFileStorageBytes: 1_073_741_824, // 1 GiB\n  },\n  hall: { maxSubmitBatch: 50 },\n  batches: { trendingFeedProcessLimit: 1000, maxFeedbackSubmitters: 100 },\n  rateLimits: {\n    UPLOAD: { maxRequests: 30, window: '1 h' },\n    // 120/h (full): the same sanctioned-admin-path upload bucket as charter, scaled\n    // with UPLOAD — always HIGHER than the user bucket, never an exemption, so a\n    // compromised admin token and third-party media cost stay bounded. See the\n    // CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 120, window: '1 h' },\n    // 60/h (full): the same non-upload content-write bucket as charter, scaled with\n    // UPLOAD so text writes and media uploads never consume each other's ceiling.\n    // See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 60, window: '1 h' },\n    VOTE: { maxRequests: 200, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 60/h: full-mode power users managing several works do dozens of legitimate\n    // management actions per hour; still a hard backstop against scripts.\n    // DJ ruling 2026-07-08 (charter 30 / full 60, single bucket; a bucket split\n    // is filed post-launch in ttt-prod docs/post-launch/).\n    SENSITIVE_ACTION: { maxRequests: 60, window: '1 h' },\n    // 300/h (full): same reasoning as the charter value above (App-Check-gated\n    // cost ceiling, IP-keyed, debounced-live). Public-launch CGNAT exposure is far\n    // larger — hundreds of concurrent legit registrants can sit behind one carrier\n    // IP — so err generous; the only cost of \"too high\" is trivial Firestore reads,\n    // while \"too low\" false-rejects real users. Raise on evidence (watch prod logs\n    // for legit 429s) rather than pre-emptively tightening. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 300, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 150, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 20, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 60, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // 240/h (full): the same grant-minting buckets as charter, doubled with the surrounding\n    // content limits. Full mode raises the ceilings a grant is minted PER (250-guildmate guilds,\n    // 25 file folders, 1000 work files, 10 auditions), so one session legitimately touches more\n    // scopes and re-mints more often. See the CHARTER_LIMITS notes above.\n    MEDIA_GRANT: { maxRequests: 240, window: '1 h' },\n    CHAT_GRANT: { maxRequests: 240, window: '1 h' },\n    // Operator step-up stays at 10/h in BOTH modes — an admin second-factor throttle is a\n    // security control, not a cost lever, so it never loosens at the flip. See CHARTER_LIMITS.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup — same read bucket in both modes (see CHARTER_LIMITS note).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 60, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 20, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 20, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 20, window: '1 h' },\n  },\n};\n\n/** The resolved limit set for the deployed mode. Import THIS (or the alias\n * constants that re-export from it), never CHARTER_/FULL_ directly. */\nexport const ACTIVE_LIMITS: TttLimits = byMode(CHARTER_LIMITS, FULL_LIMITS);\n"]}

package/dist/constants/business-admin.d.ts

@@ -82,6 +82,10 @@ export declare const MAX_CONTENT_PAGE_HEADING_LENGTH = 300;
 export declare const MAX_CONTENT_PAGE_BODY_LENGTH = 20000;
 export declare const MAX_TAKE_IT_DOWN_COPY_LENGTH = 8000;
 export declare const MAX_MAINTENANCE_MESSAGE_LENGTH = 2000;
+/** Announcement-banner copy on `_config/app.announcementMessage`. Deliberately far
+ *  shorter than the maintenance message: the announcement renders as a one-line banner
+ *  on the landing page and login screen, not a full-page takeover. */
+export declare const MAX_ANNOUNCEMENT_MESSAGE_LENGTH = 300;
 /** Admin notes on a content-appeal review (reviewContentAppeal). */
 export declare const MAX_APPEAL_REVIEW_NOTES_LENGTH = 2000;
 /** Admin reason on a Work/Realm forced-retitle remedy. */

package/dist/constants/business-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"business-admin.d.ts","sourceRoot":"","sources":["../../src/constants/business-admin.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAEnF,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;IAK9B;;uDAEmD;;CAE3C,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAE/F,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;CAK/B,CAAC;AAIX,yDAAyD;AACzD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,sCAAsC,OAAO,CAAC;AAI3D,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;gEACgE;AAChE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AAMtD,8FAA8F;AAC9F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,6FAA6F;AAC7F,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,sEAAsE;AACtE,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAIjD,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;iFACiF;AACjF,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;8EAC8E;AAC9E,eAAO,MAAM,iCAAiC,OAAO,CAAC;AAEtD,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAMhD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAC1E,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAE5D,mFAAmF;AACnF,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAMpD,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,kCAAkC,OAAO,CAAC;AACvD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,oCAAoC,OAAO,CAAC;AACzD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,eAAO,MAAM,+BAA+B,MAAM,CAAC;AACnD,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AACjD,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,sEAAsE;AACtE,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD,wDAAwD;AACxD,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAEpD,qCAAqC;AACrC,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAIhD,0EAA0E;AAC1E,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAEpD,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,oFAAoF;AACpF,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD,8DAA8D;AAC9D,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,gEAAgE;AAChE,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,kCAAkC,OAAO,CAAC;AAEvD,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,uEAAuE;AACvE,eAAO,MAAM,uCAAuC,MAAM,CAAC;AAE3D,iFAAiF;AACjF,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAEpD,qFAAqF;AACrF,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,gDAAgD;AAChD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,QAA8C,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,iKAMjB,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,QAAoC,CAAC;AAI/E,qCAAqC;AACrC,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC"}
+{"version":3,"file":"business-admin.d.ts","sourceRoot":"","sources":["../../src/constants/business-admin.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAEnF,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;IAK9B;;uDAEmD;;CAE3C,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAE/F,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;CAK/B,CAAC;AAIX,yDAAyD;AACzD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,sCAAsC,OAAO,CAAC;AAI3D,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;gEACgE;AAChE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AAMtD,8FAA8F;AAC9F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,6FAA6F;AAC7F,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,sEAAsE;AACtE,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAIjD,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;iFACiF;AACjF,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;8EAC8E;AAC9E,eAAO,MAAM,iCAAiC,OAAO,CAAC;AAEtD,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAMhD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAC1E,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAE5D,mFAAmF;AACnF,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAMpD,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,kCAAkC,OAAO,CAAC;AACvD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,oCAAoC,OAAO,CAAC;AACzD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,eAAO,MAAM,+BAA+B,MAAM,CAAC;AACnD,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AACjD,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD;;sEAEsE;AACtE,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,sEAAsE;AACtE,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD,wDAAwD;AACxD,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAEpD,qCAAqC;AACrC,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAIhD,0EAA0E;AAC1E,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAEpD,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,oFAAoF;AACpF,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD,8DAA8D;AAC9D,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,gEAAgE;AAChE,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,kCAAkC,OAAO,CAAC;AAEvD,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,uEAAuE;AACvE,eAAO,MAAM,uCAAuC,MAAM,CAAC;AAE3D,iFAAiF;AACjF,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAEpD,qFAAqF;AACrF,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,gDAAgD;AAChD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,QAA8C,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,iKAMjB,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,QAAoC,CAAC;AAI/E,qCAAqC;AACrC,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC"}

package/dist/constants/business-admin.js

@@ -97,6 +97,10 @@ export const MAX_CONTENT_PAGE_HEADING_LENGTH = 300;
 export const MAX_CONTENT_PAGE_BODY_LENGTH = 20000;
 export const MAX_TAKE_IT_DOWN_COPY_LENGTH = 8000;
 export const MAX_MAINTENANCE_MESSAGE_LENGTH = 2000;
+/** Announcement-banner copy on `_config/app.announcementMessage`. Deliberately far
+ *  shorter than the maintenance message: the announcement renders as a one-line banner
+ *  on the landing page and login screen, not a full-page takeover. */
+export const MAX_ANNOUNCEMENT_MESSAGE_LENGTH = 300;
 /** Admin notes on a content-appeal review (reviewContentAppeal). */
 export const MAX_APPEAL_REVIEW_NOTES_LENGTH = 2000;
 /** Admin reason on a Work/Realm forced-retitle remedy. */

package/dist/constants/business-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"business-admin.js","sourceRoot":"","sources":["../../src/constants/business-admin.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,qCAAqC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,KAAK;CACA,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,EAAE,EAAE;IACP,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,IAAI;IACd;;uDAEmD;IACnD,aAAa,EAAE,IAAI;CACX,CAAC;AAIX,mFAAmF;AACnF,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,GAAG;IAC5C,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,MAAM;IAClD,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,IAAI;IAC9C,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,QAAQ;CAC9C,CAAC;AAEX,2BAA2B;AAE3B,yDAAyD;AACzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,qEAAqE;AACrE,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC;AAE3D,sCAAsC;AAEtC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C;gEACgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAEtD,iDAAiD;AACjD,wFAAwF;AACxF,2FAA2F;AAE3F,8FAA8F;AAC9F,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,kCAAkC;AAElC,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;iFACiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;8EAC8E;AAC9E,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,gDAAgD;AAChD,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,mFAAmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,iDAAiD;AACjD,mFAAmF;AACnF,4EAA4E;AAE5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,qCAAqC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD,6DAA6D;AAE7D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,sFAAsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,uFAAuF;AACvF,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AAEvD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,uEAAuE;AACvE,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAE3D,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,gDAAgD;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC,OAAO,CAAC,qBAAqB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,4BAA4B;IAC5B,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,gCAAgC;CACxB,CAAC;AAKX,gGAAgG;AAChG,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC;AAE/E,sBAAsB;AAEtB,qCAAqC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,WAAW;IACvB,SAAS,EAAE,WAAW;CACd,CAAC","sourcesContent":["// Admin + content-moderation business-rule constants — task priority, dispatches,\n// the moderation/feedback workflow, and admin-task lifecycle.\nimport { ACTIVE_LIMITS } from './app-mode.js';\n\n// --- Admin Task Priority System ---\n\nexport const TASK_PRIORITY = {\n  CRITICAL: 4,\n  HIGH: 3,\n  NORMAL: 2,\n  LOW: 1,\n} as const;\n\nexport type TaskPriorityLevel = (typeof TASK_PRIORITY)[keyof typeof TASK_PRIORITY];\n\nexport const TASK_PRIORITY_LABELS = {\n  4: 'CRITICAL',\n  3: 'HIGH',\n  2: 'NORMAL',\n  1: 'LOW',\n} as const;\n\n/**\n * Canonical NUMERIC priority scale for `adminTasks.priority`, shared by BOTH\n * priority systems so `checkoutNextImportantTask` (orderBy priority desc across all\n * task types) compares commensurable values. The userReport report-core score formula\n * already writes on this scale (≈40–2250); the level-based types (thresholdLibraryReview,\n * content-appeal, adminDispatch) map their TASK_PRIORITY level onto these numbers instead\n * of writing the raw 1–4.\n *\n * Resulting order: safety reports (1200–2250) > money anomalies (1100) >\n * CRITICAL (1000) > HIGH (800) > routine reports interleave below > spam-tier (~80).\n */\nexport const TASK_PRIORITY_SCORE = {\n  LOW: 50,\n  NORMAL: 200,\n  HIGH: 800,\n  CRITICAL: 1000,\n  /** Money-integrity anomaly (stake-share / pledge-ledger corruption signal) — outranks\n   * everything except safety-class reports. The three anomaly creators that previously\n   * hardcoded `priority: 1` (LOW) all write this. */\n  MONEY_ANOMALY: 1100,\n} as const;\n\nexport type TaskPriorityScore = (typeof TASK_PRIORITY_SCORE)[keyof typeof TASK_PRIORITY_SCORE];\n\n/** Maps a level-based TASK_PRIORITY value (1–4) to its canonical numeric score. */\nexport const TASK_PRIORITY_LEVEL_TO_SCORE = {\n  [TASK_PRIORITY.LOW]: TASK_PRIORITY_SCORE.LOW,\n  [TASK_PRIORITY.NORMAL]: TASK_PRIORITY_SCORE.NORMAL,\n  [TASK_PRIORITY.HIGH]: TASK_PRIORITY_SCORE.HIGH,\n  [TASK_PRIORITY.CRITICAL]: TASK_PRIORITY_SCORE.CRITICAL,\n} as const;\n\n// --- Admin Dispatches ---\n\n/** Maximum length for an admin-dispatch subject line. */\nexport const MAX_ADMIN_DISPATCH_SUBJECT_LENGTH = 100;\n\n/** Maximum length for the initial body text of an admin dispatch. */\nexport const MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH = 1000;\n\n// --- Content Moderation Workflow ---\n\n/** Maximum length for a content-violation appeal message. */\nexport const MAX_APPEAL_MESSAGE_LENGTH = 1000;\n\n/** Threshold-review reviewer notes (revision notes shown to the author). One owner for\n *  the review callable schema AND the admin work-view input. */\nexport const MAX_THRESHOLD_REVIEW_NOTES_LENGTH = 2000;\n\n// --- Moderation / safety operator text caps ---\n// Each is declared ONCE here and derived by every input schema AND persisted doc schema\n// that carries the field — the numbers must never be re-hardcoded at an enforcement point.\n\n/** Operator-facing INTERNAL reason/rationale (LE-loggable; account actions, case reopens). */\nexport const MAX_INTERNAL_REASON_LENGTH = 2000;\n\n/** The generic owner-readable (user-facing) reason — deliberately short, no detail leaks. */\nexport const MAX_USER_FACING_REASON_LENGTH = 280;\n\n/** Structured close-out summary on report/safety-case resolutions. */\nexport const MAX_SAFETY_RESOLUTION_SUMMARY_LENGTH = 2000;\n\n/** Optional operator note attached to a close-out. */\nexport const MAX_SAFETY_ADMIN_NOTE_LENGTH = 4000;\n\n// --- Report intake text caps ---\n\n/** Reporter free-text narrative/comment (segregated private doc; never on the root). */\nexport const MAX_REPORT_NARRATIVE_LENGTH = 4000;\n\n/** The report DIALOG's comment field cap (the client-side compose bound — tighter than\n * the server narrative cap above, which also absorbs upgrade concatenations). */\nexport const MAX_REPORT_COMMENT_LENGTH = 1000;\n\n/** Minimum operator rationale/reason length on safety-console staged actions. */\nexport const MIN_SAFETY_RATIONALE_LENGTH = 10;\n\n/** Operator reason on an admin chat-moderation action (adminModerateChatMessage /\n *  adminReadChannelContext). ONE owner for both callables' `reason` bound. */\nexport const MAX_CHAT_MODERATION_REASON_LENGTH = 1000;\n\n/** Broadcast explicitUids selector audience cap (schema + composer both derive). */\nexport const MAX_BROADCAST_EXPLICIT_UIDS = 2000;\n\n// --- Operator step-up sentinel error codes ---\n// The two backend HttpsError messages the operator TOTP step-up throws; the frontend\n// matches them to open the step-up dialog in ENROLL vs VERIFY mode. ONE declaration —\n// both the callable (functions operatorStepUp.ts) and the frontend hook import these.\nexport const STEP_UP_ENROLL_REQUIRED = 'OPERATOR_STEP_UP_ENROLL_REQUIRED';\nexport const STEP_UP_REQUIRED = 'OPERATOR_STEP_UP_REQUIRED';\n\n/** The frozen report-time captured text snapshot (edit-to-evade guard; NO PII). */\nexport const MAX_REPORT_SNAPSHOT_TEXT_LENGTH = 4000;\n\n// --- Admin console config-content text caps ---\n// Every number the system uses lives HERE — even a field only one surface consumes\n// today, because any future client (TV / phone / admin app) reads ttt-core.\n\nexport const MAX_FUTURE_PLAN_TITLE_LENGTH = 200;\nexport const MAX_FUTURE_PLAN_DESCRIPTION_LENGTH = 4000;\nexport const MAX_PLATFORM_RULE_TITLE_LENGTH = 200;\nexport const MAX_PLATFORM_RULE_DESCRIPTION_LENGTH = 4000;\nexport const MAX_AGREEMENT_POINT_LENGTH = 2000;\nexport const MAX_CONTENT_PAGE_HEADING_LENGTH = 300;\nexport const MAX_CONTENT_PAGE_BODY_LENGTH = 20000;\nexport const MAX_TAKE_IT_DOWN_COPY_LENGTH = 8000;\nexport const MAX_MAINTENANCE_MESSAGE_LENGTH = 2000;\n\n/** Admin notes on a content-appeal review (reviewContentAppeal). */\nexport const MAX_APPEAL_REVIEW_NOTES_LENGTH = 2000;\n\n/** Admin reason on a Work/Realm forced-retitle remedy. */\nexport const MAX_REQUIRE_RETITLE_REASON_LENGTH = 500;\n\n/** Optional user-facing DETAIL text on a normal-report resolution. */\nexport const MAX_USER_FACING_REASON_DETAIL_LENGTH = 2000;\n\n/** Admin broadcast / user notification message body. */\nexport const MAX_NOTIFICATION_MESSAGE_LENGTH = 2000;\n\n/** Admin user-search query input. */\nexport const MAX_USER_SEARCH_QUERY_LENGTH = 100;\n\n// --- NCII / child-safety statutory + operator text caps ---\n\n/** Operator reason on the admin \"mark as NCII linked evidence\" intake. */\nexport const MAX_NCII_EVIDENCE_REASON_LENGTH = 1000;\n\n/** Operator written rationale on a TAKE IT DOWN validity decision (immutable row). */\nexport const MAX_NCII_RATIONALE_LENGTH = 4000;\n\n/** Requester's statement of nonconsent (statutory intake — in-app and no-login). */\nexport const MAX_NCII_NONCONSENT_STATEMENT_LENGTH = 4000;\n\n/** Typed-name electronic signature on a statutory request. */\nexport const MAX_NCII_SIGNED_NAME_LENGTH = 256;\n\n/** Requester's optional supporting facts (statutory intake). */\nexport const MAX_NCII_SUPPORTING_FACTS_LENGTH = 8000;\n\n/** Bounded, non-sensitive summary on an NCII request action row. */\nexport const MAX_NCII_ACTION_SUMMARY_LENGTH = 280;\n\n/** Operator description of a registered evidence artifact (e.g. portal screenshot). */\nexport const MAX_SAFETY_ARTIFACT_DESCRIPTION_LENGTH = 500;\n\n/** Operator proof note on a manual NCMEC portal filing. */\nexport const MAX_NCMEC_PORTAL_PROOF_TEXT_LENGTH = 2000;\n\n/** Requester's typed name on the no-login TAKE IT DOWN statutory intake. */\nexport const MAX_NCII_REQUESTER_NAME_LENGTH = 256;\n\n/** Name of the depicted person a representative files on behalf of. */\nexport const MAX_NCII_REPRESENTED_PERSON_NAME_LENGTH = 256;\n\n/** Representative's stated basis of authority (parent/guardian/counsel etc.). */\nexport const MAX_NCII_AUTHORITY_BASIS_LENGTH = 2000;\n\n/** Optional pointer/reference to authority evidence supplied by a representative. */\nexport const MAX_NCII_AUTHORITY_EVIDENCE_REF_LENGTH = 512;\n\n/** Maximum length for a feedback suggestion. */\nexport const MAX_FEEDBACK_SUGGESTION_LENGTH = 100;\n\n/** Maximum number of distinct submitters tracked per feedback suggestion. Mode-varied. */\nexport const MAX_FEEDBACK_SUBMITTERS = ACTIVE_LIMITS.batches.maxFeedbackSubmitters;\n\n/**\n * Canonical list of feedback types accepted by `submitFeedback`. Used both\n * for runtime validation in the schema (`SubmitFeedbackInputSchema`) and\n * for type-safe consumer props on the frontend `<FeedbackSubmission />`\n * component. Adding a new type here is the single source of truth — no\n * mirroring in callers required.\n */\nexport const FEEDBACK_TYPES = [\n  'tradeProfessionSuggestions',\n  'craftSkillTagSuggestions',\n  'talesWorkGenreSuggestions',\n  'tunesWorkGenreSuggestions',\n  'televisionWorkGenreSuggestions',\n] as const;\n\n/** Union of canonical feedback types. */\nexport type FeedbackType = (typeof FEEDBACK_TYPES)[number];\n\n/** Maximum number of items submitted in a single hallLibrary-review submission. Mode-varied. */\nexport const MAX_HALL_LIBRARY_SUBMIT_BATCH = ACTIVE_LIMITS.hall.maxSubmitBatch;\n\n// --- Admin Tasks ---\n\n/** Admin task lifecycle statuses. */\nexport const ADMIN_TASK_STATUS = {\n  PENDING: 'pending',\n  CHECKED_OUT: 'checkedOut',\n  WORK_LATER: 'workLater',\n  COMPLETED: 'completed',\n} as const;\n"]}
+{"version":3,"file":"business-admin.js","sourceRoot":"","sources":["../../src/constants/business-admin.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,qCAAqC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,KAAK;CACA,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,EAAE,EAAE;IACP,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,IAAI;IACd;;uDAEmD;IACnD,aAAa,EAAE,IAAI;CACX,CAAC;AAIX,mFAAmF;AACnF,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,GAAG;IAC5C,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,MAAM;IAClD,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,IAAI;IAC9C,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,QAAQ;CAC9C,CAAC;AAEX,2BAA2B;AAE3B,yDAAyD;AACzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,qEAAqE;AACrE,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC;AAE3D,sCAAsC;AAEtC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C;gEACgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAEtD,iDAAiD;AACjD,wFAAwF;AACxF,2FAA2F;AAE3F,8FAA8F;AAC9F,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,kCAAkC;AAElC,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;iFACiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;8EAC8E;AAC9E,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,gDAAgD;AAChD,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,mFAAmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,iDAAiD;AACjD,mFAAmF;AACnF,4EAA4E;AAE5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD;;sEAEsE;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,qCAAqC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD,6DAA6D;AAE7D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,sFAAsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,uFAAuF;AACvF,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AAEvD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,uEAAuE;AACvE,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAE3D,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,gDAAgD;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC,OAAO,CAAC,qBAAqB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,4BAA4B;IAC5B,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,gCAAgC;CACxB,CAAC;AAKX,gGAAgG;AAChG,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC;AAE/E,sBAAsB;AAEtB,qCAAqC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,WAAW;IACvB,SAAS,EAAE,WAAW;CACd,CAAC","sourcesContent":["// Admin + content-moderation business-rule constants — task priority, dispatches,\n// the moderation/feedback workflow, and admin-task lifecycle.\nimport { ACTIVE_LIMITS } from './app-mode.js';\n\n// --- Admin Task Priority System ---\n\nexport const TASK_PRIORITY = {\n  CRITICAL: 4,\n  HIGH: 3,\n  NORMAL: 2,\n  LOW: 1,\n} as const;\n\nexport type TaskPriorityLevel = (typeof TASK_PRIORITY)[keyof typeof TASK_PRIORITY];\n\nexport const TASK_PRIORITY_LABELS = {\n  4: 'CRITICAL',\n  3: 'HIGH',\n  2: 'NORMAL',\n  1: 'LOW',\n} as const;\n\n/**\n * Canonical NUMERIC priority scale for `adminTasks.priority`, shared by BOTH\n * priority systems so `checkoutNextImportantTask` (orderBy priority desc across all\n * task types) compares commensurable values. The userReport report-core score formula\n * already writes on this scale (≈40–2250); the level-based types (thresholdLibraryReview,\n * content-appeal, adminDispatch) map their TASK_PRIORITY level onto these numbers instead\n * of writing the raw 1–4.\n *\n * Resulting order: safety reports (1200–2250) > money anomalies (1100) >\n * CRITICAL (1000) > HIGH (800) > routine reports interleave below > spam-tier (~80).\n */\nexport const TASK_PRIORITY_SCORE = {\n  LOW: 50,\n  NORMAL: 200,\n  HIGH: 800,\n  CRITICAL: 1000,\n  /** Money-integrity anomaly (stake-share / pledge-ledger corruption signal) — outranks\n   * everything except safety-class reports. The three anomaly creators that previously\n   * hardcoded `priority: 1` (LOW) all write this. */\n  MONEY_ANOMALY: 1100,\n} as const;\n\nexport type TaskPriorityScore = (typeof TASK_PRIORITY_SCORE)[keyof typeof TASK_PRIORITY_SCORE];\n\n/** Maps a level-based TASK_PRIORITY value (1–4) to its canonical numeric score. */\nexport const TASK_PRIORITY_LEVEL_TO_SCORE = {\n  [TASK_PRIORITY.LOW]: TASK_PRIORITY_SCORE.LOW,\n  [TASK_PRIORITY.NORMAL]: TASK_PRIORITY_SCORE.NORMAL,\n  [TASK_PRIORITY.HIGH]: TASK_PRIORITY_SCORE.HIGH,\n  [TASK_PRIORITY.CRITICAL]: TASK_PRIORITY_SCORE.CRITICAL,\n} as const;\n\n// --- Admin Dispatches ---\n\n/** Maximum length for an admin-dispatch subject line. */\nexport const MAX_ADMIN_DISPATCH_SUBJECT_LENGTH = 100;\n\n/** Maximum length for the initial body text of an admin dispatch. */\nexport const MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH = 1000;\n\n// --- Content Moderation Workflow ---\n\n/** Maximum length for a content-violation appeal message. */\nexport const MAX_APPEAL_MESSAGE_LENGTH = 1000;\n\n/** Threshold-review reviewer notes (revision notes shown to the author). One owner for\n *  the review callable schema AND the admin work-view input. */\nexport const MAX_THRESHOLD_REVIEW_NOTES_LENGTH = 2000;\n\n// --- Moderation / safety operator text caps ---\n// Each is declared ONCE here and derived by every input schema AND persisted doc schema\n// that carries the field — the numbers must never be re-hardcoded at an enforcement point.\n\n/** Operator-facing INTERNAL reason/rationale (LE-loggable; account actions, case reopens). */\nexport const MAX_INTERNAL_REASON_LENGTH = 2000;\n\n/** The generic owner-readable (user-facing) reason — deliberately short, no detail leaks. */\nexport const MAX_USER_FACING_REASON_LENGTH = 280;\n\n/** Structured close-out summary on report/safety-case resolutions. */\nexport const MAX_SAFETY_RESOLUTION_SUMMARY_LENGTH = 2000;\n\n/** Optional operator note attached to a close-out. */\nexport const MAX_SAFETY_ADMIN_NOTE_LENGTH = 4000;\n\n// --- Report intake text caps ---\n\n/** Reporter free-text narrative/comment (segregated private doc; never on the root). */\nexport const MAX_REPORT_NARRATIVE_LENGTH = 4000;\n\n/** The report DIALOG's comment field cap (the client-side compose bound — tighter than\n * the server narrative cap above, which also absorbs upgrade concatenations). */\nexport const MAX_REPORT_COMMENT_LENGTH = 1000;\n\n/** Minimum operator rationale/reason length on safety-console staged actions. */\nexport const MIN_SAFETY_RATIONALE_LENGTH = 10;\n\n/** Operator reason on an admin chat-moderation action (adminModerateChatMessage /\n *  adminReadChannelContext). ONE owner for both callables' `reason` bound. */\nexport const MAX_CHAT_MODERATION_REASON_LENGTH = 1000;\n\n/** Broadcast explicitUids selector audience cap (schema + composer both derive). */\nexport const MAX_BROADCAST_EXPLICIT_UIDS = 2000;\n\n// --- Operator step-up sentinel error codes ---\n// The two backend HttpsError messages the operator TOTP step-up throws; the frontend\n// matches them to open the step-up dialog in ENROLL vs VERIFY mode. ONE declaration —\n// both the callable (functions operatorStepUp.ts) and the frontend hook import these.\nexport const STEP_UP_ENROLL_REQUIRED = 'OPERATOR_STEP_UP_ENROLL_REQUIRED';\nexport const STEP_UP_REQUIRED = 'OPERATOR_STEP_UP_REQUIRED';\n\n/** The frozen report-time captured text snapshot (edit-to-evade guard; NO PII). */\nexport const MAX_REPORT_SNAPSHOT_TEXT_LENGTH = 4000;\n\n// --- Admin console config-content text caps ---\n// Every number the system uses lives HERE — even a field only one surface consumes\n// today, because any future client (TV / phone / admin app) reads ttt-core.\n\nexport const MAX_FUTURE_PLAN_TITLE_LENGTH = 200;\nexport const MAX_FUTURE_PLAN_DESCRIPTION_LENGTH = 4000;\nexport const MAX_PLATFORM_RULE_TITLE_LENGTH = 200;\nexport const MAX_PLATFORM_RULE_DESCRIPTION_LENGTH = 4000;\nexport const MAX_AGREEMENT_POINT_LENGTH = 2000;\nexport const MAX_CONTENT_PAGE_HEADING_LENGTH = 300;\nexport const MAX_CONTENT_PAGE_BODY_LENGTH = 20000;\nexport const MAX_TAKE_IT_DOWN_COPY_LENGTH = 8000;\nexport const MAX_MAINTENANCE_MESSAGE_LENGTH = 2000;\n\n/** Announcement-banner copy on `_config/app.announcementMessage`. Deliberately far\n *  shorter than the maintenance message: the announcement renders as a one-line banner\n *  on the landing page and login screen, not a full-page takeover. */\nexport const MAX_ANNOUNCEMENT_MESSAGE_LENGTH = 300;\n\n/** Admin notes on a content-appeal review (reviewContentAppeal). */\nexport const MAX_APPEAL_REVIEW_NOTES_LENGTH = 2000;\n\n/** Admin reason on a Work/Realm forced-retitle remedy. */\nexport const MAX_REQUIRE_RETITLE_REASON_LENGTH = 500;\n\n/** Optional user-facing DETAIL text on a normal-report resolution. */\nexport const MAX_USER_FACING_REASON_DETAIL_LENGTH = 2000;\n\n/** Admin broadcast / user notification message body. */\nexport const MAX_NOTIFICATION_MESSAGE_LENGTH = 2000;\n\n/** Admin user-search query input. */\nexport const MAX_USER_SEARCH_QUERY_LENGTH = 100;\n\n// --- NCII / child-safety statutory + operator text caps ---\n\n/** Operator reason on the admin \"mark as NCII linked evidence\" intake. */\nexport const MAX_NCII_EVIDENCE_REASON_LENGTH = 1000;\n\n/** Operator written rationale on a TAKE IT DOWN validity decision (immutable row). */\nexport const MAX_NCII_RATIONALE_LENGTH = 4000;\n\n/** Requester's statement of nonconsent (statutory intake — in-app and no-login). */\nexport const MAX_NCII_NONCONSENT_STATEMENT_LENGTH = 4000;\n\n/** Typed-name electronic signature on a statutory request. */\nexport const MAX_NCII_SIGNED_NAME_LENGTH = 256;\n\n/** Requester's optional supporting facts (statutory intake). */\nexport const MAX_NCII_SUPPORTING_FACTS_LENGTH = 8000;\n\n/** Bounded, non-sensitive summary on an NCII request action row. */\nexport const MAX_NCII_ACTION_SUMMARY_LENGTH = 280;\n\n/** Operator description of a registered evidence artifact (e.g. portal screenshot). */\nexport const MAX_SAFETY_ARTIFACT_DESCRIPTION_LENGTH = 500;\n\n/** Operator proof note on a manual NCMEC portal filing. */\nexport const MAX_NCMEC_PORTAL_PROOF_TEXT_LENGTH = 2000;\n\n/** Requester's typed name on the no-login TAKE IT DOWN statutory intake. */\nexport const MAX_NCII_REQUESTER_NAME_LENGTH = 256;\n\n/** Name of the depicted person a representative files on behalf of. */\nexport const MAX_NCII_REPRESENTED_PERSON_NAME_LENGTH = 256;\n\n/** Representative's stated basis of authority (parent/guardian/counsel etc.). */\nexport const MAX_NCII_AUTHORITY_BASIS_LENGTH = 2000;\n\n/** Optional pointer/reference to authority evidence supplied by a representative. */\nexport const MAX_NCII_AUTHORITY_EVIDENCE_REF_LENGTH = 512;\n\n/** Maximum length for a feedback suggestion. */\nexport const MAX_FEEDBACK_SUGGESTION_LENGTH = 100;\n\n/** Maximum number of distinct submitters tracked per feedback suggestion. Mode-varied. */\nexport const MAX_FEEDBACK_SUBMITTERS = ACTIVE_LIMITS.batches.maxFeedbackSubmitters;\n\n/**\n * Canonical list of feedback types accepted by `submitFeedback`. Used both\n * for runtime validation in the schema (`SubmitFeedbackInputSchema`) and\n * for type-safe consumer props on the frontend `<FeedbackSubmission />`\n * component. Adding a new type here is the single source of truth — no\n * mirroring in callers required.\n */\nexport const FEEDBACK_TYPES = [\n  'tradeProfessionSuggestions',\n  'craftSkillTagSuggestions',\n  'talesWorkGenreSuggestions',\n  'tunesWorkGenreSuggestions',\n  'televisionWorkGenreSuggestions',\n] as const;\n\n/** Union of canonical feedback types. */\nexport type FeedbackType = (typeof FEEDBACK_TYPES)[number];\n\n/** Maximum number of items submitted in a single hallLibrary-review submission. Mode-varied. */\nexport const MAX_HALL_LIBRARY_SUBMIT_BATCH = ACTIVE_LIMITS.hall.maxSubmitBatch;\n\n// --- Admin Tasks ---\n\n/** Admin task lifecycle statuses. */\nexport const ADMIN_TASK_STATUS = {\n  PENDING: 'pending',\n  CHECKED_OUT: 'checkedOut',\n  WORK_LATER: 'workLater',\n  COMPLETED: 'completed',\n} as const;\n"]}

package/dist/constants/retention.d.ts

@@ -4,6 +4,9 @@ export declare const WORD_LIST_CACHE_TTL_MS: number;
 export declare const PENDING_MEDIA_ARCHIVE_AFTER_DAYS = 7;
 /** Per-run cap on docs archived by the archivePendingMedia scheduled commission. */
 export declare const PENDING_MEDIA_ARCHIVE_BATCH_SIZE = 500;
+/** Days a moderation-rejected upload's quarantined bytes are retained before the
+ *  hold-aware sweep deletes them. */
+export declare const REJECTED_MEDIA_RETENTION_DAYS = 90;
 /** TTL in hours after which an orphan storage upload becomes eligible for deletion. */
 export declare const ORPHAN_UPLOAD_TTL_HOURS = 24;
 /** Per-run cap on orphan storage deletions. */

package/dist/constants/retention.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/constants/retention.ts"],"names":[],"mappings":"AAIA,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,QAAiB,CAAC;AAIrD,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,MAAM,CAAC;AAIpD,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,+CAA+C;AAC/C,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,4CAA4C;AAC5C,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAIjD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAItD,+DAA+D;AAC/D,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,QAAiB,CAAC"}
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/constants/retention.ts"],"names":[],"mappings":"AAIA,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,QAAiB,CAAC;AAIrD,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,MAAM,CAAC;AAWpD;qCACqC;AACrC,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAIhD,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,+CAA+C;AAC/C,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,4CAA4C;AAC5C,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAIjD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAItD,+DAA+D;AAC/D,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,QAAiB,CAAC"}

package/dist/constants/retention.js

@@ -7,6 +7,17 @@ export const WORD_LIST_CACHE_TTL_MS = 1000 * 60 * 60;
 export const PENDING_MEDIA_ARCHIVE_AFTER_DAYS = 7;
 /** Per-run cap on docs archived by the archivePendingMedia scheduled commission. */
 export const PENDING_MEDIA_ARCHIVE_BATCH_SIZE = 500;
+// --- Rejected (moderation-quarantined) media retention ---
+// Bytes a moderation decision rejected are kept at `rejected/{userId}/…` as APPEAL EVIDENCE
+// (the violation's `rejectedFilePath`; owner + admin readable, never served through the media
+// gateway). They are not kept forever: after this window the hold-aware fail-closed sweep
+// deletes them. Fail-closed means a file it cannot prove is out of window — or that carries an
+// active Trust & Safety / legal hold — is LEFT IN PLACE, never deleted on a best guess.
+// 90 days sits comfortably past the appeal window while bounding indefinite retention of
+// often-adult rejected content. See ttt-prod docs/design/content-moderation-and-reporting.md.
+/** Days a moderation-rejected upload's quarantined bytes are retained before the
+ *  hold-aware sweep deletes them. */
+export const REJECTED_MEDIA_RETENTION_DAYS = 90;
 // --- Orphan upload cleanup ---
 /** TTL in hours after which an orphan storage upload becomes eligible for deletion. */
 export const ORPHAN_UPLOAD_TTL_HOURS = 24;

package/dist/constants/retention.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../src/constants/retention.ts"],"names":[],"mappings":"AAAA,sDAAsD;AAEtD,oCAAoC;AAEpC,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;AAErD,gCAAgC;AAEhC,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAEpD,gCAAgC;AAEhC,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,+CAA+C;AAC/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,8CAA8C;AAE9C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtD,yCAAyC;AAEzC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC","sourcesContent":["// Caching, retention, and cleanup TTLs / batch sizes.\n\n// --- Profanity word list cache ---\n\n/** TTL for the in-memory profanity word list cache (1 hour). */\nexport const WORD_LIST_CACHE_TTL_MS = 1000 * 60 * 60;\n\n// --- Pending media archive ---\n\n/** Days after which a terminal pendingMedia doc is moved to pendingMediaArchive. */\nexport const PENDING_MEDIA_ARCHIVE_AFTER_DAYS = 7;\n\n/** Per-run cap on docs archived by the archivePendingMedia scheduled commission. */\nexport const PENDING_MEDIA_ARCHIVE_BATCH_SIZE = 500;\n\n// --- Orphan upload cleanup ---\n\n/** TTL in hours after which an orphan storage upload becomes eligible for deletion. */\nexport const ORPHAN_UPLOAD_TTL_HOURS = 24;\n\n/** Per-run cap on orphan storage deletions. */\nexport const ORPHAN_UPLOAD_DELETE_CAP = 500;\n\n/** Page size for listing orphan uploads. */\nexport const ORPHAN_UPLOAD_LIST_PAGE_SIZE = 1000;\n\n// --- Frontend in-flight upload listeners ---\n\n/** Maximum lookback window for the in-flight upload listener (24 hours). */\nexport const LISTENER_WINDOW_MS = 24 * 60 * 60 * 1000;\n\n// --- Public users React Query cache ---\n\n/** Stale time for the publicUsers query cache (30 minutes). */\nexport const PUBLIC_USERS_STALE_TIME_MS = 30 * 60 * 1000;\n\n/** GC time for the publicUsers query cache (1 hour). */\nexport const PUBLIC_USERS_GC_TIME_MS = 60 * 60 * 1000;\n\n"]}
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../src/constants/retention.ts"],"names":[],"mappings":"AAAA,sDAAsD;AAEtD,oCAAoC;AAEpC,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;AAErD,gCAAgC;AAEhC,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAEpD,4DAA4D;AAC5D,4FAA4F;AAC5F,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,wFAAwF;AACxF,yFAAyF;AACzF,8FAA8F;AAE9F;qCACqC;AACrC,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,gCAAgC;AAEhC,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,+CAA+C;AAC/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,8CAA8C;AAE9C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtD,yCAAyC;AAEzC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC","sourcesContent":["// Caching, retention, and cleanup TTLs / batch sizes.\n\n// --- Profanity word list cache ---\n\n/** TTL for the in-memory profanity word list cache (1 hour). */\nexport const WORD_LIST_CACHE_TTL_MS = 1000 * 60 * 60;\n\n// --- Pending media archive ---\n\n/** Days after which a terminal pendingMedia doc is moved to pendingMediaArchive. */\nexport const PENDING_MEDIA_ARCHIVE_AFTER_DAYS = 7;\n\n/** Per-run cap on docs archived by the archivePendingMedia scheduled commission. */\nexport const PENDING_MEDIA_ARCHIVE_BATCH_SIZE = 500;\n\n// --- Rejected (moderation-quarantined) media retention ---\n// Bytes a moderation decision rejected are kept at `rejected/{userId}/…` as APPEAL EVIDENCE\n// (the violation's `rejectedFilePath`; owner + admin readable, never served through the media\n// gateway). They are not kept forever: after this window the hold-aware fail-closed sweep\n// deletes them. Fail-closed means a file it cannot prove is out of window — or that carries an\n// active Trust & Safety / legal hold — is LEFT IN PLACE, never deleted on a best guess.\n// 90 days sits comfortably past the appeal window while bounding indefinite retention of\n// often-adult rejected content. See ttt-prod docs/design/content-moderation-and-reporting.md.\n\n/** Days a moderation-rejected upload's quarantined bytes are retained before the\n *  hold-aware sweep deletes them. */\nexport const REJECTED_MEDIA_RETENTION_DAYS = 90;\n\n// --- Orphan upload cleanup ---\n\n/** TTL in hours after which an orphan storage upload becomes eligible for deletion. */\nexport const ORPHAN_UPLOAD_TTL_HOURS = 24;\n\n/** Per-run cap on orphan storage deletions. */\nexport const ORPHAN_UPLOAD_DELETE_CAP = 500;\n\n/** Page size for listing orphan uploads. */\nexport const ORPHAN_UPLOAD_LIST_PAGE_SIZE = 1000;\n\n// --- Frontend in-flight upload listeners ---\n\n/** Maximum lookback window for the in-flight upload listener (24 hours). */\nexport const LISTENER_WINDOW_MS = 24 * 60 * 60 * 1000;\n\n// --- Public users React Query cache ---\n\n/** Stale time for the publicUsers query cache (30 minutes). */\nexport const PUBLIC_USERS_STALE_TIME_MS = 30 * 60 * 1000;\n\n/** GC time for the publicUsers query cache (1 hour). */\nexport const PUBLIC_USERS_GC_TIME_MS = 60 * 60 * 1000;\n\n"]}

package/dist/constants/storage-keys.d.ts

@@ -30,6 +30,11 @@ export declare const TEXT_SIZE_STORAGE_KEY = "ttt-text-size";
 /** Same-tab window event dispatched when TEXT_SIZE_STORAGE_KEY changes (localStorage
  *  'storage' events do not fire in the writing tab), mirroring REDUCED_MOTION_CHANGE_EVENT. */
 export declare const TEXT_SIZE_CHANGE_EVENT = "ttt-text-size-change";
+/** localStorage key — and the matching first-party cookie name — holding the visitor's
+ *  cookie/analytics consent choice. The underscore spelling is byte-stable for backward
+ *  compatibility with already-stored values and MUST NOT be re-styled to match the
+ *  hyphenated House-control keys above. */
+export declare const COOKIE_CONSENT_STORAGE_KEY = "ttt_cookie_consent";
 /** localStorage key holding the caller's single unconfirmed site-tour choice. Scoped by the
  *  AUTHENTICATED uid — never a browser-global key. */
 export declare function siteTourPendingStorageKey(uid: string): string;

package/dist/constants/storage-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-keys.d.ts","sourceRoot":"","sources":["../../src/constants/storage-keys.ts"],"names":[],"mappings":"AAEA,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,2FAA2F;AAC3F,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAEhD,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAMtE,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAE3D;uCACuC;AACvC,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;AAEnE;sEACsE;AACtE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AAErE;0CAC0C;AAC1C,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAS/D;8EAC8E;AAC9E,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D;0FAC0F;AAC1F,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAQvE,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD;+FAC+F;AAC/F,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAe7D;sDACsD;AACtD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;4FAE4F;AAC5F,eAAO,MAAM,8BAA8B,iCAAiC,CAAC"}
+{"version":3,"file":"storage-keys.d.ts","sourceRoot":"","sources":["../../src/constants/storage-keys.ts"],"names":[],"mappings":"AAEA,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,2FAA2F;AAC3F,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAEhD,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAMtE,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAE3D;uCACuC;AACvC,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;AAEnE;sEACsE;AACtE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AAErE;0CAC0C;AAC1C,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAS/D;8EAC8E;AAC9E,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D;0FAC0F;AAC1F,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAQvE,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD;+FAC+F;AAC/F,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D;;;2CAG2C;AAC3C,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAe/D;sDACsD;AACtD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;4FAE4F;AAC5F,eAAO,MAAM,8BAA8B,iCAAiC,CAAC"}

package/dist/constants/storage-keys.js

@@ -45,6 +45,17 @@ export const TEXT_SIZE_STORAGE_KEY = 'ttt-text-size';
 /** Same-tab window event dispatched when TEXT_SIZE_STORAGE_KEY changes (localStorage
  *  'storage' events do not fire in the writing tab), mirroring REDUCED_MOTION_CHANGE_EVENT. */
 export const TEXT_SIZE_CHANGE_EVENT = 'ttt-text-size-change';
+// --- GDPR cookie / analytics consent (device-local) ---
+// Device-local like the House controls above — consent is a per-device choice, never mirrored
+// to Firestore or the private user document. The app persists the same value in BOTH
+// localStorage (under this key) and a first-party cookie of the SAME name, so SSR/middleware can
+// read it; both derive from this one declaration. Values are the ConsentState strings
+// ('granted' | 'denied'); ABSENT means un-chosen (opt-in default, analytics OFF).
+/** localStorage key — and the matching first-party cookie name — holding the visitor's
+ *  cookie/analytics consent choice. The underscore spelling is byte-stable for backward
+ *  compatibility with already-stored values and MUST NOT be re-styled to match the
+ *  hyphenated House-control keys above. */
+export const COOKIE_CONSENT_STORAGE_KEY = 'ttt_cookie_consent';
 // --- First-visit site-tour pending preference (the ONE sanctioned optimistic-hide slot) ---
 // Unlike the House controls above, site-tour state is ACCOUNT-DURABLE: `privateData/{uid}.siteTour`
 // stays the sole authority and the `updateSiteTourPreference` callable stays its sole writer. This

package/dist/constants/storage-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage-keys.js","sourceRoot":"","sources":["../../src/constants/storage-keys.ts"],"names":[],"mappings":"AAAA,iEAAiE;AAEjE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,uEAAuE;AACvE,4EAA4E;AAC5E,0DAA0D;AAE1D,qFAAqF;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE3D;uCACuC;AACvC,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AAEnE;sEACsE;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAErE;0CAC0C;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,6DAA6D;AAC7D,yFAAyF;AACzF,0FAA0F;AAC1F,wFAAwF;AACxF,2FAA2F;AAC3F,8DAA8D;AAE9D;8EAC8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;0FAC0F;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE,kDAAkD;AAClD,mFAAmF;AACnF,+FAA+F;AAC/F,+FAA+F;AAC/F,uEAAuE;AAEvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD;+FAC+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAE7D,6FAA6F;AAC7F,oGAAoG;AACpG,mGAAmG;AACnG,+FAA+F;AAC/F,mGAAmG;AACnG,oGAAoG;AACpG,oGAAoG;AACpG,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,mGAAmG;AACnG,yDAAyD;AAEzD;sDACsD;AACtD,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,yBAAyB,GAAG,EAAE,CAAC;AACxC,CAAC;AAED;;4FAE4F;AAC5F,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC","sourcesContent":["// Well-known keys used in browser sessionStorage / localStorage.\n\n/** sessionStorage key holding the path the user wanted before being redirected to login. */\nexport const REDIRECT_PATH_KEY = 'redirectPath';\n\n/** localStorage key holding the last-seen app version (used by version-gate component). */\nexport const LS_VERSION_KEY = 'ttt-app-version';\n\n/** sessionStorage key marking that a version-mismatch reload was already attempted. */\nexport const SS_RELOAD_ATTEMPTED_KEY = 'ttt-version-reload-attempted';\n\n// --- Company / Green Room dock companion (device-local v1 stores) ---\n// Values are byte-stable for backward compatibility — the historical 'bill'\n// naming predates the Company rename and MUST NOT change.\n\n/** localStorage key holding the user's chosen dock companion id ('bill' | 'kit'). */\nexport const COMPANION_STORAGE_KEY = 'ttt-company-companion';\n\n/** localStorage key: 'true' when the user has hidden the dock companion entirely. */\nexport const MASCOT_HIDDEN_STORAGE_KEY = 'ttt-bill-hidden';\n\n/** localStorage key holding the last-shown dock-bubble line index (avoids an\n *  immediate repeat across visits). */\nexport const MASCOT_LINE_INDEX_STORAGE_KEY = 'ttt-bill-line-index';\n\n/** Same-tab window event dispatched when MASCOT_HIDDEN_STORAGE_KEY changes\n *  (localStorage 'storage' events do not fire in the writing tab). */\nexport const MASCOT_HIDDEN_CHANGE_EVENT = 'ttt-bill-pref-change';\n\n/** Same-tab window event dispatched when COMPANION_STORAGE_KEY changes. */\nexport const COMPANION_CHANGE_EVENT = 'ttt-company-companion-change';\n\n/** Same-tab window event dispatched when the transient dock-puppet pose changes\n *  (in-memory store; never persisted). */\nexport const MASCOT_POSE_CHANGE_EVENT = 'ttt-bill-pose-change';\n\n// --- Manual reduced-motion House control (device-local) ---\n// Independent of the companion visibility store above: reducing motion does not hide the\n// companion, and hiding the companion does not change motion. Effective reduced motion is\n// (the device's prefers-reduced-motion request) OR (this manual preference); the device\n// request always wins. Device-local BY DESIGN — never mirrored to Firestore or the private\n// user document (unlike the account-durable site-tour state).\n\n/** localStorage key: 'true' when the member has manually enabled TTT's app-wide\n *  reduced-motion preference (the \"Motion: Full / Reduced\" House control). */\nexport const REDUCED_MOTION_STORAGE_KEY = 'ttt-reduced-motion';\n\n/** Same-tab window event dispatched when REDUCED_MOTION_STORAGE_KEY changes (localStorage\n *  'storage' events do not fire in the writing tab), mirroring COMPANION_CHANGE_EVENT. */\nexport const REDUCED_MOTION_CHANGE_EVENT = 'ttt-reduced-motion-change';\n\n// --- Large-text House control (device-local) ---\n// The root font-size scale behind the House \"Text size\" control. Same device-local\n// useSyncExternalStore shape as the reduced-motion control above — never mirrored to Firestore\n// or the private user document. The <html> CSS hook it applies stays app-side next to the rule\n// that defines it (as the reduced-motion store's root attribute does).\n\n/** localStorage key holding the member's text-size preference ('standard' | 'large'). */\nexport const TEXT_SIZE_STORAGE_KEY = 'ttt-text-size';\n\n/** Same-tab window event dispatched when TEXT_SIZE_STORAGE_KEY changes (localStorage\n *  'storage' events do not fire in the writing tab), mirroring REDUCED_MOTION_CHANGE_EVENT. */\nexport const TEXT_SIZE_CHANGE_EVENT = 'ttt-text-size-change';\n\n// --- First-visit site-tour pending preference (the ONE sanctioned optimistic-hide slot) ---\n// Unlike the House controls above, site-tour state is ACCOUNT-DURABLE: `privateData/{uid}.siteTour`\n// stays the sole authority and the `updateSiteTourPreference` callable stays its sole writer. This\n// key holds a SINGLE uid-scoped entry recording a choice the member has already made but whose\n// server write has not been confirmed yet, so the overlay can close instantly and the write can be\n// replayed on the next boot. It is a one-entry durable retry SLOT, never a cache, mirror, or second\n// source of eligibility — a member with no pending entry is evaluated purely from the server state.\n//\n// UID-SCOPED BY CONSTRUCTION: a browser-global key would let user A's choice suppress (or replay\n// into) the tour for user B after a sign-out/sign-in on the same device. The stored entry ALSO\n// carries its own `uid` (SiteTourPendingPreferenceSchema, schemas/users.ts) and must match the key\n// owner before it may affect eligibility or be replayed.\n\n/** localStorage key holding the caller's single unconfirmed site-tour choice. Scoped by the\n *  AUTHENTICATED uid — never a browser-global key. */\nexport function siteTourPendingStorageKey(uid: string): string {\n  return `ttt-site-tour-pending:${uid}`;\n}\n\n/** Same-tab window event dispatched when a `siteTourPendingStorageKey(uid)` entry is written or\n *  removed (localStorage 'storage' events do not fire in the writing tab), mirroring\n *  TEXT_SIZE_CHANGE_EVENT. Cross-tab propagation still rides the native 'storage' event. */\nexport const SITE_TOUR_PENDING_CHANGE_EVENT = 'ttt-site-tour-pending-change';\n"]}
+{"version":3,"file":"storage-keys.js","sourceRoot":"","sources":["../../src/constants/storage-keys.ts"],"names":[],"mappings":"AAAA,iEAAiE;AAEjE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,uEAAuE;AACvE,4EAA4E;AAC5E,0DAA0D;AAE1D,qFAAqF;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE3D;uCACuC;AACvC,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AAEnE;sEACsE;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAErE;0CAC0C;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,6DAA6D;AAC7D,yFAAyF;AACzF,0FAA0F;AAC1F,wFAAwF;AACxF,2FAA2F;AAC3F,8DAA8D;AAE9D;8EAC8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;0FAC0F;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE,kDAAkD;AAClD,mFAAmF;AACnF,+FAA+F;AAC/F,+FAA+F;AAC/F,uEAAuE;AAEvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD;+FAC+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAE7D,yDAAyD;AACzD,8FAA8F;AAC9F,qFAAqF;AACrF,iGAAiG;AACjG,sFAAsF;AACtF,kFAAkF;AAElF;;;2CAG2C;AAC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D,6FAA6F;AAC7F,oGAAoG;AACpG,mGAAmG;AACnG,+FAA+F;AAC/F,mGAAmG;AACnG,oGAAoG;AACpG,oGAAoG;AACpG,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,mGAAmG;AACnG,yDAAyD;AAEzD;sDACsD;AACtD,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,yBAAyB,GAAG,EAAE,CAAC;AACxC,CAAC;AAED;;4FAE4F;AAC5F,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC","sourcesContent":["// Well-known keys used in browser sessionStorage / localStorage.\n\n/** sessionStorage key holding the path the user wanted before being redirected to login. */\nexport const REDIRECT_PATH_KEY = 'redirectPath';\n\n/** localStorage key holding the last-seen app version (used by version-gate component). */\nexport const LS_VERSION_KEY = 'ttt-app-version';\n\n/** sessionStorage key marking that a version-mismatch reload was already attempted. */\nexport const SS_RELOAD_ATTEMPTED_KEY = 'ttt-version-reload-attempted';\n\n// --- Company / Green Room dock companion (device-local v1 stores) ---\n// Values are byte-stable for backward compatibility — the historical 'bill'\n// naming predates the Company rename and MUST NOT change.\n\n/** localStorage key holding the user's chosen dock companion id ('bill' | 'kit'). */\nexport const COMPANION_STORAGE_KEY = 'ttt-company-companion';\n\n/** localStorage key: 'true' when the user has hidden the dock companion entirely. */\nexport const MASCOT_HIDDEN_STORAGE_KEY = 'ttt-bill-hidden';\n\n/** localStorage key holding the last-shown dock-bubble line index (avoids an\n *  immediate repeat across visits). */\nexport const MASCOT_LINE_INDEX_STORAGE_KEY = 'ttt-bill-line-index';\n\n/** Same-tab window event dispatched when MASCOT_HIDDEN_STORAGE_KEY changes\n *  (localStorage 'storage' events do not fire in the writing tab). */\nexport const MASCOT_HIDDEN_CHANGE_EVENT = 'ttt-bill-pref-change';\n\n/** Same-tab window event dispatched when COMPANION_STORAGE_KEY changes. */\nexport const COMPANION_CHANGE_EVENT = 'ttt-company-companion-change';\n\n/** Same-tab window event dispatched when the transient dock-puppet pose changes\n *  (in-memory store; never persisted). */\nexport const MASCOT_POSE_CHANGE_EVENT = 'ttt-bill-pose-change';\n\n// --- Manual reduced-motion House control (device-local) ---\n// Independent of the companion visibility store above: reducing motion does not hide the\n// companion, and hiding the companion does not change motion. Effective reduced motion is\n// (the device's prefers-reduced-motion request) OR (this manual preference); the device\n// request always wins. Device-local BY DESIGN — never mirrored to Firestore or the private\n// user document (unlike the account-durable site-tour state).\n\n/** localStorage key: 'true' when the member has manually enabled TTT's app-wide\n *  reduced-motion preference (the \"Motion: Full / Reduced\" House control). */\nexport const REDUCED_MOTION_STORAGE_KEY = 'ttt-reduced-motion';\n\n/** Same-tab window event dispatched when REDUCED_MOTION_STORAGE_KEY changes (localStorage\n *  'storage' events do not fire in the writing tab), mirroring COMPANION_CHANGE_EVENT. */\nexport const REDUCED_MOTION_CHANGE_EVENT = 'ttt-reduced-motion-change';\n\n// --- Large-text House control (device-local) ---\n// The root font-size scale behind the House \"Text size\" control. Same device-local\n// useSyncExternalStore shape as the reduced-motion control above — never mirrored to Firestore\n// or the private user document. The <html> CSS hook it applies stays app-side next to the rule\n// that defines it (as the reduced-motion store's root attribute does).\n\n/** localStorage key holding the member's text-size preference ('standard' | 'large'). */\nexport const TEXT_SIZE_STORAGE_KEY = 'ttt-text-size';\n\n/** Same-tab window event dispatched when TEXT_SIZE_STORAGE_KEY changes (localStorage\n *  'storage' events do not fire in the writing tab), mirroring REDUCED_MOTION_CHANGE_EVENT. */\nexport const TEXT_SIZE_CHANGE_EVENT = 'ttt-text-size-change';\n\n// --- GDPR cookie / analytics consent (device-local) ---\n// Device-local like the House controls above — consent is a per-device choice, never mirrored\n// to Firestore or the private user document. The app persists the same value in BOTH\n// localStorage (under this key) and a first-party cookie of the SAME name, so SSR/middleware can\n// read it; both derive from this one declaration. Values are the ConsentState strings\n// ('granted' | 'denied'); ABSENT means un-chosen (opt-in default, analytics OFF).\n\n/** localStorage key — and the matching first-party cookie name — holding the visitor's\n *  cookie/analytics consent choice. The underscore spelling is byte-stable for backward\n *  compatibility with already-stored values and MUST NOT be re-styled to match the\n *  hyphenated House-control keys above. */\nexport const COOKIE_CONSENT_STORAGE_KEY = 'ttt_cookie_consent';\n\n// --- First-visit site-tour pending preference (the ONE sanctioned optimistic-hide slot) ---\n// Unlike the House controls above, site-tour state is ACCOUNT-DURABLE: `privateData/{uid}.siteTour`\n// stays the sole authority and the `updateSiteTourPreference` callable stays its sole writer. This\n// key holds a SINGLE uid-scoped entry recording a choice the member has already made but whose\n// server write has not been confirmed yet, so the overlay can close instantly and the write can be\n// replayed on the next boot. It is a one-entry durable retry SLOT, never a cache, mirror, or second\n// source of eligibility — a member with no pending entry is evaluated purely from the server state.\n//\n// UID-SCOPED BY CONSTRUCTION: a browser-global key would let user A's choice suppress (or replay\n// into) the tour for user B after a sign-out/sign-in on the same device. The stored entry ALSO\n// carries its own `uid` (SiteTourPendingPreferenceSchema, schemas/users.ts) and must match the key\n// owner before it may affect eligibility or be replayed.\n\n/** localStorage key holding the caller's single unconfirmed site-tour choice. Scoped by the\n *  AUTHENTICATED uid — never a browser-global key. */\nexport function siteTourPendingStorageKey(uid: string): string {\n  return `ttt-site-tour-pending:${uid}`;\n}\n\n/** Same-tab window event dispatched when a `siteTourPendingStorageKey(uid)` entry is written or\n *  removed (localStorage 'storage' events do not fire in the writing tab), mirroring\n *  TEXT_SIZE_CHANGE_EVENT. Cross-tab propagation still rides the native 'storage' event. */\nexport const SITE_TOUR_PENDING_CHANGE_EVENT = 'ttt-site-tour-pending-change';\n"]}

package/dist/doc-schemas/audit.d.ts

@@ -9,7 +9,7 @@ export declare const TTTAuditEventSchema: z.ZodObject<{
         actorMode: z.ZodEnum<{
             user: "user";
             system: "system";
-            projectMember: "projectMember";
+            guildmateUser: "guildmateUser";
         }>;
     }, z.core.$strip>, z.ZodObject<{
         uid: z.ZodNullable<z.ZodString>;

package/dist/doc-schemas/audit.js

@@ -8,7 +8,7 @@ const TTTAuditActorSchema = z.discriminatedUnion('actorMode', [
     z.object({
         uid: z.string().nullable(),
         isAdmin: z.boolean(),
-        actorMode: z.enum(['user', 'projectMember', 'system']),
+        actorMode: z.enum(['user', 'guildmateUser', 'system']),
     }),
     z.object({
         uid: z.string().nullable(),

package/dist/doc-schemas/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/doc-schemas/audit.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yFAAyF;AACzF,oFAAoF;AACpF,qFAAqF;AACrF,mFAAmF;AAEnF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC5D,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;KACvD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACnD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;KACzC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC","sourcesContent":["// Registry schema for auditEvents/{eventId}. Mirrors the structural shape of\n// TTTAuditEvent in ../types/audit.ts — which stays the canonical TYPE because it encodes\n// compiler-enforced actor/role rules (systemRole required on admin modes, forbidden\n// otherwise) that Zod can't express. `type` is validated as a string here; the exact\n// ~80-value AuditEventType union remains the source of truth in ../types/audit.ts.\n\nimport { z } from 'zod';\n\nconst TTTAuditActorSchema = z.discriminatedUnion('actorMode', [\n  z.object({\n    uid: z.string().nullable(),\n    isAdmin: z.boolean(),\n    actorMode: z.enum(['user', 'projectMember', 'system']),\n  }),\n  z.object({\n    uid: z.string().nullable(),\n    isAdmin: z.boolean(),\n    actorMode: z.enum(['adminReview', 'adminOverride']),\n    systemRole: z.enum(['admin', 'jrAdmin']),\n  }),\n]);\n\nconst TTTAuditTargetSchema = z.object({\n  uid: z.string().nullable(),\n  ref: z.string().nullable(),\n});\n\nexport const TTTAuditEventSchema = z.object({\n  id: z.string(),\n  type: z.string(),\n  schemaVersion: z.number(),\n  actor: TTTAuditActorSchema.nullable(),\n  target: TTTAuditTargetSchema.nullable(),\n  timestamp: z.number(),\n  ip: z.string().nullable(),\n  userAgent: z.string().nullable(),\n  region: z.string().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  result: z.enum(['success', 'failure']),\n  failureReason: z.string().nullable(),\n  correlationId: z.string().nullable(),\n});\n"]}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/doc-schemas/audit.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yFAAyF;AACzF,oFAAoF;AACpF,qFAAqF;AACrF,mFAAmF;AAEnF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC5D,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;KACvD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACnD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;KACzC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC","sourcesContent":["// Registry schema for auditEvents/{eventId}. Mirrors the structural shape of\n// TTTAuditEvent in ../types/audit.ts — which stays the canonical TYPE because it encodes\n// compiler-enforced actor/role rules (systemRole required on admin modes, forbidden\n// otherwise) that Zod can't express. `type` is validated as a string here; the exact\n// ~80-value AuditEventType union remains the source of truth in ../types/audit.ts.\n\nimport { z } from 'zod';\n\nconst TTTAuditActorSchema = z.discriminatedUnion('actorMode', [\n  z.object({\n    uid: z.string().nullable(),\n    isAdmin: z.boolean(),\n    actorMode: z.enum(['user', 'guildmateUser', 'system']),\n  }),\n  z.object({\n    uid: z.string().nullable(),\n    isAdmin: z.boolean(),\n    actorMode: z.enum(['adminReview', 'adminOverride']),\n    systemRole: z.enum(['admin', 'jrAdmin']),\n  }),\n]);\n\nconst TTTAuditTargetSchema = z.object({\n  uid: z.string().nullable(),\n  ref: z.string().nullable(),\n});\n\nexport const TTTAuditEventSchema = z.object({\n  id: z.string(),\n  type: z.string(),\n  schemaVersion: z.number(),\n  actor: TTTAuditActorSchema.nullable(),\n  target: TTTAuditTargetSchema.nullable(),\n  timestamp: z.number(),\n  ip: z.string().nullable(),\n  userAgent: z.string().nullable(),\n  region: z.string().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  result: z.enum(['success', 'failure']),\n  failureReason: z.string().nullable(),\n  correlationId: z.string().nullable(),\n});\n"]}

package/dist/doc-schemas/backend-state.d.ts

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+export declare const HallMediaReaperCursorSchema: z.ZodObject<{
+    createdAtCursor: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;
+export declare const OperatorStepUpSchema: z.ZodObject<{
+    secret: z.ZodString;
+    status: z.ZodEnum<{
+        pending: "pending";
+        active: "active";
+    }>;
+    grantExpiresAt: z.ZodOptional<z.ZodNumber>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    confirmedAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;
+export declare const SafetyReconcilerCursorSchema: z.ZodObject<{
+    afterValue: z.ZodOptional<z.ZodNumber>;
+    updatedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;
+export declare const NcmecPortalReceiptArtifactV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    caseId: z.ZodString;
+    submissionId: z.ZodString;
+    evidenceVaultKey: z.ZodString;
+    objectGeneration: z.ZodString;
+    sha256: z.ZodString;
+    contentType: z.ZodString;
+    sizeBytes: z.ZodNumber;
+    capturedAt: z.ZodNumber;
+    registeredByUid: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;
+export declare const NcmecPortalCorrectionRecordV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    caseId: z.ZodString;
+    ncmecReportId: z.ZodString;
+    correctionFiledAt: z.ZodNumber;
+    reason: z.ZodString;
+    recordedByUid: z.ZodString;
+    recordedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;
+//# sourceMappingURL=backend-state.d.ts.map

package/dist/doc-schemas/backend-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-state.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAOhF,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAgB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,eAAO,MAAM,mCAAmC;;;;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/doc-schemas/backend-state.js

@@ -0,0 +1,81 @@
+// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no
+// client ever reads or writes (firestore.rules denies client access to every path below).
+// They are registered here for the same reason every other stored shape is: ARCH-104 gives
+// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and
+// the drift-check read. Types are inferred via z.infer.
+import { z } from 'zod';
+// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.
+// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has POSITIVELY cleared
+// (candidate resolved referenced / reaped / already-deleted), so each pass resumes past
+// permanently-live Hall assets instead of re-reading the same oldest page forever.
+// (functions/src/media/reapOrphanedHallMediaCopies.ts)
+export const HallMediaReaperCursorSchema = z.object({
+    createdAtCursor: z.number(),
+    updatedAt: z.number(),
+});
+// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret
+// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by
+// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes
+// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by
+// the step-up window. (functions/src/safety/operatorStepUp.ts)
+export const OperatorStepUpSchema = z.object({
+    secret: z.string(),
+    status: z.enum(['pending', 'active']),
+    /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */
+    grantExpiresAt: z.number().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    /** Set when enrollment is confirmed (status flips to 'active'). */
+    confirmedAt: z.number().optional(),
+});
+// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler
+// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a
+// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so
+// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)
+export const SafetyReconcilerCursorSchema = z.object({
+    /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */
+    afterValue: z.number().optional(),
+    updatedAt: z.number(),
+});
+// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable
+// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the
+// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified
+// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never
+// proof. Written create-only, never overwritten, and carries the server-verified storage facts
+// (generation + sha256) so a later transactional verification can confirm the same object
+// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)
+export const NcmecPortalReceiptArtifactV1Schema = z.object({
+    schemaVersion: z.literal(1),
+    caseId: z.string(),
+    submissionId: z.string(),
+    /** Key of the object in the restricted evidence vault bucket. */
+    evidenceVaultKey: z.string(),
+    /** GCS object generation at capture time (immutable identity peg). */
+    objectGeneration: z.string(),
+    /** SHA-256 hex digest of the object bytes at capture time. */
+    sha256: z.string(),
+    contentType: z.string(),
+    sizeBytes: z.number(),
+    capturedAt: z.number(),
+    registeredByUid: z.string(),
+    /** Optional operator free-text describing what the artifact is. */
+    description: z.string().optional(),
+});
+// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that
+// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction
+// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the
+// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each
+// correction is a fresh id — a later correction is an additional record, never a mutation of
+// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)
+export const NcmecPortalCorrectionRecordV1Schema = z.object({
+    schemaVersion: z.literal(1),
+    caseId: z.string(),
+    /** The portal-assigned NCMEC report id being corrected. */
+    ncmecReportId: z.string(),
+    /** When the operator filed the correction on the portal (operator-supplied). */
+    correctionFiledAt: z.number(),
+    reason: z.string(),
+    recordedByUid: z.string(),
+    recordedAt: z.number(),
+});
+//# sourceMappingURL=backend-state.js.map