@ttt-productions/ttt-core 0.79.30 → 0.79.33

package/dist/constants/business-admin.d.ts

@@ -82,7 +82,7 @@ export declare const MAX_CONTENT_PAGE_HEADING_LENGTH = 300;
 export declare const MAX_CONTENT_PAGE_BODY_LENGTH = 20000;
 export declare const MAX_TAKE_IT_DOWN_COPY_LENGTH = 8000;
 export declare const MAX_MAINTENANCE_MESSAGE_LENGTH = 2000;
-/** Announcement-banner copy on `_config/app.announcementMessage`. Deliberately far
+/** Announcement-banner copy on `_appConfig/app.announcementMessage`. Deliberately far
  *  shorter than the maintenance message: the announcement renders as a one-line banner
  *  on the landing page and login screen, not a full-page takeover. */
 export declare const MAX_ANNOUNCEMENT_MESSAGE_LENGTH = 300;

package/dist/constants/business-admin.js

@@ -97,7 +97,7 @@ export const MAX_CONTENT_PAGE_HEADING_LENGTH = 300;
 export const MAX_CONTENT_PAGE_BODY_LENGTH = 20000;
 export const MAX_TAKE_IT_DOWN_COPY_LENGTH = 8000;
 export const MAX_MAINTENANCE_MESSAGE_LENGTH = 2000;
-/** Announcement-banner copy on `_config/app.announcementMessage`. Deliberately far
+/** Announcement-banner copy on `_appConfig/app.announcementMessage`. Deliberately far
  *  shorter than the maintenance message: the announcement renders as a one-line banner
  *  on the landing page and login screen, not a full-page takeover. */
 export const MAX_ANNOUNCEMENT_MESSAGE_LENGTH = 300;

package/dist/constants/business-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"business-admin.js","sourceRoot":"","sources":["../../src/constants/business-admin.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,qCAAqC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,KAAK;CACA,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,EAAE,EAAE;IACP,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,IAAI;IACd;;uDAEmD;IACnD,aAAa,EAAE,IAAI;CACX,CAAC;AAIX,mFAAmF;AACnF,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,GAAG;IAC5C,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,MAAM;IAClD,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,IAAI;IAC9C,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,QAAQ;CAC9C,CAAC;AAEX,2BAA2B;AAE3B,yDAAyD;AACzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,qEAAqE;AACrE,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC;AAE3D,sCAAsC;AAEtC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C;gEACgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAEtD,iDAAiD;AACjD,wFAAwF;AACxF,2FAA2F;AAE3F,8FAA8F;AAC9F,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,kCAAkC;AAElC,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;iFACiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;8EAC8E;AAC9E,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,gDAAgD;AAChD,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,mFAAmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,iDAAiD;AACjD,mFAAmF;AACnF,4EAA4E;AAE5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD;;sEAEsE;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,qCAAqC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD,6DAA6D;AAE7D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,sFAAsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,uFAAuF;AACvF,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AAEvD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,uEAAuE;AACvE,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAE3D,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,gDAAgD;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC,OAAO,CAAC,qBAAqB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,4BAA4B;IAC5B,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,gCAAgC;CACxB,CAAC;AAKX,gGAAgG;AAChG,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC;AAE/E,sBAAsB;AAEtB,qCAAqC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,WAAW;IACvB,SAAS,EAAE,WAAW;CACd,CAAC","sourcesContent":["// Admin + content-moderation business-rule constants — task priority, dispatches,\n// the moderation/feedback workflow, and admin-task lifecycle.\nimport { ACTIVE_LIMITS } from './app-mode.js';\n\n// --- Admin Task Priority System ---\n\nexport const TASK_PRIORITY = {\n  CRITICAL: 4,\n  HIGH: 3,\n  NORMAL: 2,\n  LOW: 1,\n} as const;\n\nexport type TaskPriorityLevel = (typeof TASK_PRIORITY)[keyof typeof TASK_PRIORITY];\n\nexport const TASK_PRIORITY_LABELS = {\n  4: 'CRITICAL',\n  3: 'HIGH',\n  2: 'NORMAL',\n  1: 'LOW',\n} as const;\n\n/**\n * Canonical NUMERIC priority scale for `adminTasks.priority`, shared by BOTH\n * priority systems so `checkoutNextImportantTask` (orderBy priority desc across all\n * task types) compares commensurable values. The userReport report-core score formula\n * already writes on this scale (≈40–2250); the level-based types (thresholdLibraryReview,\n * content-appeal, adminDispatch) map their TASK_PRIORITY level onto these numbers instead\n * of writing the raw 1–4.\n *\n * Resulting order: safety reports (1200–2250) > money anomalies (1100) >\n * CRITICAL (1000) > HIGH (800) > routine reports interleave below > spam-tier (~80).\n */\nexport const TASK_PRIORITY_SCORE = {\n  LOW: 50,\n  NORMAL: 200,\n  HIGH: 800,\n  CRITICAL: 1000,\n  /** Money-integrity anomaly (stake-share / pledge-ledger corruption signal) — outranks\n   * everything except safety-class reports. The three anomaly creators that previously\n   * hardcoded `priority: 1` (LOW) all write this. */\n  MONEY_ANOMALY: 1100,\n} as const;\n\nexport type TaskPriorityScore = (typeof TASK_PRIORITY_SCORE)[keyof typeof TASK_PRIORITY_SCORE];\n\n/** Maps a level-based TASK_PRIORITY value (1–4) to its canonical numeric score. */\nexport const TASK_PRIORITY_LEVEL_TO_SCORE = {\n  [TASK_PRIORITY.LOW]: TASK_PRIORITY_SCORE.LOW,\n  [TASK_PRIORITY.NORMAL]: TASK_PRIORITY_SCORE.NORMAL,\n  [TASK_PRIORITY.HIGH]: TASK_PRIORITY_SCORE.HIGH,\n  [TASK_PRIORITY.CRITICAL]: TASK_PRIORITY_SCORE.CRITICAL,\n} as const;\n\n// --- Admin Dispatches ---\n\n/** Maximum length for an admin-dispatch subject line. */\nexport const MAX_ADMIN_DISPATCH_SUBJECT_LENGTH = 100;\n\n/** Maximum length for the initial body text of an admin dispatch. */\nexport const MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH = 1000;\n\n// --- Content Moderation Workflow ---\n\n/** Maximum length for a content-violation appeal message. */\nexport const MAX_APPEAL_MESSAGE_LENGTH = 1000;\n\n/** Threshold-review reviewer notes (revision notes shown to the author). One owner for\n *  the review callable schema AND the admin work-view input. */\nexport const MAX_THRESHOLD_REVIEW_NOTES_LENGTH = 2000;\n\n// --- Moderation / safety operator text caps ---\n// Each is declared ONCE here and derived by every input schema AND persisted doc schema\n// that carries the field — the numbers must never be re-hardcoded at an enforcement point.\n\n/** Operator-facing INTERNAL reason/rationale (LE-loggable; account actions, case reopens). */\nexport const MAX_INTERNAL_REASON_LENGTH = 2000;\n\n/** The generic owner-readable (user-facing) reason — deliberately short, no detail leaks. */\nexport const MAX_USER_FACING_REASON_LENGTH = 280;\n\n/** Structured close-out summary on report/safety-case resolutions. */\nexport const MAX_SAFETY_RESOLUTION_SUMMARY_LENGTH = 2000;\n\n/** Optional operator note attached to a close-out. */\nexport const MAX_SAFETY_ADMIN_NOTE_LENGTH = 4000;\n\n// --- Report intake text caps ---\n\n/** Reporter free-text narrative/comment (segregated private doc; never on the root). */\nexport const MAX_REPORT_NARRATIVE_LENGTH = 4000;\n\n/** The report DIALOG's comment field cap (the client-side compose bound — tighter than\n * the server narrative cap above, which also absorbs upgrade concatenations). */\nexport const MAX_REPORT_COMMENT_LENGTH = 1000;\n\n/** Minimum operator rationale/reason length on safety-console staged actions. */\nexport const MIN_SAFETY_RATIONALE_LENGTH = 10;\n\n/** Operator reason on an admin chat-moderation action (adminModerateChatMessage /\n *  adminReadChannelContext). ONE owner for both callables' `reason` bound. */\nexport const MAX_CHAT_MODERATION_REASON_LENGTH = 1000;\n\n/** Broadcast explicitUids selector audience cap (schema + composer both derive). */\nexport const MAX_BROADCAST_EXPLICIT_UIDS = 2000;\n\n// --- Operator step-up sentinel error codes ---\n// The two backend HttpsError messages the operator TOTP step-up throws; the frontend\n// matches them to open the step-up dialog in ENROLL vs VERIFY mode. ONE declaration —\n// both the callable (functions operatorStepUp.ts) and the frontend hook import these.\nexport const STEP_UP_ENROLL_REQUIRED = 'OPERATOR_STEP_UP_ENROLL_REQUIRED';\nexport const STEP_UP_REQUIRED = 'OPERATOR_STEP_UP_REQUIRED';\n\n/** The frozen report-time captured text snapshot (edit-to-evade guard; NO PII). */\nexport const MAX_REPORT_SNAPSHOT_TEXT_LENGTH = 4000;\n\n// --- Admin console config-content text caps ---\n// Every number the system uses lives HERE — even a field only one surface consumes\n// today, because any future client (TV / phone / admin app) reads ttt-core.\n\nexport const MAX_FUTURE_PLAN_TITLE_LENGTH = 200;\nexport const MAX_FUTURE_PLAN_DESCRIPTION_LENGTH = 4000;\nexport const MAX_PLATFORM_RULE_TITLE_LENGTH = 200;\nexport const MAX_PLATFORM_RULE_DESCRIPTION_LENGTH = 4000;\nexport const MAX_AGREEMENT_POINT_LENGTH = 2000;\nexport const MAX_CONTENT_PAGE_HEADING_LENGTH = 300;\nexport const MAX_CONTENT_PAGE_BODY_LENGTH = 20000;\nexport const MAX_TAKE_IT_DOWN_COPY_LENGTH = 8000;\nexport const MAX_MAINTENANCE_MESSAGE_LENGTH = 2000;\n\n/** Announcement-banner copy on `_config/app.announcementMessage`. Deliberately far\n *  shorter than the maintenance message: the announcement renders as a one-line banner\n *  on the landing page and login screen, not a full-page takeover. */\nexport const MAX_ANNOUNCEMENT_MESSAGE_LENGTH = 300;\n\n/** Admin notes on a content-appeal review (reviewContentAppeal). */\nexport const MAX_APPEAL_REVIEW_NOTES_LENGTH = 2000;\n\n/** Admin reason on a Work/Realm forced-retitle remedy. */\nexport const MAX_REQUIRE_RETITLE_REASON_LENGTH = 500;\n\n/** Optional user-facing DETAIL text on a normal-report resolution. */\nexport const MAX_USER_FACING_REASON_DETAIL_LENGTH = 2000;\n\n/** Admin broadcast / user notification message body. */\nexport const MAX_NOTIFICATION_MESSAGE_LENGTH = 2000;\n\n/** Admin user-search query input. */\nexport const MAX_USER_SEARCH_QUERY_LENGTH = 100;\n\n// --- NCII / child-safety statutory + operator text caps ---\n\n/** Operator reason on the admin \"mark as NCII linked evidence\" intake. */\nexport const MAX_NCII_EVIDENCE_REASON_LENGTH = 1000;\n\n/** Operator written rationale on a TAKE IT DOWN validity decision (immutable row). */\nexport const MAX_NCII_RATIONALE_LENGTH = 4000;\n\n/** Requester's statement of nonconsent (statutory intake — in-app and no-login). */\nexport const MAX_NCII_NONCONSENT_STATEMENT_LENGTH = 4000;\n\n/** Typed-name electronic signature on a statutory request. */\nexport const MAX_NCII_SIGNED_NAME_LENGTH = 256;\n\n/** Requester's optional supporting facts (statutory intake). */\nexport const MAX_NCII_SUPPORTING_FACTS_LENGTH = 8000;\n\n/** Bounded, non-sensitive summary on an NCII request action row. */\nexport const MAX_NCII_ACTION_SUMMARY_LENGTH = 280;\n\n/** Operator description of a registered evidence artifact (e.g. portal screenshot). */\nexport const MAX_SAFETY_ARTIFACT_DESCRIPTION_LENGTH = 500;\n\n/** Operator proof note on a manual NCMEC portal filing. */\nexport const MAX_NCMEC_PORTAL_PROOF_TEXT_LENGTH = 2000;\n\n/** Requester's typed name on the no-login TAKE IT DOWN statutory intake. */\nexport const MAX_NCII_REQUESTER_NAME_LENGTH = 256;\n\n/** Name of the depicted person a representative files on behalf of. */\nexport const MAX_NCII_REPRESENTED_PERSON_NAME_LENGTH = 256;\n\n/** Representative's stated basis of authority (parent/guardian/counsel etc.). */\nexport const MAX_NCII_AUTHORITY_BASIS_LENGTH = 2000;\n\n/** Optional pointer/reference to authority evidence supplied by a representative. */\nexport const MAX_NCII_AUTHORITY_EVIDENCE_REF_LENGTH = 512;\n\n/** Maximum length for a feedback suggestion. */\nexport const MAX_FEEDBACK_SUGGESTION_LENGTH = 100;\n\n/** Maximum number of distinct submitters tracked per feedback suggestion. Mode-varied. */\nexport const MAX_FEEDBACK_SUBMITTERS = ACTIVE_LIMITS.batches.maxFeedbackSubmitters;\n\n/**\n * Canonical list of feedback types accepted by `submitFeedback`. Used both\n * for runtime validation in the schema (`SubmitFeedbackInputSchema`) and\n * for type-safe consumer props on the frontend `<FeedbackSubmission />`\n * component. Adding a new type here is the single source of truth — no\n * mirroring in callers required.\n */\nexport const FEEDBACK_TYPES = [\n  'tradeProfessionSuggestions',\n  'craftSkillTagSuggestions',\n  'talesWorkGenreSuggestions',\n  'tunesWorkGenreSuggestions',\n  'televisionWorkGenreSuggestions',\n] as const;\n\n/** Union of canonical feedback types. */\nexport type FeedbackType = (typeof FEEDBACK_TYPES)[number];\n\n/** Maximum number of items submitted in a single hallLibrary-review submission. Mode-varied. */\nexport const MAX_HALL_LIBRARY_SUBMIT_BATCH = ACTIVE_LIMITS.hall.maxSubmitBatch;\n\n// --- Admin Tasks ---\n\n/** Admin task lifecycle statuses. */\nexport const ADMIN_TASK_STATUS = {\n  PENDING: 'pending',\n  CHECKED_OUT: 'checkedOut',\n  WORK_LATER: 'workLater',\n  COMPLETED: 'completed',\n} as const;\n"]}
+{"version":3,"file":"business-admin.js","sourceRoot":"","sources":["../../src/constants/business-admin.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,qCAAqC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,KAAK;CACA,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,EAAE,EAAE;IACP,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,IAAI;IACd;;uDAEmD;IACnD,aAAa,EAAE,IAAI;CACX,CAAC;AAIX,mFAAmF;AACnF,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,GAAG;IAC5C,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,MAAM;IAClD,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,IAAI;IAC9C,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,QAAQ;CAC9C,CAAC;AAEX,2BAA2B;AAE3B,yDAAyD;AACzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,qEAAqE;AACrE,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC;AAE3D,sCAAsC;AAEtC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C;gEACgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAEtD,iDAAiD;AACjD,wFAAwF;AACxF,2FAA2F;AAE3F,8FAA8F;AAC9F,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,kCAAkC;AAElC,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;iFACiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;8EAC8E;AAC9E,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,gDAAgD;AAChD,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,mFAAmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,iDAAiD;AACjD,mFAAmF;AACnF,4EAA4E;AAE5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD;;sEAEsE;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,qCAAqC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD,6DAA6D;AAE7D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,sFAAsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,uFAAuF;AACvF,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AAEvD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,uEAAuE;AACvE,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAE3D,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAE1D,gDAAgD;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC,OAAO,CAAC,qBAAqB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,4BAA4B;IAC5B,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,gCAAgC;CACxB,CAAC;AAKX,gGAAgG;AAChG,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC;AAE/E,sBAAsB;AAEtB,qCAAqC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,WAAW;IACvB,SAAS,EAAE,WAAW;CACd,CAAC","sourcesContent":["// Admin + content-moderation business-rule constants — task priority, dispatches,\n// the moderation/feedback workflow, and admin-task lifecycle.\nimport { ACTIVE_LIMITS } from './app-mode.js';\n\n// --- Admin Task Priority System ---\n\nexport const TASK_PRIORITY = {\n  CRITICAL: 4,\n  HIGH: 3,\n  NORMAL: 2,\n  LOW: 1,\n} as const;\n\nexport type TaskPriorityLevel = (typeof TASK_PRIORITY)[keyof typeof TASK_PRIORITY];\n\nexport const TASK_PRIORITY_LABELS = {\n  4: 'CRITICAL',\n  3: 'HIGH',\n  2: 'NORMAL',\n  1: 'LOW',\n} as const;\n\n/**\n * Canonical NUMERIC priority scale for `adminTasks.priority`, shared by BOTH\n * priority systems so `checkoutNextImportantTask` (orderBy priority desc across all\n * task types) compares commensurable values. The userReport report-core score formula\n * already writes on this scale (≈40–2250); the level-based types (thresholdLibraryReview,\n * content-appeal, adminDispatch) map their TASK_PRIORITY level onto these numbers instead\n * of writing the raw 1–4.\n *\n * Resulting order: safety reports (1200–2250) > money anomalies (1100) >\n * CRITICAL (1000) > HIGH (800) > routine reports interleave below > spam-tier (~80).\n */\nexport const TASK_PRIORITY_SCORE = {\n  LOW: 50,\n  NORMAL: 200,\n  HIGH: 800,\n  CRITICAL: 1000,\n  /** Money-integrity anomaly (stake-share / pledge-ledger corruption signal) — outranks\n   * everything except safety-class reports. The three anomaly creators that previously\n   * hardcoded `priority: 1` (LOW) all write this. */\n  MONEY_ANOMALY: 1100,\n} as const;\n\nexport type TaskPriorityScore = (typeof TASK_PRIORITY_SCORE)[keyof typeof TASK_PRIORITY_SCORE];\n\n/** Maps a level-based TASK_PRIORITY value (1–4) to its canonical numeric score. */\nexport const TASK_PRIORITY_LEVEL_TO_SCORE = {\n  [TASK_PRIORITY.LOW]: TASK_PRIORITY_SCORE.LOW,\n  [TASK_PRIORITY.NORMAL]: TASK_PRIORITY_SCORE.NORMAL,\n  [TASK_PRIORITY.HIGH]: TASK_PRIORITY_SCORE.HIGH,\n  [TASK_PRIORITY.CRITICAL]: TASK_PRIORITY_SCORE.CRITICAL,\n} as const;\n\n// --- Admin Dispatches ---\n\n/** Maximum length for an admin-dispatch subject line. */\nexport const MAX_ADMIN_DISPATCH_SUBJECT_LENGTH = 100;\n\n/** Maximum length for the initial body text of an admin dispatch. */\nexport const MAX_ADMIN_DISPATCH_INITIAL_TEXT_LENGTH = 1000;\n\n// --- Content Moderation Workflow ---\n\n/** Maximum length for a content-violation appeal message. */\nexport const MAX_APPEAL_MESSAGE_LENGTH = 1000;\n\n/** Threshold-review reviewer notes (revision notes shown to the author). One owner for\n *  the review callable schema AND the admin work-view input. */\nexport const MAX_THRESHOLD_REVIEW_NOTES_LENGTH = 2000;\n\n// --- Moderation / safety operator text caps ---\n// Each is declared ONCE here and derived by every input schema AND persisted doc schema\n// that carries the field — the numbers must never be re-hardcoded at an enforcement point.\n\n/** Operator-facing INTERNAL reason/rationale (LE-loggable; account actions, case reopens). */\nexport const MAX_INTERNAL_REASON_LENGTH = 2000;\n\n/** The generic owner-readable (user-facing) reason — deliberately short, no detail leaks. */\nexport const MAX_USER_FACING_REASON_LENGTH = 280;\n\n/** Structured close-out summary on report/safety-case resolutions. */\nexport const MAX_SAFETY_RESOLUTION_SUMMARY_LENGTH = 2000;\n\n/** Optional operator note attached to a close-out. */\nexport const MAX_SAFETY_ADMIN_NOTE_LENGTH = 4000;\n\n// --- Report intake text caps ---\n\n/** Reporter free-text narrative/comment (segregated private doc; never on the root). */\nexport const MAX_REPORT_NARRATIVE_LENGTH = 4000;\n\n/** The report DIALOG's comment field cap (the client-side compose bound — tighter than\n * the server narrative cap above, which also absorbs upgrade concatenations). */\nexport const MAX_REPORT_COMMENT_LENGTH = 1000;\n\n/** Minimum operator rationale/reason length on safety-console staged actions. */\nexport const MIN_SAFETY_RATIONALE_LENGTH = 10;\n\n/** Operator reason on an admin chat-moderation action (adminModerateChatMessage /\n *  adminReadChannelContext). ONE owner for both callables' `reason` bound. */\nexport const MAX_CHAT_MODERATION_REASON_LENGTH = 1000;\n\n/** Broadcast explicitUids selector audience cap (schema + composer both derive). */\nexport const MAX_BROADCAST_EXPLICIT_UIDS = 2000;\n\n// --- Operator step-up sentinel error codes ---\n// The two backend HttpsError messages the operator TOTP step-up throws; the frontend\n// matches them to open the step-up dialog in ENROLL vs VERIFY mode. ONE declaration —\n// both the callable (functions operatorStepUp.ts) and the frontend hook import these.\nexport const STEP_UP_ENROLL_REQUIRED = 'OPERATOR_STEP_UP_ENROLL_REQUIRED';\nexport const STEP_UP_REQUIRED = 'OPERATOR_STEP_UP_REQUIRED';\n\n/** The frozen report-time captured text snapshot (edit-to-evade guard; NO PII). */\nexport const MAX_REPORT_SNAPSHOT_TEXT_LENGTH = 4000;\n\n// --- Admin console config-content text caps ---\n// Every number the system uses lives HERE — even a field only one surface consumes\n// today, because any future client (TV / phone / admin app) reads ttt-core.\n\nexport const MAX_FUTURE_PLAN_TITLE_LENGTH = 200;\nexport const MAX_FUTURE_PLAN_DESCRIPTION_LENGTH = 4000;\nexport const MAX_PLATFORM_RULE_TITLE_LENGTH = 200;\nexport const MAX_PLATFORM_RULE_DESCRIPTION_LENGTH = 4000;\nexport const MAX_AGREEMENT_POINT_LENGTH = 2000;\nexport const MAX_CONTENT_PAGE_HEADING_LENGTH = 300;\nexport const MAX_CONTENT_PAGE_BODY_LENGTH = 20000;\nexport const MAX_TAKE_IT_DOWN_COPY_LENGTH = 8000;\nexport const MAX_MAINTENANCE_MESSAGE_LENGTH = 2000;\n\n/** Announcement-banner copy on `_appConfig/app.announcementMessage`. Deliberately far\n *  shorter than the maintenance message: the announcement renders as a one-line banner\n *  on the landing page and login screen, not a full-page takeover. */\nexport const MAX_ANNOUNCEMENT_MESSAGE_LENGTH = 300;\n\n/** Admin notes on a content-appeal review (reviewContentAppeal). */\nexport const MAX_APPEAL_REVIEW_NOTES_LENGTH = 2000;\n\n/** Admin reason on a Work/Realm forced-retitle remedy. */\nexport const MAX_REQUIRE_RETITLE_REASON_LENGTH = 500;\n\n/** Optional user-facing DETAIL text on a normal-report resolution. */\nexport const MAX_USER_FACING_REASON_DETAIL_LENGTH = 2000;\n\n/** Admin broadcast / user notification message body. */\nexport const MAX_NOTIFICATION_MESSAGE_LENGTH = 2000;\n\n/** Admin user-search query input. */\nexport const MAX_USER_SEARCH_QUERY_LENGTH = 100;\n\n// --- NCII / child-safety statutory + operator text caps ---\n\n/** Operator reason on the admin \"mark as NCII linked evidence\" intake. */\nexport const MAX_NCII_EVIDENCE_REASON_LENGTH = 1000;\n\n/** Operator written rationale on a TAKE IT DOWN validity decision (immutable row). */\nexport const MAX_NCII_RATIONALE_LENGTH = 4000;\n\n/** Requester's statement of nonconsent (statutory intake — in-app and no-login). */\nexport const MAX_NCII_NONCONSENT_STATEMENT_LENGTH = 4000;\n\n/** Typed-name electronic signature on a statutory request. */\nexport const MAX_NCII_SIGNED_NAME_LENGTH = 256;\n\n/** Requester's optional supporting facts (statutory intake). */\nexport const MAX_NCII_SUPPORTING_FACTS_LENGTH = 8000;\n\n/** Bounded, non-sensitive summary on an NCII request action row. */\nexport const MAX_NCII_ACTION_SUMMARY_LENGTH = 280;\n\n/** Operator description of a registered evidence artifact (e.g. portal screenshot). */\nexport const MAX_SAFETY_ARTIFACT_DESCRIPTION_LENGTH = 500;\n\n/** Operator proof note on a manual NCMEC portal filing. */\nexport const MAX_NCMEC_PORTAL_PROOF_TEXT_LENGTH = 2000;\n\n/** Requester's typed name on the no-login TAKE IT DOWN statutory intake. */\nexport const MAX_NCII_REQUESTER_NAME_LENGTH = 256;\n\n/** Name of the depicted person a representative files on behalf of. */\nexport const MAX_NCII_REPRESENTED_PERSON_NAME_LENGTH = 256;\n\n/** Representative's stated basis of authority (parent/guardian/counsel etc.). */\nexport const MAX_NCII_AUTHORITY_BASIS_LENGTH = 2000;\n\n/** Optional pointer/reference to authority evidence supplied by a representative. */\nexport const MAX_NCII_AUTHORITY_EVIDENCE_REF_LENGTH = 512;\n\n/** Maximum length for a feedback suggestion. */\nexport const MAX_FEEDBACK_SUGGESTION_LENGTH = 100;\n\n/** Maximum number of distinct submitters tracked per feedback suggestion. Mode-varied. */\nexport const MAX_FEEDBACK_SUBMITTERS = ACTIVE_LIMITS.batches.maxFeedbackSubmitters;\n\n/**\n * Canonical list of feedback types accepted by `submitFeedback`. Used both\n * for runtime validation in the schema (`SubmitFeedbackInputSchema`) and\n * for type-safe consumer props on the frontend `<FeedbackSubmission />`\n * component. Adding a new type here is the single source of truth — no\n * mirroring in callers required.\n */\nexport const FEEDBACK_TYPES = [\n  'tradeProfessionSuggestions',\n  'craftSkillTagSuggestions',\n  'talesWorkGenreSuggestions',\n  'tunesWorkGenreSuggestions',\n  'televisionWorkGenreSuggestions',\n] as const;\n\n/** Union of canonical feedback types. */\nexport type FeedbackType = (typeof FEEDBACK_TYPES)[number];\n\n/** Maximum number of items submitted in a single hallLibrary-review submission. Mode-varied. */\nexport const MAX_HALL_LIBRARY_SUBMIT_BATCH = ACTIVE_LIMITS.hall.maxSubmitBatch;\n\n// --- Admin Tasks ---\n\n/** Admin task lifecycle statuses. */\nexport const ADMIN_TASK_STATUS = {\n  PENDING: 'pending',\n  CHECKED_OUT: 'checkedOut',\n  WORK_LATER: 'workLater',\n  COMPLETED: 'completed',\n} as const;\n"]}

package/dist/doc-schemas/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/audit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqBxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAc9B,CAAC"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/audit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsBxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAc9B,CAAC"}

package/dist/doc-schemas/audit.js

@@ -4,6 +4,7 @@
 // otherwise) that Zod can't express. `type` is validated as a string here; the exact
 // ~80-value AuditEventType union remains the source of truth in ../types/audit.ts.
 import { z } from 'zod';
+import { systemRoleSchema } from '../schemas/atoms.js';
 const TTTAuditActorSchema = z.discriminatedUnion('actorMode', [
     z.object({
         uid: z.string().nullable(),
@@ -14,7 +15,7 @@ const TTTAuditActorSchema = z.discriminatedUnion('actorMode', [
         uid: z.string().nullable(),
         isAdmin: z.boolean(),
         actorMode: z.enum(['adminReview', 'adminOverride']),
-        systemRole: z.enum(['admin', 'jrAdmin']),
+        systemRole: systemRoleSchema,
     }),
 ]);
 const TTTAuditTargetSchema = z.object({

package/dist/doc-schemas/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/doc-schemas/audit.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yFAAyF;AACzF,oFAAoF;AACpF,qFAAqF;AACrF,mFAAmF;AAEnF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC5D,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;KACvD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACnD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;KACzC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC","sourcesContent":["// Registry schema for auditEvents/{eventId}. Mirrors the structural shape of\n// TTTAuditEvent in ../types/audit.ts — which stays the canonical TYPE because it encodes\n// compiler-enforced actor/role rules (systemRole required on admin modes, forbidden\n// otherwise) that Zod can't express. `type` is validated as a string here; the exact\n// ~80-value AuditEventType union remains the source of truth in ../types/audit.ts.\n\nimport { z } from 'zod';\n\nconst TTTAuditActorSchema = z.discriminatedUnion('actorMode', [\n  z.object({\n    uid: z.string().nullable(),\n    isAdmin: z.boolean(),\n    actorMode: z.enum(['user', 'guildmateUser', 'system']),\n  }),\n  z.object({\n    uid: z.string().nullable(),\n    isAdmin: z.boolean(),\n    actorMode: z.enum(['adminReview', 'adminOverride']),\n    systemRole: z.enum(['admin', 'jrAdmin']),\n  }),\n]);\n\nconst TTTAuditTargetSchema = z.object({\n  uid: z.string().nullable(),\n  ref: z.string().nullable(),\n});\n\nexport const TTTAuditEventSchema = z.object({\n  id: z.string(),\n  type: z.string(),\n  schemaVersion: z.number(),\n  actor: TTTAuditActorSchema.nullable(),\n  target: TTTAuditTargetSchema.nullable(),\n  timestamp: z.number(),\n  ip: z.string().nullable(),\n  userAgent: z.string().nullable(),\n  region: z.string().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  result: z.enum(['success', 'failure']),\n  failureReason: z.string().nullable(),\n  correlationId: z.string().nullable(),\n});\n"]}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/doc-schemas/audit.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yFAAyF;AACzF,oFAAoF;AACpF,qFAAqF;AACrF,mFAAmF;AAEnF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC5D,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;KACvD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACnD,UAAU,EAAE,gBAAgB;KAC7B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC","sourcesContent":["// Registry schema for auditEvents/{eventId}. Mirrors the structural shape of\n// TTTAuditEvent in ../types/audit.ts — which stays the canonical TYPE because it encodes\n// compiler-enforced actor/role rules (systemRole required on admin modes, forbidden\n// otherwise) that Zod can't express. `type` is validated as a string here; the exact\n// ~80-value AuditEventType union remains the source of truth in ../types/audit.ts.\n\nimport { z } from 'zod';\nimport { systemRoleSchema } from '../schemas/atoms.js';\n\nconst TTTAuditActorSchema = z.discriminatedUnion('actorMode', [\n  z.object({\n    uid: z.string().nullable(),\n    isAdmin: z.boolean(),\n    actorMode: z.enum(['user', 'guildmateUser', 'system']),\n  }),\n  z.object({\n    uid: z.string().nullable(),\n    isAdmin: z.boolean(),\n    actorMode: z.enum(['adminReview', 'adminOverride']),\n    systemRole: systemRoleSchema,\n  }),\n]);\n\nconst TTTAuditTargetSchema = z.object({\n  uid: z.string().nullable(),\n  ref: z.string().nullable(),\n});\n\nexport const TTTAuditEventSchema = z.object({\n  id: z.string(),\n  type: z.string(),\n  schemaVersion: z.number(),\n  actor: TTTAuditActorSchema.nullable(),\n  target: TTTAuditTargetSchema.nullable(),\n  timestamp: z.number(),\n  ip: z.string().nullable(),\n  userAgent: z.string().nullable(),\n  region: z.string().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  result: z.enum(['success', 'failure']),\n  failureReason: z.string().nullable(),\n  correlationId: z.string().nullable(),\n});\n"]}

package/dist/doc-schemas/backend-state.d.ts

@@ -4,6 +4,11 @@ export declare const HallMediaReaperCursorSchema: z.ZodObject<{
     updatedAt: z.ZodNumber;
 }, z.core.$strip>;
 export type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;
+export declare const PublicUsersReconcilerCursorSchema: z.ZodObject<{
+    profileIdCursor: z.ZodString;
+    updatedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type PublicUsersReconcilerCursor = z.infer<typeof PublicUsersReconcilerCursorSchema>;
 export declare const OperatorStepUpSchema: z.ZodObject<{
     secret: z.ZodString;
     status: z.ZodEnum<{

package/dist/doc-schemas/backend-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-state.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAOhF,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF,eAAO,MAAM,gBAAgB;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAU1D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;iBAc7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAS9F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAgB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,eAAO,MAAM,mCAAmC;;;;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}
+{"version":3,"file":"backend-state.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAOhF,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAO5F,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF,eAAO,MAAM,gBAAgB;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAU1D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;iBAc7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAS9F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAgB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,eAAO,MAAM,mCAAmC;;;;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/doc-schemas/backend-state.js

@@ -14,6 +14,15 @@ export const HallMediaReaperCursorSchema = z.object({
     createdAtCursor: z.number(),
     updatedAt: z.number(),
 });
+// _systemData/publicUsersReconcilerCursor — the scheduled publicUsers reconciler's sweep cursor.
+// `profileIdCursor` is the last `userProfiles` document id the sweep has POSITIVELY cleared, so
+// each pass resumes after it instead of re-reading the same oldest page forever. An EMPTY STRING
+// means start from the beginning — both the first-ever pass and the wrap after the sweep exhausts
+// the collection. (functions/src/users/reconcilePublicUsers.ts)
+export const PublicUsersReconcilerCursorSchema = z.object({
+    profileIdCursor: z.string(),
+    updatedAt: z.number(),
+});
 // operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret
 // plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by
 // enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes

package/dist/doc-schemas/backend-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-state.js","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uCAAuC,EACvC,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,6FAA6F;AAC7F,wFAAwF;AACxF,mFAAmF;AACnF,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,6FAA6F;AAC7F,yFAAyF;AACzF,6FAA6F;AAC7F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,8CAA8C;AAC9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC;wFACoF;IACpF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mFAAmF;AACnF,kGAAkG;AAClG,uFAAuF;AACvF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,uCAAuC;IAChD,SAAS,EAAE,yCAAyC;IACpD,8EAA8E;IAC9E,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;yCACqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,0FAA0F;AAC1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,sEAAsE;IACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC","sourcesContent":["// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no\n// client ever reads or writes (firestore.rules denies client access to every path below).\n// They are registered here for the same reason every other stored shape is: ARCH-104 gives\n// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and\n// the drift-check read. Types are inferred via z.infer.\n\nimport { z } from 'zod';\nimport {\n  ChildSafetyNcmecCompletionChannelSchema,\n  ChildSafetyNcmecCompletionProofTypeSchema,\n} from './safety/case.js';\n\n// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.\n// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has POSITIVELY cleared\n// (candidate resolved referenced / reaped / already-deleted), so each pass resumes past\n// permanently-live Hall assets instead of re-reading the same oldest page forever.\n// (functions/src/media/reapOrphanedHallMediaCopies.ts)\nexport const HallMediaReaperCursorSchema = z.object({\n  createdAtCursor: z.number(),\n  updatedAt: z.number(),\n});\nexport type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;\n\n// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret\n// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by\n// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes\n// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by\n// the step-up window. (functions/src/safety/operatorStepUp.ts)\nexport const OperatorStepUpSchema = z.object({\n  secret: z.string(),\n  status: z.enum(['pending', 'active']),\n  /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */\n  grantExpiresAt: z.number().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  /** Set when enrollment is confirmed (status flips to 'active'). */\n  confirmedAt: z.number().optional(),\n});\nexport type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;\n\n// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler\n// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a\n// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so\n// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)\nexport const SafetyReconcilerCursorSchema = z.object({\n  /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */\n  afterValue: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;\n\n// sweepState/{sweepName} — durable cadence + cursor state for one scheduled user sweep. One doc\n// per sweep name; the fields a given sweep uses are the ones it declares, so every field except\n// `updatedAt` is optional. `orphanRegistrationCleanup` carries all three (the ~daily privateData\n// reaper's last completed pass + its rolling page cursor, and the ~weekly `listUsers()` scan);\n// `reconcileAccountStatus` carries only `fullScanLastRunAt`. The stamps are wall-clock so a\n// container recycle cannot reset the cadence.\n// (functions/src/users/orphanRegistrationCleanup.ts, functions/src/users/reconcileAccountStatus.ts)\nexport const SweepStateSchema = z.object({\n  /** Wall-clock ms the last COMPLETED privateData-reaper pass finished (absent = never). */\n  reaperLastRunAt: z.number().optional(),\n  /** Full document path of the last `privateData` doc the reaper examined. Empty/absent means no\n   *  pass is in flight; a non-empty value means one is mid-scan and must continue. */\n  reaperCursorPath: z.string().optional(),\n  /** Wall-clock ms the last full `listUsers()` scan ran (absent = never). */\n  fullScanLastRunAt: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SweepState = z.infer<typeof SweepStateSchema>;\n\n// childSafetyCases/{caseId}/ncmecSubmissions/{submissionId}/ncmecCompletionProof/record —\n// [H-05] the IMMUTABLE record of a verified manual-portal completion. Written create-if-absent in\n// the SAME transaction as the submission's `completed` transition, so a submission can never reach\n// `completed` without a bound proof record; a re-completion keeps the original. The submission's\n// `completionProofRef` stores this doc's path, never an operator free-text string.\n// [Q13/H-06] `portalReceiptArtifactId` binds the proof to a verified NcmecPortalReceiptArtifactV1\n// on the same (caseId, submissionId) — an arbitrary operator string is never accepted.\n// (functions/src/safety/ncmecReporting.ts)\nexport const NcmecCompletionProofRecordV1Schema = z.object({\n  caseId: z.string(),\n  submissionId: z.string(),\n  channel: ChildSafetyNcmecCompletionChannelSchema,\n  proofType: ChildSafetyNcmecCompletionProofTypeSchema,\n  /** Id of the verified portal-receipt artifact this completion is bound to. */\n  portalReceiptArtifactId: z.string(),\n  /** Optional operator free-text note about the confirmation. */\n  proofText: z.string().optional(),\n  /** The NCMEC-assigned report id — REQUIRED. The number IS the proof; there is no\n   *  \"filed, number pending\" grace. */\n  ncmecReportId: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecCompletionProofRecordV1 = z.infer<typeof NcmecCompletionProofRecordV1Schema>;\n\n// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable\n// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the\n// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified\n// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never\n// proof. Written create-only, never overwritten, and carries the server-verified storage facts\n// (generation + sha256) so a later transactional verification can confirm the same object\n// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)\nexport const NcmecPortalReceiptArtifactV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  submissionId: z.string(),\n  /** Key of the object in the restricted evidence vault bucket. */\n  evidenceVaultKey: z.string(),\n  /** GCS object generation at capture time (immutable identity peg). */\n  objectGeneration: z.string(),\n  /** SHA-256 hex digest of the object bytes at capture time. */\n  sha256: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n  capturedAt: z.number(),\n  registeredByUid: z.string(),\n  /** Optional operator free-text describing what the artifact is. */\n  description: z.string().optional(),\n});\nexport type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;\n\n// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that\n// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction\n// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the\n// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each\n// correction is a fresh id — a later correction is an additional record, never a mutation of\n// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)\nexport const NcmecPortalCorrectionRecordV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  /** The portal-assigned NCMEC report id being corrected. */\n  ncmecReportId: z.string(),\n  /** When the operator filed the correction on the portal (operator-supplied). */\n  correctionFiledAt: z.number(),\n  reason: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;\n"]}
+{"version":3,"file":"backend-state.js","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uCAAuC,EACvC,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,6FAA6F;AAC7F,wFAAwF;AACxF,mFAAmF;AACnF,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,6FAA6F;AAC7F,yFAAyF;AACzF,6FAA6F;AAC7F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,8CAA8C;AAC9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC;wFACoF;IACpF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mFAAmF;AACnF,kGAAkG;AAClG,uFAAuF;AACvF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,uCAAuC;IAChD,SAAS,EAAE,yCAAyC;IACpD,8EAA8E;IAC9E,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;yCACqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,0FAA0F;AAC1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,sEAAsE;IACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC","sourcesContent":["// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no\n// client ever reads or writes (firestore.rules denies client access to every path below).\n// They are registered here for the same reason every other stored shape is: ARCH-104 gives\n// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and\n// the drift-check read. Types are inferred via z.infer.\n\nimport { z } from 'zod';\nimport {\n  ChildSafetyNcmecCompletionChannelSchema,\n  ChildSafetyNcmecCompletionProofTypeSchema,\n} from './safety/case.js';\n\n// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.\n// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has POSITIVELY cleared\n// (candidate resolved referenced / reaped / already-deleted), so each pass resumes past\n// permanently-live Hall assets instead of re-reading the same oldest page forever.\n// (functions/src/media/reapOrphanedHallMediaCopies.ts)\nexport const HallMediaReaperCursorSchema = z.object({\n  createdAtCursor: z.number(),\n  updatedAt: z.number(),\n});\nexport type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;\n\n// _systemData/publicUsersReconcilerCursor — the scheduled publicUsers reconciler's sweep cursor.\n// `profileIdCursor` is the last `userProfiles` document id the sweep has POSITIVELY cleared, so\n// each pass resumes after it instead of re-reading the same oldest page forever. An EMPTY STRING\n// means start from the beginning — both the first-ever pass and the wrap after the sweep exhausts\n// the collection. (functions/src/users/reconcilePublicUsers.ts)\nexport const PublicUsersReconcilerCursorSchema = z.object({\n  profileIdCursor: z.string(),\n  updatedAt: z.number(),\n});\nexport type PublicUsersReconcilerCursor = z.infer<typeof PublicUsersReconcilerCursorSchema>;\n\n// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret\n// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by\n// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes\n// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by\n// the step-up window. (functions/src/safety/operatorStepUp.ts)\nexport const OperatorStepUpSchema = z.object({\n  secret: z.string(),\n  status: z.enum(['pending', 'active']),\n  /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */\n  grantExpiresAt: z.number().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  /** Set when enrollment is confirmed (status flips to 'active'). */\n  confirmedAt: z.number().optional(),\n});\nexport type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;\n\n// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler\n// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a\n// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so\n// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)\nexport const SafetyReconcilerCursorSchema = z.object({\n  /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */\n  afterValue: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;\n\n// sweepState/{sweepName} — durable cadence + cursor state for one scheduled user sweep. One doc\n// per sweep name; the fields a given sweep uses are the ones it declares, so every field except\n// `updatedAt` is optional. `orphanRegistrationCleanup` carries all three (the ~daily privateData\n// reaper's last completed pass + its rolling page cursor, and the ~weekly `listUsers()` scan);\n// `reconcileAccountStatus` carries only `fullScanLastRunAt`. The stamps are wall-clock so a\n// container recycle cannot reset the cadence.\n// (functions/src/users/orphanRegistrationCleanup.ts, functions/src/users/reconcileAccountStatus.ts)\nexport const SweepStateSchema = z.object({\n  /** Wall-clock ms the last COMPLETED privateData-reaper pass finished (absent = never). */\n  reaperLastRunAt: z.number().optional(),\n  /** Full document path of the last `privateData` doc the reaper examined. Empty/absent means no\n   *  pass is in flight; a non-empty value means one is mid-scan and must continue. */\n  reaperCursorPath: z.string().optional(),\n  /** Wall-clock ms the last full `listUsers()` scan ran (absent = never). */\n  fullScanLastRunAt: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SweepState = z.infer<typeof SweepStateSchema>;\n\n// childSafetyCases/{caseId}/ncmecSubmissions/{submissionId}/ncmecCompletionProof/record —\n// [H-05] the IMMUTABLE record of a verified manual-portal completion. Written create-if-absent in\n// the SAME transaction as the submission's `completed` transition, so a submission can never reach\n// `completed` without a bound proof record; a re-completion keeps the original. The submission's\n// `completionProofRef` stores this doc's path, never an operator free-text string.\n// [Q13/H-06] `portalReceiptArtifactId` binds the proof to a verified NcmecPortalReceiptArtifactV1\n// on the same (caseId, submissionId) — an arbitrary operator string is never accepted.\n// (functions/src/safety/ncmecReporting.ts)\nexport const NcmecCompletionProofRecordV1Schema = z.object({\n  caseId: z.string(),\n  submissionId: z.string(),\n  channel: ChildSafetyNcmecCompletionChannelSchema,\n  proofType: ChildSafetyNcmecCompletionProofTypeSchema,\n  /** Id of the verified portal-receipt artifact this completion is bound to. */\n  portalReceiptArtifactId: z.string(),\n  /** Optional operator free-text note about the confirmation. */\n  proofText: z.string().optional(),\n  /** The NCMEC-assigned report id — REQUIRED. The number IS the proof; there is no\n   *  \"filed, number pending\" grace. */\n  ncmecReportId: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecCompletionProofRecordV1 = z.infer<typeof NcmecCompletionProofRecordV1Schema>;\n\n// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable\n// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the\n// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified\n// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never\n// proof. Written create-only, never overwritten, and carries the server-verified storage facts\n// (generation + sha256) so a later transactional verification can confirm the same object\n// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)\nexport const NcmecPortalReceiptArtifactV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  submissionId: z.string(),\n  /** Key of the object in the restricted evidence vault bucket. */\n  evidenceVaultKey: z.string(),\n  /** GCS object generation at capture time (immutable identity peg). */\n  objectGeneration: z.string(),\n  /** SHA-256 hex digest of the object bytes at capture time. */\n  sha256: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n  capturedAt: z.number(),\n  registeredByUid: z.string(),\n  /** Optional operator free-text describing what the artifact is. */\n  description: z.string().optional(),\n});\nexport type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;\n\n// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that\n// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction\n// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the\n// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each\n// correction is a fresh id — a later correction is an additional record, never a mutation of\n// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)\nexport const NcmecPortalCorrectionRecordV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  /** The portal-assigned NCMEC report id being corrected. */\n  ncmecReportId: z.string(),\n  /** When the operator filed the correction on the portal (operator-supplied). */\n  correctionFiledAt: z.number(),\n  reason: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;\n"]}

package/dist/doc-schemas/chat-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-sync.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/chat-sync.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;iBAW1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAUlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;;;;;iBAKvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAGlF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;iBAclC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAKxE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqCvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgBlF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAK5F,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;iBAQtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC"}
+{"version":3,"file":"chat-sync.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/chat-sync.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;iBAW1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAUlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;;;;;iBAKvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAGlF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;iBAclC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAKxE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqCvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgBlF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAK5F,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;iBAQtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC"}

package/dist/doc-schemas/chat-sync.js

@@ -7,6 +7,7 @@
 // which is a real Firestore `Timestamp` (modeled as `unknown` so the drift-check
 // does not false-flag a Timestamp object against `z.number()`).
 import { z } from 'zod';
+import { systemRoleSchema } from '../schemas/atoms.js';
 /** Native-TTL field — a real Firestore Timestamp (NOT epoch-ms). Absent until the terminal that sets TTL. */
 const expireAtField = z.unknown().optional();
 // ── chatChannelAuthProjections/{authPairKey} ────────────────────────────────
@@ -105,7 +106,7 @@ export const ChatAdminActionCommandSchema = z.object({
     requestId: z.string(),
     actorUid: z.string(),
     actorMode: z.enum(['adminReview', 'adminOverride']),
-    systemRole: z.enum(['admin', 'jrAdmin']),
+    systemRole: systemRoleSchema,
     channelRef: z.record(z.string(), z.unknown()),
     messageSeq: z.number(),
     action: z.enum(['hide', 'delete']),

package/dist/doc-schemas/chat-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat-sync.js","sourceRoot":"","sources":["../../src/doc-schemas/chat-sync.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,+EAA+E;AAC/E,gFAAgF;AAChF,mFAAmF;AACnF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,gEAAgE;AAEhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6GAA6G;AAC7G,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE7C,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC9C,yFAAyF;IACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACzE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,yBAAyB,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mFAAmF;IACnF,8EAA8E;IAC9E,oCAAoC;IACpC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,+EAA+E;IAC/E,sCAAsC;IACtC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,wEAAwE;IACxE,iFAAiF;IACjF,sDAAsD;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,mFAAmF;AACnF,kFAAkF;AAClF,iEAAiE;AACjE,qFAAqF;AACrF,2CAA2C;AAC3C,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,yFAAyF;AACzF,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClF,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,gFAAgF;AAChF,iFAAiF;AACjF,yFAAyF;AACzF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;CACzC,CAAC,CAAC","sourcesContent":["// Chat realtime SYNC / projection / command Firestore schemas (chat-edge-rebuild P1).\n// The chat sync / projection / command (Firestore-side) field lists are FROZEN\n// here — this file is their single source; the durable design owner is ttt-prod\n// docs/design/chat-realtime-system.md. All of these collections are Admin-SDK-only\n// (`allow read, write: if false`). Per the TTT timestamp convention every time\n// field is epoch-ms `number`; the SINGLE exception is the native-TTL `expireAt`,\n// which is a real Firestore `Timestamp` (modeled as `unknown` so the drift-check\n// does not false-flag a Timestamp object against `z.number()`).\n\nimport { z } from 'zod';\n\n/** Native-TTL field — a real Firestore Timestamp (NOT epoch-ms). Absent until the terminal that sets TTL. */\nconst expireAtField = z.unknown().optional();\n\n// ── chatChannelAuthProjections/{authPairKey} ────────────────────────────────\n// Per-(user, channel) authorization FACT. Absent ⇒ removed/deny (fail-closed).\nexport const ChatChannelAuthProjectionSchema = z.object({\n  channelRefScope: z.enum(['channel', 'invite']),\n  workProjectId: z.string().nullable(),\n  guildChatChannelId: z.string().nullable(),\n  guildInviteId: z.string().nullable(),\n  uid: z.string(),\n  channelKey: z.string(),\n  channelAuthState: z.enum(['authorized', 'removed']),\n  channelAuthVersion: z.number(),\n  inputFingerprint: z.string(),\n  updatedAt: z.number(),\n});\nexport type ChatChannelAuthProjection = z.infer<typeof ChatChannelAuthProjectionSchema>;\n\n// ── chatScopeDegraded/{scopeKey} (+ causes/{causeId}) ───────────────────────\n// Exists IFF unresolvedCauseCount > 0. Grant mints fail closed while it exists.\nexport const ChatScopeDegradedSchema = z.object({\n  scopeKey: z.string(),\n  scopeKind: z.enum(['channel', 'memberInWork']),\n  // channel scope carries the channelRef tuple; memberInWork carries {uid, workProjectId}.\n  workProjectId: z.string().nullable(),\n  guildChatChannelId: z.string().nullable(),\n  guildInviteId: z.string().nullable(),\n  uid: z.string().nullable(),\n  unresolvedCauseCount: z.number(),\n  updatedAt: z.number(),\n});\nexport type ChatScopeDegraded = z.infer<typeof ChatScopeDegradedSchema>;\n\nexport const ChatScopeDegradedCauseSchema = z.object({\n  causeId: z.string(),\n  kind: z.enum(['syncEvent', 'fanoutJob']),\n  ref: z.string(),\n  deadLetteredAt: z.number(),\n});\nexport type ChatScopeDegradedCause = z.infer<typeof ChatScopeDegradedCauseSchema>;\n\n// ── chatSyncEvents/{eventId} ────────────────────────────────────────────────\nexport const ChatSyncEventSchema = z.object({\n  eventId: z.string(),\n  targetDo: z.string(),\n  kind: z.enum(['channelAuth', 'accountAccess', 'config', 'serverMessage']),\n  version: z.number(),\n  payload: z.record(z.string(), z.unknown()).nullable(),\n  tombstone: z.boolean().optional(),\n  payloadHash: z.string(),\n  status: z.enum(['pending', 'delivered', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  deliveredResult: z.record(z.string(), z.unknown()).nullable(),\n  deliveredAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatSyncEvent = z.infer<typeof ChatSyncEventSchema>;\n\n// ── chatSyncFanoutJobs/{jobId} ──────────────────────────────────────────────\nexport const ChatSyncFanoutJobSchema = z.object({\n  jobId: z.string(),\n  selectorKind: z.enum(['channelMembers', 'workChannelsForUser', 'policyEditAffectedUsers']),\n  selectorArgs: z.object({\n    workProjectId: z.string().optional(),\n    channelKey: z.string().optional(),\n    uid: z.string().optional(),\n  }),\n  causeVersion: z.number(),\n  cursor: z.object({ pageIndex: z.number(), lastDocId: z.string().nullable() }),\n  revision: z.number(),\n  status: z.enum(['pending', 'complete', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  completedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatSyncFanoutJob = z.infer<typeof ChatSyncFanoutJobSchema>;\n\n// ── chatMessageOutbox/{commandId} ───────────────────────────────────────────\nexport const ChatMessageOutboxSchema = z.object({\n  commandId: z.string(),\n  kind: z.enum(['userMsg', 'systemMsg']),\n  threadRef: z.string(),\n  payload: z.record(z.string(), z.unknown()),\n  payloadVersion: z.number(),\n  status: z.enum(['pending', 'applied', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  appliedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatMessageOutbox = z.infer<typeof ChatMessageOutboxSchema>;\n\n// ── chatAdminActionCommands/{requestId} ─────────────────────────────────────\n// `requestId` IS the doc id + DO dedup key. `delivering` is NOT a lease (it sets\n// nextAttemptAt = now + DELIVERY_TIMEOUT). terminalFailureGeneration default 0.\nexport const ChatAdminActionCommandSchema = z.object({\n  requestId: z.string(),\n  actorUid: z.string(),\n  actorMode: z.enum(['adminReview', 'adminOverride']),\n  systemRole: z.enum(['admin', 'jrAdmin']),\n  channelRef: z.record(z.string(), z.unknown()),\n  messageSeq: z.number(),\n  action: z.enum(['hide', 'delete']),\n  caseId: z.string(),\n  reason: z.string(),\n  expectedMessageRevision: z.number(),\n  payloadHash: z.string(),\n  // `safetyRepair` is the NONTERMINAL stall loop: a RESERVED command whose reconcile\n  // leg (PROBE → FINALIZE) failed past ADMIN_COMMAND_MAX_ATTEMPTS. Drained like\n  // `delivering`; never dead-letters.\n  state: z.enum(['queued', 'delivering', 'safetyRepair', 'applied', 'failed', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  result: z.record(z.string(), z.unknown()).nullable(),\n  doRevisionId: z.string().nullable(),\n  terminalFailureGeneration: z.number(),\n  createdAt: z.number(),\n  appliedAt: z.number().nullable(),\n  failedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  reconciled: z.boolean(),\n  reconciledAt: z.number().nullable(),\n  safetyRepair: z.boolean(),\n  // Monotonic counter of distinct entries into the safety-repair loop — keys the\n  // per-entry idempotent failure audit.\n  safetyRepairGeneration: z.number(),\n  // Failed reconcile passes on an already-reserved command. Separate from\n  // `attemptCount` (delivery attempts, which dead-letter); at the cap it escalates\n  // once into `safetyRepair` instead of dead-lettering.\n  reconcileAttemptCount: z.number(),\n  expireAt: expireAtField,\n});\nexport type ChatAdminActionCommand = z.infer<typeof ChatAdminActionCommandSchema>;\n\n// ── chatHistoryAnonymizationJobs/{jobId} ────────────────────────────────────\n// Account-deletion history anonymization (Contract F; P8). Resumable + crash-safe:\n// the recorded source-manifest identity (key/hash/generation) + the three cursors\n// (scan/rewrite/delete) make every boundary restartable. jobId =\n// hash('chat-anonymize', channelDoId, epoch, anonymizedUid). `expireAt` (native TTL)\n// is set ONLY when the job reaches `done`.\n//\n// C-B1: the replacement generation is DO-OWNED — the Channel DO (single-threaded per\n// channel) allocates a DISTINCT monotonic generation per erasure off the epoch row and\n// rewrites against the CURRENT live manifest, so two erasures on one epoch chain instead\n// of colliding on a shared `anon-1` keyspace. These four fields are therefore RECORDED AT\n// SCAN (null until the DO reports/allocates them), not pinned at enqueue; if a concurrent\n// anonymization supersedes the source between scan and swap, the job resets to `scanning`\n// to re-derive against the new current manifest (keeping its own allocated generation).\nexport const ChatHistoryAnonymizationJobSchema = z.object({\n  jobId: z.string(),\n  channelDoId: z.string(),\n  epoch: z.number(),\n  anonymizedUid: z.string(),\n  sourceManifestKey: z.string().nullable(),\n  sourceManifestHash: z.string().nullable(),\n  sourceGeneration: z.number().nullable(),\n  replacementGeneration: z.number().nullable(),\n  newManifestKey: z.string().nullable(),\n  scanCursor: z.number(),\n  rewriteCursor: z.number(),\n  deleteCursor: z.number(),\n  swappedAt: z.number().nullable(),\n  state: z.enum(['scanning', 'rewriting', 'swapping', 'deleting', 'done', 'failed']),\n  legalHoldPaused: z.boolean(),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  expireAt: expireAtField,\n});\nexport type ChatHistoryAnonymizationJob = z.infer<typeof ChatHistoryAnonymizationJobSchema>;\n\n// ── chatHistoryAnonymizationJobs/{jobId}/affectedChunks/{chunkOrdinal} ───────\n// The non-contiguous affected-chunk set (round-16 finding 7) — a crash after the\n// manifest swap resumes deletion from these rows + `deleteCursor` without re-listing R2.\nexport const ChatHistoryAnonymizationAffectedChunkSchema = z.object({\n  chunkOrdinal: z.number(),\n  sourceChunkKey: z.string(),\n  sourceSha256: z.string(),\n  replacementChunkKey: z.string().nullable(),\n  replacementSha256: z.string().nullable(),\n  rewriteState: z.enum(['pending', 'done']),\n  deleteState: z.enum(['pending', 'done']),\n});\nexport type ChatHistoryAnonymizationAffectedChunk = z.infer<typeof ChatHistoryAnonymizationAffectedChunkSchema>;\n"]}
+{"version":3,"file":"chat-sync.js","sourceRoot":"","sources":["../../src/doc-schemas/chat-sync.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,+EAA+E;AAC/E,gFAAgF;AAChF,mFAAmF;AACnF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,gEAAgE;AAEhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,6GAA6G;AAC7G,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE7C,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC9C,yFAAyF;IACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACzE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,yBAAyB,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACnD,UAAU,EAAE,gBAAgB;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mFAAmF;IACnF,8EAA8E;IAC9E,oCAAoC;IACpC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,+EAA+E;IAC/E,sCAAsC;IACtC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,wEAAwE;IACxE,iFAAiF;IACjF,sDAAsD;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,mFAAmF;AACnF,kFAAkF;AAClF,iEAAiE;AACjE,qFAAqF;AACrF,2CAA2C;AAC3C,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,yFAAyF;AACzF,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClF,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,gFAAgF;AAChF,iFAAiF;AACjF,yFAAyF;AACzF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;CACzC,CAAC,CAAC","sourcesContent":["// Chat realtime SYNC / projection / command Firestore schemas (chat-edge-rebuild P1).\n// The chat sync / projection / command (Firestore-side) field lists are FROZEN\n// here — this file is their single source; the durable design owner is ttt-prod\n// docs/design/chat-realtime-system.md. All of these collections are Admin-SDK-only\n// (`allow read, write: if false`). Per the TTT timestamp convention every time\n// field is epoch-ms `number`; the SINGLE exception is the native-TTL `expireAt`,\n// which is a real Firestore `Timestamp` (modeled as `unknown` so the drift-check\n// does not false-flag a Timestamp object against `z.number()`).\n\nimport { z } from 'zod';\nimport { systemRoleSchema } from '../schemas/atoms.js';\n\n/** Native-TTL field — a real Firestore Timestamp (NOT epoch-ms). Absent until the terminal that sets TTL. */\nconst expireAtField = z.unknown().optional();\n\n// ── chatChannelAuthProjections/{authPairKey} ────────────────────────────────\n// Per-(user, channel) authorization FACT. Absent ⇒ removed/deny (fail-closed).\nexport const ChatChannelAuthProjectionSchema = z.object({\n  channelRefScope: z.enum(['channel', 'invite']),\n  workProjectId: z.string().nullable(),\n  guildChatChannelId: z.string().nullable(),\n  guildInviteId: z.string().nullable(),\n  uid: z.string(),\n  channelKey: z.string(),\n  channelAuthState: z.enum(['authorized', 'removed']),\n  channelAuthVersion: z.number(),\n  inputFingerprint: z.string(),\n  updatedAt: z.number(),\n});\nexport type ChatChannelAuthProjection = z.infer<typeof ChatChannelAuthProjectionSchema>;\n\n// ── chatScopeDegraded/{scopeKey} (+ causes/{causeId}) ───────────────────────\n// Exists IFF unresolvedCauseCount > 0. Grant mints fail closed while it exists.\nexport const ChatScopeDegradedSchema = z.object({\n  scopeKey: z.string(),\n  scopeKind: z.enum(['channel', 'memberInWork']),\n  // channel scope carries the channelRef tuple; memberInWork carries {uid, workProjectId}.\n  workProjectId: z.string().nullable(),\n  guildChatChannelId: z.string().nullable(),\n  guildInviteId: z.string().nullable(),\n  uid: z.string().nullable(),\n  unresolvedCauseCount: z.number(),\n  updatedAt: z.number(),\n});\nexport type ChatScopeDegraded = z.infer<typeof ChatScopeDegradedSchema>;\n\nexport const ChatScopeDegradedCauseSchema = z.object({\n  causeId: z.string(),\n  kind: z.enum(['syncEvent', 'fanoutJob']),\n  ref: z.string(),\n  deadLetteredAt: z.number(),\n});\nexport type ChatScopeDegradedCause = z.infer<typeof ChatScopeDegradedCauseSchema>;\n\n// ── chatSyncEvents/{eventId} ────────────────────────────────────────────────\nexport const ChatSyncEventSchema = z.object({\n  eventId: z.string(),\n  targetDo: z.string(),\n  kind: z.enum(['channelAuth', 'accountAccess', 'config', 'serverMessage']),\n  version: z.number(),\n  payload: z.record(z.string(), z.unknown()).nullable(),\n  tombstone: z.boolean().optional(),\n  payloadHash: z.string(),\n  status: z.enum(['pending', 'delivered', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  deliveredResult: z.record(z.string(), z.unknown()).nullable(),\n  deliveredAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatSyncEvent = z.infer<typeof ChatSyncEventSchema>;\n\n// ── chatSyncFanoutJobs/{jobId} ──────────────────────────────────────────────\nexport const ChatSyncFanoutJobSchema = z.object({\n  jobId: z.string(),\n  selectorKind: z.enum(['channelMembers', 'workChannelsForUser', 'policyEditAffectedUsers']),\n  selectorArgs: z.object({\n    workProjectId: z.string().optional(),\n    channelKey: z.string().optional(),\n    uid: z.string().optional(),\n  }),\n  causeVersion: z.number(),\n  cursor: z.object({ pageIndex: z.number(), lastDocId: z.string().nullable() }),\n  revision: z.number(),\n  status: z.enum(['pending', 'complete', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  completedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatSyncFanoutJob = z.infer<typeof ChatSyncFanoutJobSchema>;\n\n// ── chatMessageOutbox/{commandId} ───────────────────────────────────────────\nexport const ChatMessageOutboxSchema = z.object({\n  commandId: z.string(),\n  kind: z.enum(['userMsg', 'systemMsg']),\n  threadRef: z.string(),\n  payload: z.record(z.string(), z.unknown()),\n  payloadVersion: z.number(),\n  status: z.enum(['pending', 'applied', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  appliedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatMessageOutbox = z.infer<typeof ChatMessageOutboxSchema>;\n\n// ── chatAdminActionCommands/{requestId} ─────────────────────────────────────\n// `requestId` IS the doc id + DO dedup key. `delivering` is NOT a lease (it sets\n// nextAttemptAt = now + DELIVERY_TIMEOUT). terminalFailureGeneration default 0.\nexport const ChatAdminActionCommandSchema = z.object({\n  requestId: z.string(),\n  actorUid: z.string(),\n  actorMode: z.enum(['adminReview', 'adminOverride']),\n  systemRole: systemRoleSchema,\n  channelRef: z.record(z.string(), z.unknown()),\n  messageSeq: z.number(),\n  action: z.enum(['hide', 'delete']),\n  caseId: z.string(),\n  reason: z.string(),\n  expectedMessageRevision: z.number(),\n  payloadHash: z.string(),\n  // `safetyRepair` is the NONTERMINAL stall loop: a RESERVED command whose reconcile\n  // leg (PROBE → FINALIZE) failed past ADMIN_COMMAND_MAX_ATTEMPTS. Drained like\n  // `delivering`; never dead-letters.\n  state: z.enum(['queued', 'delivering', 'safetyRepair', 'applied', 'failed', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  result: z.record(z.string(), z.unknown()).nullable(),\n  doRevisionId: z.string().nullable(),\n  terminalFailureGeneration: z.number(),\n  createdAt: z.number(),\n  appliedAt: z.number().nullable(),\n  failedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  reconciled: z.boolean(),\n  reconciledAt: z.number().nullable(),\n  safetyRepair: z.boolean(),\n  // Monotonic counter of distinct entries into the safety-repair loop — keys the\n  // per-entry idempotent failure audit.\n  safetyRepairGeneration: z.number(),\n  // Failed reconcile passes on an already-reserved command. Separate from\n  // `attemptCount` (delivery attempts, which dead-letter); at the cap it escalates\n  // once into `safetyRepair` instead of dead-lettering.\n  reconcileAttemptCount: z.number(),\n  expireAt: expireAtField,\n});\nexport type ChatAdminActionCommand = z.infer<typeof ChatAdminActionCommandSchema>;\n\n// ── chatHistoryAnonymizationJobs/{jobId} ────────────────────────────────────\n// Account-deletion history anonymization (Contract F; P8). Resumable + crash-safe:\n// the recorded source-manifest identity (key/hash/generation) + the three cursors\n// (scan/rewrite/delete) make every boundary restartable. jobId =\n// hash('chat-anonymize', channelDoId, epoch, anonymizedUid). `expireAt` (native TTL)\n// is set ONLY when the job reaches `done`.\n//\n// C-B1: the replacement generation is DO-OWNED — the Channel DO (single-threaded per\n// channel) allocates a DISTINCT monotonic generation per erasure off the epoch row and\n// rewrites against the CURRENT live manifest, so two erasures on one epoch chain instead\n// of colliding on a shared `anon-1` keyspace. These four fields are therefore RECORDED AT\n// SCAN (null until the DO reports/allocates them), not pinned at enqueue; if a concurrent\n// anonymization supersedes the source between scan and swap, the job resets to `scanning`\n// to re-derive against the new current manifest (keeping its own allocated generation).\nexport const ChatHistoryAnonymizationJobSchema = z.object({\n  jobId: z.string(),\n  channelDoId: z.string(),\n  epoch: z.number(),\n  anonymizedUid: z.string(),\n  sourceManifestKey: z.string().nullable(),\n  sourceManifestHash: z.string().nullable(),\n  sourceGeneration: z.number().nullable(),\n  replacementGeneration: z.number().nullable(),\n  newManifestKey: z.string().nullable(),\n  scanCursor: z.number(),\n  rewriteCursor: z.number(),\n  deleteCursor: z.number(),\n  swappedAt: z.number().nullable(),\n  state: z.enum(['scanning', 'rewriting', 'swapping', 'deleting', 'done', 'failed']),\n  legalHoldPaused: z.boolean(),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  expireAt: expireAtField,\n});\nexport type ChatHistoryAnonymizationJob = z.infer<typeof ChatHistoryAnonymizationJobSchema>;\n\n// ── chatHistoryAnonymizationJobs/{jobId}/affectedChunks/{chunkOrdinal} ───────\n// The non-contiguous affected-chunk set (round-16 finding 7) — a crash after the\n// manifest swap resumes deletion from these rows + `deleteCursor` without re-listing R2.\nexport const ChatHistoryAnonymizationAffectedChunkSchema = z.object({\n  chunkOrdinal: z.number(),\n  sourceChunkKey: z.string(),\n  sourceSha256: z.string(),\n  replacementChunkKey: z.string().nullable(),\n  replacementSha256: z.string().nullable(),\n  rewriteState: z.enum(['pending', 'done']),\n  deleteState: z.enum(['pending', 'done']),\n});\nexport type ChatHistoryAnonymizationAffectedChunk = z.infer<typeof ChatHistoryAnonymizationAffectedChunkSchema>;\n"]}

package/dist/doc-schemas/content.d.ts

@@ -97,6 +97,14 @@ export declare const FullTelevisionEpisodeSchema: z.ZodObject<{
     createdOn: z.ZodNumber;
 }, z.core.$strip>;
 export type FullTelevisionEpisode = z.infer<typeof FullTelevisionEpisodeSchema>;
+/** `allWorkProjects/{workProjectId}/hallSubmissionReservation/reservation` — the Work's ONE
+ * hall-entry reservation, created (never updated) inside the first threshold submit's
+ * transaction; every later submit converges on its `hallItemId`. Backend-only. */
+export declare const HallSubmissionReservationSchema: z.ZodObject<{
+    hallItemId: z.ZodString;
+    createdAt: z.ZodNumber;
+}, z.core.$strict>;
+export type HallSubmissionReservation = z.infer<typeof HallSubmissionReservationSchema>;
 export declare const ThresholdItemSchema: z.ZodObject<{
     thresholdItemId: z.ZodString;
     hallItemId: z.ZodString;
@@ -447,7 +455,7 @@ export declare const ContentPageSectionSchema: z.ZodObject<{
     order: z.ZodNumber;
 }, z.core.$strip>;
 export type ContentPageSection = z.infer<typeof ContentPageSectionSchema>;
-/** Long-form legal page doc — the shape of BOTH `_config/termsOfService` and `_config/privacyPolicy`. */
+/** Long-form legal page doc — the shape of BOTH `_appConfig/termsOfService` and `_appConfig/privacyPolicy`. */
 export declare const LegalPageDocumentSchema: z.ZodObject<{
     version: z.ZodNumber;
     lastUpdated: z.ZodNumber;
@@ -461,7 +469,7 @@ export declare const LegalPageDocumentSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type LegalPageDocument = z.infer<typeof LegalPageDocumentSchema>;
 /**
- * `_config/takeItDownPageCopy` — the /take-it-down page's user-facing language as
+ * `_appConfig/takeItDownPageCopy` — the /take-it-down page's user-facing language as
  * a keyed strings map (the page is a functional form, so its copy is discrete
  * labeled strings, not long-form sections). Keys are stable identifiers defined
  * by the page (e.g. `pageTitle`, `introBody`); the admin editor renders one

package/dist/doc-schemas/content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/content.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB,eAAO,MAAM,cAAc;;;;EAA2D,CAAC;AACvF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAItD,eAAO,MAAM,cAAc;;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;iBAU5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;iBAW9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;iBAU/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;iBAWtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAIhF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAIhE;;;;8CAI8C;AAC9C,eAAO,MAAM,4BAA4B;;;;;;;;EAQvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;qFAGqF;AACrF,eAAO,MAAM,qBAAqB;;;;EAA0C,CAAC;AAC7E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,6BAA6B;;;;EAA4C,CAAC;AACvF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AASpF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;iBAcnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAcjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAc3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAU1F,eAAO,MAAM,gCAAgC;;;;;iBAK3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,oCAAoC;;;;iBAI/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;iBAcvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAO/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,eAAe;;;;;;EAAuF,CAAC;AACpH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;;;;EAA4F,CAAC;AAC5H,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;iBAQrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB;;;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,yGAAyG;AACzG,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/content.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB,eAAO,MAAM,cAAc;;;;EAA2D,CAAC;AACvF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAItD,eAAO,MAAM,cAAc;;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;iBAU5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;iBAW9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;iBAU/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;iBAWtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAIhF;;kFAEkF;AAClF,eAAO,MAAM,+BAA+B;;;kBAGjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAIhE;;;;8CAI8C;AAC9C,eAAO,MAAM,4BAA4B;;;;;;;;EAQvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;qFAGqF;AACrF,eAAO,MAAM,qBAAqB;;;;EAA0C,CAAC;AAC7E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,6BAA6B;;;;EAA4C,CAAC;AACvF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AASpF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;iBAcnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAcjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAc3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAU1F,eAAO,MAAM,gCAAgC;;;;;iBAK3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,oCAAoC;;;;iBAI/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;iBAcvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAO/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,eAAe;;;;;;EAAuF,CAAC;AACpH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;;;;EAA4F,CAAC;AAC5H,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;iBAQrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB;;;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,+GAA+G;AAC/G,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/doc-schemas/content.js

@@ -87,6 +87,13 @@ export const FullTelevisionEpisodeSchema = z.object({
     ...moderationClearedFieldsShape,
 });
 // --- Threshold + Hall library items ---
+/** `allWorkProjects/{workProjectId}/hallSubmissionReservation/reservation` — the Work's ONE
+ * hall-entry reservation, created (never updated) inside the first threshold submit's
+ * transaction; every later submit converges on its `hallItemId`. Backend-only. */
+export const HallSubmissionReservationSchema = z.object({
+    hallItemId: z.string().min(1),
+    createdAt: z.number(),
+}).strict();
 export const ThresholdItemSchema = z.object({
     thresholdItemId: z.string(),
     hallItemId: z.string(),
@@ -345,14 +352,14 @@ export const ContentPageSectionSchema = z.object({
     body: z.string(),
     order: z.number(),
 });
-/** Long-form legal page doc — the shape of BOTH `_config/termsOfService` and `_config/privacyPolicy`. */
+/** Long-form legal page doc — the shape of BOTH `_appConfig/termsOfService` and `_appConfig/privacyPolicy`. */
 export const LegalPageDocumentSchema = z.object({
     version: z.number(),
     lastUpdated: z.number(),
     sections: z.array(ContentPageSectionSchema),
 });
 /**
- * `_config/takeItDownPageCopy` — the /take-it-down page's user-facing language as
+ * `_appConfig/takeItDownPageCopy` — the /take-it-down page's user-facing language as
  * a keyed strings map (the page is a functional form, so its copy is discrete
  * labeled strings, not long-form sections). Keys are stable identifiers defined
  * by the page (e.g. `pageTitle`, `introBody`); the admin editor renders one