@ttt-productions/ttt-core 0.79.26 → 0.79.28

package/dist/constants/app-mode.d.ts

@@ -84,4 +84,13 @@ export declare const FULL_LIMITS: TttLimits;
 /** The resolved limit set for the deployed mode. Import THIS (or the alias
  * constants that re-export from it), never CHARTER_/FULL_ directly. */
 export declare const ACTIVE_LIMITS: TttLimits;
+/**
+ * User-facing copy for a reached count cap — the ONE owner of the cap-message
+ * shape, beside the limits it describes. Every callable refusing on a
+ * mode-varied count cap formats through this. In charter mode the message
+ * names Charter Season so the cap reads as the season's limit rather than the
+ * platform's permanent shape; full mode stays neutral. `hint` is an optional
+ * trailing sentence (e.g. "Delete a file to add another.").
+ */
+export declare const countCapReachedMessage: (subject: string, limit: number, noun: string, hint?: string) => string;
 //# sourceMappingURL=app-mode.d.ts.map

package/dist/constants/app-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-mode.d.ts","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,EAAE,OAAmB,CAAC;AAE3C,qDAAqD;AACrD,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,KAAG,CACM,CAAC;AAEvD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,GAAG,MAAM,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,yBAAyB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,WAAW,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,MAAM,CAAC;QAChC,uBAAuB,EAAE,MAAM,CAAC;QAChC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,oFAAoF;QACpF,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF;;qFAEiF;IACjF,YAAY,EAAE;QACZ,uEAAuE;QACvE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iEAAiE;QACjE,+BAA+B,EAAE,MAAM,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,wBAAwB,EAAE,MAAM,CAAC;QACjC,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,gFAAgF;IAChF,UAAU,EAAE;QACV,MAAM,EAAE,cAAc,CAAC;QACvB,YAAY,EAAE,cAAc,CAAC;QAC7B,aAAa,EAAE,cAAc,CAAC;QAC9B,IAAI,EAAE,cAAc,CAAC;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,YAAY,EAAE,cAAc,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC;QAC3B,aAAa,EAAE,cAAc,CAAC;QAC9B,UAAU,EAAE,cAAc,CAAC;QAC3B,cAAc,EAAE,cAAc,CAAC;QAC/B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,cAAc,CAAC;QACjC,MAAM,EAAE,cAAc,CAAC;QACvB,eAAe,EAAE,cAAc,CAAC;QAChC,WAAW,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,WAAW,EAAE,cAAc,CAAC;QAC5B,sBAAsB,EAAE,cAAc,CAAC;QACvC,oBAAoB,EAAE,cAAc,CAAC;QACrC,sBAAsB,EAAE,cAAc,CAAC;QACvC,QAAQ,EAAE,cAAc,CAAC;QACzB,iBAAiB,EAAE,cAAc,CAAC;QAClC,aAAa,EAAE,cAAc,CAAC;QAC9B,kBAAkB,EAAE,cAAc,CAAC;QACnC,cAAc,EAAE,cAAc,CAAC;QAC/B,eAAe,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,eAAO,MAAM,cAAc,EAAE,SAoH5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,SAuFzB,CAAC;AAEF;uEACuE;AACvE,eAAO,MAAM,aAAa,EAAE,SAA+C,CAAC"}
+{"version":3,"file":"app-mode.d.ts","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,EAAE,OAAmB,CAAC;AAE3C,qDAAqD;AACrD,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,KAAG,CACM,CAAC;AAEvD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,GAAG,MAAM,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,yBAAyB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,WAAW,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,MAAM,CAAC;QAChC,uBAAuB,EAAE,MAAM,CAAC;QAChC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,oFAAoF;QACpF,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF;;qFAEiF;IACjF,YAAY,EAAE;QACZ,uEAAuE;QACvE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iEAAiE;QACjE,+BAA+B,EAAE,MAAM,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,wBAAwB,EAAE,MAAM,CAAC;QACjC,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,gFAAgF;IAChF,UAAU,EAAE;QACV,MAAM,EAAE,cAAc,CAAC;QACvB,YAAY,EAAE,cAAc,CAAC;QAC7B,aAAa,EAAE,cAAc,CAAC;QAC9B,IAAI,EAAE,cAAc,CAAC;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,YAAY,EAAE,cAAc,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC;QAC3B,aAAa,EAAE,cAAc,CAAC;QAC9B,UAAU,EAAE,cAAc,CAAC;QAC3B,cAAc,EAAE,cAAc,CAAC;QAC/B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,cAAc,CAAC;QACjC,MAAM,EAAE,cAAc,CAAC;QACvB,eAAe,EAAE,cAAc,CAAC;QAChC,WAAW,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,WAAW,EAAE,cAAc,CAAC;QAC5B,sBAAsB,EAAE,cAAc,CAAC;QACvC,oBAAoB,EAAE,cAAc,CAAC;QACrC,sBAAsB,EAAE,cAAc,CAAC;QACvC,QAAQ,EAAE,cAAc,CAAC;QACzB,iBAAiB,EAAE,cAAc,CAAC;QAClC,aAAa,EAAE,cAAc,CAAC;QAC9B,kBAAkB,EAAE,cAAc,CAAC;QACnC,cAAc,EAAE,cAAc,CAAC;QAC/B,eAAe,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,eAAO,MAAM,cAAc,EAAE,SAoH5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,SAuFzB,CAAC;AAEF;uEACuE;AACvE,eAAO,MAAM,aAAa,EAAE,SAA+C,CAAC;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,OAAO,MAAM,EACb,MAAM,MAAM,EACZ,OAAO,MAAM,KACZ,MAMF,CAAC"}

package/dist/constants/app-mode.js

@@ -221,4 +221,16 @@ export const FULL_LIMITS = {
 /** The resolved limit set for the deployed mode. Import THIS (or the alias
  * constants that re-export from it), never CHARTER_/FULL_ directly. */
 export const ACTIVE_LIMITS = byMode(CHARTER_LIMITS, FULL_LIMITS);
+/**
+ * User-facing copy for a reached count cap — the ONE owner of the cap-message
+ * shape, beside the limits it describes. Every callable refusing on a
+ * mode-varied count cap formats through this. In charter mode the message
+ * names Charter Season so the cap reads as the season's limit rather than the
+ * platform's permanent shape; full mode stays neutral. `hint` is an optional
+ * trailing sentence (e.g. "Delete a file to add another.").
+ */
+export const countCapReachedMessage = (subject, limit, noun, hint) => {
+    const base = byMode(`${subject} already has the Charter Season maximum of ${limit} ${noun} — caps expand when Charter Season ends.`, `${subject} already has the maximum of ${limit} ${noun}.`);
+    return hint ? `${base} ${hint}` : base;
+};
 //# sourceMappingURL=app-mode.js.map

package/dist/constants/app-mode.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-mode.js","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,+DAA+D;AAC/D,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AAIzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAY,SAAS,CAAC;AAE3C,qDAAqD;AACrD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAI,OAAU,EAAE,IAAO,EAAK,EAAE,CACjD,QAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAiFvD,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,cAAc,EAAE,CAAC;QACjB,oBAAoB,EAAE,CAAC;QACvB,yBAAyB,EAAE,EAAE;KAC9B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,GAAG;QACjB,uBAAuB,EAAE,aAAa,EAAE,UAAU;QAClD,uBAAuB,EAAE,CAAC;QAC1B,qBAAqB,EAAE,CAAC;QACxB,WAAW,EAAE,CAAC;QACd,+EAA+E;QAC/E,yDAAyD;QACzD,uBAAuB,EAAE,MAAM;QAC/B,aAAa,EAAE,CAAC;QAChB,qBAAqB,EAAE,CAAC;KACzB;IACD,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,wFAAwF;IACxF,uDAAuD;IACvD,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,WAAW,EAAE,UAAU;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,EAAE;IACrE,UAAU,EAAE;QACV,2EAA2E;QAC3E,iCAAiC;QACjC,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,8EAA8E;QAC9E,yEAAyE;QACzE,6EAA6E;QAC7E,+EAA+E;QAC/E,mFAAmF;QACnF,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,iCAAiC;QACjC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,yEAAyE;QACzE,6EAA6E;QAC7E,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,oFAAoF;QACpF,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,8BAA8B;QAC9B,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,mFAAmF;QACnF,0FAA0F;QAC1F,2EAA2E;QAC3E,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,mFAAmF;QACnF,mFAAmF;QACnF,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,2FAA2F;QAC3F,8FAA8F;QAC9F,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,eAAe,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACJ,cAAc,EAAE,EAAE;QAClB,oBAAoB,EAAE,EAAE;QACxB,yBAAyB,EAAE,GAAG;KAC/B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,GAAG;QACjB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,IAAI;QAClB,uBAAuB,EAAE,cAAc,EAAE,SAAS;QAClD,uBAAuB,EAAE,EAAE;QAC3B,qBAAqB,EAAE,EAAE;QACzB,WAAW,EAAE,EAAE;QACf,8EAA8E;QAC9E,4EAA4E;QAC5E,yEAAyE;QACzE,uBAAuB,EAAE,OAAO;QAChC,aAAa,EAAE,EAAE;QACjB,qBAAqB,EAAE,EAAE;KAC1B;IACD,iFAAiF;IACjF,4EAA4E;IAC5E,sFAAsF;IACtF,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,aAAa,EAAE,QAAQ;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE;IACvE,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,gFAAgF;QAChF,6EAA6E;QAC7E,2EAA2E;QAC3E,mDAAmD;QACnD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gFAAgF;QAChF,8EAA8E;QAC9E,2DAA2D;QAC3D,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,uDAAuD;QACvD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,wFAAwF;QACxF,6FAA6F;QAC7F,4FAA4F;QAC5F,sEAAsE;QACtE,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,2FAA2F;QAC3F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,eAAe,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KACpD;CACF,CAAC;AAEF;uEACuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAc,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC","sourcesContent":["// App mode + the charter/full limit sets — the single published constant that\n// drives the whole app's cost posture. The flip to full-live is: change\n// APP_MODE → publish ttt-core → install in ttt-prod (root + functions) →\n// deploy. There is NO runtime mode flag and NO console toggle.\n// See ttt-prod docs/design/charter-season-and-app-mode.md.\n//\n// Only real cost/abuse drivers vary by mode: media specs (ttt-media-specs.ts),\n// rate-limit values, count caps, batch sizes. Text-length limits and payment\n// min/max are deliberately mode-invariant — with ONE ruled exception (DJ\n// 2026-07-13): chapter body content (maxChapterContentLength), because it\n// bounds threshold-review reading effort per item during charter season.\n\nexport type AppMode = 'charter' | 'full';\n\n/** The deployed mode. Changing this constant (and publishing) IS the flip. */\nexport const APP_MODE: AppMode = 'charter';\n\n/** Pick the active value for a mode-varied limit. */\nexport const byMode = <T>(charter: T, full: T): T =>\n  (APP_MODE as AppMode) === 'charter' ? charter : full;\n\n/** Upstash-style sliding-window duration, e.g. '1 h'. */\nexport type RateLimitWindow = `${number} ${'ms' | 's' | 'm' | 'h' | 'd'}`;\n\nexport interface RateLimitValue {\n  maxRequests: number;\n  window: RateLimitWindow;\n}\n\nexport interface TttLimits {\n  mode: AppMode;\n  user: {\n    maxCraftSkills: number;\n    maxOwnedWorkProjects: number;\n    maxAssociatedWorkProjects: number;\n  };\n  workProject: {\n    maxGuildSize: number;\n    maxFileFolders: number;\n    maxWorkFiles: number;\n    maxWorkFileStorageBytes: number;\n    maxWorkProjectAuditions: number;\n    maxCommissionListings: number;\n    maxChapters: number;\n    /** Chapter BODY length (chars) — the one mode-varied text limit (DJ 2026-07-13). */\n    maxChapterContentLength: number;\n    maxTuneTracks: number;\n    maxTelevisionEpisodes: number;\n  };\n  /** Conversation Files container caps — PER CONVERSATION (one guild-invite\n   *  conversation or one admin-support dispatch thread). Both scopes share one cap\n   *  set; guild chat channels have no Conversation Files. DJ ruling 2026-07-25. */\n  conversation: {\n    /** Published active Conversation Files allowed in one conversation. */\n    maxConversationFiles: number;\n    /** Published STORED-OUTPUT bytes allowed in one conversation. */\n    maxConversationFileStorageBytes: number;\n  };\n  hall: {\n    maxSubmitBatch: number;\n  };\n  batches: {\n    trendingFeedProcessLimit: number;\n    maxFeedbackSubmitters: number;\n  };\n  /** Values for the backend rate limiters. Prefixes/factory stay in functions. */\n  rateLimits: {\n    UPLOAD: RateLimitValue;\n    ADMIN_UPLOAD: RateLimitValue;\n    CONTENT_WRITE: RateLimitValue;\n    VOTE: RateLimitValue;\n    MODERATION: RateLimitValue;\n    SENSITIVE_ACTION: RateLimitValue;\n    DISPLAY_NAME_CHECK: RateLimitValue;\n    CHAT_MESSAGE: RateLimitValue;\n    ADMIN_TASK: RateLimitValue;\n    APPEAL_REVIEW: RateLimitValue;\n    BAN_ACTION: RateLimitValue;\n    SHARE_TRANSFER: RateLimitValue;\n    CONTENT_REPORT: RateLimitValue;\n    SHORT_LINK_CLICK: RateLimitValue;\n    FOLLOW: RateLimitValue;\n    MENTION_HISTORY: RateLimitValue;\n    MEDIA_GRANT: RateLimitValue;\n    CHAT_GRANT: RateLimitValue;\n    OPERATOR_STEP_UP: RateLimitValue;\n    ADMIN_MESSAGE_READ: RateLimitValue;\n    USER_LOOKUP: RateLimitValue;\n    NOTIFICATION_BROADCAST: RateLimitValue;\n    NOTIFICATION_ARCHIVE: RateLimitValue;\n    NOTIFICATION_MARK_SEEN: RateLimitValue;\n    FEEDBACK: RateLimitValue;\n    SHORT_LINK_CREATE: RateLimitValue;\n    INVITE_ACTION: RateLimitValue;\n    LIBRARY_SUBMISSION: RateLimitValue;\n    CHANNEL_CREATE: RateLimitValue;\n    CHECKOUT_CREATE: RateLimitValue;\n  };\n}\n\nexport const CHARTER_LIMITS: TttLimits = {\n  mode: 'charter',\n  user: {\n    maxCraftSkills: 8,\n    maxOwnedWorkProjects: 3,\n    maxAssociatedWorkProjects: 10,\n  },\n  workProject: {\n    maxGuildSize: 25,\n    maxFileFolders: 10,\n    maxWorkFiles: 100,\n    maxWorkFileStorageBytes: 2_684_354_560, // 2.5 GiB\n    maxWorkProjectAuditions: 3,\n    maxCommissionListings: 3,\n    maxChapters: 5,\n    // ~5,000 words — a full real chapter, while keeping the human threshold-review\n    // reading effort per item bounded during charter season.\n    maxChapterContentLength: 30_000,\n    maxTuneTracks: 5,\n    maxTelevisionEpisodes: 3,\n  },\n  // Conversation Files are QUOTA'D PER CONVERSATION (DJ ruling 2026-07-25). Counted on\n  // STORED OUTPUT bytes (what actually sits in R2 after transcode), never on raw upload\n  // bytes. Rationale: a per-file `maxBytes` cap alone bounds one upload but nothing stops\n  // unbounded accumulation across a long-running conversation — this is the abuse brake\n  // on that, and it is what `startUpload`'s reservation and the publication transfer both\n  // check. Charter: 10 files / 500 MiB per conversation.\n  conversation: {\n    maxConversationFiles: 10,\n    maxConversationFileStorageBytes: 524_288_000, // 500 MiB\n  },\n  hall: { maxSubmitBatch: 10 },\n  batches: { trendingFeedProcessLimit: 250, maxFeedbackSubmitters: 25 },\n  rateLimits: {\n    // Uploads are charged ONCE per upload (in startUpload); the processor-side\n    // check is a non-charging guard.\n    UPLOAD: { maxRequests: 15, window: '1 h' },\n    // A separate HIGHER bucket for uploads performed through the sanctioned admin\n    // authority path — never an exemption. Bulk admin setup work (creating 3\n    // auditions is ~5 uploads) exhausts the 15/h user bucket; 60/h covers a real\n    // bulk admin session while keeping a brake on a compromised admin token and on\n    // third-party quota/cost (Vision / Video Intelligence / R2). DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 60, window: '1 h' },\n    // General content-write throttle for the non-upload write callables (text posts,\n    // craft-skill edits, support-thread starts) that used to charge UPLOAD. Sharing\n    // the 15/h charter upload window meant heavy text posting blocked real uploads\n    // and vice versa; a separate 30/h bucket keeps each cost driver on its own\n    // ceiling. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 30, window: '1 h' },\n    VOTE: { maxRequests: 100, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 30/h: one bucket is shared by ~35 callables (register, become-artisan,\n    // create-work, invites, trades, appeals, …) — a real first-hour artisan does\n    // 10-15 legitimate sensitive actions; 5/h blocked the intended golden path\n    // (proven live by the hosted-dev E2E, 2026-07-07). DJ ruling 2026-07-08.\n    SENSITIVE_ACTION: { maxRequests: 30, window: '1 h' },\n    // 120/h (charter): checkDisplayNameAvailable is enforceAppCheck:true, so\n    // reCAPTCHA-Enterprise attestation is the real abuse gate — this bucket is a\n    // cost/DoS ceiling, not the security boundary. It is IP-keyed (pre-registration,\n    // no uid yet) and the register form fires it debounced-LIVE as you type, so one\n    // legit registrant spends ~3-8 checks and shared NAT/CGNAT multiplies that across\n    // everyone on the IP. The old 20/h false-rejected legitimate shared-IP users and\n    // could not fit a full hosted-dev E2E suite run on one IP. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 120, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 125, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 5, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 20, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // Scoped-media grant minting (createMediaGrant). Its OWN bucket — it used to charge\n    // MENTION_HISTORY, an unrelated surface, so neither limit meant what its name said and the\n    // two shared a budget sized for neither (BACKEND-013). Refresh-driven, not user-initiated:\n    // a grant is short-TTL (60 min work media, 15 min chat/folder scopes) and the client re-mints\n    // under expiry, so a browsing session naturally spends several per hour PER SCOPE (each work,\n    // each private file folder, each conversation). Cheap to serve (a Firestore permission read\n    // plus an HMAC sign — no third-party cost), and a false 429 breaks media rendering outright,\n    // so the ceiling is generous: it exists to stop a scripted grant-farming sweep, not to pace a\n    // real reader. 120/h charter.\n    MEDIA_GRANT: { maxRequests: 120, window: '1 h' },\n    // Realtime chat grant minting (mintChatGrant) — previously NO limiter at all (BACKEND-013),\n    // despite minting signed grants at concurrency: 20. Same refresh-driven shape as MEDIA_GRANT:\n    // a 15-minute grant TTL means ~4 mints/hour for the inbox plus ~4 per open channel, doubled\n    // again by socket reconnects on a flaky mobile network. It stays behind the per-channel\n    // authorizeChannelScope gate, so this bucket is a cost/DoS ceiling rather than the\n    // authorization boundary — sized to match MEDIA_GRANT so the two grant surfaces are paced\n    // alike and neither can be starved by the other (separate Redis prefixes).\n    CHAT_GRANT: { maxRequests: 120, window: '1 h' },\n    // Operator step-up TOTP verification (confirmOperatorStepUp / verifyOperatorStepUp) —\n    // previously unthrottled, so an attacker holding a stolen full-admin session could\n    // brute-force the 6-digit second factor guarding the safety console (BACKEND-013).\n    // DELIBERATELY THE TIGHTEST BUCKET IN THE SET: a real operator enrolls once and verifies\n    // roughly twice an hour (the grant window is 30 minutes), so 10/h absorbs every legitimate\n    // mistype while capping guessing at 10 attempts per hour against a code that rotates every\n    // 30 seconds. Mode-INVARIANT — this is an admin security control, not a cost driver, so it\n    // never loosens at the full-mode flip (same posture as MODERATION / BAN_ACTION / USER_LOOKUP).\n    // The lockout-after-N-failures behaviour is a separate app-side concern; this is the throttle.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup (searchPublicUsers / lookupUserByEmailOrUid) — a read, so a\n    // generous per-minute bucket that still backstops a scripted enumeration sweep. Admin-only\n    // and not a cost driver, so the value is the same in both modes (like MODERATION/ADMIN_TASK).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 30, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 10, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 5, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 5, window: '1 h' },\n  },\n};\n\nexport const FULL_LIMITS: TttLimits = {\n  mode: 'full',\n  user: {\n    maxCraftSkills: 24,\n    maxOwnedWorkProjects: 25,\n    maxAssociatedWorkProjects: 100,\n  },\n  workProject: {\n    maxGuildSize: 250,\n    maxFileFolders: 25,\n    maxWorkFiles: 1000,\n    maxWorkFileStorageBytes: 26_843_545_600, // 25 GiB\n    maxWorkProjectAuditions: 10,\n    maxCommissionListings: 10,\n    maxChapters: 50,\n    // The intentional design ceiling (~17,000 words; trivially inside Firestore's\n    // 1 MiB doc limit) — the audit trail deliberately stores field LENGTHS, not\n    // content, because chapters can be this large (runUpdateChapterDetails).\n    maxChapterContentLength: 100_000,\n    maxTuneTracks: 50,\n    maxTelevisionEpisodes: 25,\n  },\n  // 20 files / 1 GiB (full): the same per-conversation Conversation Files quota as\n  // charter, scaled for a public-launch conversation. Still a hard ceiling on\n  // unbounded R2 accumulation. See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n  conversation: {\n    maxConversationFiles: 20,\n    maxConversationFileStorageBytes: 1_073_741_824, // 1 GiB\n  },\n  hall: { maxSubmitBatch: 50 },\n  batches: { trendingFeedProcessLimit: 1000, maxFeedbackSubmitters: 100 },\n  rateLimits: {\n    UPLOAD: { maxRequests: 30, window: '1 h' },\n    // 120/h (full): the same sanctioned-admin-path upload bucket as charter, scaled\n    // with UPLOAD — always HIGHER than the user bucket, never an exemption, so a\n    // compromised admin token and third-party media cost stay bounded. See the\n    // CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 120, window: '1 h' },\n    // 60/h (full): the same non-upload content-write bucket as charter, scaled with\n    // UPLOAD so text writes and media uploads never consume each other's ceiling.\n    // See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 60, window: '1 h' },\n    VOTE: { maxRequests: 200, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 60/h: full-mode power users managing several works do dozens of legitimate\n    // management actions per hour; still a hard backstop against scripts.\n    // DJ ruling 2026-07-08 (charter 30 / full 60, single bucket; a bucket split\n    // is filed post-launch in ttt-prod docs/post-launch/).\n    SENSITIVE_ACTION: { maxRequests: 60, window: '1 h' },\n    // 300/h (full): same reasoning as the charter value above (App-Check-gated\n    // cost ceiling, IP-keyed, debounced-live). Public-launch CGNAT exposure is far\n    // larger — hundreds of concurrent legit registrants can sit behind one carrier\n    // IP — so err generous; the only cost of \"too high\" is trivial Firestore reads,\n    // while \"too low\" false-rejects real users. Raise on evidence (watch prod logs\n    // for legit 429s) rather than pre-emptively tightening. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 300, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 150, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 20, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 60, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // 240/h (full): the same grant-minting buckets as charter, doubled with the surrounding\n    // content limits. Full mode raises the ceilings a grant is minted PER (250-guildmate guilds,\n    // 25 file folders, 1000 work files, 10 auditions), so one session legitimately touches more\n    // scopes and re-mints more often. See the CHARTER_LIMITS notes above.\n    MEDIA_GRANT: { maxRequests: 240, window: '1 h' },\n    CHAT_GRANT: { maxRequests: 240, window: '1 h' },\n    // Operator step-up stays at 10/h in BOTH modes — an admin second-factor throttle is a\n    // security control, not a cost lever, so it never loosens at the flip. See CHARTER_LIMITS.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup — same read bucket in both modes (see CHARTER_LIMITS note).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 60, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 20, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 20, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 20, window: '1 h' },\n  },\n};\n\n/** The resolved limit set for the deployed mode. Import THIS (or the alias\n * constants that re-export from it), never CHARTER_/FULL_ directly. */\nexport const ACTIVE_LIMITS: TttLimits = byMode(CHARTER_LIMITS, FULL_LIMITS);\n"]}
+{"version":3,"file":"app-mode.js","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,+DAA+D;AAC/D,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AAIzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAY,SAAS,CAAC;AAE3C,qDAAqD;AACrD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAI,OAAU,EAAE,IAAO,EAAK,EAAE,CACjD,QAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAiFvD,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,cAAc,EAAE,CAAC;QACjB,oBAAoB,EAAE,CAAC;QACvB,yBAAyB,EAAE,EAAE;KAC9B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,GAAG;QACjB,uBAAuB,EAAE,aAAa,EAAE,UAAU;QAClD,uBAAuB,EAAE,CAAC;QAC1B,qBAAqB,EAAE,CAAC;QACxB,WAAW,EAAE,CAAC;QACd,+EAA+E;QAC/E,yDAAyD;QACzD,uBAAuB,EAAE,MAAM;QAC/B,aAAa,EAAE,CAAC;QAChB,qBAAqB,EAAE,CAAC;KACzB;IACD,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,wFAAwF;IACxF,uDAAuD;IACvD,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,WAAW,EAAE,UAAU;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,EAAE;IACrE,UAAU,EAAE;QACV,2EAA2E;QAC3E,iCAAiC;QACjC,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,8EAA8E;QAC9E,yEAAyE;QACzE,6EAA6E;QAC7E,+EAA+E;QAC/E,mFAAmF;QACnF,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,iCAAiC;QACjC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,yEAAyE;QACzE,6EAA6E;QAC7E,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,oFAAoF;QACpF,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,8BAA8B;QAC9B,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,mFAAmF;QACnF,0FAA0F;QAC1F,2EAA2E;QAC3E,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,mFAAmF;QACnF,mFAAmF;QACnF,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,2FAA2F;QAC3F,8FAA8F;QAC9F,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,eAAe,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACJ,cAAc,EAAE,EAAE;QAClB,oBAAoB,EAAE,EAAE;QACxB,yBAAyB,EAAE,GAAG;KAC/B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,GAAG;QACjB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,IAAI;QAClB,uBAAuB,EAAE,cAAc,EAAE,SAAS;QAClD,uBAAuB,EAAE,EAAE;QAC3B,qBAAqB,EAAE,EAAE;QACzB,WAAW,EAAE,EAAE;QACf,8EAA8E;QAC9E,4EAA4E;QAC5E,yEAAyE;QACzE,uBAAuB,EAAE,OAAO;QAChC,aAAa,EAAE,EAAE;QACjB,qBAAqB,EAAE,EAAE;KAC1B;IACD,iFAAiF;IACjF,4EAA4E;IAC5E,sFAAsF;IACtF,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,aAAa,EAAE,QAAQ;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE;IACvE,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,gFAAgF;QAChF,6EAA6E;QAC7E,2EAA2E;QAC3E,mDAAmD;QACnD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gFAAgF;QAChF,8EAA8E;QAC9E,2DAA2D;QAC3D,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,uDAAuD;QACvD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,wFAAwF;QACxF,6FAA6F;QAC7F,4FAA4F;QAC5F,sEAAsE;QACtE,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,2FAA2F;QAC3F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,eAAe,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KACpD;CACF,CAAC;AAEF;uEACuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAc,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,OAAe,EACf,KAAa,EACb,IAAY,EACZ,IAAa,EACL,EAAE;IACV,MAAM,IAAI,GAAG,MAAM,CACjB,GAAG,OAAO,8CAA8C,KAAK,IAAI,IAAI,0CAA0C,EAC/G,GAAG,OAAO,+BAA+B,KAAK,IAAI,IAAI,GAAG,CAC1D,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC","sourcesContent":["// App mode + the charter/full limit sets — the single published constant that\n// drives the whole app's cost posture. The flip to full-live is: change\n// APP_MODE → publish ttt-core → install in ttt-prod (root + functions) →\n// deploy. There is NO runtime mode flag and NO console toggle.\n// See ttt-prod docs/design/charter-season-and-app-mode.md.\n//\n// Only real cost/abuse drivers vary by mode: media specs (ttt-media-specs.ts),\n// rate-limit values, count caps, batch sizes. Text-length limits and payment\n// min/max are deliberately mode-invariant — with ONE ruled exception (DJ\n// 2026-07-13): chapter body content (maxChapterContentLength), because it\n// bounds threshold-review reading effort per item during charter season.\n\nexport type AppMode = 'charter' | 'full';\n\n/** The deployed mode. Changing this constant (and publishing) IS the flip. */\nexport const APP_MODE: AppMode = 'charter';\n\n/** Pick the active value for a mode-varied limit. */\nexport const byMode = <T>(charter: T, full: T): T =>\n  (APP_MODE as AppMode) === 'charter' ? charter : full;\n\n/** Upstash-style sliding-window duration, e.g. '1 h'. */\nexport type RateLimitWindow = `${number} ${'ms' | 's' | 'm' | 'h' | 'd'}`;\n\nexport interface RateLimitValue {\n  maxRequests: number;\n  window: RateLimitWindow;\n}\n\nexport interface TttLimits {\n  mode: AppMode;\n  user: {\n    maxCraftSkills: number;\n    maxOwnedWorkProjects: number;\n    maxAssociatedWorkProjects: number;\n  };\n  workProject: {\n    maxGuildSize: number;\n    maxFileFolders: number;\n    maxWorkFiles: number;\n    maxWorkFileStorageBytes: number;\n    maxWorkProjectAuditions: number;\n    maxCommissionListings: number;\n    maxChapters: number;\n    /** Chapter BODY length (chars) — the one mode-varied text limit (DJ 2026-07-13). */\n    maxChapterContentLength: number;\n    maxTuneTracks: number;\n    maxTelevisionEpisodes: number;\n  };\n  /** Conversation Files container caps — PER CONVERSATION (one guild-invite\n   *  conversation or one admin-support dispatch thread). Both scopes share one cap\n   *  set; guild chat channels have no Conversation Files. DJ ruling 2026-07-25. */\n  conversation: {\n    /** Published active Conversation Files allowed in one conversation. */\n    maxConversationFiles: number;\n    /** Published STORED-OUTPUT bytes allowed in one conversation. */\n    maxConversationFileStorageBytes: number;\n  };\n  hall: {\n    maxSubmitBatch: number;\n  };\n  batches: {\n    trendingFeedProcessLimit: number;\n    maxFeedbackSubmitters: number;\n  };\n  /** Values for the backend rate limiters. Prefixes/factory stay in functions. */\n  rateLimits: {\n    UPLOAD: RateLimitValue;\n    ADMIN_UPLOAD: RateLimitValue;\n    CONTENT_WRITE: RateLimitValue;\n    VOTE: RateLimitValue;\n    MODERATION: RateLimitValue;\n    SENSITIVE_ACTION: RateLimitValue;\n    DISPLAY_NAME_CHECK: RateLimitValue;\n    CHAT_MESSAGE: RateLimitValue;\n    ADMIN_TASK: RateLimitValue;\n    APPEAL_REVIEW: RateLimitValue;\n    BAN_ACTION: RateLimitValue;\n    SHARE_TRANSFER: RateLimitValue;\n    CONTENT_REPORT: RateLimitValue;\n    SHORT_LINK_CLICK: RateLimitValue;\n    FOLLOW: RateLimitValue;\n    MENTION_HISTORY: RateLimitValue;\n    MEDIA_GRANT: RateLimitValue;\n    CHAT_GRANT: RateLimitValue;\n    OPERATOR_STEP_UP: RateLimitValue;\n    ADMIN_MESSAGE_READ: RateLimitValue;\n    USER_LOOKUP: RateLimitValue;\n    NOTIFICATION_BROADCAST: RateLimitValue;\n    NOTIFICATION_ARCHIVE: RateLimitValue;\n    NOTIFICATION_MARK_SEEN: RateLimitValue;\n    FEEDBACK: RateLimitValue;\n    SHORT_LINK_CREATE: RateLimitValue;\n    INVITE_ACTION: RateLimitValue;\n    LIBRARY_SUBMISSION: RateLimitValue;\n    CHANNEL_CREATE: RateLimitValue;\n    CHECKOUT_CREATE: RateLimitValue;\n  };\n}\n\nexport const CHARTER_LIMITS: TttLimits = {\n  mode: 'charter',\n  user: {\n    maxCraftSkills: 8,\n    maxOwnedWorkProjects: 3,\n    maxAssociatedWorkProjects: 10,\n  },\n  workProject: {\n    maxGuildSize: 25,\n    maxFileFolders: 10,\n    maxWorkFiles: 100,\n    maxWorkFileStorageBytes: 2_684_354_560, // 2.5 GiB\n    maxWorkProjectAuditions: 3,\n    maxCommissionListings: 3,\n    maxChapters: 5,\n    // ~5,000 words — a full real chapter, while keeping the human threshold-review\n    // reading effort per item bounded during charter season.\n    maxChapterContentLength: 30_000,\n    maxTuneTracks: 5,\n    maxTelevisionEpisodes: 3,\n  },\n  // Conversation Files are QUOTA'D PER CONVERSATION (DJ ruling 2026-07-25). Counted on\n  // STORED OUTPUT bytes (what actually sits in R2 after transcode), never on raw upload\n  // bytes. Rationale: a per-file `maxBytes` cap alone bounds one upload but nothing stops\n  // unbounded accumulation across a long-running conversation — this is the abuse brake\n  // on that, and it is what `startUpload`'s reservation and the publication transfer both\n  // check. Charter: 10 files / 500 MiB per conversation.\n  conversation: {\n    maxConversationFiles: 10,\n    maxConversationFileStorageBytes: 524_288_000, // 500 MiB\n  },\n  hall: { maxSubmitBatch: 10 },\n  batches: { trendingFeedProcessLimit: 250, maxFeedbackSubmitters: 25 },\n  rateLimits: {\n    // Uploads are charged ONCE per upload (in startUpload); the processor-side\n    // check is a non-charging guard.\n    UPLOAD: { maxRequests: 15, window: '1 h' },\n    // A separate HIGHER bucket for uploads performed through the sanctioned admin\n    // authority path — never an exemption. Bulk admin setup work (creating 3\n    // auditions is ~5 uploads) exhausts the 15/h user bucket; 60/h covers a real\n    // bulk admin session while keeping a brake on a compromised admin token and on\n    // third-party quota/cost (Vision / Video Intelligence / R2). DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 60, window: '1 h' },\n    // General content-write throttle for the non-upload write callables (text posts,\n    // craft-skill edits, support-thread starts) that used to charge UPLOAD. Sharing\n    // the 15/h charter upload window meant heavy text posting blocked real uploads\n    // and vice versa; a separate 30/h bucket keeps each cost driver on its own\n    // ceiling. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 30, window: '1 h' },\n    VOTE: { maxRequests: 100, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 30/h: one bucket is shared by ~35 callables (register, become-artisan,\n    // create-work, invites, trades, appeals, …) — a real first-hour artisan does\n    // 10-15 legitimate sensitive actions; 5/h blocked the intended golden path\n    // (proven live by the hosted-dev E2E, 2026-07-07). DJ ruling 2026-07-08.\n    SENSITIVE_ACTION: { maxRequests: 30, window: '1 h' },\n    // 120/h (charter): checkDisplayNameAvailable is enforceAppCheck:true, so\n    // reCAPTCHA-Enterprise attestation is the real abuse gate — this bucket is a\n    // cost/DoS ceiling, not the security boundary. It is IP-keyed (pre-registration,\n    // no uid yet) and the register form fires it debounced-LIVE as you type, so one\n    // legit registrant spends ~3-8 checks and shared NAT/CGNAT multiplies that across\n    // everyone on the IP. The old 20/h false-rejected legitimate shared-IP users and\n    // could not fit a full hosted-dev E2E suite run on one IP. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 120, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 125, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 5, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 20, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // Scoped-media grant minting (createMediaGrant). Its OWN bucket — it used to charge\n    // MENTION_HISTORY, an unrelated surface, so neither limit meant what its name said and the\n    // two shared a budget sized for neither (BACKEND-013). Refresh-driven, not user-initiated:\n    // a grant is short-TTL (60 min work media, 15 min chat/folder scopes) and the client re-mints\n    // under expiry, so a browsing session naturally spends several per hour PER SCOPE (each work,\n    // each private file folder, each conversation). Cheap to serve (a Firestore permission read\n    // plus an HMAC sign — no third-party cost), and a false 429 breaks media rendering outright,\n    // so the ceiling is generous: it exists to stop a scripted grant-farming sweep, not to pace a\n    // real reader. 120/h charter.\n    MEDIA_GRANT: { maxRequests: 120, window: '1 h' },\n    // Realtime chat grant minting (mintChatGrant) — previously NO limiter at all (BACKEND-013),\n    // despite minting signed grants at concurrency: 20. Same refresh-driven shape as MEDIA_GRANT:\n    // a 15-minute grant TTL means ~4 mints/hour for the inbox plus ~4 per open channel, doubled\n    // again by socket reconnects on a flaky mobile network. It stays behind the per-channel\n    // authorizeChannelScope gate, so this bucket is a cost/DoS ceiling rather than the\n    // authorization boundary — sized to match MEDIA_GRANT so the two grant surfaces are paced\n    // alike and neither can be starved by the other (separate Redis prefixes).\n    CHAT_GRANT: { maxRequests: 120, window: '1 h' },\n    // Operator step-up TOTP verification (confirmOperatorStepUp / verifyOperatorStepUp) —\n    // previously unthrottled, so an attacker holding a stolen full-admin session could\n    // brute-force the 6-digit second factor guarding the safety console (BACKEND-013).\n    // DELIBERATELY THE TIGHTEST BUCKET IN THE SET: a real operator enrolls once and verifies\n    // roughly twice an hour (the grant window is 30 minutes), so 10/h absorbs every legitimate\n    // mistype while capping guessing at 10 attempts per hour against a code that rotates every\n    // 30 seconds. Mode-INVARIANT — this is an admin security control, not a cost driver, so it\n    // never loosens at the full-mode flip (same posture as MODERATION / BAN_ACTION / USER_LOOKUP).\n    // The lockout-after-N-failures behaviour is a separate app-side concern; this is the throttle.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup (searchPublicUsers / lookupUserByEmailOrUid) — a read, so a\n    // generous per-minute bucket that still backstops a scripted enumeration sweep. Admin-only\n    // and not a cost driver, so the value is the same in both modes (like MODERATION/ADMIN_TASK).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 30, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 10, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 5, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 5, window: '1 h' },\n  },\n};\n\nexport const FULL_LIMITS: TttLimits = {\n  mode: 'full',\n  user: {\n    maxCraftSkills: 24,\n    maxOwnedWorkProjects: 25,\n    maxAssociatedWorkProjects: 100,\n  },\n  workProject: {\n    maxGuildSize: 250,\n    maxFileFolders: 25,\n    maxWorkFiles: 1000,\n    maxWorkFileStorageBytes: 26_843_545_600, // 25 GiB\n    maxWorkProjectAuditions: 10,\n    maxCommissionListings: 10,\n    maxChapters: 50,\n    // The intentional design ceiling (~17,000 words; trivially inside Firestore's\n    // 1 MiB doc limit) — the audit trail deliberately stores field LENGTHS, not\n    // content, because chapters can be this large (runUpdateChapterDetails).\n    maxChapterContentLength: 100_000,\n    maxTuneTracks: 50,\n    maxTelevisionEpisodes: 25,\n  },\n  // 20 files / 1 GiB (full): the same per-conversation Conversation Files quota as\n  // charter, scaled for a public-launch conversation. Still a hard ceiling on\n  // unbounded R2 accumulation. See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n  conversation: {\n    maxConversationFiles: 20,\n    maxConversationFileStorageBytes: 1_073_741_824, // 1 GiB\n  },\n  hall: { maxSubmitBatch: 50 },\n  batches: { trendingFeedProcessLimit: 1000, maxFeedbackSubmitters: 100 },\n  rateLimits: {\n    UPLOAD: { maxRequests: 30, window: '1 h' },\n    // 120/h (full): the same sanctioned-admin-path upload bucket as charter, scaled\n    // with UPLOAD — always HIGHER than the user bucket, never an exemption, so a\n    // compromised admin token and third-party media cost stay bounded. See the\n    // CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 120, window: '1 h' },\n    // 60/h (full): the same non-upload content-write bucket as charter, scaled with\n    // UPLOAD so text writes and media uploads never consume each other's ceiling.\n    // See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 60, window: '1 h' },\n    VOTE: { maxRequests: 200, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 60/h: full-mode power users managing several works do dozens of legitimate\n    // management actions per hour; still a hard backstop against scripts.\n    // DJ ruling 2026-07-08 (charter 30 / full 60, single bucket; a bucket split\n    // is filed post-launch in ttt-prod docs/post-launch/).\n    SENSITIVE_ACTION: { maxRequests: 60, window: '1 h' },\n    // 300/h (full): same reasoning as the charter value above (App-Check-gated\n    // cost ceiling, IP-keyed, debounced-live). Public-launch CGNAT exposure is far\n    // larger — hundreds of concurrent legit registrants can sit behind one carrier\n    // IP — so err generous; the only cost of \"too high\" is trivial Firestore reads,\n    // while \"too low\" false-rejects real users. Raise on evidence (watch prod logs\n    // for legit 429s) rather than pre-emptively tightening. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 300, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 150, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 20, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 60, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // 240/h (full): the same grant-minting buckets as charter, doubled with the surrounding\n    // content limits. Full mode raises the ceilings a grant is minted PER (250-guildmate guilds,\n    // 25 file folders, 1000 work files, 10 auditions), so one session legitimately touches more\n    // scopes and re-mints more often. See the CHARTER_LIMITS notes above.\n    MEDIA_GRANT: { maxRequests: 240, window: '1 h' },\n    CHAT_GRANT: { maxRequests: 240, window: '1 h' },\n    // Operator step-up stays at 10/h in BOTH modes — an admin second-factor throttle is a\n    // security control, not a cost lever, so it never loosens at the flip. See CHARTER_LIMITS.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup — same read bucket in both modes (see CHARTER_LIMITS note).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 60, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 20, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 20, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 20, window: '1 h' },\n  },\n};\n\n/** The resolved limit set for the deployed mode. Import THIS (or the alias\n * constants that re-export from it), never CHARTER_/FULL_ directly. */\nexport const ACTIVE_LIMITS: TttLimits = byMode(CHARTER_LIMITS, FULL_LIMITS);\n\n/**\n * User-facing copy for a reached count cap — the ONE owner of the cap-message\n * shape, beside the limits it describes. Every callable refusing on a\n * mode-varied count cap formats through this. In charter mode the message\n * names Charter Season so the cap reads as the season's limit rather than the\n * platform's permanent shape; full mode stays neutral. `hint` is an optional\n * trailing sentence (e.g. \"Delete a file to add another.\").\n */\nexport const countCapReachedMessage = (\n  subject: string,\n  limit: number,\n  noun: string,\n  hint?: string,\n): string => {\n  const base = byMode(\n    `${subject} already has the Charter Season maximum of ${limit} ${noun} — caps expand when Charter Season ends.`,\n    `${subject} already has the maximum of ${limit} ${noun}.`,\n  );\n  return hint ? `${base} ${hint}` : base;\n};\n"]}

package/dist/doc-schemas/account-deletion.d.ts

@@ -43,6 +43,33 @@ export type ActiveDeletionRequestStatus = {
  *  classification above in union-declaration order — so it can also feed a Firestore
  *  `where('status', 'in', ACTIVE_DELETION_REQUEST_STATUSES)` query directly. */
 export declare const ACTIVE_DELETION_REQUEST_STATUSES: readonly ActiveDeletionRequestStatus[];
+/**
+ * MID-SCRUB = the destructive erasure has STARTED and has not finished. These statuses are
+ * neither active (nothing left to cancel or re-offer) nor terminal, so the scrub drain's
+ * due-request query never sees them again — which is exactly why a request stranded here needs
+ * its own recovery query (the stranded-erasure sweep over an expired `erasureLease`).
+ *
+ * Declared as an EXHAUSTIVE Record over the status union for the same reason the ACTIVE
+ * classification is: adding a lifecycle status must be a compile error here until that status is
+ * classified, rather than silently defaulting to "not mid-scrub" and dropping out of recovery.
+ */
+declare const DELETION_REQUEST_STATUS_IS_MID_SCRUB: {
+    readonly pending: false;
+    readonly cancelled: false;
+    readonly scrubbing: true;
+    readonly leased: true;
+    readonly parkedOnHold: false;
+    readonly completed: false;
+    readonly superseded: false;
+};
+/** The statuses classified MID-SCRUB above, as a literal union — derived, never restated. */
+export type MidScrubDeletionRequestStatus = {
+    [K in AccountDeletionRequestStatus]: (typeof DELETION_REQUEST_STATUS_IS_MID_SCRUB)[K] extends true ? K : never;
+}[AccountDeletionRequestStatus];
+/** The MID-SCRUB (erasure started, not finished) deletion-request statuses, projected from the
+ *  classification above in union-declaration order — so it can feed the stranded-erasure recovery
+ *  `where('status', 'in', MID_SCRUB_DELETION_REQUEST_STATUSES)` query directly. */
+export declare const MID_SCRUB_DELETION_REQUEST_STATUSES: readonly MidScrubDeletionRequestStatus[];
 /** True for an ACTIVE (open, still-cancellable) deletion request. Takes `unknown` because every
  *  caller reads the status off an unvalidated Firestore doc: anything outside the canonical active
  *  set — a terminal/mid-scrub status, an unrecognized value, a missing field — is false. */

package/dist/doc-schemas/account-deletion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-deletion.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/account-deletion.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gDAAgD;AAChD,eAAO,MAAM,kCAAkC;;;;;;;;EAU7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,iCAAiC;;;;;;;;CAQ2B,CAAC;AAEnE,0FAA0F;AAC1F,MAAM,MAAM,2BAA2B,GAAG;KACvC,CAAC,IAAI,4BAA4B,GAAG,CAAC,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK;CAC5G,CAAC,4BAA4B,CAAC,CAAC;AAEhC;;gFAEgF;AAChF,eAAO,MAAM,gCAAgC,EAAE,SAAS,2BAA2B,EAEmB,CAAC;AAEvG;;4FAE4F;AAC5F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAE9F;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;kBAmBtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,yEAAyE;AACzE,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+ChC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"account-deletion.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/account-deletion.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gDAAgD;AAChD,eAAO,MAAM,kCAAkC;;;;;;;;EAU7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,iCAAiC;;;;;;;;CAQ2B,CAAC;AAEnE,0FAA0F;AAC1F,MAAM,MAAM,2BAA2B,GAAG;KACvC,CAAC,IAAI,4BAA4B,GAAG,CAAC,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK;CAC5G,CAAC,4BAA4B,CAAC,CAAC;AAEhC;;gFAEgF;AAChF,eAAO,MAAM,gCAAgC,EAAE,SAAS,2BAA2B,EAEmB,CAAC;AAEvG;;;;;;;;;GASG;AACH,QAAA,MAAM,oCAAoC;;;;;;;;CAQwB,CAAC;AAEnE,6FAA6F;AAC7F,MAAM,MAAM,6BAA6B,GAAG;KACzC,CAAC,IAAI,4BAA4B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK;CAC/G,CAAC,4BAA4B,CAAC,CAAC;AAEhC;;mFAEmF;AACnF,eAAO,MAAM,mCAAmC,EAAE,SAAS,6BAA6B,EAEmB,CAAC;AAE5G;;4FAE4F;AAC5F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAE9F;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;kBAmBtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,yEAAyE;AACzE,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+ChC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/doc-schemas/account-deletion.js

@@ -67,6 +67,29 @@ const DELETION_REQUEST_STATUS_IS_ACTIVE = {
  *  classification above in union-declaration order — so it can also feed a Firestore
  *  `where('status', 'in', ACTIVE_DELETION_REQUEST_STATUSES)` query directly. */
 export const ACTIVE_DELETION_REQUEST_STATUSES = Object.keys(DELETION_REQUEST_STATUS_IS_ACTIVE).filter((status) => DELETION_REQUEST_STATUS_IS_ACTIVE[status]);
+/**
+ * MID-SCRUB = the destructive erasure has STARTED and has not finished. These statuses are
+ * neither active (nothing left to cancel or re-offer) nor terminal, so the scrub drain's
+ * due-request query never sees them again — which is exactly why a request stranded here needs
+ * its own recovery query (the stranded-erasure sweep over an expired `erasureLease`).
+ *
+ * Declared as an EXHAUSTIVE Record over the status union for the same reason the ACTIVE
+ * classification is: adding a lifecycle status must be a compile error here until that status is
+ * classified, rather than silently defaulting to "not mid-scrub" and dropping out of recovery.
+ */
+const DELETION_REQUEST_STATUS_IS_MID_SCRUB = {
+    pending: false,
+    cancelled: false,
+    scrubbing: true,
+    leased: true,
+    parkedOnHold: false,
+    completed: false,
+    superseded: false,
+};
+/** The MID-SCRUB (erasure started, not finished) deletion-request statuses, projected from the
+ *  classification above in union-declaration order — so it can feed the stranded-erasure recovery
+ *  `where('status', 'in', MID_SCRUB_DELETION_REQUEST_STATUSES)` query directly. */
+export const MID_SCRUB_DELETION_REQUEST_STATUSES = Object.keys(DELETION_REQUEST_STATUS_IS_MID_SCRUB).filter((status) => DELETION_REQUEST_STATUS_IS_MID_SCRUB[status]);
 /** True for an ACTIVE (open, still-cancellable) deletion request. Takes `unknown` because every
  *  caller reads the status off an unvalidated Firestore doc: anything outside the canonical active
  *  set — a terminal/mid-scrub status, an unrecognized value, a missing field — is false. */

package/dist/doc-schemas/account-deletion.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-deletion.js","sourceRoot":"","sources":["../../src/doc-schemas/account-deletion.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,mEAAmE;AACnE,iFAAiF;AACjF,qEAAqE;AACrE,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,6CAA6C;AAC7C,EAAE;AACF,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AAEzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gDAAgD;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC;IACvD,SAAS,EAAE,4DAA4D;IACvE,WAAW,EAAE,4DAA4D;IACzE,WAAW,EAAE,8DAA8D;IAC3E,gFAAgF;IAChF,wFAAwF;IACxF,QAAQ;IACR,cAAc,EAAE,mEAAmE;IACnF,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,gEAAgE;CAC/E,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,iCAAiC,GAAG;IACxC,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;CAC+C,CAAC;AAOnE;;gFAEgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAC9C,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyC,EAAE,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEvG;;4FAE4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAK,gCAAsD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN;yFACqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC;wFACoF;IACpF,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB;2FACuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,4FAA4F;IAC5F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,8FAA8F;IAC9F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,yEAAyE;AACzE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,kCAAkC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,yDAAyD;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,qFAAqF;IACrF,mFAAmF;IACnF,EAAE;IACF,qFAAqF;IACrF,oFAAoF;IACpF,yFAAyF;IACzF,uFAAuF;IACvF,kFAAkF;IAClF,sFAAsF;IACtF,4EAA4E;IAC5E,EAAE;IACF,uFAAuF;IACvF,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,oDAAoD;IACpD,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,wFAAwF;IACxF,sFAAsF;IACtF,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gFAAgF;IAChF,mEAAmE;IACnE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,+EAA+E;IAC/E,gFAAgF;IAChF,YAAY,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAC","sourcesContent":["// Account-deletion / GDPR-erasure request SCHEMA — `accountDeletionRequests/{uid}`.\n//\n// N3 data-deletion flow. A user clicks \"delete account\" on their profile → a\n// request doc is created (one per user, doc id = uid, create-if-absent) and the\n// account is immediately deactivated/locked out. The request runs a 30-day grace\n// window (logging back in CANCELS it). After the window, the scheduled scrub\n// worker checks for any BLOCKING safety hold over the user's data:\n//   - no hold  → anonymize-in-place (scrub PII, release reserved name, anonymize\n//                chat history, tombstone memberships) → `completed`.\n//   - hold     → `parkedOnHold` (re-checked periodically): resumes + `completed`\n//                once cleared, or → `superseded` if it becomes a ban-for-cause /\n//                evidence-preservation outcome (the erasure is overridden and the\n//                data retained as evidence).\n//\n// The scrub itself deletes/anonymizes data across many collections; this doc is\n// ONLY the request lifecycle + the worker's resumable cursor.\n//\n// [C-02] Erasure-vs-safety-hold race fence. The destructive scrub and a safety\n// hold landing mid-scrub race over the SAME account. The fence is an epoch LEASE\n// stamped on THIS doc (`erasureLease`): the scrub transactionally acquires the\n// lease ONLY when the account owns no active blocking hold; every destructive\n// write re-checks the SAME epoch in its own transaction; and `commitSafetyHold`\n// (the SINGLE shared hold authority) reads this doc's live lease and PARKS the\n// erasure (revoking the epoch) before committing a hold against a leased account.\n// A revoked epoch makes every still-running destructive step a no-op. The lease\n// lives HERE — not a parallel safety-only deletion subsystem — so the one shared\n// hold/destructive contract owns the fence (engineering-rules ARCH-001).\n\nimport { z } from 'zod';\n\n/** Lifecycle of an account-deletion request. */\nexport const AccountDeletionRequestStatusSchema = z.enum([\n  'pending', // grace window running; user can still cancel by logging in\n  'cancelled', // user cancelled (logged back in) before the window elapsed\n  'scrubbing', // the scrub worker has started the anonymize-in-place erasure\n  // [C-02] the scrub holds an ACTIVE erasure lease and is mid-destruction. A hold\n  // landing now revokes the lease (→ parkedOnHold) so the scrub aborts deterministically.\n  'leased',\n  'parkedOnHold', // erasure deferred — a blocking safety hold covers the user's data\n  'completed', // erasure finished\n  'superseded', // overridden by a ban-for-cause / evidence-preservation outcome\n]);\nexport type AccountDeletionRequestStatus = z.infer<typeof AccountDeletionRequestStatusSchema>;\n\n/**\n * ACTIVE = the request is still OPEN and still cancellable. This is the one predicate the\n * lifecycle's enforcement points share — `requestAccountDeletion`'s idempotent re-return of the\n * existing schedule, `cancelAccountDeletion`'s cancel gate, the scrub worker's due-request query,\n * and the client's live own-request read — each of which previously restated\n * `status === 'pending' || status === 'parkedOnHold'` locally (ARCH-102).\n *\n * Declared as an EXHAUSTIVE Record over the status union, not as a subset array: a subset array\n * only catches a REMOVED member, whereas adding a lifecycle status must be a compile error here\n * until that status is classified. A new status silently defaulting to \"not active\" is exactly the\n * drift this classification exists to prevent.\n *\n * `scrubbing` / `leased` are deliberately NOT active — the destructive erasure has already begun,\n * so there is no schedule left to re-offer and nothing left to cancel. `cancelled` / `completed` /\n * `superseded` are terminal.\n */\nconst DELETION_REQUEST_STATUS_IS_ACTIVE = {\n  pending: true,\n  cancelled: false,\n  scrubbing: false,\n  leased: false,\n  parkedOnHold: true,\n  completed: false,\n  superseded: false,\n} as const satisfies Record<AccountDeletionRequestStatus, boolean>;\n\n/** The statuses classified ACTIVE above, as a literal union — derived, never restated. */\nexport type ActiveDeletionRequestStatus = {\n  [K in AccountDeletionRequestStatus]: (typeof DELETION_REQUEST_STATUS_IS_ACTIVE)[K] extends true ? K : never;\n}[AccountDeletionRequestStatus];\n\n/** The ACTIVE (open, still-cancellable) deletion-request statuses, projected from the\n *  classification above in union-declaration order — so it can also feed a Firestore\n *  `where('status', 'in', ACTIVE_DELETION_REQUEST_STATUSES)` query directly. */\nexport const ACTIVE_DELETION_REQUEST_STATUSES: readonly ActiveDeletionRequestStatus[] = (\n  Object.keys(DELETION_REQUEST_STATUS_IS_ACTIVE) as AccountDeletionRequestStatus[]\n).filter((status): status is ActiveDeletionRequestStatus => DELETION_REQUEST_STATUS_IS_ACTIVE[status]);\n\n/** True for an ACTIVE (open, still-cancellable) deletion request. Takes `unknown` because every\n *  caller reads the status off an unvalidated Firestore doc: anything outside the canonical active\n *  set — a terminal/mid-scrub status, an unrecognized value, a missing field — is false. */\nexport function isActiveDeletionRequest(status: unknown): status is ActiveDeletionRequestStatus {\n  return typeof status === 'string' && (ACTIVE_DELETION_REQUEST_STATUSES as readonly string[]).includes(status);\n}\n\n/**\n * [C-02] The erasure LEASE / epoch token — the race fence between the destructive\n * scrub and a mid-scrub safety hold.\n *\n * The scrub acquires this transactionally ONLY when the account owns no active\n * blocking hold; it then re-verifies the SAME `epoch` inside every destructive\n * Firestore transaction and immediately before AND after each non-transactional\n * external delete (Auth/Storage). `commitSafetyHold` reads this lease and, when it\n * is `active`, REVOKES it (sets `revokedByHold`/`revokedAt`, status → `parkedOnHold`)\n * in the SAME transaction that commits the hold — so a hold deterministically wins\n * the race and the scrub, finding its epoch revoked on the next check, aborts into\n * a recoverable parked state without finishing the destruction.\n */\nexport const ErasureLeaseV1Schema = z\n  .object({\n    /** Monotonic acquisition token. The \"live lease\" identity: every destructive step\n     *  re-reads the doc and proceeds ONLY if this still equals the epoch it acquired. */\n    epoch: z.number().int().nonnegative(),\n    /** 'active' = the scrub holds the lease; 'revoked' = a hold reclaimed it mid-scrub\n     *  (the scrub must abort); 'released' = the scrub finished/relinquished cleanly. */\n    state: z.enum(['active', 'revoked', 'released']),\n    acquiredAt: z.number(),\n    /** Staleness boundary. A still-`active` lease past this is presumed crashed and may\n     *  be safely superseded by a fresh acquisition (idempotent retry / crash recovery). */\n    expiresAt: z.number(),\n    /** Last destructive phase the scrub reached under this epoch (observability + recovery). */\n    phase: z.string().optional(),\n    /** Set when a hold revoked the lease — the caseId/refId of the winning hold (audit trail). */\n    revokedByHoldRefId: z.string().min(1).optional(),\n    revokedAt: z.number().optional(),\n    releasedAt: z.number().optional(),\n  })\n  .strict();\nexport type ErasureLeaseV1 = z.infer<typeof ErasureLeaseV1Schema>;\n\n/** `accountDeletionRequests/{uid}` — one per user; doc id IS the uid. */\nexport const AccountDeletionRequestV1Schema = z\n  .object({\n    schemaVersion: z.literal(1),\n    uid: z.string().min(1),\n    status: AccountDeletionRequestStatusSchema,\n    requestedAt: z.number(),\n    // requestedAt + graceDays; the scrub worker queries status='pending' AND\n    // scheduledScrubAt <= now (composite index, ttt-prod firestore.indexes.json).\n    scheduledScrubAt: z.number(),\n    graceDays: z.number(), // recorded for the audit/compliance trail (30 at launch)\n    cancelledAt: z.number().optional(),\n    // Token-revocation obligation — the request doc IS the durable ledger (BACKEND-302 /\n    // QUALITY-104); no separate queue, worker collection, or dead-letter state exists.\n    //\n    // `tokenRevocationNextAttemptAt` is the DRAIN KEY: present ⇔ the revocation is still\n    // OWED. Set to `now` when the request is created; the scheduled worker's revocation\n    // drain queries `tokenRevocationNextAttemptAt <= now` (single-field range — deliberately\n    // no status clause and no composite index; every terminal transition clears the field,\n    // and the drain clears it on any non-active doc it meets, so \"owed\" means exactly\n    // \"field present\"). A failed attempt moves it forward (bounded backoff); a successful\n    // revoke DELETES it and stamps `tokensRevokedAt` in the same fenced update.\n    //\n    // The stamp is GENERATION-FENCED on `requestedAt`: the revoker snapshots `requestedAt`\n    // before calling Auth and stamps transactionally only if the doc still carries that\n    // value with an active status — a delayed revoke from a cancelled request must never\n    // mark a newly reopened request satisfied. Revocation is idempotent, so a skipped or\n    // lost stamp merely causes one redundant re-revoke.\n    tokenRevocationNextAttemptAt: z.number().optional(),\n    // When the user's refresh tokens were revoked for THIS request (\"account deletion signs\n    // the user out of every session everywhere\"). The callable's immediate revoke is only\n    // the accelerator (BACKEND-301); the worker drain above is the guarantee.\n    tokensRevokedAt: z.number().optional(),\n    scrubStartedAt: z.number().optional(),\n    // Why a scrub is parked (e.g. 'blocking safety hold over user data') — kept for\n    // the GDPR compliance record so a deferred erasure is explainable.\n    parkedReason: z.string().optional(),\n    parkedAt: z.number().optional(),\n    lastHoldCheckAt: z.number().optional(),\n    completedAt: z.number().optional(),\n    supersededAt: z.number().optional(),\n    supersededReason: z.string().optional(),\n    // [C-02] the erasure-vs-hold race fence (see ErasureLeaseV1). Absent until the\n    // scrub first acquires the lease; thereafter it carries the live epoch + state.\n    erasureLease: ErasureLeaseV1Schema.optional(),\n    createdAt: z.number(),\n    updatedAt: z.number(),\n  })\n  .strict();\nexport type AccountDeletionRequestV1 = z.infer<typeof AccountDeletionRequestV1Schema>;\n"]}
+{"version":3,"file":"account-deletion.js","sourceRoot":"","sources":["../../src/doc-schemas/account-deletion.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,mEAAmE;AACnE,iFAAiF;AACjF,qEAAqE;AACrE,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,6CAA6C;AAC7C,EAAE;AACF,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AAEzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gDAAgD;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC;IACvD,SAAS,EAAE,4DAA4D;IACvE,WAAW,EAAE,4DAA4D;IACzE,WAAW,EAAE,8DAA8D;IAC3E,gFAAgF;IAChF,wFAAwF;IACxF,QAAQ;IACR,cAAc,EAAE,mEAAmE;IACnF,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,gEAAgE;CAC/E,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,iCAAiC,GAAG;IACxC,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;CAC+C,CAAC;AAOnE;;gFAEgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAC9C,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyC,EAAE,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEvG;;;;;;;;;GASG;AACH,MAAM,oCAAoC,GAAG;IAC3C,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;CAC+C,CAAC;AAOnE;;mFAEmF;AACnF,MAAM,CAAC,MAAM,mCAAmC,GAC9C,MAAM,CAAC,IAAI,CAAC,oCAAoC,CACjD,CAAC,MAAM,CAAC,CAAC,MAAM,EAA2C,EAAE,CAAC,oCAAoC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5G;;4FAE4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAK,gCAAsD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN;yFACqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC;wFACoF;IACpF,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB;2FACuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,4FAA4F;IAC5F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,8FAA8F;IAC9F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,yEAAyE;AACzE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,kCAAkC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,yDAAyD;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,qFAAqF;IACrF,mFAAmF;IACnF,EAAE;IACF,qFAAqF;IACrF,oFAAoF;IACpF,yFAAyF;IACzF,uFAAuF;IACvF,kFAAkF;IAClF,sFAAsF;IACtF,4EAA4E;IAC5E,EAAE;IACF,uFAAuF;IACvF,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,oDAAoD;IACpD,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,wFAAwF;IACxF,sFAAsF;IACtF,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gFAAgF;IAChF,mEAAmE;IACnE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,+EAA+E;IAC/E,gFAAgF;IAChF,YAAY,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAC","sourcesContent":["// Account-deletion / GDPR-erasure request SCHEMA — `accountDeletionRequests/{uid}`.\n//\n// N3 data-deletion flow. A user clicks \"delete account\" on their profile → a\n// request doc is created (one per user, doc id = uid, create-if-absent) and the\n// account is immediately deactivated/locked out. The request runs a 30-day grace\n// window (logging back in CANCELS it). After the window, the scheduled scrub\n// worker checks for any BLOCKING safety hold over the user's data:\n//   - no hold  → anonymize-in-place (scrub PII, release reserved name, anonymize\n//                chat history, tombstone memberships) → `completed`.\n//   - hold     → `parkedOnHold` (re-checked periodically): resumes + `completed`\n//                once cleared, or → `superseded` if it becomes a ban-for-cause /\n//                evidence-preservation outcome (the erasure is overridden and the\n//                data retained as evidence).\n//\n// The scrub itself deletes/anonymizes data across many collections; this doc is\n// ONLY the request lifecycle + the worker's resumable cursor.\n//\n// [C-02] Erasure-vs-safety-hold race fence. The destructive scrub and a safety\n// hold landing mid-scrub race over the SAME account. The fence is an epoch LEASE\n// stamped on THIS doc (`erasureLease`): the scrub transactionally acquires the\n// lease ONLY when the account owns no active blocking hold; every destructive\n// write re-checks the SAME epoch in its own transaction; and `commitSafetyHold`\n// (the SINGLE shared hold authority) reads this doc's live lease and PARKS the\n// erasure (revoking the epoch) before committing a hold against a leased account.\n// A revoked epoch makes every still-running destructive step a no-op. The lease\n// lives HERE — not a parallel safety-only deletion subsystem — so the one shared\n// hold/destructive contract owns the fence (engineering-rules ARCH-001).\n\nimport { z } from 'zod';\n\n/** Lifecycle of an account-deletion request. */\nexport const AccountDeletionRequestStatusSchema = z.enum([\n  'pending', // grace window running; user can still cancel by logging in\n  'cancelled', // user cancelled (logged back in) before the window elapsed\n  'scrubbing', // the scrub worker has started the anonymize-in-place erasure\n  // [C-02] the scrub holds an ACTIVE erasure lease and is mid-destruction. A hold\n  // landing now revokes the lease (→ parkedOnHold) so the scrub aborts deterministically.\n  'leased',\n  'parkedOnHold', // erasure deferred — a blocking safety hold covers the user's data\n  'completed', // erasure finished\n  'superseded', // overridden by a ban-for-cause / evidence-preservation outcome\n]);\nexport type AccountDeletionRequestStatus = z.infer<typeof AccountDeletionRequestStatusSchema>;\n\n/**\n * ACTIVE = the request is still OPEN and still cancellable. This is the one predicate the\n * lifecycle's enforcement points share — `requestAccountDeletion`'s idempotent re-return of the\n * existing schedule, `cancelAccountDeletion`'s cancel gate, the scrub worker's due-request query,\n * and the client's live own-request read — each of which previously restated\n * `status === 'pending' || status === 'parkedOnHold'` locally (ARCH-102).\n *\n * Declared as an EXHAUSTIVE Record over the status union, not as a subset array: a subset array\n * only catches a REMOVED member, whereas adding a lifecycle status must be a compile error here\n * until that status is classified. A new status silently defaulting to \"not active\" is exactly the\n * drift this classification exists to prevent.\n *\n * `scrubbing` / `leased` are deliberately NOT active — the destructive erasure has already begun,\n * so there is no schedule left to re-offer and nothing left to cancel. `cancelled` / `completed` /\n * `superseded` are terminal.\n */\nconst DELETION_REQUEST_STATUS_IS_ACTIVE = {\n  pending: true,\n  cancelled: false,\n  scrubbing: false,\n  leased: false,\n  parkedOnHold: true,\n  completed: false,\n  superseded: false,\n} as const satisfies Record<AccountDeletionRequestStatus, boolean>;\n\n/** The statuses classified ACTIVE above, as a literal union — derived, never restated. */\nexport type ActiveDeletionRequestStatus = {\n  [K in AccountDeletionRequestStatus]: (typeof DELETION_REQUEST_STATUS_IS_ACTIVE)[K] extends true ? K : never;\n}[AccountDeletionRequestStatus];\n\n/** The ACTIVE (open, still-cancellable) deletion-request statuses, projected from the\n *  classification above in union-declaration order — so it can also feed a Firestore\n *  `where('status', 'in', ACTIVE_DELETION_REQUEST_STATUSES)` query directly. */\nexport const ACTIVE_DELETION_REQUEST_STATUSES: readonly ActiveDeletionRequestStatus[] = (\n  Object.keys(DELETION_REQUEST_STATUS_IS_ACTIVE) as AccountDeletionRequestStatus[]\n).filter((status): status is ActiveDeletionRequestStatus => DELETION_REQUEST_STATUS_IS_ACTIVE[status]);\n\n/**\n * MID-SCRUB = the destructive erasure has STARTED and has not finished. These statuses are\n * neither active (nothing left to cancel or re-offer) nor terminal, so the scrub drain's\n * due-request query never sees them again — which is exactly why a request stranded here needs\n * its own recovery query (the stranded-erasure sweep over an expired `erasureLease`).\n *\n * Declared as an EXHAUSTIVE Record over the status union for the same reason the ACTIVE\n * classification is: adding a lifecycle status must be a compile error here until that status is\n * classified, rather than silently defaulting to \"not mid-scrub\" and dropping out of recovery.\n */\nconst DELETION_REQUEST_STATUS_IS_MID_SCRUB = {\n  pending: false,\n  cancelled: false,\n  scrubbing: true,\n  leased: true,\n  parkedOnHold: false,\n  completed: false,\n  superseded: false,\n} as const satisfies Record<AccountDeletionRequestStatus, boolean>;\n\n/** The statuses classified MID-SCRUB above, as a literal union — derived, never restated. */\nexport type MidScrubDeletionRequestStatus = {\n  [K in AccountDeletionRequestStatus]: (typeof DELETION_REQUEST_STATUS_IS_MID_SCRUB)[K] extends true ? K : never;\n}[AccountDeletionRequestStatus];\n\n/** The MID-SCRUB (erasure started, not finished) deletion-request statuses, projected from the\n *  classification above in union-declaration order — so it can feed the stranded-erasure recovery\n *  `where('status', 'in', MID_SCRUB_DELETION_REQUEST_STATUSES)` query directly. */\nexport const MID_SCRUB_DELETION_REQUEST_STATUSES: readonly MidScrubDeletionRequestStatus[] = (\n  Object.keys(DELETION_REQUEST_STATUS_IS_MID_SCRUB) as AccountDeletionRequestStatus[]\n).filter((status): status is MidScrubDeletionRequestStatus => DELETION_REQUEST_STATUS_IS_MID_SCRUB[status]);\n\n/** True for an ACTIVE (open, still-cancellable) deletion request. Takes `unknown` because every\n *  caller reads the status off an unvalidated Firestore doc: anything outside the canonical active\n *  set — a terminal/mid-scrub status, an unrecognized value, a missing field — is false. */\nexport function isActiveDeletionRequest(status: unknown): status is ActiveDeletionRequestStatus {\n  return typeof status === 'string' && (ACTIVE_DELETION_REQUEST_STATUSES as readonly string[]).includes(status);\n}\n\n/**\n * [C-02] The erasure LEASE / epoch token — the race fence between the destructive\n * scrub and a mid-scrub safety hold.\n *\n * The scrub acquires this transactionally ONLY when the account owns no active\n * blocking hold; it then re-verifies the SAME `epoch` inside every destructive\n * Firestore transaction and immediately before AND after each non-transactional\n * external delete (Auth/Storage). `commitSafetyHold` reads this lease and, when it\n * is `active`, REVOKES it (sets `revokedByHold`/`revokedAt`, status → `parkedOnHold`)\n * in the SAME transaction that commits the hold — so a hold deterministically wins\n * the race and the scrub, finding its epoch revoked on the next check, aborts into\n * a recoverable parked state without finishing the destruction.\n */\nexport const ErasureLeaseV1Schema = z\n  .object({\n    /** Monotonic acquisition token. The \"live lease\" identity: every destructive step\n     *  re-reads the doc and proceeds ONLY if this still equals the epoch it acquired. */\n    epoch: z.number().int().nonnegative(),\n    /** 'active' = the scrub holds the lease; 'revoked' = a hold reclaimed it mid-scrub\n     *  (the scrub must abort); 'released' = the scrub finished/relinquished cleanly. */\n    state: z.enum(['active', 'revoked', 'released']),\n    acquiredAt: z.number(),\n    /** Staleness boundary. A still-`active` lease past this is presumed crashed and may\n     *  be safely superseded by a fresh acquisition (idempotent retry / crash recovery). */\n    expiresAt: z.number(),\n    /** Last destructive phase the scrub reached under this epoch (observability + recovery). */\n    phase: z.string().optional(),\n    /** Set when a hold revoked the lease — the caseId/refId of the winning hold (audit trail). */\n    revokedByHoldRefId: z.string().min(1).optional(),\n    revokedAt: z.number().optional(),\n    releasedAt: z.number().optional(),\n  })\n  .strict();\nexport type ErasureLeaseV1 = z.infer<typeof ErasureLeaseV1Schema>;\n\n/** `accountDeletionRequests/{uid}` — one per user; doc id IS the uid. */\nexport const AccountDeletionRequestV1Schema = z\n  .object({\n    schemaVersion: z.literal(1),\n    uid: z.string().min(1),\n    status: AccountDeletionRequestStatusSchema,\n    requestedAt: z.number(),\n    // requestedAt + graceDays; the scrub worker queries status='pending' AND\n    // scheduledScrubAt <= now (composite index, ttt-prod firestore.indexes.json).\n    scheduledScrubAt: z.number(),\n    graceDays: z.number(), // recorded for the audit/compliance trail (30 at launch)\n    cancelledAt: z.number().optional(),\n    // Token-revocation obligation — the request doc IS the durable ledger (BACKEND-302 /\n    // QUALITY-104); no separate queue, worker collection, or dead-letter state exists.\n    //\n    // `tokenRevocationNextAttemptAt` is the DRAIN KEY: present ⇔ the revocation is still\n    // OWED. Set to `now` when the request is created; the scheduled worker's revocation\n    // drain queries `tokenRevocationNextAttemptAt <= now` (single-field range — deliberately\n    // no status clause and no composite index; every terminal transition clears the field,\n    // and the drain clears it on any non-active doc it meets, so \"owed\" means exactly\n    // \"field present\"). A failed attempt moves it forward (bounded backoff); a successful\n    // revoke DELETES it and stamps `tokensRevokedAt` in the same fenced update.\n    //\n    // The stamp is GENERATION-FENCED on `requestedAt`: the revoker snapshots `requestedAt`\n    // before calling Auth and stamps transactionally only if the doc still carries that\n    // value with an active status — a delayed revoke from a cancelled request must never\n    // mark a newly reopened request satisfied. Revocation is idempotent, so a skipped or\n    // lost stamp merely causes one redundant re-revoke.\n    tokenRevocationNextAttemptAt: z.number().optional(),\n    // When the user's refresh tokens were revoked for THIS request (\"account deletion signs\n    // the user out of every session everywhere\"). The callable's immediate revoke is only\n    // the accelerator (BACKEND-301); the worker drain above is the guarantee.\n    tokensRevokedAt: z.number().optional(),\n    scrubStartedAt: z.number().optional(),\n    // Why a scrub is parked (e.g. 'blocking safety hold over user data') — kept for\n    // the GDPR compliance record so a deferred erasure is explainable.\n    parkedReason: z.string().optional(),\n    parkedAt: z.number().optional(),\n    lastHoldCheckAt: z.number().optional(),\n    completedAt: z.number().optional(),\n    supersededAt: z.number().optional(),\n    supersededReason: z.string().optional(),\n    // [C-02] the erasure-vs-hold race fence (see ErasureLeaseV1). Absent until the\n    // scrub first acquires the lease; thereafter it carries the live epoch + state.\n    erasureLease: ErasureLeaseV1Schema.optional(),\n    createdAt: z.number(),\n    updatedAt: z.number(),\n  })\n  .strict();\nexport type AccountDeletionRequestV1 = z.infer<typeof AccountDeletionRequestV1Schema>;\n"]}

package/dist/doc-schemas/backend-state.d.ts

@@ -21,6 +21,29 @@ export declare const SafetyReconcilerCursorSchema: z.ZodObject<{
     updatedAt: z.ZodNumber;
 }, z.core.$strip>;
 export type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;
+export declare const SweepStateSchema: z.ZodObject<{
+    reaperLastRunAt: z.ZodOptional<z.ZodNumber>;
+    reaperCursorPath: z.ZodOptional<z.ZodString>;
+    fullScanLastRunAt: z.ZodOptional<z.ZodNumber>;
+    updatedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type SweepState = z.infer<typeof SweepStateSchema>;
+export declare const NcmecCompletionProofRecordV1Schema: z.ZodObject<{
+    caseId: z.ZodString;
+    submissionId: z.ZodString;
+    channel: z.ZodEnum<{
+        manualPortal: "manualPortal";
+    }>;
+    proofType: z.ZodEnum<{
+        portalConfirmation: "portalConfirmation";
+    }>;
+    portalReceiptArtifactId: z.ZodString;
+    proofText: z.ZodOptional<z.ZodString>;
+    ncmecReportId: z.ZodString;
+    recordedByUid: z.ZodString;
+    recordedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type NcmecCompletionProofRecordV1 = z.infer<typeof NcmecCompletionProofRecordV1Schema>;
 export declare const NcmecPortalReceiptArtifactV1Schema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     caseId: z.ZodString;

package/dist/doc-schemas/backend-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-state.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAOhF,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAgB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,eAAO,MAAM,mCAAmC;;;;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}
+{"version":3,"file":"backend-state.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAOhF,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF,eAAO,MAAM,gBAAgB;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAU1D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;iBAc7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAS9F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAgB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,eAAO,MAAM,mCAAmC;;;;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/doc-schemas/backend-state.js

@@ -4,6 +4,7 @@
 // the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and
 // the drift-check read. Types are inferred via z.infer.
 import { z } from 'zod';
+import { ChildSafetyNcmecCompletionChannelSchema, ChildSafetyNcmecCompletionProofTypeSchema, } from './safety/case.js';
 // _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.
 // `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has POSITIVELY cleared
 // (candidate resolved referenced / reaped / already-deleted), so each pass resumes past
@@ -37,6 +38,46 @@ export const SafetyReconcilerCursorSchema = z.object({
     afterValue: z.number().optional(),
     updatedAt: z.number(),
 });
+// sweepState/{sweepName} — durable cadence + cursor state for one scheduled user sweep. One doc
+// per sweep name; the fields a given sweep uses are the ones it declares, so every field except
+// `updatedAt` is optional. `orphanRegistrationCleanup` carries all three (the ~daily privateData
+// reaper's last completed pass + its rolling page cursor, and the ~weekly `listUsers()` scan);
+// `reconcileAccountStatus` carries only `fullScanLastRunAt`. The stamps are wall-clock so a
+// container recycle cannot reset the cadence.
+// (functions/src/users/orphanRegistrationCleanup.ts, functions/src/users/reconcileAccountStatus.ts)
+export const SweepStateSchema = z.object({
+    /** Wall-clock ms the last COMPLETED privateData-reaper pass finished (absent = never). */
+    reaperLastRunAt: z.number().optional(),
+    /** Full document path of the last `privateData` doc the reaper examined. Empty/absent means no
+     *  pass is in flight; a non-empty value means one is mid-scan and must continue. */
+    reaperCursorPath: z.string().optional(),
+    /** Wall-clock ms the last full `listUsers()` scan ran (absent = never). */
+    fullScanLastRunAt: z.number().optional(),
+    updatedAt: z.number(),
+});
+// childSafetyCases/{caseId}/ncmecSubmissions/{submissionId}/ncmecCompletionProof/record —
+// [H-05] the IMMUTABLE record of a verified manual-portal completion. Written create-if-absent in
+// the SAME transaction as the submission's `completed` transition, so a submission can never reach
+// `completed` without a bound proof record; a re-completion keeps the original. The submission's
+// `completionProofRef` stores this doc's path, never an operator free-text string.
+// [Q13/H-06] `portalReceiptArtifactId` binds the proof to a verified NcmecPortalReceiptArtifactV1
+// on the same (caseId, submissionId) — an arbitrary operator string is never accepted.
+// (functions/src/safety/ncmecReporting.ts)
+export const NcmecCompletionProofRecordV1Schema = z.object({
+    caseId: z.string(),
+    submissionId: z.string(),
+    channel: ChildSafetyNcmecCompletionChannelSchema,
+    proofType: ChildSafetyNcmecCompletionProofTypeSchema,
+    /** Id of the verified portal-receipt artifact this completion is bound to. */
+    portalReceiptArtifactId: z.string(),
+    /** Optional operator free-text note about the confirmation. */
+    proofText: z.string().optional(),
+    /** The NCMEC-assigned report id — REQUIRED. The number IS the proof; there is no
+     *  "filed, number pending" grace. */
+    ncmecReportId: z.string(),
+    recordedByUid: z.string(),
+    recordedAt: z.number(),
+});
 // childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable
 // record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the
 // restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified

package/dist/doc-schemas/backend-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-state.js","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4FAA4F;AAC5F,6FAA6F;AAC7F,wFAAwF;AACxF,mFAAmF;AACnF,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,6FAA6F;AAC7F,yFAAyF;AACzF,6FAA6F;AAC7F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,0FAA0F;AAC1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,sEAAsE;IACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC","sourcesContent":["// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no\n// client ever reads or writes (firestore.rules denies client access to every path below).\n// They are registered here for the same reason every other stored shape is: ARCH-104 gives\n// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and\n// the drift-check read. Types are inferred via z.infer.\n\nimport { z } from 'zod';\n\n// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.\n// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has POSITIVELY cleared\n// (candidate resolved referenced / reaped / already-deleted), so each pass resumes past\n// permanently-live Hall assets instead of re-reading the same oldest page forever.\n// (functions/src/media/reapOrphanedHallMediaCopies.ts)\nexport const HallMediaReaperCursorSchema = z.object({\n  createdAtCursor: z.number(),\n  updatedAt: z.number(),\n});\nexport type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;\n\n// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret\n// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by\n// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes\n// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by\n// the step-up window. (functions/src/safety/operatorStepUp.ts)\nexport const OperatorStepUpSchema = z.object({\n  secret: z.string(),\n  status: z.enum(['pending', 'active']),\n  /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */\n  grantExpiresAt: z.number().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  /** Set when enrollment is confirmed (status flips to 'active'). */\n  confirmedAt: z.number().optional(),\n});\nexport type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;\n\n// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler\n// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a\n// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so\n// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)\nexport const SafetyReconcilerCursorSchema = z.object({\n  /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */\n  afterValue: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;\n\n// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable\n// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the\n// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified\n// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never\n// proof. Written create-only, never overwritten, and carries the server-verified storage facts\n// (generation + sha256) so a later transactional verification can confirm the same object\n// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)\nexport const NcmecPortalReceiptArtifactV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  submissionId: z.string(),\n  /** Key of the object in the restricted evidence vault bucket. */\n  evidenceVaultKey: z.string(),\n  /** GCS object generation at capture time (immutable identity peg). */\n  objectGeneration: z.string(),\n  /** SHA-256 hex digest of the object bytes at capture time. */\n  sha256: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n  capturedAt: z.number(),\n  registeredByUid: z.string(),\n  /** Optional operator free-text describing what the artifact is. */\n  description: z.string().optional(),\n});\nexport type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;\n\n// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that\n// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction\n// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the\n// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each\n// correction is a fresh id — a later correction is an additional record, never a mutation of\n// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)\nexport const NcmecPortalCorrectionRecordV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  /** The portal-assigned NCMEC report id being corrected. */\n  ncmecReportId: z.string(),\n  /** When the operator filed the correction on the portal (operator-supplied). */\n  correctionFiledAt: z.number(),\n  reason: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;\n"]}
+{"version":3,"file":"backend-state.js","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uCAAuC,EACvC,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,6FAA6F;AAC7F,wFAAwF;AACxF,mFAAmF;AACnF,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,6FAA6F;AAC7F,yFAAyF;AACzF,6FAA6F;AAC7F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,8CAA8C;AAC9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC;wFACoF;IACpF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mFAAmF;AACnF,kGAAkG;AAClG,uFAAuF;AACvF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,uCAAuC;IAChD,SAAS,EAAE,yCAAyC;IACpD,8EAA8E;IAC9E,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;yCACqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,0FAA0F;AAC1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,sEAAsE;IACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC","sourcesContent":["// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no\n// client ever reads or writes (firestore.rules denies client access to every path below).\n// They are registered here for the same reason every other stored shape is: ARCH-104 gives\n// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and\n// the drift-check read. Types are inferred via z.infer.\n\nimport { z } from 'zod';\nimport {\n  ChildSafetyNcmecCompletionChannelSchema,\n  ChildSafetyNcmecCompletionProofTypeSchema,\n} from './safety/case.js';\n\n// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.\n// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has POSITIVELY cleared\n// (candidate resolved referenced / reaped / already-deleted), so each pass resumes past\n// permanently-live Hall assets instead of re-reading the same oldest page forever.\n// (functions/src/media/reapOrphanedHallMediaCopies.ts)\nexport const HallMediaReaperCursorSchema = z.object({\n  createdAtCursor: z.number(),\n  updatedAt: z.number(),\n});\nexport type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;\n\n// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret\n// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by\n// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes\n// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by\n// the step-up window. (functions/src/safety/operatorStepUp.ts)\nexport const OperatorStepUpSchema = z.object({\n  secret: z.string(),\n  status: z.enum(['pending', 'active']),\n  /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */\n  grantExpiresAt: z.number().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  /** Set when enrollment is confirmed (status flips to 'active'). */\n  confirmedAt: z.number().optional(),\n});\nexport type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;\n\n// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler\n// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a\n// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so\n// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)\nexport const SafetyReconcilerCursorSchema = z.object({\n  /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */\n  afterValue: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;\n\n// sweepState/{sweepName} — durable cadence + cursor state for one scheduled user sweep. One doc\n// per sweep name; the fields a given sweep uses are the ones it declares, so every field except\n// `updatedAt` is optional. `orphanRegistrationCleanup` carries all three (the ~daily privateData\n// reaper's last completed pass + its rolling page cursor, and the ~weekly `listUsers()` scan);\n// `reconcileAccountStatus` carries only `fullScanLastRunAt`. The stamps are wall-clock so a\n// container recycle cannot reset the cadence.\n// (functions/src/users/orphanRegistrationCleanup.ts, functions/src/users/reconcileAccountStatus.ts)\nexport const SweepStateSchema = z.object({\n  /** Wall-clock ms the last COMPLETED privateData-reaper pass finished (absent = never). */\n  reaperLastRunAt: z.number().optional(),\n  /** Full document path of the last `privateData` doc the reaper examined. Empty/absent means no\n   *  pass is in flight; a non-empty value means one is mid-scan and must continue. */\n  reaperCursorPath: z.string().optional(),\n  /** Wall-clock ms the last full `listUsers()` scan ran (absent = never). */\n  fullScanLastRunAt: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SweepState = z.infer<typeof SweepStateSchema>;\n\n// childSafetyCases/{caseId}/ncmecSubmissions/{submissionId}/ncmecCompletionProof/record —\n// [H-05] the IMMUTABLE record of a verified manual-portal completion. Written create-if-absent in\n// the SAME transaction as the submission's `completed` transition, so a submission can never reach\n// `completed` without a bound proof record; a re-completion keeps the original. The submission's\n// `completionProofRef` stores this doc's path, never an operator free-text string.\n// [Q13/H-06] `portalReceiptArtifactId` binds the proof to a verified NcmecPortalReceiptArtifactV1\n// on the same (caseId, submissionId) — an arbitrary operator string is never accepted.\n// (functions/src/safety/ncmecReporting.ts)\nexport const NcmecCompletionProofRecordV1Schema = z.object({\n  caseId: z.string(),\n  submissionId: z.string(),\n  channel: ChildSafetyNcmecCompletionChannelSchema,\n  proofType: ChildSafetyNcmecCompletionProofTypeSchema,\n  /** Id of the verified portal-receipt artifact this completion is bound to. */\n  portalReceiptArtifactId: z.string(),\n  /** Optional operator free-text note about the confirmation. */\n  proofText: z.string().optional(),\n  /** The NCMEC-assigned report id — REQUIRED. The number IS the proof; there is no\n   *  \"filed, number pending\" grace. */\n  ncmecReportId: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecCompletionProofRecordV1 = z.infer<typeof NcmecCompletionProofRecordV1Schema>;\n\n// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable\n// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the\n// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified\n// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never\n// proof. Written create-only, never overwritten, and carries the server-verified storage facts\n// (generation + sha256) so a later transactional verification can confirm the same object\n// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)\nexport const NcmecPortalReceiptArtifactV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  submissionId: z.string(),\n  /** Key of the object in the restricted evidence vault bucket. */\n  evidenceVaultKey: z.string(),\n  /** GCS object generation at capture time (immutable identity peg). */\n  objectGeneration: z.string(),\n  /** SHA-256 hex digest of the object bytes at capture time. */\n  sha256: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n  capturedAt: z.number(),\n  registeredByUid: z.string(),\n  /** Optional operator free-text describing what the artifact is. */\n  description: z.string().optional(),\n});\nexport type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;\n\n// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that\n// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction\n// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the\n// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each\n// correction is a fresh id — a later correction is an additional record, never a mutation of\n// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)\nexport const NcmecPortalCorrectionRecordV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  /** The portal-assigned NCMEC report id being corrected. */\n  ncmecReportId: z.string(),\n  /** When the operator filed the correction on the portal (operator-supplied). */\n  correctionFiledAt: z.number(),\n  reason: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;\n"]}

package/dist/doc-schemas/index.d.ts

@@ -30,7 +30,6 @@ export * from './safety/provenance.js';
 export * from './safety/sagas.js';
 export * from './safety/monitors.js';
 export * from './safety/age.js';
-export * from './safety/reviewer-security.js';
 export * from './ncii/allegations.js';
 export * from './ncii/requests.js';
 export * from './ncii/cases.js';

package/dist/doc-schemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/index.ts"],"names":[],"mappings":"AAMA,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,+BAA+B,CAAC;AAC9C,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AAGjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAG9C,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/index.ts"],"names":[],"mappings":"AAMA,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,+BAA+B,CAAC;AAC9C,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AAGjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAGhC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,eAAe,CAAC"}

package/dist/doc-schemas/index.js

@@ -36,7 +36,6 @@ export * from './safety/provenance.js';
 export * from './safety/sagas.js';
 export * from './safety/monitors.js';
 export * from './safety/age.js';
-export * from './safety/reviewer-security.js';
 // ===== Trust & Safety — NCII / TAKE IT DOWN (§A11) =====
 export * from './ncii/allegations.js';
 export * from './ncii/requests.js';

package/dist/doc-schemas/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/doc-schemas/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,mFAAmF;AAEnF,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,+BAA+B,CAAC;AAC9C,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AAEjC,6EAA6E;AAC7E,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAE9C,0DAA0D;AAC1D,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AAEjC,sDAAsD;AACtD,cAAc,oBAAoB,CAAC;AAEnC,cAAc,eAAe,CAAC","sourcesContent":["// Barrel for the Firestore document SCHEMAS (Zod) and the collection registry.\n// Exposed on the `@ttt-productions/ttt-core/doc-schemas` subpath. The schema registry\n// (COLLECTION_SCHEMAS) is consumed by the schema-doc generator (ttt-packages) and the\n// drift-check (ttt-prod). Document TYPES are inferred from these schemas and surface on\n// the main barrel via ../types/*; this subpath is the home of the runtime schemas.\n\nexport * from './user.js';\nexport * from './firestore-primitives.js';\nexport * from './media-assets.js';\nexport * from './media-activation-jobs.js';\nexport * from './publicUser.js';\nexport * from './account-deletion.js';\nexport * from './work-project.js';\nexport * from './content.js';\nexport * from './social.js';\nexport * from './square-announcement-jobs.js';\nexport * from './payments.js';\nexport * from './commissions.js';\nexport * from './messaging.js';\nexport * from './system.js';\nexport * from './moderation.js';\nexport * from './report-docs.js';\nexport * from './audit.js';\nexport * from './notifications.js';\nexport * from './notification-ledger.js';\nexport * from './chat-sync.js';\nexport * from './operational.js';\n\n// ===== Trust & Safety — shared foundation + cluster schemas (§A1–A11) =====\nexport * from './safety/foundation.js';\nexport * from './safety/report.js';\nexport * from './safety/case-alert.js';\nexport * from './safety/case.js';\nexport * from './safety/case-aliases.js';\nexport * from './safety/holds.js';\nexport * from './safety/evidence.js';\nexport * from './safety/provenance.js';\nexport * from './safety/sagas.js';\nexport * from './safety/monitors.js';\nexport * from './safety/age.js';\nexport * from './safety/reviewer-security.js';\n\n// ===== Trust & Safety — NCII / TAKE IT DOWN (§A11) =====\nexport * from './ncii/allegations.js';\nexport * from './ncii/requests.js';\nexport * from './ncii/cases.js';\nexport * from './ncii/holds.js';\nexport * from './ncii/removal.js';\nexport * from './ncii/config.js';\n\n// ===== Backend-only cursor / operational state =====\nexport * from './backend-state.js';\n\nexport * from './registry.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/doc-schemas/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,mFAAmF;AAEnF,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,+BAA+B,CAAC;AAC9C,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AAEjC,6EAA6E;AAC7E,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAEhC,0DAA0D;AAC1D,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AAEjC,sDAAsD;AACtD,cAAc,oBAAoB,CAAC;AAEnC,cAAc,eAAe,CAAC","sourcesContent":["// Barrel for the Firestore document SCHEMAS (Zod) and the collection registry.\n// Exposed on the `@ttt-productions/ttt-core/doc-schemas` subpath. The schema registry\n// (COLLECTION_SCHEMAS) is consumed by the schema-doc generator (ttt-packages) and the\n// drift-check (ttt-prod). Document TYPES are inferred from these schemas and surface on\n// the main barrel via ../types/*; this subpath is the home of the runtime schemas.\n\nexport * from './user.js';\nexport * from './firestore-primitives.js';\nexport * from './media-assets.js';\nexport * from './media-activation-jobs.js';\nexport * from './publicUser.js';\nexport * from './account-deletion.js';\nexport * from './work-project.js';\nexport * from './content.js';\nexport * from './social.js';\nexport * from './square-announcement-jobs.js';\nexport * from './payments.js';\nexport * from './commissions.js';\nexport * from './messaging.js';\nexport * from './system.js';\nexport * from './moderation.js';\nexport * from './report-docs.js';\nexport * from './audit.js';\nexport * from './notifications.js';\nexport * from './notification-ledger.js';\nexport * from './chat-sync.js';\nexport * from './operational.js';\n\n// ===== Trust & Safety — shared foundation + cluster schemas (§A1–A11) =====\nexport * from './safety/foundation.js';\nexport * from './safety/report.js';\nexport * from './safety/case-alert.js';\nexport * from './safety/case.js';\nexport * from './safety/case-aliases.js';\nexport * from './safety/holds.js';\nexport * from './safety/evidence.js';\nexport * from './safety/provenance.js';\nexport * from './safety/sagas.js';\nexport * from './safety/monitors.js';\nexport * from './safety/age.js';\n\n// ===== Trust & Safety — NCII / TAKE IT DOWN (§A11) =====\nexport * from './ncii/allegations.js';\nexport * from './ncii/requests.js';\nexport * from './ncii/cases.js';\nexport * from './ncii/holds.js';\nexport * from './ncii/removal.js';\nexport * from './ncii/config.js';\n\n// ===== Backend-only cursor / operational state =====\nexport * from './backend-state.js';\n\nexport * from './registry.js';\n"]}

package/dist/doc-schemas/media-assets.d.ts

@@ -159,6 +159,16 @@ export declare const MediaRetentionPolicySchema: z.ZodEnum<{
     legalHold: "legalHold";
 }>;
 export type MediaRetentionPolicy = z.infer<typeof MediaRetentionPolicySchema>;
+/** Not shared to the realm — the default standing for every work file. */
+export declare const REALM_FILE_NONE_STATUS: "none";
+/** The single AWAITING-DECISION standing. Exported as a VALUE as well as a schema so a
+ *  consumer can branch on it (`status === REALM_FILE_PENDING_APPROVAL_STATUS`) without
+ *  re-quoting the member — the redeclaration guard pins this literal to this file. */
+export declare const REALM_FILE_PENDING_APPROVAL_STATUS: "pendingApproval";
+/** Approved into the realm's shared pool, not marked canon. */
+export declare const REALM_FILE_NON_CANON_STATUS: "nonCanon";
+/** Approved into the realm's shared pool AND marked canon by the Realm steward. */
+export declare const REALM_FILE_CANON_STATUS: "canon";
 export declare const REALM_FILE_CANON_STATUS_VALUES: readonly ["none", "pendingApproval", "nonCanon", "canon"];
 export declare const RealmFileCanonStatusSchema: z.ZodEnum<{
     none: "none";
@@ -177,10 +187,6 @@ export declare const RealmFileApprovedStatusSchema: z.ZodEnum<{
     canon: "canon";
 }>;
 export type RealmFileApprovedStatus = z.infer<typeof RealmFileApprovedStatusSchema>;
-/** The single AWAITING-DECISION standing. Exported as a VALUE as well as a schema so a
- *  consumer can branch on it (`status === REALM_FILE_PENDING_APPROVAL_STATUS`) without
- *  re-quoting the member — the redeclaration guard pins this literal to this file. */
-export declare const REALM_FILE_PENDING_APPROVAL_STATUS: "pendingApproval";
 /** The steward promotion-queue projection accepts only this, so an approved or unshared row
  *  can never be typed into the queue. */
 export declare const RealmFilePendingApprovalStatusSchema: z.ZodLiteral<"pendingApproval">;

package/dist/doc-schemas/media-assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-assets.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/media-assets.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;EAAsD,CAAC;AACzF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;4DAC4D;AAC5D,eAAO,MAAM,wBAAwB;;;;;EAA2D,CAAC;AACjG,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;uCAEuC;AACvC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;EAsBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;uFAEuF;AACvF,eAAO,MAAM,sBAAsB;;;;EAAsC,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,8CAA+C,CAAC;AAC/E,eAAO,MAAM,qBAAqB;;;;;EAA6B,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;iCAKiC;AACjC,eAAO,MAAM,qBAAqB;;;;;;;;EAQhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0B5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,uBAAuB;;;;;;;kBAyBzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;EAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAc9E,eAAO,MAAM,8BAA8B,2DAKjC,CAAC;AACX,eAAO,MAAM,0BAA0B;;;;;EAAyC,CAAC;AACjF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;uFAGuF;AACvF,eAAO,MAAM,iCAAiC,gCAAiC,CAAC;AAChF,eAAO,MAAM,6BAA6B;;;EAA4C,CAAC;AACvF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;sFAEsF;AACtF,eAAO,MAAM,kCAAkC,EAAG,iBAA0B,CAAC;AAC7E;yCACyC;AACzC,eAAO,MAAM,oCAAoC,iCAAgD,CAAC;AAClG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;kEAGkE;AAClE,eAAO,MAAM,+BAA+B,mDAGlC,CAAC;AACX,eAAO,MAAM,2BAA2B;;;;EAA0C,CAAC;AACnF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF,iFAAiF;AACjF,eAAO,MAAM,6BAA6B;;;;EAA+C,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;iFACiF;AACjF,eAAO,MAAM,gCAAgC;;;;EAAkD,CAAC;AAChG,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;4BAkBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;EAoBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiBnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsI3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"media-assets.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/media-assets.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;EAAsD,CAAC;AACzF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;4DAC4D;AAC5D,eAAO,MAAM,wBAAwB;;;;;EAA2D,CAAC;AACjG,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;uCAEuC;AACvC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;EAsBpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;uFAEuF;AACvF,eAAO,MAAM,sBAAsB;;;;EAAsC,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,8CAA+C,CAAC;AAC/E,eAAO,MAAM,qBAAqB;;;;;EAA6B,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;iCAKiC;AACjC,eAAO,MAAM,qBAAqB;;;;;;;;EAQhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0B5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,uBAAuB;;;;;;;kBAyBzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;EAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAkB9E,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,EAAG,MAAe,CAAC;AACtD;;sFAEsF;AACtF,eAAO,MAAM,kCAAkC,EAAG,iBAA0B,CAAC;AAC7E,+DAA+D;AAC/D,eAAO,MAAM,2BAA2B,EAAG,UAAmB,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,EAAG,OAAgB,CAAC;AAExD,eAAO,MAAM,8BAA8B,2DAKjC,CAAC;AACX,eAAO,MAAM,0BAA0B;;;;;EAAyC,CAAC;AACjF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;uFAGuF;AACvF,eAAO,MAAM,iCAAiC,gCAGpC,CAAC;AACX,eAAO,MAAM,6BAA6B;;;EAA4C,CAAC;AACvF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;yCACyC;AACzC,eAAO,MAAM,oCAAoC,iCAAgD,CAAC;AAClG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;kEAGkE;AAClE,eAAO,MAAM,+BAA+B,mDAGlC,CAAC;AACX,eAAO,MAAM,2BAA2B;;;;EAA0C,CAAC;AACnF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF,iFAAiF;AACjF,eAAO,MAAM,6BAA6B;;;;EAA+C,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;iFACiF;AACjF,eAAO,MAAM,gCAAgC;;;;EAAkD,CAAC;AAChG,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;4BAkBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;EAoBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiBnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsI3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}