@ttt-productions/ttt-core 0.79.38 → 0.79.40

package/dist/doc-schemas/backend-state.d.ts

@@ -19,6 +19,8 @@ export declare const OperatorStepUpSchema: z.ZodObject<{
     createdAt: z.ZodNumber;
     updatedAt: z.ZodNumber;
     confirmedAt: z.ZodOptional<z.ZodNumber>;
+    failedAttempts: z.ZodOptional<z.ZodNumber>;
+    lockedUntil: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;
 export declare const SafetyReconcilerCursorSchema: z.ZodObject<{

package/dist/doc-schemas/backend-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-state.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAOhF,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAO5F,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF,eAAO,MAAM,gBAAgB;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAU1D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;iBAc7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAS9F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAgB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,eAAO,MAAM,mCAAmC;;;;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}
+{"version":3,"file":"backend-state.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAOhF,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAS5F,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAa/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AASlF,eAAO,MAAM,gBAAgB;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAU1D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;iBAc7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAS9F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAgB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAQ9F,eAAO,MAAM,mCAAmC;;;;;;;;iBAU9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/doc-schemas/backend-state.js

@@ -27,7 +27,9 @@ export const PublicUsersReconcilerCursorSchema = z.object({
 // plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by
 // enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes
 // 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by
-// the step-up window. (functions/src/safety/operatorStepUp.ts)
+// the step-up window. `failedAttempts` and `lockedUntil` make the server-side TOTP brute-force
+// lockout durable; omitted fields are the compatible no-lockout state for rows written before
+// that protection shipped. (functions/src/safety/operatorStepUp.ts)
 export const OperatorStepUpSchema = z.object({
     secret: z.string(),
     status: z.enum(['pending', 'active']),
@@ -37,6 +39,10 @@ export const OperatorStepUpSchema = z.object({
     updatedAt: z.number(),
     /** Set when enrollment is confirmed (status flips to 'active'). */
     confirmedAt: z.number().optional(),
+    /** Consecutive failed TOTP checks since the most recent success or lockout. */
+    failedAttempts: z.number().int().nonnegative().optional(),
+    /** Epoch ms until which TOTP verification is refused; absent or 0 means not locked. */
+    lockedUntil: z.number().nonnegative().optional(),
 });
 // safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler
 // needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a

package/dist/doc-schemas/backend-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-state.js","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uCAAuC,EACvC,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,6FAA6F;AAC7F,wFAAwF;AACxF,mFAAmF;AACnF,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,6FAA6F;AAC7F,yFAAyF;AACzF,6FAA6F;AAC7F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,8CAA8C;AAC9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC;wFACoF;IACpF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mFAAmF;AACnF,kGAAkG;AAClG,uFAAuF;AACvF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,uCAAuC;IAChD,SAAS,EAAE,yCAAyC;IACpD,8EAA8E;IAC9E,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;yCACqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,0FAA0F;AAC1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,sEAAsE;IACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC","sourcesContent":["// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no\n// client ever reads or writes (firestore.rules denies client access to every path below).\n// They are registered here for the same reason every other stored shape is: ARCH-104 gives\n// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and\n// the drift-check read. Types are inferred via z.infer.\n\nimport { z } from 'zod';\nimport {\n  ChildSafetyNcmecCompletionChannelSchema,\n  ChildSafetyNcmecCompletionProofTypeSchema,\n} from './safety/case.js';\n\n// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.\n// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has POSITIVELY cleared\n// (candidate resolved referenced / reaped / already-deleted), so each pass resumes past\n// permanently-live Hall assets instead of re-reading the same oldest page forever.\n// (functions/src/media/reapOrphanedHallMediaCopies.ts)\nexport const HallMediaReaperCursorSchema = z.object({\n  createdAtCursor: z.number(),\n  updatedAt: z.number(),\n});\nexport type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;\n\n// _systemData/publicUsersReconcilerCursor — the scheduled publicUsers reconciler's sweep cursor.\n// `profileIdCursor` is the last `userProfiles` document id the sweep has POSITIVELY cleared, so\n// each pass resumes after it instead of re-reading the same oldest page forever. An EMPTY STRING\n// means start from the beginning — both the first-ever pass and the wrap after the sweep exhausts\n// the collection. (functions/src/users/reconcilePublicUsers.ts)\nexport const PublicUsersReconcilerCursorSchema = z.object({\n  profileIdCursor: z.string(),\n  updatedAt: z.number(),\n});\nexport type PublicUsersReconcilerCursor = z.infer<typeof PublicUsersReconcilerCursorSchema>;\n\n// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret\n// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by\n// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes\n// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by\n// the step-up window. (functions/src/safety/operatorStepUp.ts)\nexport const OperatorStepUpSchema = z.object({\n  secret: z.string(),\n  status: z.enum(['pending', 'active']),\n  /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */\n  grantExpiresAt: z.number().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  /** Set when enrollment is confirmed (status flips to 'active'). */\n  confirmedAt: z.number().optional(),\n});\nexport type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;\n\n// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler\n// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a\n// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so\n// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)\nexport const SafetyReconcilerCursorSchema = z.object({\n  /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */\n  afterValue: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;\n\n// sweepState/{sweepName} — durable cadence + cursor state for one scheduled user sweep. One doc\n// per sweep name; the fields a given sweep uses are the ones it declares, so every field except\n// `updatedAt` is optional. `orphanRegistrationCleanup` carries all three (the ~daily privateData\n// reaper's last completed pass + its rolling page cursor, and the ~weekly `listUsers()` scan);\n// `reconcileAccountStatus` carries only `fullScanLastRunAt`. The stamps are wall-clock so a\n// container recycle cannot reset the cadence.\n// (functions/src/users/orphanRegistrationCleanup.ts, functions/src/users/reconcileAccountStatus.ts)\nexport const SweepStateSchema = z.object({\n  /** Wall-clock ms the last COMPLETED privateData-reaper pass finished (absent = never). */\n  reaperLastRunAt: z.number().optional(),\n  /** Full document path of the last `privateData` doc the reaper examined. Empty/absent means no\n   *  pass is in flight; a non-empty value means one is mid-scan and must continue. */\n  reaperCursorPath: z.string().optional(),\n  /** Wall-clock ms the last full `listUsers()` scan ran (absent = never). */\n  fullScanLastRunAt: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SweepState = z.infer<typeof SweepStateSchema>;\n\n// childSafetyCases/{caseId}/ncmecSubmissions/{submissionId}/ncmecCompletionProof/record —\n// [H-05] the IMMUTABLE record of a verified manual-portal completion. Written create-if-absent in\n// the SAME transaction as the submission's `completed` transition, so a submission can never reach\n// `completed` without a bound proof record; a re-completion keeps the original. The submission's\n// `completionProofRef` stores this doc's path, never an operator free-text string.\n// [Q13/H-06] `portalReceiptArtifactId` binds the proof to a verified NcmecPortalReceiptArtifactV1\n// on the same (caseId, submissionId) — an arbitrary operator string is never accepted.\n// (functions/src/safety/ncmecReporting.ts)\nexport const NcmecCompletionProofRecordV1Schema = z.object({\n  caseId: z.string(),\n  submissionId: z.string(),\n  channel: ChildSafetyNcmecCompletionChannelSchema,\n  proofType: ChildSafetyNcmecCompletionProofTypeSchema,\n  /** Id of the verified portal-receipt artifact this completion is bound to. */\n  portalReceiptArtifactId: z.string(),\n  /** Optional operator free-text note about the confirmation. */\n  proofText: z.string().optional(),\n  /** The NCMEC-assigned report id — REQUIRED. The number IS the proof; there is no\n   *  \"filed, number pending\" grace. */\n  ncmecReportId: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecCompletionProofRecordV1 = z.infer<typeof NcmecCompletionProofRecordV1Schema>;\n\n// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable\n// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the\n// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified\n// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never\n// proof. Written create-only, never overwritten, and carries the server-verified storage facts\n// (generation + sha256) so a later transactional verification can confirm the same object\n// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)\nexport const NcmecPortalReceiptArtifactV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  submissionId: z.string(),\n  /** Key of the object in the restricted evidence vault bucket. */\n  evidenceVaultKey: z.string(),\n  /** GCS object generation at capture time (immutable identity peg). */\n  objectGeneration: z.string(),\n  /** SHA-256 hex digest of the object bytes at capture time. */\n  sha256: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n  capturedAt: z.number(),\n  registeredByUid: z.string(),\n  /** Optional operator free-text describing what the artifact is. */\n  description: z.string().optional(),\n});\nexport type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;\n\n// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that\n// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction\n// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the\n// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each\n// correction is a fresh id — a later correction is an additional record, never a mutation of\n// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)\nexport const NcmecPortalCorrectionRecordV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  /** The portal-assigned NCMEC report id being corrected. */\n  ncmecReportId: z.string(),\n  /** When the operator filed the correction on the portal (operator-supplied). */\n  correctionFiledAt: z.number(),\n  reason: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;\n"]}
+{"version":3,"file":"backend-state.js","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uCAAuC,EACvC,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,6FAA6F;AAC7F,wFAAwF;AACxF,mFAAmF;AACnF,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,6FAA6F;AAC7F,yFAAyF;AACzF,6FAA6F;AAC7F,+FAA+F;AAC/F,8FAA8F;AAC9F,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACzD,uFAAuF;IACvF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,8CAA8C;AAC9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC;wFACoF;IACpF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mFAAmF;AACnF,kGAAkG;AAClG,uFAAuF;AACvF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,uCAAuC;IAChD,SAAS,EAAE,yCAAyC;IACpD,8EAA8E;IAC9E,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;yCACqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,0FAA0F;AAC1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,sEAAsE;IACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC","sourcesContent":["// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no\n// client ever reads or writes (firestore.rules denies client access to every path below).\n// They are registered here for the same reason every other stored shape is: ARCH-104 gives\n// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and\n// the drift-check read. Types are inferred via z.infer.\n\nimport { z } from 'zod';\nimport {\n  ChildSafetyNcmecCompletionChannelSchema,\n  ChildSafetyNcmecCompletionProofTypeSchema,\n} from './safety/case.js';\n\n// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.\n// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has POSITIVELY cleared\n// (candidate resolved referenced / reaped / already-deleted), so each pass resumes past\n// permanently-live Hall assets instead of re-reading the same oldest page forever.\n// (functions/src/media/reapOrphanedHallMediaCopies.ts)\nexport const HallMediaReaperCursorSchema = z.object({\n  createdAtCursor: z.number(),\n  updatedAt: z.number(),\n});\nexport type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;\n\n// _systemData/publicUsersReconcilerCursor — the scheduled publicUsers reconciler's sweep cursor.\n// `profileIdCursor` is the last `userProfiles` document id the sweep has POSITIVELY cleared, so\n// each pass resumes after it instead of re-reading the same oldest page forever. An EMPTY STRING\n// means start from the beginning — both the first-ever pass and the wrap after the sweep exhausts\n// the collection. (functions/src/users/reconcilePublicUsers.ts)\nexport const PublicUsersReconcilerCursorSchema = z.object({\n  profileIdCursor: z.string(),\n  updatedAt: z.number(),\n});\nexport type PublicUsersReconcilerCursor = z.infer<typeof PublicUsersReconcilerCursorSchema>;\n\n// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret\n// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by\n// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes\n// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by\n// the step-up window. `failedAttempts` and `lockedUntil` make the server-side TOTP brute-force\n// lockout durable; omitted fields are the compatible no-lockout state for rows written before\n// that protection shipped. (functions/src/safety/operatorStepUp.ts)\nexport const OperatorStepUpSchema = z.object({\n  secret: z.string(),\n  status: z.enum(['pending', 'active']),\n  /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */\n  grantExpiresAt: z.number().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  /** Set when enrollment is confirmed (status flips to 'active'). */\n  confirmedAt: z.number().optional(),\n  /** Consecutive failed TOTP checks since the most recent success or lockout. */\n  failedAttempts: z.number().int().nonnegative().optional(),\n  /** Epoch ms until which TOTP verification is refused; absent or 0 means not locked. */\n  lockedUntil: z.number().nonnegative().optional(),\n});\nexport type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;\n\n// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler\n// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a\n// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so\n// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)\nexport const SafetyReconcilerCursorSchema = z.object({\n  /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */\n  afterValue: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;\n\n// sweepState/{sweepName} — durable cadence + cursor state for one scheduled user sweep. One doc\n// per sweep name; the fields a given sweep uses are the ones it declares, so every field except\n// `updatedAt` is optional. `orphanRegistrationCleanup` carries all three (the ~daily privateData\n// reaper's last completed pass + its rolling page cursor, and the ~weekly `listUsers()` scan);\n// `reconcileAccountStatus` carries only `fullScanLastRunAt`. The stamps are wall-clock so a\n// container recycle cannot reset the cadence.\n// (functions/src/users/orphanRegistrationCleanup.ts, functions/src/users/reconcileAccountStatus.ts)\nexport const SweepStateSchema = z.object({\n  /** Wall-clock ms the last COMPLETED privateData-reaper pass finished (absent = never). */\n  reaperLastRunAt: z.number().optional(),\n  /** Full document path of the last `privateData` doc the reaper examined. Empty/absent means no\n   *  pass is in flight; a non-empty value means one is mid-scan and must continue. */\n  reaperCursorPath: z.string().optional(),\n  /** Wall-clock ms the last full `listUsers()` scan ran (absent = never). */\n  fullScanLastRunAt: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SweepState = z.infer<typeof SweepStateSchema>;\n\n// childSafetyCases/{caseId}/ncmecSubmissions/{submissionId}/ncmecCompletionProof/record —\n// [H-05] the IMMUTABLE record of a verified manual-portal completion. Written create-if-absent in\n// the SAME transaction as the submission's `completed` transition, so a submission can never reach\n// `completed` without a bound proof record; a re-completion keeps the original. The submission's\n// `completionProofRef` stores this doc's path, never an operator free-text string.\n// [Q13/H-06] `portalReceiptArtifactId` binds the proof to a verified NcmecPortalReceiptArtifactV1\n// on the same (caseId, submissionId) — an arbitrary operator string is never accepted.\n// (functions/src/safety/ncmecReporting.ts)\nexport const NcmecCompletionProofRecordV1Schema = z.object({\n  caseId: z.string(),\n  submissionId: z.string(),\n  channel: ChildSafetyNcmecCompletionChannelSchema,\n  proofType: ChildSafetyNcmecCompletionProofTypeSchema,\n  /** Id of the verified portal-receipt artifact this completion is bound to. */\n  portalReceiptArtifactId: z.string(),\n  /** Optional operator free-text note about the confirmation. */\n  proofText: z.string().optional(),\n  /** The NCMEC-assigned report id — REQUIRED. The number IS the proof; there is no\n   *  \"filed, number pending\" grace. */\n  ncmecReportId: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecCompletionProofRecordV1 = z.infer<typeof NcmecCompletionProofRecordV1Schema>;\n\n// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable\n// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the\n// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified\n// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never\n// proof. Written create-only, never overwritten, and carries the server-verified storage facts\n// (generation + sha256) so a later transactional verification can confirm the same object\n// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)\nexport const NcmecPortalReceiptArtifactV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  submissionId: z.string(),\n  /** Key of the object in the restricted evidence vault bucket. */\n  evidenceVaultKey: z.string(),\n  /** GCS object generation at capture time (immutable identity peg). */\n  objectGeneration: z.string(),\n  /** SHA-256 hex digest of the object bytes at capture time. */\n  sha256: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n  capturedAt: z.number(),\n  registeredByUid: z.string(),\n  /** Optional operator free-text describing what the artifact is. */\n  description: z.string().optional(),\n});\nexport type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;\n\n// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that\n// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction\n// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the\n// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each\n// correction is a fresh id — a later correction is an additional record, never a mutation of\n// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)\nexport const NcmecPortalCorrectionRecordV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  /** The portal-assigned NCMEC report id being corrected. */\n  ncmecReportId: z.string(),\n  /** When the operator filed the correction on the portal (operator-supplied). */\n  correctionFiledAt: z.number(),\n  reason: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;\n"]}

package/dist/doc-schemas/chat-sync.d.ts

@@ -71,18 +71,65 @@ export declare const ChatSyncEventSchema: z.ZodObject<{
     expireAt: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>;
 export type ChatSyncEvent = z.infer<typeof ChatSyncEventSchema>;
-export declare const ChatSyncFanoutJobSchema: z.ZodObject<{
+export declare const ChatSyncFanoutJobSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    selectorKind: z.ZodLiteral<"channelMembers">;
+    selectorArgs: z.ZodObject<{
+        workProjectId: z.ZodString;
+        guildChatChannelId: z.ZodString;
+        channelKey: z.ZodString;
+    }, z.core.$strict>;
     jobId: z.ZodString;
-    selectorKind: z.ZodEnum<{
-        channelMembers: "channelMembers";
-        workChannelsForUser: "workChannelsForUser";
-        policyEditAffectedUsers: "policyEditAffectedUsers";
+    causeVersion: z.ZodNumber;
+    cursor: z.ZodObject<{
+        pageIndex: z.ZodNumber;
+        lastDocId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    revision: z.ZodNumber;
+    status: z.ZodEnum<{
+        pending: "pending";
+        complete: "complete";
+        deadLetter: "deadLetter";
     }>;
+    attemptCount: z.ZodNumber;
+    nextAttemptAt: z.ZodNumber;
+    lastError: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodNumber;
+    completedAt: z.ZodNullable<z.ZodNumber>;
+    deadLetteredAt: z.ZodNullable<z.ZodNumber>;
+    expireAt: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strict>, z.ZodObject<{
+    selectorKind: z.ZodLiteral<"policyEditAffectedUsers">;
     selectorArgs: z.ZodObject<{
-        workProjectId: z.ZodOptional<z.ZodString>;
-        channelKey: z.ZodOptional<z.ZodString>;
-        uid: z.ZodOptional<z.ZodString>;
+        workProjectId: z.ZodString;
+        guildChatChannelId: z.ZodString;
+        channelKey: z.ZodString;
+    }, z.core.$strict>;
+    jobId: z.ZodString;
+    causeVersion: z.ZodNumber;
+    cursor: z.ZodObject<{
+        pageIndex: z.ZodNumber;
+        lastDocId: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>;
+    revision: z.ZodNumber;
+    status: z.ZodEnum<{
+        pending: "pending";
+        complete: "complete";
+        deadLetter: "deadLetter";
+    }>;
+    attemptCount: z.ZodNumber;
+    nextAttemptAt: z.ZodNumber;
+    lastError: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodNumber;
+    completedAt: z.ZodNullable<z.ZodNumber>;
+    deadLetteredAt: z.ZodNullable<z.ZodNumber>;
+    expireAt: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strict>, z.ZodObject<{
+    selectorKind: z.ZodLiteral<"workChannelsForUser">;
+    selectorArgs: z.ZodObject<{
+        uid: z.ZodString;
+        workProjectId: z.ZodString;
+    }, z.core.$strict>;
+    jobId: z.ZodString;
     causeVersion: z.ZodNumber;
     cursor: z.ZodObject<{
         pageIndex: z.ZodNumber;
@@ -101,7 +148,32 @@ export declare const ChatSyncFanoutJobSchema: z.ZodObject<{
     completedAt: z.ZodNullable<z.ZodNumber>;
     deadLetteredAt: z.ZodNullable<z.ZodNumber>;
     expireAt: z.ZodOptional<z.ZodUnknown>;
-}, z.core.$strip>;
+}, z.core.$strict>, z.ZodObject<{
+    selectorKind: z.ZodLiteral<"inviteParticipants">;
+    selectorArgs: z.ZodObject<{
+        guildInviteId: z.ZodString;
+        participantUids: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    jobId: z.ZodString;
+    causeVersion: z.ZodNumber;
+    cursor: z.ZodObject<{
+        pageIndex: z.ZodNumber;
+        lastDocId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    revision: z.ZodNumber;
+    status: z.ZodEnum<{
+        pending: "pending";
+        complete: "complete";
+        deadLetter: "deadLetter";
+    }>;
+    attemptCount: z.ZodNumber;
+    nextAttemptAt: z.ZodNumber;
+    lastError: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodNumber;
+    completedAt: z.ZodNullable<z.ZodNumber>;
+    deadLetteredAt: z.ZodNullable<z.ZodNumber>;
+    expireAt: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strict>], "selectorKind">;
 export type ChatSyncFanoutJob = z.infer<typeof ChatSyncFanoutJobSchema>;
 export declare const ChatMessageOutboxSchema: z.ZodObject<{
     commandId: z.ZodString;

package/dist/doc-schemas/chat-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-sync.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/chat-sync.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;iBAc1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAUlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;;;;;iBAKvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAGlF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;iBAclC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAKxE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqCvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgBlF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAK5F,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;iBAQtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC"}
+{"version":3,"file":"chat-sync.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/chat-sync.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;iBAc1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAUlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;;;;;iBAKvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAGlF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAmChE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;iBAclC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAKxE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqCvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgBlF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAK5F,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;iBAQtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC"}

package/dist/doc-schemas/chat-sync.js

@@ -66,14 +66,11 @@ export const ChatSyncEventSchema = z.object({
     expireAt: expireAtField,
 });
 // ── chatSyncFanoutJobs/{jobId} ──────────────────────────────────────────────
-export const ChatSyncFanoutJobSchema = z.object({
+// The selector is a closed discriminated contract. The worker has different expansion
+// semantics for a Work-channel page, a member-in-Work page, and the fixed two-person
+// invite re-drive; a loose optional bag lets malformed persisted jobs silently wedge.
+const ChatSyncFanoutJobBaseShape = {
     jobId: z.string(),
-    selectorKind: z.enum(['channelMembers', 'workChannelsForUser', 'policyEditAffectedUsers']),
-    selectorArgs: z.object({
-        workProjectId: z.string().optional(),
-        channelKey: z.string().optional(),
-        uid: z.string().optional(),
-    }),
     causeVersion: z.number(),
     cursor: z.object({ pageIndex: z.number(), lastDocId: z.string().nullable() }),
     revision: z.number(),
@@ -85,7 +82,41 @@ export const ChatSyncFanoutJobSchema = z.object({
     completedAt: z.number().nullable(),
     deadLetteredAt: z.number().nullable(),
     expireAt: expireAtField,
-});
+};
+const channelFanoutSelectorArgs = z.object({
+    workProjectId: z.string().min(1),
+    guildChatChannelId: z.string().min(1),
+    channelKey: z.string().min(1),
+}).strict();
+const inviteParticipantsSelectorArgs = z.object({
+    guildInviteId: z.string().min(1),
+    participantUids: z.array(z.string().min(1)).length(2).refine((uids) => new Set(uids).size === uids.length, { message: 'Invite participant uids must be distinct.' }),
+}).strict();
+export const ChatSyncFanoutJobSchema = z.discriminatedUnion('selectorKind', [
+    z.object({
+        ...ChatSyncFanoutJobBaseShape,
+        selectorKind: z.literal('channelMembers'),
+        selectorArgs: channelFanoutSelectorArgs,
+    }).strict(),
+    z.object({
+        ...ChatSyncFanoutJobBaseShape,
+        selectorKind: z.literal('policyEditAffectedUsers'),
+        selectorArgs: channelFanoutSelectorArgs,
+    }).strict(),
+    z.object({
+        ...ChatSyncFanoutJobBaseShape,
+        selectorKind: z.literal('workChannelsForUser'),
+        selectorArgs: z.object({
+            uid: z.string().min(1),
+            workProjectId: z.string().min(1),
+        }).strict(),
+    }).strict(),
+    z.object({
+        ...ChatSyncFanoutJobBaseShape,
+        selectorKind: z.literal('inviteParticipants'),
+        selectorArgs: inviteParticipantsSelectorArgs,
+    }).strict(),
+]);
 // ── chatMessageOutbox/{commandId} ───────────────────────────────────────────
 export const ChatMessageOutboxSchema = z.object({
     commandId: z.string(),

package/dist/doc-schemas/chat-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat-sync.js","sourceRoot":"","sources":["../../src/doc-schemas/chat-sync.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,+EAA+E;AAC/E,gFAAgF;AAChF,mFAAmF;AACnF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,gEAAgE;AAEhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,6GAA6G;AAC7G,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE7C,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,2FAA2F;IAC3F,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC9C,yFAAyF;IACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACzE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,yBAAyB,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACnD,UAAU,EAAE,gBAAgB;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mFAAmF;IACnF,8EAA8E;IAC9E,oCAAoC;IACpC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,+EAA+E;IAC/E,sCAAsC;IACtC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,wEAAwE;IACxE,iFAAiF;IACjF,sDAAsD;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,mFAAmF;AACnF,kFAAkF;AAClF,iEAAiE;AACjE,qFAAqF;AACrF,2CAA2C;AAC3C,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,yFAAyF;AACzF,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClF,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,gFAAgF;AAChF,iFAAiF;AACjF,yFAAyF;AACzF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;CACzC,CAAC,CAAC","sourcesContent":["// Chat realtime SYNC / projection / command Firestore schemas (chat-edge-rebuild P1).\n// The chat sync / projection / command (Firestore-side) field lists are FROZEN\n// here — this file is their single source; the durable design owner is ttt-prod\n// docs/design/chat-realtime-system.md. All of these collections are Admin-SDK-only\n// (`allow read, write: if false`). Per the TTT timestamp convention every time\n// field is epoch-ms `number`; the SINGLE exception is the native-TTL `expireAt`,\n// which is a real Firestore `Timestamp` (modeled as `unknown` so the drift-check\n// does not false-flag a Timestamp object against `z.number()`).\n\nimport { z } from 'zod';\nimport { systemRoleSchema } from '../schemas/atoms.js';\n\n/** Native-TTL field — a real Firestore Timestamp (NOT epoch-ms). Absent until the terminal that sets TTL. */\nconst expireAtField = z.unknown().optional();\n\n// ── chatChannelAuthProjections/{authPairKey} ────────────────────────────────\n// Per-(user, channel) authorization FACT. Absent ⇒ removed/deny (fail-closed).\nexport const ChatChannelAuthProjectionSchema = z.object({\n  channelRefScope: z.enum(['channel', 'invite']),\n  workProjectId: z.string().nullable(),\n  guildChatChannelId: z.string().nullable(),\n  guildInviteId: z.string().nullable(),\n  uid: z.string(),\n  channelKey: z.string(),\n  channelAuthState: z.enum(['authorized', 'removed']),\n  channelAuthVersion: z.number(),\n  inputFingerprint: z.string(),\n  updatedAt: z.number(),\n  // Reconcile cursor — advanced on every reconciler visit, including a no-op one, so a stuck\n  // window rotates. Absent until the reconciler first reaches the projection.\n  lastReconciledAt: z.number().optional(),\n});\nexport type ChatChannelAuthProjection = z.infer<typeof ChatChannelAuthProjectionSchema>;\n\n// ── chatScopeDegraded/{scopeKey} (+ causes/{causeId}) ───────────────────────\n// Exists IFF unresolvedCauseCount > 0. Grant mints fail closed while it exists.\nexport const ChatScopeDegradedSchema = z.object({\n  scopeKey: z.string(),\n  scopeKind: z.enum(['channel', 'memberInWork']),\n  // channel scope carries the channelRef tuple; memberInWork carries {uid, workProjectId}.\n  workProjectId: z.string().nullable(),\n  guildChatChannelId: z.string().nullable(),\n  guildInviteId: z.string().nullable(),\n  uid: z.string().nullable(),\n  unresolvedCauseCount: z.number(),\n  updatedAt: z.number(),\n});\nexport type ChatScopeDegraded = z.infer<typeof ChatScopeDegradedSchema>;\n\nexport const ChatScopeDegradedCauseSchema = z.object({\n  causeId: z.string(),\n  kind: z.enum(['syncEvent', 'fanoutJob']),\n  ref: z.string(),\n  deadLetteredAt: z.number(),\n});\nexport type ChatScopeDegradedCause = z.infer<typeof ChatScopeDegradedCauseSchema>;\n\n// ── chatSyncEvents/{eventId} ────────────────────────────────────────────────\nexport const ChatSyncEventSchema = z.object({\n  eventId: z.string(),\n  targetDo: z.string(),\n  kind: z.enum(['channelAuth', 'accountAccess', 'config', 'serverMessage']),\n  version: z.number(),\n  payload: z.record(z.string(), z.unknown()).nullable(),\n  tombstone: z.boolean().optional(),\n  payloadHash: z.string(),\n  status: z.enum(['pending', 'delivered', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  deliveredResult: z.record(z.string(), z.unknown()).nullable(),\n  deliveredAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatSyncEvent = z.infer<typeof ChatSyncEventSchema>;\n\n// ── chatSyncFanoutJobs/{jobId} ──────────────────────────────────────────────\nexport const ChatSyncFanoutJobSchema = z.object({\n  jobId: z.string(),\n  selectorKind: z.enum(['channelMembers', 'workChannelsForUser', 'policyEditAffectedUsers']),\n  selectorArgs: z.object({\n    workProjectId: z.string().optional(),\n    channelKey: z.string().optional(),\n    uid: z.string().optional(),\n  }),\n  causeVersion: z.number(),\n  cursor: z.object({ pageIndex: z.number(), lastDocId: z.string().nullable() }),\n  revision: z.number(),\n  status: z.enum(['pending', 'complete', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  completedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatSyncFanoutJob = z.infer<typeof ChatSyncFanoutJobSchema>;\n\n// ── chatMessageOutbox/{commandId} ───────────────────────────────────────────\nexport const ChatMessageOutboxSchema = z.object({\n  commandId: z.string(),\n  kind: z.enum(['userMsg', 'systemMsg']),\n  threadRef: z.string(),\n  payload: z.record(z.string(), z.unknown()),\n  payloadVersion: z.number(),\n  status: z.enum(['pending', 'applied', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  appliedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatMessageOutbox = z.infer<typeof ChatMessageOutboxSchema>;\n\n// ── chatAdminActionCommands/{requestId} ─────────────────────────────────────\n// `requestId` IS the doc id + DO dedup key. `delivering` is NOT a lease (it sets\n// nextAttemptAt = now + DELIVERY_TIMEOUT). terminalFailureGeneration default 0.\nexport const ChatAdminActionCommandSchema = z.object({\n  requestId: z.string(),\n  actorUid: z.string(),\n  actorMode: z.enum(['adminReview', 'adminOverride']),\n  systemRole: systemRoleSchema,\n  channelRef: z.record(z.string(), z.unknown()),\n  messageSeq: z.number(),\n  action: z.enum(['hide', 'delete']),\n  caseId: z.string(),\n  reason: z.string(),\n  expectedMessageRevision: z.number(),\n  payloadHash: z.string(),\n  // `safetyRepair` is the NONTERMINAL stall loop: a RESERVED command whose reconcile\n  // leg (PROBE → FINALIZE) failed past ADMIN_COMMAND_MAX_ATTEMPTS. Drained like\n  // `delivering`; never dead-letters.\n  state: z.enum(['queued', 'delivering', 'safetyRepair', 'applied', 'failed', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  result: z.record(z.string(), z.unknown()).nullable(),\n  doRevisionId: z.string().nullable(),\n  terminalFailureGeneration: z.number(),\n  createdAt: z.number(),\n  appliedAt: z.number().nullable(),\n  failedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  reconciled: z.boolean(),\n  reconciledAt: z.number().nullable(),\n  safetyRepair: z.boolean(),\n  // Monotonic counter of distinct entries into the safety-repair loop — keys the\n  // per-entry idempotent failure audit.\n  safetyRepairGeneration: z.number(),\n  // Failed reconcile passes on an already-reserved command. Separate from\n  // `attemptCount` (delivery attempts, which dead-letter); at the cap it escalates\n  // once into `safetyRepair` instead of dead-lettering.\n  reconcileAttemptCount: z.number(),\n  expireAt: expireAtField,\n});\nexport type ChatAdminActionCommand = z.infer<typeof ChatAdminActionCommandSchema>;\n\n// ── chatHistoryAnonymizationJobs/{jobId} ────────────────────────────────────\n// Account-deletion history anonymization (Contract F; P8). Resumable + crash-safe:\n// the recorded source-manifest identity (key/hash/generation) + the three cursors\n// (scan/rewrite/delete) make every boundary restartable. jobId =\n// hash('chat-anonymize', channelDoId, epoch, anonymizedUid). `expireAt` (native TTL)\n// is set ONLY when the job reaches `done`.\n//\n// C-B1: the replacement generation is DO-OWNED — the Channel DO (single-threaded per\n// channel) allocates a DISTINCT monotonic generation per erasure off the epoch row and\n// rewrites against the CURRENT live manifest, so two erasures on one epoch chain instead\n// of colliding on a shared `anon-1` keyspace. These four fields are therefore RECORDED AT\n// SCAN (null until the DO reports/allocates them), not pinned at enqueue; if a concurrent\n// anonymization supersedes the source between scan and swap, the job resets to `scanning`\n// to re-derive against the new current manifest (keeping its own allocated generation).\nexport const ChatHistoryAnonymizationJobSchema = z.object({\n  jobId: z.string(),\n  channelDoId: z.string(),\n  epoch: z.number(),\n  anonymizedUid: z.string(),\n  sourceManifestKey: z.string().nullable(),\n  sourceManifestHash: z.string().nullable(),\n  sourceGeneration: z.number().nullable(),\n  replacementGeneration: z.number().nullable(),\n  newManifestKey: z.string().nullable(),\n  scanCursor: z.number(),\n  rewriteCursor: z.number(),\n  deleteCursor: z.number(),\n  swappedAt: z.number().nullable(),\n  state: z.enum(['scanning', 'rewriting', 'swapping', 'deleting', 'done', 'failed']),\n  legalHoldPaused: z.boolean(),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  expireAt: expireAtField,\n});\nexport type ChatHistoryAnonymizationJob = z.infer<typeof ChatHistoryAnonymizationJobSchema>;\n\n// ── chatHistoryAnonymizationJobs/{jobId}/affectedChunks/{chunkOrdinal} ───────\n// The non-contiguous affected-chunk set (round-16 finding 7) — a crash after the\n// manifest swap resumes deletion from these rows + `deleteCursor` without re-listing R2.\nexport const ChatHistoryAnonymizationAffectedChunkSchema = z.object({\n  chunkOrdinal: z.number(),\n  sourceChunkKey: z.string(),\n  sourceSha256: z.string(),\n  replacementChunkKey: z.string().nullable(),\n  replacementSha256: z.string().nullable(),\n  rewriteState: z.enum(['pending', 'done']),\n  deleteState: z.enum(['pending', 'done']),\n});\nexport type ChatHistoryAnonymizationAffectedChunk = z.infer<typeof ChatHistoryAnonymizationAffectedChunkSchema>;\n"]}
+{"version":3,"file":"chat-sync.js","sourceRoot":"","sources":["../../src/doc-schemas/chat-sync.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,+EAA+E;AAC/E,gFAAgF;AAChF,mFAAmF;AACnF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,gEAAgE;AAEhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,6GAA6G;AAC7G,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE7C,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,2FAA2F;IAC3F,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC9C,yFAAyF;IACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACzE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,MAAM,0BAA0B,GAAG;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAC1D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAC5C,EAAE,OAAO,EAAE,2CAA2C,EAAE,CACzD;CACF,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,cAAc,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,0BAA0B;QAC7B,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACzC,YAAY,EAAE,yBAAyB;KACxC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,0BAA0B;QAC7B,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;QAClD,YAAY,EAAE,yBAAyB;KACxC,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,0BAA0B;QAC7B,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SACjC,CAAC,CAAC,MAAM,EAAE;KACZ,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,0BAA0B;QAC7B,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC7C,YAAY,EAAE,8BAA8B;KAC7C,CAAC,CAAC,MAAM,EAAE;CACZ,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACnD,UAAU,EAAE,gBAAgB;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mFAAmF;IACnF,8EAA8E;IAC9E,oCAAoC;IACpC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,+EAA+E;IAC/E,sCAAsC;IACtC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,wEAAwE;IACxE,iFAAiF;IACjF,sDAAsD;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,mFAAmF;AACnF,kFAAkF;AAClF,iEAAiE;AACjE,qFAAqF;AACrF,2CAA2C;AAC3C,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,yFAAyF;AACzF,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClF,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH,gFAAgF;AAChF,iFAAiF;AACjF,yFAAyF;AACzF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;CACzC,CAAC,CAAC","sourcesContent":["// Chat realtime SYNC / projection / command Firestore schemas (chat-edge-rebuild P1).\n// The chat sync / projection / command (Firestore-side) field lists are FROZEN\n// here — this file is their single source; the durable design owner is ttt-prod\n// docs/design/chat-realtime-system.md. All of these collections are Admin-SDK-only\n// (`allow read, write: if false`). Per the TTT timestamp convention every time\n// field is epoch-ms `number`; the SINGLE exception is the native-TTL `expireAt`,\n// which is a real Firestore `Timestamp` (modeled as `unknown` so the drift-check\n// does not false-flag a Timestamp object against `z.number()`).\n\nimport { z } from 'zod';\nimport { systemRoleSchema } from '../schemas/atoms.js';\n\n/** Native-TTL field — a real Firestore Timestamp (NOT epoch-ms). Absent until the terminal that sets TTL. */\nconst expireAtField = z.unknown().optional();\n\n// ── chatChannelAuthProjections/{authPairKey} ────────────────────────────────\n// Per-(user, channel) authorization FACT. Absent ⇒ removed/deny (fail-closed).\nexport const ChatChannelAuthProjectionSchema = z.object({\n  channelRefScope: z.enum(['channel', 'invite']),\n  workProjectId: z.string().nullable(),\n  guildChatChannelId: z.string().nullable(),\n  guildInviteId: z.string().nullable(),\n  uid: z.string(),\n  channelKey: z.string(),\n  channelAuthState: z.enum(['authorized', 'removed']),\n  channelAuthVersion: z.number(),\n  inputFingerprint: z.string(),\n  updatedAt: z.number(),\n  // Reconcile cursor — advanced on every reconciler visit, including a no-op one, so a stuck\n  // window rotates. Absent until the reconciler first reaches the projection.\n  lastReconciledAt: z.number().optional(),\n});\nexport type ChatChannelAuthProjection = z.infer<typeof ChatChannelAuthProjectionSchema>;\n\n// ── chatScopeDegraded/{scopeKey} (+ causes/{causeId}) ───────────────────────\n// Exists IFF unresolvedCauseCount > 0. Grant mints fail closed while it exists.\nexport const ChatScopeDegradedSchema = z.object({\n  scopeKey: z.string(),\n  scopeKind: z.enum(['channel', 'memberInWork']),\n  // channel scope carries the channelRef tuple; memberInWork carries {uid, workProjectId}.\n  workProjectId: z.string().nullable(),\n  guildChatChannelId: z.string().nullable(),\n  guildInviteId: z.string().nullable(),\n  uid: z.string().nullable(),\n  unresolvedCauseCount: z.number(),\n  updatedAt: z.number(),\n});\nexport type ChatScopeDegraded = z.infer<typeof ChatScopeDegradedSchema>;\n\nexport const ChatScopeDegradedCauseSchema = z.object({\n  causeId: z.string(),\n  kind: z.enum(['syncEvent', 'fanoutJob']),\n  ref: z.string(),\n  deadLetteredAt: z.number(),\n});\nexport type ChatScopeDegradedCause = z.infer<typeof ChatScopeDegradedCauseSchema>;\n\n// ── chatSyncEvents/{eventId} ────────────────────────────────────────────────\nexport const ChatSyncEventSchema = z.object({\n  eventId: z.string(),\n  targetDo: z.string(),\n  kind: z.enum(['channelAuth', 'accountAccess', 'config', 'serverMessage']),\n  version: z.number(),\n  payload: z.record(z.string(), z.unknown()).nullable(),\n  tombstone: z.boolean().optional(),\n  payloadHash: z.string(),\n  status: z.enum(['pending', 'delivered', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  deliveredResult: z.record(z.string(), z.unknown()).nullable(),\n  deliveredAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatSyncEvent = z.infer<typeof ChatSyncEventSchema>;\n\n// ── chatSyncFanoutJobs/{jobId} ──────────────────────────────────────────────\n// The selector is a closed discriminated contract. The worker has different expansion\n// semantics for a Work-channel page, a member-in-Work page, and the fixed two-person\n// invite re-drive; a loose optional bag lets malformed persisted jobs silently wedge.\nconst ChatSyncFanoutJobBaseShape = {\n  jobId: z.string(),\n  causeVersion: z.number(),\n  cursor: z.object({ pageIndex: z.number(), lastDocId: z.string().nullable() }),\n  revision: z.number(),\n  status: z.enum(['pending', 'complete', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  completedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n};\n\nconst channelFanoutSelectorArgs = z.object({\n  workProjectId: z.string().min(1),\n  guildChatChannelId: z.string().min(1),\n  channelKey: z.string().min(1),\n}).strict();\n\nconst inviteParticipantsSelectorArgs = z.object({\n  guildInviteId: z.string().min(1),\n  participantUids: z.array(z.string().min(1)).length(2).refine(\n    (uids) => new Set(uids).size === uids.length,\n    { message: 'Invite participant uids must be distinct.' },\n  ),\n}).strict();\n\nexport const ChatSyncFanoutJobSchema = z.discriminatedUnion('selectorKind', [\n  z.object({\n    ...ChatSyncFanoutJobBaseShape,\n    selectorKind: z.literal('channelMembers'),\n    selectorArgs: channelFanoutSelectorArgs,\n  }).strict(),\n  z.object({\n    ...ChatSyncFanoutJobBaseShape,\n    selectorKind: z.literal('policyEditAffectedUsers'),\n    selectorArgs: channelFanoutSelectorArgs,\n  }).strict(),\n  z.object({\n    ...ChatSyncFanoutJobBaseShape,\n    selectorKind: z.literal('workChannelsForUser'),\n    selectorArgs: z.object({\n      uid: z.string().min(1),\n      workProjectId: z.string().min(1),\n    }).strict(),\n  }).strict(),\n  z.object({\n    ...ChatSyncFanoutJobBaseShape,\n    selectorKind: z.literal('inviteParticipants'),\n    selectorArgs: inviteParticipantsSelectorArgs,\n  }).strict(),\n]);\nexport type ChatSyncFanoutJob = z.infer<typeof ChatSyncFanoutJobSchema>;\n\n// ── chatMessageOutbox/{commandId} ───────────────────────────────────────────\nexport const ChatMessageOutboxSchema = z.object({\n  commandId: z.string(),\n  kind: z.enum(['userMsg', 'systemMsg']),\n  threadRef: z.string(),\n  payload: z.record(z.string(), z.unknown()),\n  payloadVersion: z.number(),\n  status: z.enum(['pending', 'applied', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  appliedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  expireAt: expireAtField,\n});\nexport type ChatMessageOutbox = z.infer<typeof ChatMessageOutboxSchema>;\n\n// ── chatAdminActionCommands/{requestId} ─────────────────────────────────────\n// `requestId` IS the doc id + DO dedup key. `delivering` is NOT a lease (it sets\n// nextAttemptAt = now + DELIVERY_TIMEOUT). terminalFailureGeneration default 0.\nexport const ChatAdminActionCommandSchema = z.object({\n  requestId: z.string(),\n  actorUid: z.string(),\n  actorMode: z.enum(['adminReview', 'adminOverride']),\n  systemRole: systemRoleSchema,\n  channelRef: z.record(z.string(), z.unknown()),\n  messageSeq: z.number(),\n  action: z.enum(['hide', 'delete']),\n  caseId: z.string(),\n  reason: z.string(),\n  expectedMessageRevision: z.number(),\n  payloadHash: z.string(),\n  // `safetyRepair` is the NONTERMINAL stall loop: a RESERVED command whose reconcile\n  // leg (PROBE → FINALIZE) failed past ADMIN_COMMAND_MAX_ATTEMPTS. Drained like\n  // `delivering`; never dead-letters.\n  state: z.enum(['queued', 'delivering', 'safetyRepair', 'applied', 'failed', 'deadLetter']),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  result: z.record(z.string(), z.unknown()).nullable(),\n  doRevisionId: z.string().nullable(),\n  terminalFailureGeneration: z.number(),\n  createdAt: z.number(),\n  appliedAt: z.number().nullable(),\n  failedAt: z.number().nullable(),\n  deadLetteredAt: z.number().nullable(),\n  reconciled: z.boolean(),\n  reconciledAt: z.number().nullable(),\n  safetyRepair: z.boolean(),\n  // Monotonic counter of distinct entries into the safety-repair loop — keys the\n  // per-entry idempotent failure audit.\n  safetyRepairGeneration: z.number(),\n  // Failed reconcile passes on an already-reserved command. Separate from\n  // `attemptCount` (delivery attempts, which dead-letter); at the cap it escalates\n  // once into `safetyRepair` instead of dead-lettering.\n  reconcileAttemptCount: z.number(),\n  expireAt: expireAtField,\n});\nexport type ChatAdminActionCommand = z.infer<typeof ChatAdminActionCommandSchema>;\n\n// ── chatHistoryAnonymizationJobs/{jobId} ────────────────────────────────────\n// Account-deletion history anonymization (Contract F; P8). Resumable + crash-safe:\n// the recorded source-manifest identity (key/hash/generation) + the three cursors\n// (scan/rewrite/delete) make every boundary restartable. jobId =\n// hash('chat-anonymize', channelDoId, epoch, anonymizedUid). `expireAt` (native TTL)\n// is set ONLY when the job reaches `done`.\n//\n// C-B1: the replacement generation is DO-OWNED — the Channel DO (single-threaded per\n// channel) allocates a DISTINCT monotonic generation per erasure off the epoch row and\n// rewrites against the CURRENT live manifest, so two erasures on one epoch chain instead\n// of colliding on a shared `anon-1` keyspace. These four fields are therefore RECORDED AT\n// SCAN (null until the DO reports/allocates them), not pinned at enqueue; if a concurrent\n// anonymization supersedes the source between scan and swap, the job resets to `scanning`\n// to re-derive against the new current manifest (keeping its own allocated generation).\nexport const ChatHistoryAnonymizationJobSchema = z.object({\n  jobId: z.string(),\n  channelDoId: z.string(),\n  epoch: z.number(),\n  anonymizedUid: z.string(),\n  sourceManifestKey: z.string().nullable(),\n  sourceManifestHash: z.string().nullable(),\n  sourceGeneration: z.number().nullable(),\n  replacementGeneration: z.number().nullable(),\n  newManifestKey: z.string().nullable(),\n  scanCursor: z.number(),\n  rewriteCursor: z.number(),\n  deleteCursor: z.number(),\n  swappedAt: z.number().nullable(),\n  state: z.enum(['scanning', 'rewriting', 'swapping', 'deleting', 'done', 'failed']),\n  legalHoldPaused: z.boolean(),\n  attemptCount: z.number(),\n  nextAttemptAt: z.number(),\n  lastError: z.string().nullable(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  expireAt: expireAtField,\n});\nexport type ChatHistoryAnonymizationJob = z.infer<typeof ChatHistoryAnonymizationJobSchema>;\n\n// ── chatHistoryAnonymizationJobs/{jobId}/affectedChunks/{chunkOrdinal} ───────\n// The non-contiguous affected-chunk set (round-16 finding 7) — a crash after the\n// manifest swap resumes deletion from these rows + `deleteCursor` without re-listing R2.\nexport const ChatHistoryAnonymizationAffectedChunkSchema = z.object({\n  chunkOrdinal: z.number(),\n  sourceChunkKey: z.string(),\n  sourceSha256: z.string(),\n  replacementChunkKey: z.string().nullable(),\n  replacementSha256: z.string().nullable(),\n  rewriteState: z.enum(['pending', 'done']),\n  deleteState: z.enum(['pending', 'done']),\n});\nexport type ChatHistoryAnonymizationAffectedChunk = z.infer<typeof ChatHistoryAnonymizationAffectedChunkSchema>;\n"]}

package/dist/doc-schemas/content.d.ts

@@ -31,8 +31,8 @@ export declare const FullChapterSchema: z.ZodObject<{
     photoAssetId: z.ZodOptional<z.ZodString>;
     status: z.ZodEnum<{
         unpublished: "unpublished";
-        pending_approval: "pending_approval";
         published: "published";
+        pending_approval: "pending_approval";
     }>;
     createdOn: z.ZodNumber;
 }, z.core.$strip>;
@@ -64,8 +64,8 @@ export declare const FullTuneTrackSchema: z.ZodObject<{
     photoAssetId: z.ZodOptional<z.ZodString>;
     status: z.ZodEnum<{
         unpublished: "unpublished";
-        pending_approval: "pending_approval";
         published: "published";
+        pending_approval: "pending_approval";
     }>;
     createdOn: z.ZodNumber;
 }, z.core.$strip>;
@@ -97,8 +97,8 @@ export declare const FullTelevisionEpisodeSchema: z.ZodObject<{
     photoAssetId: z.ZodOptional<z.ZodString>;
     status: z.ZodEnum<{
         unpublished: "unpublished";
-        pending_approval: "pending_approval";
         published: "published";
+        pending_approval: "pending_approval";
     }>;
     createdOn: z.ZodNumber;
 }, z.core.$strip>;
@@ -185,7 +185,13 @@ export declare const PublishedHallItemStatusSchema: z.ZodEnum<{
     banned: "banned";
 }>;
 export type PublishedHallItemStatus = z.infer<typeof PublishedHallItemStatusSchema>;
-export declare const HallContentChangeRequestSchema: z.ZodObject<{
+/**
+ * Older valid rows stored the same closed fields directly as a map and already carry
+ * the authoritative request-level surface. Normalize that legacy representation while
+ * reading so deployment does not strand outstanding requests; all new writers use the
+ * closed discriminated patch above.
+ */
+export declare const HallContentChangeRequestSchema: z.ZodPreprocess<z.ZodObject<{
     changeRequestId: z.ZodString;
     requestKind: z.ZodLiteral<"text">;
     targetKey: z.ZodString;
@@ -208,7 +214,7 @@ export declare const HallContentChangeRequestSchema: z.ZodObject<{
     workRealmId: z.ZodNullable<z.ZodString>;
     subItemId: z.ZodNullable<z.ZodString>;
     proposerUid: z.ZodString;
-    proposedFields: z.ZodRecord<z.ZodString, z.ZodString>;
+    proposedFields: z.ZodUnion<[z.ZodType<import("../schemas/hall-library.js").HallContentTextPatch, unknown, z.core.$ZodTypeInternals<import("../schemas/hall-library.js").HallContentTextPatch, unknown>>, z.ZodType<import("../schemas/hall-library.js").HallContentTextPatch, unknown, z.core.$ZodTypeInternals<import("../schemas/hall-library.js").HallContentTextPatch, unknown>>, ...z.ZodType<import("../schemas/hall-library.js").HallContentTextPatch, unknown, z.core.$ZodTypeInternals<import("../schemas/hall-library.js").HallContentTextPatch, unknown>>[]]>;
     status: z.ZodEnum<{
         approved: "approved";
         denied: "denied";
@@ -219,7 +225,7 @@ export declare const HallContentChangeRequestSchema: z.ZodObject<{
     resolvedAt: z.ZodOptional<z.ZodNumber>;
     resolvedBy: z.ZodOptional<z.ZodString>;
     resolutionReason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
+}, z.core.$strip>>;
 export type HallContentChangeRequest = z.infer<typeof HallContentChangeRequestSchema>;
 export declare const PublishedHallItemSchema: z.ZodObject<{
     hallItemId: z.ZodString;

package/dist/doc-schemas/content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/content.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,cAAc;;;;EAA2D,CAAC;AACvF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAItD,eAAO,MAAM,cAAc;;;;;;;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;iBAW5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAY9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAW/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAYtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAIhF;;kFAEkF;AAClF,eAAO,MAAM,+BAA+B;;;kBAGjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoC9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAIhE;;;;8CAI8C;AAC9C,eAAO,MAAM,4BAA4B;;;;;;;;EAQvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;qFAGqF;AACrF,eAAO,MAAM,qBAAqB;;;;EAA0C,CAAC;AAC7E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,6BAA6B;;;;EAA4C,CAAC;AACvF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AASpF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+BlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAU1F,eAAO,MAAM,gCAAgC;;;;;iBAK3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,oCAAoC;;;;iBAI/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;iBAcvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAO/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,eAAe;;;;;;EAAuF,CAAC;AACpH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;;;;EAA4F,CAAC;AAC5H,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;iBAQrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB;;;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,+GAA+G;AAC/G,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/content.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,eAAO,MAAM,cAAc;;;;EAA2D,CAAC;AACvF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAItD,eAAO,MAAM,cAAc;;;;;;;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;iBAW5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAY9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAW/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAYtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAIhF;;kFAEkF;AAClF,eAAO,MAAM,+BAA+B;;;kBAGjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoC9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAIhE;;;;8CAI8C;AAC9C,eAAO,MAAM,4BAA4B;;;;;;;;EAQvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;qFAGqF;AACrF,eAAO,MAAM,qBAAqB;;;;EAA0C,CAAC;AAC7E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,6BAA6B;;;;EAA4C,CAAC;AACvF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAiFpF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiBA,CAAC;AAC5C,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+BlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAU1F,eAAO,MAAM,gCAAgC;;;;;iBAK3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,oCAAoC;;;;iBAI/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;iBAcvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAO/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,eAAe;;;;;;EAAuF,CAAC;AACpH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;;;;EAA4F,CAAC;AAC5H,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;iBAQrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB;;;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,+GAA+G;AAC/G,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/doc-schemas/content.js

@@ -6,6 +6,8 @@
 import { z } from 'zod';
 import { HALL_WING_TYPE_KEYS, WORK_PROJECT_TYPE_KEYS } from '../types/content.js';
 import { ModerationEdgeSyncOpSchema, ModerationEdgeSyncStateSchema } from './moderation.js';
+import { HallContentTextPatchSchema } from '../schemas/hall-library.js';
+import { HALL_CONTENT_SURFACES_BY_WORK_TYPE } from '../constants/business-content.js';
 const contentStatusSchema = z.enum(['unpublished', 'pending_approval', 'published']);
 // Per-field moderation text-clear remedy (shared shape across the content family — Tale/Tune/
 // Television details, their chapter/track/episode sub-items, and the published Hall projections of
@@ -167,7 +169,7 @@ export const PublishedHallItemStatusSchema = z.enum(['published', 'paused', 'ban
 // item + its live in-Work source doc; deny = nothing changes, `resolutionReason` shown
 // to the member. Writes are callable-only; reads are the owning work's active guildmates
 // + admins. `requestKind` future-proofs a media variant (new kind, no schema break).
-export const HallContentChangeRequestSchema = z.object({
+const HallContentChangeRequestCanonicalSchema = z.object({
     changeRequestId: z.string(),
     requestKind: z.literal('text'),
     // One-open-per-target enforcement/query key. Hall grains:
@@ -188,9 +190,9 @@ export const HallContentChangeRequestSchema = z.object({
     // chapter/track/episode sub-item.
     subItemId: z.string().nullable(),
     proposerUid: z.string(),
-    // Raw doc field name → proposed new text. Allowlist + per-field caps enforced by the
-    // submit runner against HALL_CONTENT_TEXT_FIELDS / HALL_CONTENT_TEXT_FIELD_MAX.
-    proposedFields: z.record(z.string(), z.string()),
+    // Closed, surface-discriminated text patch. The persisted surface and patch surface must
+    // agree, and the patch contains only fields that surface owns.
+    proposedFields: HallContentTextPatchSchema,
     status: z.enum(['requested', 'approved', 'denied']),
     createdAt: z.number(),
     lastUpdatedAt: z.number(),
@@ -198,7 +200,66 @@ export const HallContentChangeRequestSchema = z.object({
     resolvedBy: z.string().optional(),
     // Admin's reason, surfaced to the member (required on a deny).
     resolutionReason: z.string().optional(),
+}).superRefine((value, ctx) => {
+    const patchSurface = value.proposedFields.surface;
+    if (patchSurface !== value.surface) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'The proposed text patch surface must match the request surface.',
+            path: ['proposedFields', 'surface'],
+        });
+    }
+    if (value.surface === 'workRealm') {
+        if (value.hallItemId !== null || value.workProjectType !== null || value.workRealmId === null || value.subItemId !== null) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'A workRealm request must carry only the realm target grain.',
+                path: ['surface'],
+            });
+        }
+        return;
+    }
+    if (value.hallItemId === null || value.workProjectType === null || value.workRealmId !== null) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'A Hall request must carry a hall item and work-project type, not a realm.',
+            path: ['surface'],
+        });
+        return;
+    }
+    const routing = HALL_CONTENT_SURFACES_BY_WORK_TYPE[value.workProjectType];
+    const expectedSurface = value.subItemId === null ? routing.detailSurface : routing.subItemSurface;
+    if (value.surface !== expectedSurface) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `The target grain requires the ${expectedSurface} surface.`,
+            path: ['surface'],
+        });
+    }
 });
+/**
+ * Older valid rows stored the same closed fields directly as a map and already carry
+ * the authoritative request-level surface. Normalize that legacy representation while
+ * reading so deployment does not strand outstanding requests; all new writers use the
+ * closed discriminated patch above.
+ */
+export const HallContentChangeRequestSchema = z.preprocess((raw) => {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return raw;
+    const value = raw;
+    const proposedFields = value.proposedFields;
+    if (typeof proposedFields === 'object'
+        && proposedFields !== null
+        && !Array.isArray(proposedFields)
+        && !Object.prototype.hasOwnProperty.call(proposedFields, 'surface')
+        && typeof value.surface === 'string') {
+        return {
+            ...value,
+            proposedFields: { surface: value.surface, fields: proposedFields },
+        };
+    }
+    return raw;
+}, HallContentChangeRequestCanonicalSchema);
 export const PublishedHallItemSchema = z.object({
     hallItemId: z.string(),
     workProjectId: z.string(),