@ttt-productions/ttt-core 0.79.57 → 0.79.58

package/dist/constants/app-mode.d.ts

@@ -1,3 +1,4 @@
+import type { WorkProjectType } from '../types/content.js';
 export type AppMode = 'charter' | 'full';
 /** The deployed mode. Changing this constant (and publishing) IS the flip. */
 export declare const APP_MODE: AppMode;
@@ -82,8 +83,19 @@ export interface TttLimits {
 export declare const CHARTER_LIMITS: TttLimits;
 export declare const FULL_LIMITS: TttLimits;
 /** The resolved limit set for the deployed mode. Import THIS (or the alias
- * constants that re-export from it), never CHARTER_/FULL_ directly. */
+ * constants that re-export from it), never CHARTER_/FULL_ directly. A read bound
+ * that must hold whichever mode the data was written under uses
+ * HALL_SUB_ITEM_READ_BOUND_BY_WORK_TYPE below instead. */
 export declare const ACTIVE_LIMITS: TttLimits;
+/**
+ * The most sub-items one Hall item can hold of each kind (Tale chapters, Tune tracks, Television
+ * episodes) in ANY app mode — each kind's count cap at its largest across CHARTER_LIMITS and
+ * FULL_LIMITS. A READ bound, never an enforced limit: a Hall item keeps the sub-items it was
+ * published with when the mode changes, so a reader that must see all of them sizes its query
+ * from this and treats a read that returns more as uncertain. Enforcement reads the active caps
+ * (MAX_CHAPTERS, MAX_TUNE_TRACKS, MAX_TELEVISION_EPISODES).
+ */
+export declare const HALL_SUB_ITEM_READ_BOUND_BY_WORK_TYPE: Readonly<Record<WorkProjectType, number>>;
 /**
  * User-facing copy for a reached count cap — the ONE owner of the cap-message
  * shape, beside the limits it describes. Every callable refusing on a

package/dist/constants/app-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-mode.d.ts","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,EAAE,OAAmB,CAAC;AAE3C,qDAAqD;AACrD,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,KAAG,CACM,CAAC;AAEvD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,GAAG,MAAM,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,yBAAyB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,WAAW,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,MAAM,CAAC;QAChC,uBAAuB,EAAE,MAAM,CAAC;QAChC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,oFAAoF;QACpF,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF;;qFAEiF;IACjF,YAAY,EAAE;QACZ,uEAAuE;QACvE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iEAAiE;QACjE,+BAA+B,EAAE,MAAM,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,wBAAwB,EAAE,MAAM,CAAC;QACjC,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,gFAAgF;IAChF,UAAU,EAAE;QACV,MAAM,EAAE,cAAc,CAAC;QACvB,YAAY,EAAE,cAAc,CAAC;QAC7B,aAAa,EAAE,cAAc,CAAC;QAC9B,IAAI,EAAE,cAAc,CAAC;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,YAAY,EAAE,cAAc,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC;QAC3B,aAAa,EAAE,cAAc,CAAC;QAC9B,UAAU,EAAE,cAAc,CAAC;QAC3B,cAAc,EAAE,cAAc,CAAC;QAC/B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,cAAc,CAAC;QACjC,MAAM,EAAE,cAAc,CAAC;QACvB,eAAe,EAAE,cAAc,CAAC;QAChC,WAAW,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,WAAW,EAAE,cAAc,CAAC;QAC5B,sBAAsB,EAAE,cAAc,CAAC;QACvC,oBAAoB,EAAE,cAAc,CAAC;QACrC,sBAAsB,EAAE,cAAc,CAAC;QACvC,QAAQ,EAAE,cAAc,CAAC;QACzB,iBAAiB,EAAE,cAAc,CAAC;QAClC,aAAa,EAAE,cAAc,CAAC;QAC9B,kBAAkB,EAAE,cAAc,CAAC;QACnC,cAAc,EAAE,cAAc,CAAC;QAC/B,eAAe,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,eAAO,MAAM,cAAc,EAAE,SAoH5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,SAuFzB,CAAC;AAEF;uEACuE;AACvE,eAAO,MAAM,aAAa,EAAE,SAA+C,CAAC;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,OAAO,MAAM,EACb,MAAM,MAAM,EACZ,OAAO,MAAM,KACZ,MAMF,CAAC"}
+{"version":3,"file":"app-mode.d.ts","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,EAAE,OAAmB,CAAC;AAE3C,qDAAqD;AACrD,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,KAAG,CACM,CAAC;AAEvD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,GAAG,MAAM,IAAI,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,yBAAyB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,WAAW,EAAE;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,MAAM,CAAC;QAChC,uBAAuB,EAAE,MAAM,CAAC;QAChC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,oFAAoF;QACpF,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF;;qFAEiF;IACjF,YAAY,EAAE;QACZ,uEAAuE;QACvE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iEAAiE;QACjE,+BAA+B,EAAE,MAAM,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,wBAAwB,EAAE,MAAM,CAAC;QACjC,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,gFAAgF;IAChF,UAAU,EAAE;QACV,MAAM,EAAE,cAAc,CAAC;QACvB,YAAY,EAAE,cAAc,CAAC;QAC7B,aAAa,EAAE,cAAc,CAAC;QAC9B,IAAI,EAAE,cAAc,CAAC;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,YAAY,EAAE,cAAc,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC;QAC3B,aAAa,EAAE,cAAc,CAAC;QAC9B,UAAU,EAAE,cAAc,CAAC;QAC3B,cAAc,EAAE,cAAc,CAAC;QAC/B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,cAAc,CAAC;QACjC,MAAM,EAAE,cAAc,CAAC;QACvB,eAAe,EAAE,cAAc,CAAC;QAChC,WAAW,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,cAAc,CAAC;QAC3B,gBAAgB,EAAE,cAAc,CAAC;QACjC,kBAAkB,EAAE,cAAc,CAAC;QACnC,WAAW,EAAE,cAAc,CAAC;QAC5B,sBAAsB,EAAE,cAAc,CAAC;QACvC,oBAAoB,EAAE,cAAc,CAAC;QACrC,sBAAsB,EAAE,cAAc,CAAC;QACvC,QAAQ,EAAE,cAAc,CAAC;QACzB,iBAAiB,EAAE,cAAc,CAAC;QAClC,aAAa,EAAE,cAAc,CAAC;QAC9B,kBAAkB,EAAE,cAAc,CAAC;QACnC,cAAc,EAAE,cAAc,CAAC;QAC/B,eAAe,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,eAAO,MAAM,cAAc,EAAE,SAoH5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,SAuFzB,CAAC;AAEF;;;0DAG0D;AAC1D,eAAO,MAAM,aAAa,EAAE,SAA+C,CAAC;AAK5E;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAI3F,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,OAAO,MAAM,EACb,MAAM,MAAM,EACZ,OAAO,MAAM,KACZ,MAMF,CAAC"}

package/dist/constants/app-mode.js

@@ -219,8 +219,24 @@ export const FULL_LIMITS = {
     },
 };
 /** The resolved limit set for the deployed mode. Import THIS (or the alias
- * constants that re-export from it), never CHARTER_/FULL_ directly. */
+ * constants that re-export from it), never CHARTER_/FULL_ directly. A read bound
+ * that must hold whichever mode the data was written under uses
+ * HALL_SUB_ITEM_READ_BOUND_BY_WORK_TYPE below instead. */
 export const ACTIVE_LIMITS = byMode(CHARTER_LIMITS, FULL_LIMITS);
+const largestInAnyMode = (pick) => Math.max(pick(CHARTER_LIMITS), pick(FULL_LIMITS));
+/**
+ * The most sub-items one Hall item can hold of each kind (Tale chapters, Tune tracks, Television
+ * episodes) in ANY app mode — each kind's count cap at its largest across CHARTER_LIMITS and
+ * FULL_LIMITS. A READ bound, never an enforced limit: a Hall item keeps the sub-items it was
+ * published with when the mode changes, so a reader that must see all of them sizes its query
+ * from this and treats a read that returns more as uncertain. Enforcement reads the active caps
+ * (MAX_CHAPTERS, MAX_TUNE_TRACKS, MAX_TELEVISION_EPISODES).
+ */
+export const HALL_SUB_ITEM_READ_BOUND_BY_WORK_TYPE = {
+    Tales: largestInAnyMode((limits) => limits.workProject.maxChapters),
+    Tunes: largestInAnyMode((limits) => limits.workProject.maxTuneTracks),
+    Television: largestInAnyMode((limits) => limits.workProject.maxTelevisionEpisodes),
+};
 /**
  * User-facing copy for a reached count cap — the ONE owner of the cap-message
  * shape, beside the limits it describes. Every callable refusing on a

package/dist/constants/app-mode.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-mode.js","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,+DAA+D;AAC/D,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AAIzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAY,SAAS,CAAC;AAE3C,qDAAqD;AACrD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAI,OAAU,EAAE,IAAO,EAAK,EAAE,CACjD,QAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAiFvD,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,cAAc,EAAE,CAAC;QACjB,oBAAoB,EAAE,CAAC;QACvB,yBAAyB,EAAE,EAAE;KAC9B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,GAAG;QACjB,uBAAuB,EAAE,aAAa,EAAE,UAAU;QAClD,uBAAuB,EAAE,CAAC;QAC1B,qBAAqB,EAAE,CAAC;QACxB,WAAW,EAAE,CAAC;QACd,+EAA+E;QAC/E,yDAAyD;QACzD,uBAAuB,EAAE,MAAM;QAC/B,aAAa,EAAE,CAAC;QAChB,qBAAqB,EAAE,CAAC;KACzB;IACD,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,wFAAwF;IACxF,uDAAuD;IACvD,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,WAAW,EAAE,UAAU;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,EAAE;IACrE,UAAU,EAAE;QACV,2EAA2E;QAC3E,iCAAiC;QACjC,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,8EAA8E;QAC9E,yEAAyE;QACzE,6EAA6E;QAC7E,+EAA+E;QAC/E,mFAAmF;QACnF,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,iCAAiC;QACjC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,yEAAyE;QACzE,6EAA6E;QAC7E,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,oFAAoF;QACpF,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,8BAA8B;QAC9B,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,mFAAmF;QACnF,0FAA0F;QAC1F,2EAA2E;QAC3E,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,mFAAmF;QACnF,mFAAmF;QACnF,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,2FAA2F;QAC3F,8FAA8F;QAC9F,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,eAAe,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACJ,cAAc,EAAE,EAAE;QAClB,oBAAoB,EAAE,EAAE;QACxB,yBAAyB,EAAE,GAAG;KAC/B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,GAAG;QACjB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,IAAI;QAClB,uBAAuB,EAAE,cAAc,EAAE,SAAS;QAClD,uBAAuB,EAAE,EAAE;QAC3B,qBAAqB,EAAE,EAAE;QACzB,WAAW,EAAE,EAAE;QACf,8EAA8E;QAC9E,4EAA4E;QAC5E,yEAAyE;QACzE,uBAAuB,EAAE,OAAO;QAChC,aAAa,EAAE,EAAE;QACjB,qBAAqB,EAAE,EAAE;KAC1B;IACD,iFAAiF;IACjF,4EAA4E;IAC5E,sFAAsF;IACtF,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,aAAa,EAAE,QAAQ;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE;IACvE,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,gFAAgF;QAChF,6EAA6E;QAC7E,2EAA2E;QAC3E,mDAAmD;QACnD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gFAAgF;QAChF,8EAA8E;QAC9E,2DAA2D;QAC3D,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,uDAAuD;QACvD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,wFAAwF;QACxF,6FAA6F;QAC7F,4FAA4F;QAC5F,sEAAsE;QACtE,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,2FAA2F;QAC3F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,eAAe,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KACpD;CACF,CAAC;AAEF;uEACuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAc,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,OAAe,EACf,KAAa,EACb,IAAY,EACZ,IAAa,EACL,EAAE;IACV,MAAM,IAAI,GAAG,MAAM,CACjB,GAAG,OAAO,8CAA8C,KAAK,IAAI,IAAI,0CAA0C,EAC/G,GAAG,OAAO,+BAA+B,KAAK,IAAI,IAAI,GAAG,CAC1D,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC","sourcesContent":["// App mode + the charter/full limit sets — the single published constant that\n// drives the whole app's cost posture. The flip to full-live is: change\n// APP_MODE → publish ttt-core → install in ttt-prod (root + functions) →\n// deploy. There is NO runtime mode flag and NO console toggle.\n// See ttt-prod docs/design/charter-season-and-app-mode.md.\n//\n// Only real cost/abuse drivers vary by mode: media specs (ttt-media-specs.ts),\n// rate-limit values, count caps, batch sizes. Text-length limits and payment\n// min/max are deliberately mode-invariant — with ONE ruled exception (DJ\n// 2026-07-13): chapter body content (maxChapterContentLength), because it\n// bounds threshold-review reading effort per item during charter season.\n\nexport type AppMode = 'charter' | 'full';\n\n/** The deployed mode. Changing this constant (and publishing) IS the flip. */\nexport const APP_MODE: AppMode = 'charter';\n\n/** Pick the active value for a mode-varied limit. */\nexport const byMode = <T>(charter: T, full: T): T =>\n  (APP_MODE as AppMode) === 'charter' ? charter : full;\n\n/** Upstash-style sliding-window duration, e.g. '1 h'. */\nexport type RateLimitWindow = `${number} ${'ms' | 's' | 'm' | 'h' | 'd'}`;\n\nexport interface RateLimitValue {\n  maxRequests: number;\n  window: RateLimitWindow;\n}\n\nexport interface TttLimits {\n  mode: AppMode;\n  user: {\n    maxCraftSkills: number;\n    maxOwnedWorkProjects: number;\n    maxAssociatedWorkProjects: number;\n  };\n  workProject: {\n    maxGuildSize: number;\n    maxFileFolders: number;\n    maxWorkFiles: number;\n    maxWorkFileStorageBytes: number;\n    maxWorkProjectAuditions: number;\n    maxCommissionListings: number;\n    maxChapters: number;\n    /** Chapter BODY length (chars) — the one mode-varied text limit (DJ 2026-07-13). */\n    maxChapterContentLength: number;\n    maxTuneTracks: number;\n    maxTelevisionEpisodes: number;\n  };\n  /** Conversation Files container caps — PER CONVERSATION (one guild-invite\n   *  conversation or one admin-support dispatch thread). Both scopes share one cap\n   *  set; guild chat channels have no Conversation Files. DJ ruling 2026-07-25. */\n  conversation: {\n    /** Published active Conversation Files allowed in one conversation. */\n    maxConversationFiles: number;\n    /** Published STORED-OUTPUT bytes allowed in one conversation. */\n    maxConversationFileStorageBytes: number;\n  };\n  hall: {\n    maxSubmitBatch: number;\n  };\n  batches: {\n    trendingFeedProcessLimit: number;\n    maxFeedbackSubmitters: number;\n  };\n  /** Values for the backend rate limiters. Prefixes/factory stay in functions. */\n  rateLimits: {\n    UPLOAD: RateLimitValue;\n    ADMIN_UPLOAD: RateLimitValue;\n    CONTENT_WRITE: RateLimitValue;\n    VOTE: RateLimitValue;\n    MODERATION: RateLimitValue;\n    SENSITIVE_ACTION: RateLimitValue;\n    DISPLAY_NAME_CHECK: RateLimitValue;\n    CHAT_MESSAGE: RateLimitValue;\n    ADMIN_TASK: RateLimitValue;\n    APPEAL_REVIEW: RateLimitValue;\n    BAN_ACTION: RateLimitValue;\n    SHARE_TRANSFER: RateLimitValue;\n    CONTENT_REPORT: RateLimitValue;\n    SHORT_LINK_CLICK: RateLimitValue;\n    FOLLOW: RateLimitValue;\n    MENTION_HISTORY: RateLimitValue;\n    MEDIA_GRANT: RateLimitValue;\n    CHAT_GRANT: RateLimitValue;\n    OPERATOR_STEP_UP: RateLimitValue;\n    ADMIN_MESSAGE_READ: RateLimitValue;\n    USER_LOOKUP: RateLimitValue;\n    NOTIFICATION_BROADCAST: RateLimitValue;\n    NOTIFICATION_ARCHIVE: RateLimitValue;\n    NOTIFICATION_MARK_SEEN: RateLimitValue;\n    FEEDBACK: RateLimitValue;\n    SHORT_LINK_CREATE: RateLimitValue;\n    INVITE_ACTION: RateLimitValue;\n    LIBRARY_SUBMISSION: RateLimitValue;\n    CHANNEL_CREATE: RateLimitValue;\n    CHECKOUT_CREATE: RateLimitValue;\n  };\n}\n\nexport const CHARTER_LIMITS: TttLimits = {\n  mode: 'charter',\n  user: {\n    maxCraftSkills: 8,\n    maxOwnedWorkProjects: 3,\n    maxAssociatedWorkProjects: 10,\n  },\n  workProject: {\n    maxGuildSize: 25,\n    maxFileFolders: 10,\n    maxWorkFiles: 100,\n    maxWorkFileStorageBytes: 2_684_354_560, // 2.5 GiB\n    maxWorkProjectAuditions: 3,\n    maxCommissionListings: 3,\n    maxChapters: 5,\n    // ~5,000 words — a full real chapter, while keeping the human threshold-review\n    // reading effort per item bounded during charter season.\n    maxChapterContentLength: 30_000,\n    maxTuneTracks: 5,\n    maxTelevisionEpisodes: 3,\n  },\n  // Conversation Files are QUOTA'D PER CONVERSATION (DJ ruling 2026-07-25). Counted on\n  // STORED OUTPUT bytes (what actually sits in R2 after transcode), never on raw upload\n  // bytes. Rationale: a per-file `maxBytes` cap alone bounds one upload but nothing stops\n  // unbounded accumulation across a long-running conversation — this is the abuse brake\n  // on that, and it is what `startUpload`'s reservation and the publication transfer both\n  // check. Charter: 10 files / 500 MiB per conversation.\n  conversation: {\n    maxConversationFiles: 10,\n    maxConversationFileStorageBytes: 524_288_000, // 500 MiB\n  },\n  hall: { maxSubmitBatch: 10 },\n  batches: { trendingFeedProcessLimit: 250, maxFeedbackSubmitters: 25 },\n  rateLimits: {\n    // Uploads are charged ONCE per upload (in startUpload); the processor-side\n    // check is a non-charging guard.\n    UPLOAD: { maxRequests: 15, window: '1 h' },\n    // A separate HIGHER bucket for uploads performed through the sanctioned admin\n    // authority path — never an exemption. Bulk admin setup work (creating 3\n    // auditions is ~5 uploads) exhausts the 15/h user bucket; 60/h covers a real\n    // bulk admin session while keeping a brake on a compromised admin token and on\n    // third-party quota/cost (Vision / Video Intelligence / R2). DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 60, window: '1 h' },\n    // General content-write throttle for the non-upload write callables (text posts,\n    // craft-skill edits, support-thread starts) that used to charge UPLOAD. Sharing\n    // the 15/h charter upload window meant heavy text posting blocked real uploads\n    // and vice versa; a separate 30/h bucket keeps each cost driver on its own\n    // ceiling. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 30, window: '1 h' },\n    VOTE: { maxRequests: 100, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 30/h: one bucket is shared by ~35 callables (register, become-artisan,\n    // create-work, invites, trades, appeals, …) — a real first-hour artisan does\n    // 10-15 legitimate sensitive actions; 5/h blocked the intended golden path\n    // (proven live by the hosted-dev E2E, 2026-07-07). DJ ruling 2026-07-08.\n    SENSITIVE_ACTION: { maxRequests: 30, window: '1 h' },\n    // 120/h (charter): checkDisplayNameAvailable is enforceAppCheck:true, so\n    // reCAPTCHA-Enterprise attestation is the real abuse gate — this bucket is a\n    // cost/DoS ceiling, not the security boundary. It is IP-keyed (pre-registration,\n    // no uid yet) and the register form fires it debounced-LIVE as you type, so one\n    // legit registrant spends ~3-8 checks and shared NAT/CGNAT multiplies that across\n    // everyone on the IP. The old 20/h false-rejected legitimate shared-IP users and\n    // could not fit a full hosted-dev E2E suite run on one IP. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 120, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 125, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 5, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 20, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // Scoped-media grant minting (createMediaGrant). Its OWN bucket — it used to charge\n    // MENTION_HISTORY, an unrelated surface, so neither limit meant what its name said and the\n    // two shared a budget sized for neither (BACKEND-013). Refresh-driven, not user-initiated:\n    // a grant is short-TTL (60 min work media, 15 min chat/folder scopes) and the client re-mints\n    // under expiry, so a browsing session naturally spends several per hour PER SCOPE (each work,\n    // each private file folder, each conversation). Cheap to serve (a Firestore permission read\n    // plus an HMAC sign — no third-party cost), and a false 429 breaks media rendering outright,\n    // so the ceiling is generous: it exists to stop a scripted grant-farming sweep, not to pace a\n    // real reader. 120/h charter.\n    MEDIA_GRANT: { maxRequests: 120, window: '1 h' },\n    // Realtime chat grant minting (mintChatGrant) — previously NO limiter at all (BACKEND-013),\n    // despite minting signed grants at concurrency: 20. Same refresh-driven shape as MEDIA_GRANT:\n    // a 15-minute grant TTL means ~4 mints/hour for the inbox plus ~4 per open channel, doubled\n    // again by socket reconnects on a flaky mobile network. It stays behind the per-channel\n    // authorizeChannelScope gate, so this bucket is a cost/DoS ceiling rather than the\n    // authorization boundary — sized to match MEDIA_GRANT so the two grant surfaces are paced\n    // alike and neither can be starved by the other (separate Redis prefixes).\n    CHAT_GRANT: { maxRequests: 120, window: '1 h' },\n    // Operator step-up TOTP verification (confirmOperatorStepUp / verifyOperatorStepUp) —\n    // previously unthrottled, so an attacker holding a stolen full-admin session could\n    // brute-force the 6-digit second factor guarding the safety console (BACKEND-013).\n    // DELIBERATELY THE TIGHTEST BUCKET IN THE SET: a real operator enrolls once and verifies\n    // roughly twice an hour (the grant window is 30 minutes), so 10/h absorbs every legitimate\n    // mistype while capping guessing at 10 attempts per hour against a code that rotates every\n    // 30 seconds. Mode-INVARIANT — this is an admin security control, not a cost driver, so it\n    // never loosens at the full-mode flip (same posture as MODERATION / BAN_ACTION / USER_LOOKUP).\n    // The lockout-after-N-failures behaviour is a separate app-side concern; this is the throttle.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup (searchPublicUsers / lookupUserByEmailOrUid) — a read, so a\n    // generous per-minute bucket that still backstops a scripted enumeration sweep. Admin-only\n    // and not a cost driver, so the value is the same in both modes (like MODERATION/ADMIN_TASK).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 30, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 10, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 5, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 5, window: '1 h' },\n  },\n};\n\nexport const FULL_LIMITS: TttLimits = {\n  mode: 'full',\n  user: {\n    maxCraftSkills: 24,\n    maxOwnedWorkProjects: 25,\n    maxAssociatedWorkProjects: 100,\n  },\n  workProject: {\n    maxGuildSize: 250,\n    maxFileFolders: 25,\n    maxWorkFiles: 1000,\n    maxWorkFileStorageBytes: 26_843_545_600, // 25 GiB\n    maxWorkProjectAuditions: 10,\n    maxCommissionListings: 10,\n    maxChapters: 50,\n    // The intentional design ceiling (~17,000 words; trivially inside Firestore's\n    // 1 MiB doc limit) — the audit trail deliberately stores field LENGTHS, not\n    // content, because chapters can be this large (runUpdateChapterDetails).\n    maxChapterContentLength: 100_000,\n    maxTuneTracks: 50,\n    maxTelevisionEpisodes: 25,\n  },\n  // 20 files / 1 GiB (full): the same per-conversation Conversation Files quota as\n  // charter, scaled for a public-launch conversation. Still a hard ceiling on\n  // unbounded R2 accumulation. See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n  conversation: {\n    maxConversationFiles: 20,\n    maxConversationFileStorageBytes: 1_073_741_824, // 1 GiB\n  },\n  hall: { maxSubmitBatch: 50 },\n  batches: { trendingFeedProcessLimit: 1000, maxFeedbackSubmitters: 100 },\n  rateLimits: {\n    UPLOAD: { maxRequests: 30, window: '1 h' },\n    // 120/h (full): the same sanctioned-admin-path upload bucket as charter, scaled\n    // with UPLOAD — always HIGHER than the user bucket, never an exemption, so a\n    // compromised admin token and third-party media cost stay bounded. See the\n    // CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 120, window: '1 h' },\n    // 60/h (full): the same non-upload content-write bucket as charter, scaled with\n    // UPLOAD so text writes and media uploads never consume each other's ceiling.\n    // See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 60, window: '1 h' },\n    VOTE: { maxRequests: 200, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 60/h: full-mode power users managing several works do dozens of legitimate\n    // management actions per hour; still a hard backstop against scripts.\n    // DJ ruling 2026-07-08 (charter 30 / full 60, single bucket; a bucket split\n    // is filed post-launch in ttt-prod docs/post-launch/).\n    SENSITIVE_ACTION: { maxRequests: 60, window: '1 h' },\n    // 300/h (full): same reasoning as the charter value above (App-Check-gated\n    // cost ceiling, IP-keyed, debounced-live). Public-launch CGNAT exposure is far\n    // larger — hundreds of concurrent legit registrants can sit behind one carrier\n    // IP — so err generous; the only cost of \"too high\" is trivial Firestore reads,\n    // while \"too low\" false-rejects real users. Raise on evidence (watch prod logs\n    // for legit 429s) rather than pre-emptively tightening. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 300, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 150, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 20, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 60, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // 240/h (full): the same grant-minting buckets as charter, doubled with the surrounding\n    // content limits. Full mode raises the ceilings a grant is minted PER (250-guildmate guilds,\n    // 25 file folders, 1000 work files, 10 auditions), so one session legitimately touches more\n    // scopes and re-mints more often. See the CHARTER_LIMITS notes above.\n    MEDIA_GRANT: { maxRequests: 240, window: '1 h' },\n    CHAT_GRANT: { maxRequests: 240, window: '1 h' },\n    // Operator step-up stays at 10/h in BOTH modes — an admin second-factor throttle is a\n    // security control, not a cost lever, so it never loosens at the flip. See CHARTER_LIMITS.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup — same read bucket in both modes (see CHARTER_LIMITS note).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 60, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 20, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 20, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 20, window: '1 h' },\n  },\n};\n\n/** The resolved limit set for the deployed mode. Import THIS (or the alias\n * constants that re-export from it), never CHARTER_/FULL_ directly. */\nexport const ACTIVE_LIMITS: TttLimits = byMode(CHARTER_LIMITS, FULL_LIMITS);\n\n/**\n * User-facing copy for a reached count cap — the ONE owner of the cap-message\n * shape, beside the limits it describes. Every callable refusing on a\n * mode-varied count cap formats through this. In charter mode the message\n * names Charter Season so the cap reads as the season's limit rather than the\n * platform's permanent shape; full mode stays neutral. `hint` is an optional\n * trailing sentence (e.g. \"Delete a file to add another.\").\n */\nexport const countCapReachedMessage = (\n  subject: string,\n  limit: number,\n  noun: string,\n  hint?: string,\n): string => {\n  const base = byMode(\n    `${subject} already has the Charter Season maximum of ${limit} ${noun} — caps expand when Charter Season ends.`,\n    `${subject} already has the maximum of ${limit} ${noun}.`,\n  );\n  return hint ? `${base} ${hint}` : base;\n};\n"]}
+{"version":3,"file":"app-mode.js","sourceRoot":"","sources":["../../src/constants/app-mode.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,+DAA+D;AAC/D,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AAMzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAY,SAAS,CAAC;AAE3C,qDAAqD;AACrD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAI,OAAU,EAAE,IAAO,EAAK,EAAE,CACjD,QAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAiFvD,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,cAAc,EAAE,CAAC;QACjB,oBAAoB,EAAE,CAAC;QACvB,yBAAyB,EAAE,EAAE;KAC9B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,GAAG;QACjB,uBAAuB,EAAE,aAAa,EAAE,UAAU;QAClD,uBAAuB,EAAE,CAAC;QAC1B,qBAAqB,EAAE,CAAC;QACxB,WAAW,EAAE,CAAC;QACd,+EAA+E;QAC/E,yDAAyD;QACzD,uBAAuB,EAAE,MAAM;QAC/B,aAAa,EAAE,CAAC;QAChB,qBAAqB,EAAE,CAAC;KACzB;IACD,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,wFAAwF;IACxF,uDAAuD;IACvD,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,WAAW,EAAE,UAAU;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,EAAE;IACrE,UAAU,EAAE;QACV,2EAA2E;QAC3E,iCAAiC;QACjC,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,8EAA8E;QAC9E,yEAAyE;QACzE,6EAA6E;QAC7E,+EAA+E;QAC/E,mFAAmF;QACnF,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,iCAAiC;QACjC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,yEAAyE;QACzE,6EAA6E;QAC7E,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,oFAAoF;QACpF,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,8BAA8B;QAC9B,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,mFAAmF;QACnF,0FAA0F;QAC1F,2EAA2E;QAC3E,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,mFAAmF;QACnF,mFAAmF;QACnF,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,2FAA2F;QAC3F,8FAA8F;QAC9F,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,eAAe,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE;QACJ,cAAc,EAAE,EAAE;QAClB,oBAAoB,EAAE,EAAE;QACxB,yBAAyB,EAAE,GAAG;KAC/B;IACD,WAAW,EAAE;QACX,YAAY,EAAE,GAAG;QACjB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,IAAI;QAClB,uBAAuB,EAAE,cAAc,EAAE,SAAS;QAClD,uBAAuB,EAAE,EAAE;QAC3B,qBAAqB,EAAE,EAAE;QACzB,WAAW,EAAE,EAAE;QACf,8EAA8E;QAC9E,4EAA4E;QAC5E,yEAAyE;QACzE,uBAAuB,EAAE,OAAO;QAChC,aAAa,EAAE,EAAE;QACjB,qBAAqB,EAAE,EAAE;KAC1B;IACD,iFAAiF;IACjF,4EAA4E;IAC5E,sFAAsF;IACtF,YAAY,EAAE;QACZ,oBAAoB,EAAE,EAAE;QACxB,+BAA+B,EAAE,aAAa,EAAE,QAAQ;KACzD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IAC5B,OAAO,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE;IACvE,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,gFAAgF;QAChF,6EAA6E;QAC7E,2EAA2E;QAC3E,mDAAmD;QACnD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,gFAAgF;QAChF,8EAA8E;QAC9E,2DAA2D;QAC3D,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,uDAAuD;QACvD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,kBAAkB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACvD,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9C,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1C,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,wFAAwF;QACxF,6FAA6F;QAC7F,4FAA4F;QAC5F,sEAAsE;QACtE,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAChD,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sFAAsF;QACtF,2FAA2F;QAC3F,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,yFAAyF;QACzF,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/C,sBAAsB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1D,oBAAoB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QACzD,sBAAsB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3D,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACjD,kBAAkB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACtD,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,eAAe,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KACpD;CACF,CAAC;AAEF;;;0DAG0D;AAC1D,MAAM,CAAC,MAAM,aAAa,GAAc,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;AAE5E,MAAM,gBAAgB,GAAG,CAAC,IAAmC,EAAU,EAAE,CACvE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAA8C;IAC9F,KAAK,EAAE,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;IACnE,KAAK,EAAE,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC;IACrE,UAAU,EAAE,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC;CACnF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,OAAe,EACf,KAAa,EACb,IAAY,EACZ,IAAa,EACL,EAAE;IACV,MAAM,IAAI,GAAG,MAAM,CACjB,GAAG,OAAO,8CAA8C,KAAK,IAAI,IAAI,0CAA0C,EAC/G,GAAG,OAAO,+BAA+B,KAAK,IAAI,IAAI,GAAG,CAC1D,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC","sourcesContent":["// App mode + the charter/full limit sets — the single published constant that\n// drives the whole app's cost posture. The flip to full-live is: change\n// APP_MODE → publish ttt-core → install in ttt-prod (root + functions) →\n// deploy. There is NO runtime mode flag and NO console toggle.\n// See ttt-prod docs/design/charter-season-and-app-mode.md.\n//\n// Only real cost/abuse drivers vary by mode: media specs (ttt-media-specs.ts),\n// rate-limit values, count caps, batch sizes. Text-length limits and payment\n// min/max are deliberately mode-invariant — with ONE ruled exception (DJ\n// 2026-07-13): chapter body content (maxChapterContentLength), because it\n// bounds threshold-review reading effort per item during charter season.\n\nimport type { WorkProjectType } from '../types/content.js';\n\nexport type AppMode = 'charter' | 'full';\n\n/** The deployed mode. Changing this constant (and publishing) IS the flip. */\nexport const APP_MODE: AppMode = 'charter';\n\n/** Pick the active value for a mode-varied limit. */\nexport const byMode = <T>(charter: T, full: T): T =>\n  (APP_MODE as AppMode) === 'charter' ? charter : full;\n\n/** Upstash-style sliding-window duration, e.g. '1 h'. */\nexport type RateLimitWindow = `${number} ${'ms' | 's' | 'm' | 'h' | 'd'}`;\n\nexport interface RateLimitValue {\n  maxRequests: number;\n  window: RateLimitWindow;\n}\n\nexport interface TttLimits {\n  mode: AppMode;\n  user: {\n    maxCraftSkills: number;\n    maxOwnedWorkProjects: number;\n    maxAssociatedWorkProjects: number;\n  };\n  workProject: {\n    maxGuildSize: number;\n    maxFileFolders: number;\n    maxWorkFiles: number;\n    maxWorkFileStorageBytes: number;\n    maxWorkProjectAuditions: number;\n    maxCommissionListings: number;\n    maxChapters: number;\n    /** Chapter BODY length (chars) — the one mode-varied text limit (DJ 2026-07-13). */\n    maxChapterContentLength: number;\n    maxTuneTracks: number;\n    maxTelevisionEpisodes: number;\n  };\n  /** Conversation Files container caps — PER CONVERSATION (one guild-invite\n   *  conversation or one admin-support dispatch thread). Both scopes share one cap\n   *  set; guild chat channels have no Conversation Files. DJ ruling 2026-07-25. */\n  conversation: {\n    /** Published active Conversation Files allowed in one conversation. */\n    maxConversationFiles: number;\n    /** Published STORED-OUTPUT bytes allowed in one conversation. */\n    maxConversationFileStorageBytes: number;\n  };\n  hall: {\n    maxSubmitBatch: number;\n  };\n  batches: {\n    trendingFeedProcessLimit: number;\n    maxFeedbackSubmitters: number;\n  };\n  /** Values for the backend rate limiters. Prefixes/factory stay in functions. */\n  rateLimits: {\n    UPLOAD: RateLimitValue;\n    ADMIN_UPLOAD: RateLimitValue;\n    CONTENT_WRITE: RateLimitValue;\n    VOTE: RateLimitValue;\n    MODERATION: RateLimitValue;\n    SENSITIVE_ACTION: RateLimitValue;\n    DISPLAY_NAME_CHECK: RateLimitValue;\n    CHAT_MESSAGE: RateLimitValue;\n    ADMIN_TASK: RateLimitValue;\n    APPEAL_REVIEW: RateLimitValue;\n    BAN_ACTION: RateLimitValue;\n    SHARE_TRANSFER: RateLimitValue;\n    CONTENT_REPORT: RateLimitValue;\n    SHORT_LINK_CLICK: RateLimitValue;\n    FOLLOW: RateLimitValue;\n    MENTION_HISTORY: RateLimitValue;\n    MEDIA_GRANT: RateLimitValue;\n    CHAT_GRANT: RateLimitValue;\n    OPERATOR_STEP_UP: RateLimitValue;\n    ADMIN_MESSAGE_READ: RateLimitValue;\n    USER_LOOKUP: RateLimitValue;\n    NOTIFICATION_BROADCAST: RateLimitValue;\n    NOTIFICATION_ARCHIVE: RateLimitValue;\n    NOTIFICATION_MARK_SEEN: RateLimitValue;\n    FEEDBACK: RateLimitValue;\n    SHORT_LINK_CREATE: RateLimitValue;\n    INVITE_ACTION: RateLimitValue;\n    LIBRARY_SUBMISSION: RateLimitValue;\n    CHANNEL_CREATE: RateLimitValue;\n    CHECKOUT_CREATE: RateLimitValue;\n  };\n}\n\nexport const CHARTER_LIMITS: TttLimits = {\n  mode: 'charter',\n  user: {\n    maxCraftSkills: 8,\n    maxOwnedWorkProjects: 3,\n    maxAssociatedWorkProjects: 10,\n  },\n  workProject: {\n    maxGuildSize: 25,\n    maxFileFolders: 10,\n    maxWorkFiles: 100,\n    maxWorkFileStorageBytes: 2_684_354_560, // 2.5 GiB\n    maxWorkProjectAuditions: 3,\n    maxCommissionListings: 3,\n    maxChapters: 5,\n    // ~5,000 words — a full real chapter, while keeping the human threshold-review\n    // reading effort per item bounded during charter season.\n    maxChapterContentLength: 30_000,\n    maxTuneTracks: 5,\n    maxTelevisionEpisodes: 3,\n  },\n  // Conversation Files are QUOTA'D PER CONVERSATION (DJ ruling 2026-07-25). Counted on\n  // STORED OUTPUT bytes (what actually sits in R2 after transcode), never on raw upload\n  // bytes. Rationale: a per-file `maxBytes` cap alone bounds one upload but nothing stops\n  // unbounded accumulation across a long-running conversation — this is the abuse brake\n  // on that, and it is what `startUpload`'s reservation and the publication transfer both\n  // check. Charter: 10 files / 500 MiB per conversation.\n  conversation: {\n    maxConversationFiles: 10,\n    maxConversationFileStorageBytes: 524_288_000, // 500 MiB\n  },\n  hall: { maxSubmitBatch: 10 },\n  batches: { trendingFeedProcessLimit: 250, maxFeedbackSubmitters: 25 },\n  rateLimits: {\n    // Uploads are charged ONCE per upload (in startUpload); the processor-side\n    // check is a non-charging guard.\n    UPLOAD: { maxRequests: 15, window: '1 h' },\n    // A separate HIGHER bucket for uploads performed through the sanctioned admin\n    // authority path — never an exemption. Bulk admin setup work (creating 3\n    // auditions is ~5 uploads) exhausts the 15/h user bucket; 60/h covers a real\n    // bulk admin session while keeping a brake on a compromised admin token and on\n    // third-party quota/cost (Vision / Video Intelligence / R2). DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 60, window: '1 h' },\n    // General content-write throttle for the non-upload write callables (text posts,\n    // craft-skill edits, support-thread starts) that used to charge UPLOAD. Sharing\n    // the 15/h charter upload window meant heavy text posting blocked real uploads\n    // and vice versa; a separate 30/h bucket keeps each cost driver on its own\n    // ceiling. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 30, window: '1 h' },\n    VOTE: { maxRequests: 100, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 30/h: one bucket is shared by ~35 callables (register, become-artisan,\n    // create-work, invites, trades, appeals, …) — a real first-hour artisan does\n    // 10-15 legitimate sensitive actions; 5/h blocked the intended golden path\n    // (proven live by the hosted-dev E2E, 2026-07-07). DJ ruling 2026-07-08.\n    SENSITIVE_ACTION: { maxRequests: 30, window: '1 h' },\n    // 120/h (charter): checkDisplayNameAvailable is enforceAppCheck:true, so\n    // reCAPTCHA-Enterprise attestation is the real abuse gate — this bucket is a\n    // cost/DoS ceiling, not the security boundary. It is IP-keyed (pre-registration,\n    // no uid yet) and the register form fires it debounced-LIVE as you type, so one\n    // legit registrant spends ~3-8 checks and shared NAT/CGNAT multiplies that across\n    // everyone on the IP. The old 20/h false-rejected legitimate shared-IP users and\n    // could not fit a full hosted-dev E2E suite run on one IP. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 120, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 125, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 5, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 20, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // Scoped-media grant minting (createMediaGrant). Its OWN bucket — it used to charge\n    // MENTION_HISTORY, an unrelated surface, so neither limit meant what its name said and the\n    // two shared a budget sized for neither (BACKEND-013). Refresh-driven, not user-initiated:\n    // a grant is short-TTL (60 min work media, 15 min chat/folder scopes) and the client re-mints\n    // under expiry, so a browsing session naturally spends several per hour PER SCOPE (each work,\n    // each private file folder, each conversation). Cheap to serve (a Firestore permission read\n    // plus an HMAC sign — no third-party cost), and a false 429 breaks media rendering outright,\n    // so the ceiling is generous: it exists to stop a scripted grant-farming sweep, not to pace a\n    // real reader. 120/h charter.\n    MEDIA_GRANT: { maxRequests: 120, window: '1 h' },\n    // Realtime chat grant minting (mintChatGrant) — previously NO limiter at all (BACKEND-013),\n    // despite minting signed grants at concurrency: 20. Same refresh-driven shape as MEDIA_GRANT:\n    // a 15-minute grant TTL means ~4 mints/hour for the inbox plus ~4 per open channel, doubled\n    // again by socket reconnects on a flaky mobile network. It stays behind the per-channel\n    // authorizeChannelScope gate, so this bucket is a cost/DoS ceiling rather than the\n    // authorization boundary — sized to match MEDIA_GRANT so the two grant surfaces are paced\n    // alike and neither can be starved by the other (separate Redis prefixes).\n    CHAT_GRANT: { maxRequests: 120, window: '1 h' },\n    // Operator step-up TOTP verification (confirmOperatorStepUp / verifyOperatorStepUp) —\n    // previously unthrottled, so an attacker holding a stolen full-admin session could\n    // brute-force the 6-digit second factor guarding the safety console (BACKEND-013).\n    // DELIBERATELY THE TIGHTEST BUCKET IN THE SET: a real operator enrolls once and verifies\n    // roughly twice an hour (the grant window is 30 minutes), so 10/h absorbs every legitimate\n    // mistype while capping guessing at 10 attempts per hour against a code that rotates every\n    // 30 seconds. Mode-INVARIANT — this is an admin security control, not a cost driver, so it\n    // never loosens at the full-mode flip (same posture as MODERATION / BAN_ACTION / USER_LOOKUP).\n    // The lockout-after-N-failures behaviour is a separate app-side concern; this is the throttle.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup (searchPublicUsers / lookupUserByEmailOrUid) — a read, so a\n    // generous per-minute bucket that still backstops a scripted enumeration sweep. Admin-only\n    // and not a cost driver, so the value is the same in both modes (like MODERATION/ADMIN_TASK).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 30, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 10, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 5, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 5, window: '1 h' },\n  },\n};\n\nexport const FULL_LIMITS: TttLimits = {\n  mode: 'full',\n  user: {\n    maxCraftSkills: 24,\n    maxOwnedWorkProjects: 25,\n    maxAssociatedWorkProjects: 100,\n  },\n  workProject: {\n    maxGuildSize: 250,\n    maxFileFolders: 25,\n    maxWorkFiles: 1000,\n    maxWorkFileStorageBytes: 26_843_545_600, // 25 GiB\n    maxWorkProjectAuditions: 10,\n    maxCommissionListings: 10,\n    maxChapters: 50,\n    // The intentional design ceiling (~17,000 words; trivially inside Firestore's\n    // 1 MiB doc limit) — the audit trail deliberately stores field LENGTHS, not\n    // content, because chapters can be this large (runUpdateChapterDetails).\n    maxChapterContentLength: 100_000,\n    maxTuneTracks: 50,\n    maxTelevisionEpisodes: 25,\n  },\n  // 20 files / 1 GiB (full): the same per-conversation Conversation Files quota as\n  // charter, scaled for a public-launch conversation. Still a hard ceiling on\n  // unbounded R2 accumulation. See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n  conversation: {\n    maxConversationFiles: 20,\n    maxConversationFileStorageBytes: 1_073_741_824, // 1 GiB\n  },\n  hall: { maxSubmitBatch: 50 },\n  batches: { trendingFeedProcessLimit: 1000, maxFeedbackSubmitters: 100 },\n  rateLimits: {\n    UPLOAD: { maxRequests: 30, window: '1 h' },\n    // 120/h (full): the same sanctioned-admin-path upload bucket as charter, scaled\n    // with UPLOAD — always HIGHER than the user bucket, never an exemption, so a\n    // compromised admin token and third-party media cost stay bounded. See the\n    // CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    ADMIN_UPLOAD: { maxRequests: 120, window: '1 h' },\n    // 60/h (full): the same non-upload content-write bucket as charter, scaled with\n    // UPLOAD so text writes and media uploads never consume each other's ceiling.\n    // See the CHARTER_LIMITS note above. DJ ruling 2026-07-25.\n    CONTENT_WRITE: { maxRequests: 60, window: '1 h' },\n    VOTE: { maxRequests: 200, window: '1 h' },\n    MODERATION: { maxRequests: 50, window: '1 h' },\n    // 60/h: full-mode power users managing several works do dozens of legitimate\n    // management actions per hour; still a hard backstop against scripts.\n    // DJ ruling 2026-07-08 (charter 30 / full 60, single bucket; a bucket split\n    // is filed post-launch in ttt-prod docs/post-launch/).\n    SENSITIVE_ACTION: { maxRequests: 60, window: '1 h' },\n    // 300/h (full): same reasoning as the charter value above (App-Check-gated\n    // cost ceiling, IP-keyed, debounced-live). Public-launch CGNAT exposure is far\n    // larger — hundreds of concurrent legit registrants can sit behind one carrier\n    // IP — so err generous; the only cost of \"too high\" is trivial Firestore reads,\n    // while \"too low\" false-rejects real users. Raise on evidence (watch prod logs\n    // for legit 429s) rather than pre-emptively tightening. DJ ruling 2026-07-21.\n    DISPLAY_NAME_CHECK: { maxRequests: 300, window: '1 h' },\n    CHAT_MESSAGE: { maxRequests: 150, window: '1 h' },\n    ADMIN_TASK: { maxRequests: 60, window: '1 h' },\n    APPEAL_REVIEW: { maxRequests: 30, window: '1 h' },\n    BAN_ACTION: { maxRequests: 20, window: '1 h' },\n    SHARE_TRANSFER: { maxRequests: 10, window: '1 h' },\n    CONTENT_REPORT: { maxRequests: 20, window: '1 h' },\n    SHORT_LINK_CLICK: { maxRequests: 60, window: '1 h' },\n    FOLLOW: { maxRequests: 60, window: '1 m' },\n    MENTION_HISTORY: { maxRequests: 120, window: '1 h' },\n    // 240/h (full): the same grant-minting buckets as charter, doubled with the surrounding\n    // content limits. Full mode raises the ceilings a grant is minted PER (250-guildmate guilds,\n    // 25 file folders, 1000 work files, 10 auditions), so one session legitimately touches more\n    // scopes and re-mints more often. See the CHARTER_LIMITS notes above.\n    MEDIA_GRANT: { maxRequests: 240, window: '1 h' },\n    CHAT_GRANT: { maxRequests: 240, window: '1 h' },\n    // Operator step-up stays at 10/h in BOTH modes — an admin second-factor throttle is a\n    // security control, not a cost lever, so it never loosens at the flip. See CHARTER_LIMITS.\n    OPERATOR_STEP_UP: { maxRequests: 10, window: '1 h' },\n    ADMIN_MESSAGE_READ: { maxRequests: 60, window: '1 h' },\n    // Admin exact-account lookup — same read bucket in both modes (see CHARTER_LIMITS note).\n    USER_LOOKUP: { maxRequests: 30, window: '1 m' },\n    NOTIFICATION_BROADCAST: { maxRequests: 10, window: '1 h' },\n    NOTIFICATION_ARCHIVE: { maxRequests: 120, window: '1 h' },\n    NOTIFICATION_MARK_SEEN: { maxRequests: 120, window: '1 h' },\n    FEEDBACK: { maxRequests: 10, window: '1 h' },\n    SHORT_LINK_CREATE: { maxRequests: 30, window: '1 h' },\n    INVITE_ACTION: { maxRequests: 60, window: '1 h' },\n    LIBRARY_SUBMISSION: { maxRequests: 20, window: '1 h' },\n    CHANNEL_CREATE: { maxRequests: 20, window: '1 h' },\n    CHECKOUT_CREATE: { maxRequests: 20, window: '1 h' },\n  },\n};\n\n/** The resolved limit set for the deployed mode. Import THIS (or the alias\n * constants that re-export from it), never CHARTER_/FULL_ directly. A read bound\n * that must hold whichever mode the data was written under uses\n * HALL_SUB_ITEM_READ_BOUND_BY_WORK_TYPE below instead. */\nexport const ACTIVE_LIMITS: TttLimits = byMode(CHARTER_LIMITS, FULL_LIMITS);\n\nconst largestInAnyMode = (pick: (limits: TttLimits) => number): number =>\n  Math.max(pick(CHARTER_LIMITS), pick(FULL_LIMITS));\n\n/**\n * The most sub-items one Hall item can hold of each kind (Tale chapters, Tune tracks, Television\n * episodes) in ANY app mode — each kind's count cap at its largest across CHARTER_LIMITS and\n * FULL_LIMITS. A READ bound, never an enforced limit: a Hall item keeps the sub-items it was\n * published with when the mode changes, so a reader that must see all of them sizes its query\n * from this and treats a read that returns more as uncertain. Enforcement reads the active caps\n * (MAX_CHAPTERS, MAX_TUNE_TRACKS, MAX_TELEVISION_EPISODES).\n */\nexport const HALL_SUB_ITEM_READ_BOUND_BY_WORK_TYPE: Readonly<Record<WorkProjectType, number>> = {\n  Tales: largestInAnyMode((limits) => limits.workProject.maxChapters),\n  Tunes: largestInAnyMode((limits) => limits.workProject.maxTuneTracks),\n  Television: largestInAnyMode((limits) => limits.workProject.maxTelevisionEpisodes),\n};\n\n/**\n * User-facing copy for a reached count cap — the ONE owner of the cap-message\n * shape, beside the limits it describes. Every callable refusing on a\n * mode-varied count cap formats through this. In charter mode the message\n * names Charter Season so the cap reads as the season's limit rather than the\n * platform's permanent shape; full mode stays neutral. `hint` is an optional\n * trailing sentence (e.g. \"Delete a file to add another.\").\n */\nexport const countCapReachedMessage = (\n  subject: string,\n  limit: number,\n  noun: string,\n  hint?: string,\n): string => {\n  const base = byMode(\n    `${subject} already has the Charter Season maximum of ${limit} ${noun} — caps expand when Charter Season ends.`,\n    `${subject} already has the maximum of ${limit} ${noun}.`,\n  );\n  return hint ? `${base} ${hint}` : base;\n};\n"]}

package/dist/doc-schemas/backend-state.js

@@ -21,7 +21,7 @@ export const HallMediaReaperDeferredCandidateSchema = z
     attemptCount: z.number().int().positive(),
 })
     .strict();
-// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.
+// _serverData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.
 // `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has moved past: every
 // candidate at or below it was positively cleared (referenced / reaped / already-deleted) or is
 // held in `deferred`, so each pass resumes past permanently-live Hall assets instead of
@@ -56,7 +56,7 @@ export const HallMediaReaperCursorSchema = z
         }
     });
 });
-// _systemData/publicUsersReconcilerCursor — the scheduled publicUsers reconciler's sweep cursor.
+// _serverData/publicUsersReconcilerCursor — the scheduled publicUsers reconciler's sweep cursor.
 // `profileIdCursor` is the last `userProfiles` document id the sweep has POSITIVELY cleared, so
 // each pass resumes after it instead of re-reading the same oldest page forever. An EMPTY STRING
 // means start from the beginning — both the first-ever pass and the wrap after the sweep exhausts

package/dist/doc-schemas/backend-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-state.js","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EACL,uCAAuC,EACvC,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,iGAAiG;AACjG,yDAAyD;AACzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,+CAA+C;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,+CAA+C;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C;sGACkG;IAClG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,4FAA4F;AAC5F,4FAA4F;AAC5F,gGAAgG;AAChG,wFAAwF;AACxF,8FAA8F;AAC9F,gGAAgG;AAChG,4FAA4F;AAC5F,mDAAmD;AACnD,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CACzG,CAAC;KACD,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC;gBACzC,OAAO,EAAE,sCAAsC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC;gBACtC,OAAO,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGL,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,6FAA6F;AAC7F,yFAAyF;AACzF,6FAA6F;AAC7F,+FAA+F;AAC/F,8FAA8F;AAC9F,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACzD,uFAAuF;IACvF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,8CAA8C;AAC9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC;wFACoF;IACpF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mFAAmF;AACnF,kGAAkG;AAClG,uFAAuF;AACvF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,uCAAuC;IAChD,SAAS,EAAE,yCAAyC;IACpD,8EAA8E;IAC9E,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;yCACqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,0FAA0F;AAC1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,sEAAsE;IACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC","sourcesContent":["// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no\n// client ever reads or writes (firestore.rules denies client access to every path below).\n// They are registered here for the same reason every other stored shape is: ARCH-104 gives\n// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and\n// the drift-check read. Types are inferred via z.infer.\n\nimport { z } from 'zod';\nimport { HALL_MEDIA_REAPER_MAX_DEFERRED } from '../constants/scheduled-jobs.js';\nimport {\n  ChildSafetyNcmecCompletionChannelSchema,\n  ChildSafetyNcmecCompletionProofTypeSchema,\n} from './safety/case.js';\n\n// One asset-phase candidate the Hall-media orphan reaper could not positively clear (a read\n// error, a missing owner). The cursor moves past it and the reaper retries it from here instead,\n// so one uncertain candidate never pins the scan window.\nexport const HallMediaReaperDeferredCandidateSchema = z\n  .object({\n    mediaAssetId: z.string().min(1),\n    /** The candidate's mediaAssets `createdAt`. */\n    createdAt: z.number().int().nonnegative(),\n    /** Epoch ms from which a pass may retry it. */\n    nextAttemptAt: z.number().int().nonnegative(),\n    /** Passes that examined it without clearing it; the pass that deferred it is the first. The\n     *  HALL_MEDIA_REAPER_BACKOFF_BASE_MS / HALL_MEDIA_REAPER_BACKOFF_MAX_MS backoff grows from it. */\n    attemptCount: z.number().int().positive(),\n  })\n  .strict();\nexport type HallMediaReaperDeferredCandidate = z.infer<typeof HallMediaReaperDeferredCandidateSchema>;\n\n// _systemData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.\n// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has moved past: every\n// candidate at or below it was positively cleared (referenced / reaped / already-deleted) or is\n// held in `deferred`, so each pass resumes past permanently-live Hall assets instead of\n// re-reading the same oldest page forever. `deferred` names each asset at most once, holds at\n// most HALL_MEDIA_REAPER_MAX_DEFERRED entries, and holds only candidates at or below the cursor\n// — deferring a candidate is what moves the cursor past it. A cursor written before the set\n// existed has no `deferred`, which reads as empty.\n// (functions/src/media/reapOrphanedHallMediaCopies.ts)\nexport const HallMediaReaperCursorSchema = z\n  .object({\n    createdAtCursor: z.number(),\n    updatedAt: z.number(),\n    deferred: z.array(HallMediaReaperDeferredCandidateSchema).max(HALL_MEDIA_REAPER_MAX_DEFERRED).optional(),\n  })\n  .superRefine((val, ctx) => {\n    const seen = new Set<string>();\n    (val.deferred ?? []).forEach((entry, index) => {\n      if (seen.has(entry.mediaAssetId)) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['deferred', index, 'mediaAssetId'],\n          message: 'a candidate is deferred at most once',\n        });\n      }\n      seen.add(entry.mediaAssetId);\n      if (entry.createdAt > val.createdAtCursor) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['deferred', index, 'createdAt'],\n          message: 'a deferred candidate sits at or below the cursor that moved past it',\n        });\n      }\n    });\n  });\nexport type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;\n\n// _systemData/publicUsersReconcilerCursor — the scheduled publicUsers reconciler's sweep cursor.\n// `profileIdCursor` is the last `userProfiles` document id the sweep has POSITIVELY cleared, so\n// each pass resumes after it instead of re-reading the same oldest page forever. An EMPTY STRING\n// means start from the beginning — both the first-ever pass and the wrap after the sweep exhausts\n// the collection. (functions/src/users/reconcilePublicUsers.ts)\nexport const PublicUsersReconcilerCursorSchema = z.object({\n  profileIdCursor: z.string(),\n  updatedAt: z.number(),\n});\nexport type PublicUsersReconcilerCursor = z.infer<typeof PublicUsersReconcilerCursorSchema>;\n\n// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret\n// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by\n// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes\n// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by\n// the step-up window. `failedAttempts` and `lockedUntil` make the server-side TOTP brute-force\n// lockout durable; omitted fields are the compatible no-lockout state for rows written before\n// that protection shipped. (functions/src/safety/operatorStepUp.ts)\nexport const OperatorStepUpSchema = z.object({\n  secret: z.string(),\n  status: z.enum(['pending', 'active']),\n  /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */\n  grantExpiresAt: z.number().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  /** Set when enrollment is confirmed (status flips to 'active'). */\n  confirmedAt: z.number().optional(),\n  /** Consecutive failed TOTP checks since the most recent success or lockout. */\n  failedAttempts: z.number().int().nonnegative().optional(),\n  /** Epoch ms until which TOTP verification is refused; absent or 0 means not locked. */\n  lockedUntil: z.number().nonnegative().optional(),\n});\nexport type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;\n\n// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler\n// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a\n// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so\n// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)\nexport const SafetyReconcilerCursorSchema = z.object({\n  /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */\n  afterValue: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;\n\n// sweepState/{sweepName} — durable cadence + cursor state for one scheduled user sweep. One doc\n// per sweep name; the fields a given sweep uses are the ones it declares, so every field except\n// `updatedAt` is optional. `orphanRegistrationCleanup` carries all three (the ~daily privateData\n// reaper's last completed pass + its rolling page cursor, and the ~weekly `listUsers()` scan);\n// `reconcileAccountStatus` carries only `fullScanLastRunAt`. The stamps are wall-clock so a\n// container recycle cannot reset the cadence.\n// (functions/src/users/orphanRegistrationCleanup.ts, functions/src/users/reconcileAccountStatus.ts)\nexport const SweepStateSchema = z.object({\n  /** Wall-clock ms the last COMPLETED privateData-reaper pass finished (absent = never). */\n  reaperLastRunAt: z.number().optional(),\n  /** Full document path of the last `privateData` doc the reaper examined. Empty/absent means no\n   *  pass is in flight; a non-empty value means one is mid-scan and must continue. */\n  reaperCursorPath: z.string().optional(),\n  /** Wall-clock ms the last full `listUsers()` scan ran (absent = never). */\n  fullScanLastRunAt: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SweepState = z.infer<typeof SweepStateSchema>;\n\n// childSafetyCases/{caseId}/ncmecSubmissions/{submissionId}/ncmecCompletionProof/record —\n// [H-05] the IMMUTABLE record of a verified manual-portal completion. Written create-if-absent in\n// the SAME transaction as the submission's `completed` transition, so a submission can never reach\n// `completed` without a bound proof record; a re-completion keeps the original. The submission's\n// `completionProofRef` stores this doc's path, never an operator free-text string.\n// [Q13/H-06] `portalReceiptArtifactId` binds the proof to a verified NcmecPortalReceiptArtifactV1\n// on the same (caseId, submissionId) — an arbitrary operator string is never accepted.\n// (functions/src/safety/ncmecReporting.ts)\nexport const NcmecCompletionProofRecordV1Schema = z.object({\n  caseId: z.string(),\n  submissionId: z.string(),\n  channel: ChildSafetyNcmecCompletionChannelSchema,\n  proofType: ChildSafetyNcmecCompletionProofTypeSchema,\n  /** Id of the verified portal-receipt artifact this completion is bound to. */\n  portalReceiptArtifactId: z.string(),\n  /** Optional operator free-text note about the confirmation. */\n  proofText: z.string().optional(),\n  /** The NCMEC-assigned report id — REQUIRED. The number IS the proof; there is no\n   *  \"filed, number pending\" grace. */\n  ncmecReportId: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecCompletionProofRecordV1 = z.infer<typeof NcmecCompletionProofRecordV1Schema>;\n\n// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable\n// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the\n// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified\n// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never\n// proof. Written create-only, never overwritten, and carries the server-verified storage facts\n// (generation + sha256) so a later transactional verification can confirm the same object\n// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)\nexport const NcmecPortalReceiptArtifactV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  submissionId: z.string(),\n  /** Key of the object in the restricted evidence vault bucket. */\n  evidenceVaultKey: z.string(),\n  /** GCS object generation at capture time (immutable identity peg). */\n  objectGeneration: z.string(),\n  /** SHA-256 hex digest of the object bytes at capture time. */\n  sha256: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n  capturedAt: z.number(),\n  registeredByUid: z.string(),\n  /** Optional operator free-text describing what the artifact is. */\n  description: z.string().optional(),\n});\nexport type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;\n\n// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that\n// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction\n// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the\n// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each\n// correction is a fresh id — a later correction is an additional record, never a mutation of\n// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)\nexport const NcmecPortalCorrectionRecordV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  /** The portal-assigned NCMEC report id being corrected. */\n  ncmecReportId: z.string(),\n  /** When the operator filed the correction on the portal (operator-supplied). */\n  correctionFiledAt: z.number(),\n  reason: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;\n"]}
+{"version":3,"file":"backend-state.js","sourceRoot":"","sources":["../../src/doc-schemas/backend-state.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EACL,uCAAuC,EACvC,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,iGAAiG;AACjG,yDAAyD;AACzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,+CAA+C;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,+CAA+C;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C;sGACkG;IAClG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,4FAA4F;AAC5F,4FAA4F;AAC5F,gGAAgG;AAChG,wFAAwF;AACxF,8FAA8F;AAC9F,gGAAgG;AAChG,4FAA4F;AAC5F,mDAAmD;AACnD,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CACzG,CAAC;KACD,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC;gBACzC,OAAO,EAAE,sCAAsC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC;gBACtC,OAAO,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGL,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,6FAA6F;AAC7F,yFAAyF;AACzF,6FAA6F;AAC7F,+FAA+F;AAC/F,8FAA8F;AAC9F,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACzD,uFAAuF;IACvF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,8FAA8F;IAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,8CAA8C;AAC9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC;wFACoF;IACpF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mFAAmF;AACnF,kGAAkG;AAClG,uFAAuF;AACvF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,uCAAuC;IAChD,SAAS,EAAE,yCAAyC;IACpD,8EAA8E;IAC9E,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;yCACqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,2FAA2F;AAC3F,+FAA+F;AAC/F,0FAA0F;AAC1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,sEAAsE;IACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,mEAAmE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC","sourcesContent":["// Backend-only state document SCHEMAS — Cloud-Functions-owned bookkeeping docs that no\n// client ever reads or writes (firestore.rules denies client access to every path below).\n// They are registered here for the same reason every other stored shape is: ARCH-104 gives\n// the path ONE owner, and COLLECTION_SCHEMAS is the inventory the schema-doc generator and\n// the drift-check read. Types are inferred via z.infer.\n\nimport { z } from 'zod';\nimport { HALL_MEDIA_REAPER_MAX_DEFERRED } from '../constants/scheduled-jobs.js';\nimport {\n  ChildSafetyNcmecCompletionChannelSchema,\n  ChildSafetyNcmecCompletionProofTypeSchema,\n} from './safety/case.js';\n\n// One asset-phase candidate the Hall-media orphan reaper could not positively clear (a read\n// error, a missing owner). The cursor moves past it and the reaper retries it from here instead,\n// so one uncertain candidate never pins the scan window.\nexport const HallMediaReaperDeferredCandidateSchema = z\n  .object({\n    mediaAssetId: z.string().min(1),\n    /** The candidate's mediaAssets `createdAt`. */\n    createdAt: z.number().int().nonnegative(),\n    /** Epoch ms from which a pass may retry it. */\n    nextAttemptAt: z.number().int().nonnegative(),\n    /** Passes that examined it without clearing it; the pass that deferred it is the first. The\n     *  HALL_MEDIA_REAPER_BACKOFF_BASE_MS / HALL_MEDIA_REAPER_BACKOFF_MAX_MS backoff grows from it. */\n    attemptCount: z.number().int().positive(),\n  })\n  .strict();\nexport type HallMediaReaperDeferredCandidate = z.infer<typeof HallMediaReaperDeferredCandidateSchema>;\n\n// _serverData/hallMediaReaperCursor — the scheduled Hall-media orphan reaper's scan cursor.\n// `createdAtCursor` is the highest mediaAssets `createdAt` the reaper has moved past: every\n// candidate at or below it was positively cleared (referenced / reaped / already-deleted) or is\n// held in `deferred`, so each pass resumes past permanently-live Hall assets instead of\n// re-reading the same oldest page forever. `deferred` names each asset at most once, holds at\n// most HALL_MEDIA_REAPER_MAX_DEFERRED entries, and holds only candidates at or below the cursor\n// — deferring a candidate is what moves the cursor past it. A cursor written before the set\n// existed has no `deferred`, which reads as empty.\n// (functions/src/media/reapOrphanedHallMediaCopies.ts)\nexport const HallMediaReaperCursorSchema = z\n  .object({\n    createdAtCursor: z.number(),\n    updatedAt: z.number(),\n    deferred: z.array(HallMediaReaperDeferredCandidateSchema).max(HALL_MEDIA_REAPER_MAX_DEFERRED).optional(),\n  })\n  .superRefine((val, ctx) => {\n    const seen = new Set<string>();\n    (val.deferred ?? []).forEach((entry, index) => {\n      if (seen.has(entry.mediaAssetId)) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['deferred', index, 'mediaAssetId'],\n          message: 'a candidate is deferred at most once',\n        });\n      }\n      seen.add(entry.mediaAssetId);\n      if (entry.createdAt > val.createdAtCursor) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['deferred', index, 'createdAt'],\n          message: 'a deferred candidate sits at or below the cursor that moved past it',\n        });\n      }\n    });\n  });\nexport type HallMediaReaperCursor = z.infer<typeof HallMediaReaperCursorSchema>;\n\n// _serverData/publicUsersReconcilerCursor — the scheduled publicUsers reconciler's sweep cursor.\n// `profileIdCursor` is the last `userProfiles` document id the sweep has POSITIVELY cleared, so\n// each pass resumes after it instead of re-reading the same oldest page forever. An EMPTY STRING\n// means start from the beginning — both the first-ever pass and the wrap after the sweep exhausts\n// the collection. (functions/src/users/reconcilePublicUsers.ts)\nexport const PublicUsersReconcilerCursorSchema = z.object({\n  profileIdCursor: z.string(),\n  updatedAt: z.number(),\n});\nexport type PublicUsersReconcilerCursor = z.infer<typeof PublicUsersReconcilerCursorSchema>;\n\n// operatorStepUp/{uid} — [H-08] per-operator TOTP step-up state: the authenticator secret\n// plus the currently open grant window. The secret is returned to the client EXACTLY ONCE by\n// enrollOperatorStepUp and is never readable through Firestore afterwards; `status` goes\n// 'pending' → 'active' on confirm, and each successful verify pushes `grantExpiresAt` out by\n// the step-up window. `failedAttempts` and `lockedUntil` make the server-side TOTP brute-force\n// lockout durable; omitted fields are the compatible no-lockout state for rows written before\n// that protection shipped. (functions/src/safety/operatorStepUp.ts)\nexport const OperatorStepUpSchema = z.object({\n  secret: z.string(),\n  status: z.enum(['pending', 'active']),\n  /** Absent until the first successful verify; a grant is live while now < grantExpiresAt. */\n  grantExpiresAt: z.number().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  /** Set when enrollment is confirmed (status flips to 'active'). */\n  confirmedAt: z.number().optional(),\n  /** Consecutive failed TOTP checks since the most recent success or lockout. */\n  failedAttempts: z.number().int().nonnegative().optional(),\n  /** Epoch ms until which TOTP verification is refused; absent or 0 means not locked. */\n  lockedUntil: z.number().nonnegative().optional(),\n});\nexport type OperatorStepUp = z.infer<typeof OperatorStepUpSchema>;\n\n// safetyReconcilerCursors/{cursorKey} — one persisted pagination cursor per reconciler\n// needs-work backstop sweep (quarantine enqueue, NCMEC enqueue). The sweep pages a\n// needs-work-filtered query from `afterValue` and WRAPS to the start when exhausted, so\n// coverage does not stall on the oldest rows. (functions/src/safety/reconcilerCursor.ts)\nexport const SafetyReconcilerCursorSchema = z.object({\n  /** `orderBy` value of the last row examined last pass (exclusive lower bound). Absent ⇒ 0. */\n  afterValue: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SafetyReconcilerCursor = z.infer<typeof SafetyReconcilerCursorSchema>;\n\n// sweepState/{sweepName} — durable cadence + cursor state for one scheduled user sweep. One doc\n// per sweep name; the fields a given sweep uses are the ones it declares, so every field except\n// `updatedAt` is optional. `orphanRegistrationCleanup` carries all three (the ~daily privateData\n// reaper's last completed pass + its rolling page cursor, and the ~weekly `listUsers()` scan);\n// `reconcileAccountStatus` carries only `fullScanLastRunAt`. The stamps are wall-clock so a\n// container recycle cannot reset the cadence.\n// (functions/src/users/orphanRegistrationCleanup.ts, functions/src/users/reconcileAccountStatus.ts)\nexport const SweepStateSchema = z.object({\n  /** Wall-clock ms the last COMPLETED privateData-reaper pass finished (absent = never). */\n  reaperLastRunAt: z.number().optional(),\n  /** Full document path of the last `privateData` doc the reaper examined. Empty/absent means no\n   *  pass is in flight; a non-empty value means one is mid-scan and must continue. */\n  reaperCursorPath: z.string().optional(),\n  /** Wall-clock ms the last full `listUsers()` scan ran (absent = never). */\n  fullScanLastRunAt: z.number().optional(),\n  updatedAt: z.number(),\n});\nexport type SweepState = z.infer<typeof SweepStateSchema>;\n\n// childSafetyCases/{caseId}/ncmecSubmissions/{submissionId}/ncmecCompletionProof/record —\n// [H-05] the IMMUTABLE record of a verified manual-portal completion. Written create-if-absent in\n// the SAME transaction as the submission's `completed` transition, so a submission can never reach\n// `completed` without a bound proof record; a re-completion keeps the original. The submission's\n// `completionProofRef` stores this doc's path, never an operator free-text string.\n// [Q13/H-06] `portalReceiptArtifactId` binds the proof to a verified NcmecPortalReceiptArtifactV1\n// on the same (caseId, submissionId) — an arbitrary operator string is never accepted.\n// (functions/src/safety/ncmecReporting.ts)\nexport const NcmecCompletionProofRecordV1Schema = z.object({\n  caseId: z.string(),\n  submissionId: z.string(),\n  channel: ChildSafetyNcmecCompletionChannelSchema,\n  proofType: ChildSafetyNcmecCompletionProofTypeSchema,\n  /** Id of the verified portal-receipt artifact this completion is bound to. */\n  portalReceiptArtifactId: z.string(),\n  /** Optional operator free-text note about the confirmation. */\n  proofText: z.string().optional(),\n  /** The NCMEC-assigned report id — REQUIRED. The number IS the proof; there is no\n   *  \"filed, number pending\" grace. */\n  ncmecReportId: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecCompletionProofRecordV1 = z.infer<typeof NcmecCompletionProofRecordV1Schema>;\n\n// childSafetyCases/{caseId}/portalReceiptArtifacts/{artifactId} — [Q13/H-06] the immutable\n// record of a PDF/screenshot of the completed NCMEC CyberTipline submission, stored in the\n// restricted evidence vault. `markNcmecPortalComplete` accepts only the id of a verified\n// artifact bound to the SAME (caseId, submissionId); an arbitrary operator string is never\n// proof. Written create-only, never overwritten, and carries the server-verified storage facts\n// (generation + sha256) so a later transactional verification can confirm the same object\n// still exists unchanged. (functions/src/safety/ncmecOperatorCommands.ts)\nexport const NcmecPortalReceiptArtifactV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  submissionId: z.string(),\n  /** Key of the object in the restricted evidence vault bucket. */\n  evidenceVaultKey: z.string(),\n  /** GCS object generation at capture time (immutable identity peg). */\n  objectGeneration: z.string(),\n  /** SHA-256 hex digest of the object bytes at capture time. */\n  sha256: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n  capturedAt: z.number(),\n  registeredByUid: z.string(),\n  /** Optional operator free-text describing what the artifact is. */\n  description: z.string().optional(),\n});\nexport type NcmecPortalReceiptArtifactV1 = z.infer<typeof NcmecPortalReceiptArtifactV1Schema>;\n\n// childSafetyCases/{caseId}/ncmecPortalCorrections/{correctionId} — the immutable record that\n// the operator filed a CORRECTION on the NCMEC manual portal. There is no in-app correction\n// submission pipeline; this records the portal filing. Its EXISTENCE is the gate on the\n// corrected-no-apparent-violation disposition, so it is never a bare-discretion close. Each\n// correction is a fresh id — a later correction is an additional record, never a mutation of\n// the prior one. (functions/src/safety/recordNcmecPortalCorrection.ts)\nexport const NcmecPortalCorrectionRecordV1Schema = z.object({\n  schemaVersion: z.literal(1),\n  caseId: z.string(),\n  /** The portal-assigned NCMEC report id being corrected. */\n  ncmecReportId: z.string(),\n  /** When the operator filed the correction on the portal (operator-supplied). */\n  correctionFiledAt: z.number(),\n  reason: z.string(),\n  recordedByUid: z.string(),\n  recordedAt: z.number(),\n});\nexport type NcmecPortalCorrectionRecordV1 = z.infer<typeof NcmecPortalCorrectionRecordV1Schema>;\n"]}

package/dist/doc-schemas/registry.d.ts

@@ -7250,6 +7250,20 @@ export declare const COLLECTION_SCHEMAS: {
         canonicalId: z.ZodString;
         originalType: z.ZodString;
     }, z.core.$strip>;
+    readonly '_serverData/hallMediaReaperCursor': z.ZodObject<{
+        createdAtCursor: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+        deferred: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            mediaAssetId: z.ZodString;
+            createdAt: z.ZodNumber;
+            nextAttemptAt: z.ZodNumber;
+            attemptCount: z.ZodNumber;
+        }, z.core.$strict>>>;
+    }, z.core.$strip>;
+    readonly '_serverData/publicUsersReconcilerCursor': z.ZodObject<{
+        profileIdCursor: z.ZodString;
+        updatedAt: z.ZodNumber;
+    }, z.core.$strip>;
     readonly '_systemData/adminList': z.ZodObject<{
         admins: z.ZodArray<z.ZodString>;
         jrAdmins: z.ZodArray<z.ZodString>;
@@ -7275,20 +7289,6 @@ export declare const COLLECTION_SCHEMAS: {
         }>;
         updatedAt: z.ZodNumber;
     }, z.core.$strip>;
-    readonly '_systemData/hallMediaReaperCursor': z.ZodObject<{
-        createdAtCursor: z.ZodNumber;
-        updatedAt: z.ZodNumber;
-        deferred: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            mediaAssetId: z.ZodString;
-            createdAt: z.ZodNumber;
-            nextAttemptAt: z.ZodNumber;
-            attemptCount: z.ZodNumber;
-        }, z.core.$strict>>>;
-    }, z.core.$strip>;
-    readonly '_systemData/publicUsersReconcilerCursor': z.ZodObject<{
-        profileIdCursor: z.ZodString;
-        updatedAt: z.ZodNumber;
-    }, z.core.$strip>;
 };
 export type RegisteredCollectionPath = keyof typeof COLLECTION_SCHEMAS;
 /**

package/dist/doc-schemas/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/registry.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoN7B,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoQkB,CAAC;AAElD,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAEvE;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;CAmBiC,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAOvC,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/doc-schemas/registry.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoN7B,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqQkB,CAAC;AAElD,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAEvE;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;CAmBiC,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAOvC,CAAC"}

package/dist/doc-schemas/registry.js

@@ -277,14 +277,15 @@ export const COLLECTION_SCHEMAS = {
     // `feedbackDenylist` subcollection has no field contract (`.exists`-only) — see
     // PENDING_COLLECTIONS.
     '_serverData/feedbackLists/feedbackAliases/{aliasId}': FeedbackAliasSchema,
-    // ===== _systemData singletons =====
+    // The scheduled sweeps' scan cursors — each read only by the function that owns it.
+    '_serverData/hallMediaReaperCursor': HallMediaReaperCursorSchema,
+    '_serverData/publicUsersReconcilerCursor': PublicUsersReconcilerCursorSchema,
+    // ===== _systemData singletons (signed-in readers, BACKEND-108) =====
     '_systemData/adminList': AdminListSchema,
     '_systemData/profanityList': ProfanityListSchema,
     '_systemData/reservedUsernames': ReservedUsernamesSchema,
     '_systemData/blockedFranchiseNames': BlockedFranchiseNamesSchema,
     '_systemData/appMode': AppModeMarkerSchema,
-    '_systemData/hallMediaReaperCursor': HallMediaReaperCursorSchema,
-    '_systemData/publicUsersReconcilerCursor': PublicUsersReconcilerCursorSchema,
 };
 /**
  * Doc-id field annotation: for the listed bindings, the named body field equals the