@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.js

@@ -0,0 +1,153 @@
+/**
+ * InboundContact Resource Configuration (Phase 0.5, Q-E=B path)
+ *
+ * Lead-capture resource for the public marketing site.
+ * APPLICATION-scope (anchored via the `ANONYMOUS_USERS → INBOUND_CONTACTS`
+ * relationship row in `coreSharedResourceRelationship`), NO
+ * `isAnonymizable: true` — the framework's anonymizable transposition
+ * pipeline gates on USER_SELF semantics, but `INBOUND_CONTACTS` is
+ * conceptually an org-owned admin resource. Transposition is handled
+ * by a focused manual hook in `AnonymousSessionBackendService` that
+ * UPDATEs `{ anonymousUserId } → { userId, anonymousUserId: null }`
+ * when the lead converts to an authenticated user.
+ *
+ * Operations:
+ * - CREATE       : public — `APP_ANONYMOUS` role, requires an active
+ *                  anonymous session. Per-endpoint rate-limit declared
+ *                  on the variant itself (5 req/min + 30 req/hour per IP),
+ *                  enforced at the controller pre-flight seam by
+ *                  `RateLimitBackendService.checkPolicyForVariant`
+ *                  BEFORE execution-context creation.
+ * - READ / LIST  : `APP_ADMIN_MARKETING_EDITOR` (admin marketing dashboard).
+ * - SEARCH       : `APP_ADMIN_MARKETING_EDITOR`.
+ * - UPDATE       : INTERNAL_CALL only — used by the manual transposition
+ *                  hook in `AnonymousSessionBackendService` to set
+ *                  `{ userId, anonymousUserId: null }` on lead conversion.
+ *                  Not exposed as a public API (no admin-edit surface in
+ *                  Phase 0.5 — leads are read-only in the dashboard).
+ * - DELETE       : `APP_ADMIN_SUPER_ADMIN` (compliance / data-cleanup).
+ *
+ * Marketing attribution does NOT live on this row. First-touch
+ * attribution is on `AnonymousUser.marketingMetadata` (Q-D=β); analytics
+ * joins via `anonymousUserId`.
+ */
+import { InboundContactSchema } from './inbound-contacts.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier, } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+export const inboundContactsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: InboundContactSchema,
+    resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_CONTACTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    // Lead-conversion transposition (`AnonymousSessionBackendService`
+    // .transposeInboundContactsOwnership) UPDATEs `{ anonymousUserId } →
+    // { userId, anonymousUserId: null }` in-process. Both FKs are context-auto-
+    // populated names the client-shaped request DTO strips, so a plain update is a
+    // silent no-op; `updateAsSystem` re-attaches them after the strict parse,
+    // fail-closed behind this opt-in. INBOUND_CONTACTS is APPLICATION-scoped (not
+    // `isAnonymizable`), so the grant is authored explicitly here rather than
+    // derived by the factory's anonymizable enrichment.
+    systemAccessPolicy: {
+        // Subject-export disclosure. Lead records the subject is the data subject of. ⚠️ Art. 15(4): if an app stores third-party notes ABOUT the subject on these rows, mark those fields `.isBackendOnly()` so the export's security floor withholds them. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.
+        exportSubject: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED
+    },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.SEARCH,
+        CoreResourceOperation.UPDATE,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                /** @wildo_source:part:start example.rate-limit.resource-operation-surface facet:kind:usage-example facet:audience:app-developer */
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ANONYMOUS],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    // Public anonymous CREATE — declares the per-IP rate-limit on the
+                    // default API_CALL variant. Two windows (a short burst limit + an
+                    // hourly cap) are AND-ed and enforced at the controller pre-flight
+                    // seam; no bucket-key choice is needed here because IP is the only
+                    // identity available before execution-context creation. The global
+                    // HTTP limiter remains the safety net for any path that bypasses
+                    // this surface.
+                    rateLimit: {
+                        requestsPerMinute: 5,
+                        requestsPerHour: 30,
+                    },
+                },
+                /** @wildo_source:part:end example.rate-limit.resource-operation-surface */
+            ],
+            // No `userNotifications` on CREATE. A Phase-0.5 draft declared an
+            // `INBOUND_CONTACT` + `EMAIL` notification, but the dispatcher has no
+            // email-by-target recipient resolution for `INBOUND_CONTACT`
+            // (`getUserIdsForTarget` falls through to `[]`, so the email was a silent
+            // no-op) and there is no template for it. `INBOUND_CONTACT` is wired only
+            // for the WEBSOCKET channel (admin in-app alerts) — declare
+            // `{ target: INBOUND_CONTACT, channel: WEBSOCKET }` here if an app wants
+            // that. For a visitor acknowledgement email, use the email-by-address
+            // path — `{ channel: EMAIL, recipientEmailField: 'email' }` (see
+            // `organization-member-invitations` CREATE). The paired resource spec
+            // asserts no email delivery; keep both in sync.
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.SEARCH]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                },
+            ],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=inbound-contacts.shared.resources-config.schemas.js.map

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAS7C;IACA,UAAU,EAAE,oBAAoB;IAChC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kEAAkE;IAClE,qEAAqE;IACrE,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,oDAAoD;IACpD,kBAAkB,EAAE;QAChB,ydAAyd;QACzd,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAC/F,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,mIAAmI;gBACnI;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,kEAAkE;oBAClE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,iEAAiE;oBACjE,gBAAgB;oBAChB,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;iBACF;gBACD,2EAA2E;aAC5E;YACD,kEAAkE;YAClE,sEAAsE;YACtE,6DAA6D;YAC7D,0EAA0E;YAC1E,0EAA0E;YAC1E,4DAA4D;YAC5D,yEAAyE;YACzE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,gDAAgD;SACjD;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * InboundContact Resource Configuration (Phase 0.5, Q-E=B path)\n *\n * Lead-capture resource for the public marketing site.\n * APPLICATION-scope (anchored via the `ANONYMOUS_USERS → INBOUND_CONTACTS`\n * relationship row in `coreSharedResourceRelationship`), NO\n * `isAnonymizable: true` — the framework's anonymizable transposition\n * pipeline gates on USER_SELF semantics, but `INBOUND_CONTACTS` is\n * conceptually an org-owned admin resource. Transposition is handled\n * by a focused manual hook in `AnonymousSessionBackendService` that\n * UPDATEs `{ anonymousUserId } → { userId, anonymousUserId: null }`\n * when the lead converts to an authenticated user.\n *\n * Operations:\n * - CREATE       : public — `APP_ANONYMOUS` role, requires an active\n *                  anonymous session. Per-endpoint rate-limit declared\n *                  on the variant itself (5 req/min + 30 req/hour per IP),\n *                  enforced at the controller pre-flight seam by\n *                  `RateLimitBackendService.checkPolicyForVariant`\n *                  BEFORE execution-context creation.\n * - READ / LIST  : `APP_ADMIN_MARKETING_EDITOR` (admin marketing dashboard).\n * - SEARCH       : `APP_ADMIN_MARKETING_EDITOR`.\n * - UPDATE       : INTERNAL_CALL only — used by the manual transposition\n *                  hook in `AnonymousSessionBackendService` to set\n *                  `{ userId, anonymousUserId: null }` on lead conversion.\n *                  Not exposed as a public API (no admin-edit surface in\n *                  Phase 0.5 — leads are read-only in the dashboard).\n * - DELETE       : `APP_ADMIN_SUPER_ADMIN` (compliance / data-cleanup).\n *\n * Marketing attribution does NOT live on this row. First-touch\n * attribution is on `AnonymousUser.marketingMetadata` (Q-D=β); analytics\n * joins via `anonymousUserId`.\n */\n\nimport { InboundContactSchema } from './inbound-contacts.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport const inboundContactsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE,\n  typeof InboundContactSchema\n>({\n  mainSchema: InboundContactSchema,\n  resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_CONTACTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Lead-conversion transposition (`AnonymousSessionBackendService`\n  // .transposeInboundContactsOwnership) UPDATEs `{ anonymousUserId } →\n  // { userId, anonymousUserId: null }` in-process. Both FKs are context-auto-\n  // populated names the client-shaped request DTO strips, so a plain update is a\n  // silent no-op; `updateAsSystem` re-attaches them after the strict parse,\n  // fail-closed behind this opt-in. INBOUND_CONTACTS is APPLICATION-scoped (not\n  // `isAnonymizable`), so the grant is authored explicitly here rather than\n  // derived by the factory's anonymizable enrichment.\n  systemAccessPolicy: {\n      // Subject-export disclosure. Lead records the subject is the data subject of. ⚠️ Art. 15(4): if an app stores third-party notes ABOUT the subject on these rows, mark those fields `.isBackendOnly()` so the export's security floor withholds them. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        /** @wildo_source:part:start example.rate-limit.resource-operation-surface facet:kind:usage-example facet:audience:app-developer */\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Public anonymous CREATE — declares the per-IP rate-limit on the\n          // default API_CALL variant. Two windows (a short burst limit + an\n          // hourly cap) are AND-ed and enforced at the controller pre-flight\n          // seam; no bucket-key choice is needed here because IP is the only\n          // identity available before execution-context creation. The global\n          // HTTP limiter remains the safety net for any path that bypasses\n          // this surface.\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n        },\n        /** @wildo_source:part:end example.rate-limit.resource-operation-surface */\n      ],\n      // No `userNotifications` on CREATE. A Phase-0.5 draft declared an\n      // `INBOUND_CONTACT` + `EMAIL` notification, but the dispatcher has no\n      // email-by-target recipient resolution for `INBOUND_CONTACT`\n      // (`getUserIdsForTarget` falls through to `[]`, so the email was a silent\n      // no-op) and there is no template for it. `INBOUND_CONTACT` is wired only\n      // for the WEBSOCKET channel (admin in-app alerts) — declare\n      // `{ target: INBOUND_CONTACT, channel: WEBSOCKET }` here if an app wants\n      // that. For a visitor acknowledgement email, use the email-by-address\n      // path — `{ channel: EMAIL, recipientEmailField: 'email' }` (see\n      // `organization-member-invitations` CREATE). The paired resource spec\n      // asserts no email delivery; keep both in sync.\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts

@@ -1,23 +1,53 @@
 import { z } from "zod";
+/**
+ * Server-computed lead-triage signal: whether the lead's email corresponded to
+ * an existing `users` account at capture time, and — because the caller only
+ * flagged "active, or not" — whether that account was ACTIVE.
+ *
+ * This is a TRIAGE / dedup HINT, **not** an ownership link. It NEVER sets
+ * `userId`/`relatedUserId`: an anonymous visitor typing an email does not prove
+ * they own it, so attributing the lead to a real account on an unverified string
+ * would be an account-takeover hole. Ownership is established only by proven
+ * authentication (the transposition hook) or a manual sales tag (`relatedUserId`).
+ */
+export declare enum InboundContactEmailUserMatch {
+    /** No existing `users` row carried this email at capture time. */
+    NONE = "NONE",
+    /** Email matched an existing user whose lifecycle `status` is `ACTIVE`. */
+    ACTIVE_USER = "ACTIVE_USER",
+    /**
+     * Email matched an existing user that is NOT active — any of `INACTIVE`,
+     * `SUSPENDED`, `PENDING_VERIFICATION`, `PENDING_INVITATION`, `DELETED`.
+     */
+    INACTIVE_USER = "INACTIVE_USER"
+}
+/**
+ * InboundContact — lead / contact-form submission captured from the
+ * public marketing site (Phase 0.5). APPLICATION-scoped (Q-E=B), no
+ * `isAnonymizable: true` — transposition is handled by a focused
+ * manual hook in `AnonymousSessionBackendService.transposeOwnership`
+ * that updates `{ anonymousUserId, userId }` (see
+ * .cursor/plans/saas-website-slice.md § 0.5.a).
+ *
+ * Attribution data (UTM, referrer, landing path, IP fingerprint) does
+ * NOT live here. It lives ONCE on `AnonymousUser` (Q-D=β first-touch
+ * attribution); analytics joins via the `anonymousUserId` FK.
+ */
 export declare const InboundContactSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
-    firstName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-    lastName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-    phone: z.ZodOptional<z.ZodString>;
-    ipAddress: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodIPv4>;
-    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodISODateTime>>>>;
-    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodISODateTime>>>;
+    email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>>;
+    firstName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    lastName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    phone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    anonymousUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodNullable<z.ZodString>>>>;
+    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodNullable<z.ZodString>>>>;
+    relatedUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    emailUserMatch: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof InboundContactEmailUserMatch>>>>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
     privacy: z.ZodObject<{
-        dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof import("../index.js").DataProcessingConsent>>;
-        dataProcessingAgreementApproval: z.ZodDefault<z.ZodObject<{
-            accepted: z.ZodDefault<z.ZodBoolean>;
-            acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-            acceptedVersion: z.ZodOptional<z.ZodString>;
-            ipAddress: z.ZodOptional<z.ZodIPv4>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    relatedUserId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+        dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof import("..").DataProcessingConsent>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export type InboundContact = z.infer<typeof InboundContactSchema>;
 //# sourceMappingURL=inbound-contacts.shared.schemas.d.ts.map

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;uCAW/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;iBA+F/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/users/inbound-contacts.shared.schemas.js

@@ -1,15 +1,129 @@
 import { z } from "zod";
 import { InboundContactPrivacySchema } from "../compliance/privacy/privacy.shared.schemas.js";
+import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
+/**
+ * Server-computed lead-triage signal: whether the lead's email corresponded to
+ * an existing `users` account at capture time, and — because the caller only
+ * flagged "active, or not" — whether that account was ACTIVE.
+ *
+ * This is a TRIAGE / dedup HINT, **not** an ownership link. It NEVER sets
+ * `userId`/`relatedUserId`: an anonymous visitor typing an email does not prove
+ * they own it, so attributing the lead to a real account on an unverified string
+ * would be an account-takeover hole. Ownership is established only by proven
+ * authentication (the transposition hook) or a manual sales tag (`relatedUserId`).
+ */
+export var InboundContactEmailUserMatch;
+(function (InboundContactEmailUserMatch) {
+    /** No existing `users` row carried this email at capture time. */
+    InboundContactEmailUserMatch["NONE"] = "NONE";
+    /** Email matched an existing user whose lifecycle `status` is `ACTIVE`. */
+    InboundContactEmailUserMatch["ACTIVE_USER"] = "ACTIVE_USER";
+    /**
+     * Email matched an existing user that is NOT active — any of `INACTIVE`,
+     * `SUSPENDED`, `PENDING_VERIFICATION`, `PENDING_INVITATION`, `DELETED`.
+     */
+    InboundContactEmailUserMatch["INACTIVE_USER"] = "INACTIVE_USER";
+})(InboundContactEmailUserMatch || (InboundContactEmailUserMatch = {}));
+/**
+ * InboundContact — lead / contact-form submission captured from the
+ * public marketing site (Phase 0.5). APPLICATION-scoped (Q-E=B), no
+ * `isAnonymizable: true` — transposition is handled by a focused
+ * manual hook in `AnonymousSessionBackendService.transposeOwnership`
+ * that updates `{ anonymousUserId, userId }` (see
+ * .cursor/plans/saas-website-slice.md § 0.5.a).
+ *
+ * Attribution data (UTM, referrer, landing path, IP fingerprint) does
+ * NOT live here. It lives ONCE on `AnonymousUser` (Q-D=β first-touch
+ * attribution); analytics joins via the `anonymousUserId` FK.
+ */
 export const InboundContactSchema = z.object({
     _id: z.string().isPrimaryKey().isSummaryField(),
-    email: z.email().isSummaryField(),
-    firstName: z.string().optional().isSummaryField(),
-    lastName: z.string().optional().isSummaryField(),
-    phone: z.string().optional(),
-    ipAddress: z.ipv4().isBackendOnly(),
-    createdAt: z.iso.datetime().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
-    updatedAt: z.iso.datetime().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+    email: z.email().isSummaryField().dataCategories(PersonalDataCategory.CONTACT_DETAILS),
+    firstName: z.string().optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
+    lastName: z.string().optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
+    phone: z.string().optional().dataCategories(PersonalDataCategory.CONTACT_DETAILS),
+    /**
+     * Anonymous session that created this lead. FK to `AnonymousUser`.
+     * Carries first-touch marketing attribution (utm, referrer,
+     * landingPath) via `AnonymousUser.marketingMetadata` (Q-D=β —
+     * attribution lives on the session, not the conversion row).
+     * Cleared to `null` by the manual transposition hook on
+     * `AnonymousSessionBackendService` once the user converts and
+     * `userId` is set.
+     *
+     * Server-set on anonymous-session creates by the write-path context
+     * enrichment (`ResourceOperationHelperBackendService.enrichDataWithContext`),
+     * which injects `executionContext.initiatorIds.anonymousUserId` — the client
+     * `uuidRef` (the AnonymousUser's relational identity), NOT its server-minted
+     * `_id`. This resource is APPLICATION-scoped and standalone-created (no nested
+     * `/anonymous-users/{uuidRef}/…` URL segment carries the FK, and it is
+     * deliberately NOT `isAnonymizable`), so the enrichment resolves the FK from the
+     * anonymous initiator identity rather than the URL scope map. Never client-authored.
+     */
+    anonymousUserId: z.string().nullable().isDBIndexed().excludeFromCreate().isBackendOnly(),
+    /**
+     * Authenticated user AFTER anonymous-session transposition (W7.3a).
+     * Auto-set by the manual transposition hook on
+     * `AnonymousSessionBackendService` when the anonymous user signs up
+     * or logs in. `null` for leads that never converted to an
+     * authenticated user. Distinct from `relatedUserId` below — see
+     * `relatedUserId` JSDoc for the semantic boundary.
+     */
+    userId: z.string().nullable().isDBIndexed().excludeFromCreate().isBackendOnly(),
+    /**
+     * Manually-linked existing customer profile by sales / support
+     * (e.g. a salesperson tags an inbound lead as "this is the same
+     * human as CRM contact X"). **Not** auto-populated by
+     * anonymous-session transposition — that slot is `userId` above.
+     *
+     * A lead can legitimately have both populated:
+     * - `userId`        = the user who eventually signed up from this
+     *                     lead session (auto-set by transposition).
+     * - `relatedUserId` = the user a human rep manually associated
+     *                     (may be a different person, e.g. the lead is
+     *                     for a colleague of an existing customer).
+     *
+     * Kept on the schema for zero-cost preservation (no migration);
+     * the disambiguating JSDoc here exists so future readers do not
+     * conflate it with `userId`.
+     *
+     * `.excludeFromCreate()` is a HARD requirement, not polish: the public
+     * INBOUND_CONTACTS CREATE is anonymous (`APP_ANONYMOUS`), so a client-
+     * authorable `relatedUserId` would let an unauthenticated visitor tag a
+     * lead as "related to" an arbitrary existing user (a data-integrity /
+     * attribution-forgery hole). It is set ONLY post-create by a sales/support
+     * admin via a privileged update, never on the public capture request.
+     */
+    relatedUserId: z.string().isDBIndexed().optional().excludeFromCreate(),
+    /**
+     * Lead-triage signal (see `InboundContactEmailUserMatch`): did this lead's
+     * email match an existing user at capture time, and was that user active?
+     *
+     * Server-computed by the INBOUND_CONTACTS CREATE custom implementation
+     * (`prefixCoreOperations`) via a privileged users-by-email lookup — the
+     * anonymous create context cannot read `users`, so the lookup runs in a
+     * dedicated internal super-admin context and the result is stamped here.
+     *
+     * `.isBackendOnly()` is a HARD requirement, not polish: the CREATE response
+     * is returned to the anonymous submitter, so exposing the match would turn
+     * lead capture into an account-enumeration oracle. Backend-only keeps it out
+     * of every client response; admin / analytics surfaces read it through the
+     * internal DTO. `.excludeFromCreate()` (server-set, never client-authored)
+     * and `.excludeFromUpdate()` (immutable capture-time snapshot); `.default`
+     * `NONE` is the fail-safe when the email is absent or the lookup fails.
+     */
+    emailUserMatch: z.enum(InboundContactEmailUserMatch).default(InboundContactEmailUserMatch.NONE).isDBIndexed().excludeFromCreate().excludeFromUpdate().isBackendOnly(),
+    /**
+     * Mongoose-managed timestamps. Declared `z.date()` (NOT `z.iso.datetime()`)
+     * because the persistence layer stores them as BSON `Date`s and the DTO
+     * builder's network-boundary coercion (`applyNetworkBoundaryCoercion`)
+     * rewrites `z.date()` → `z.coerce.date()`. A `z.iso.datetime()` string validator would
+     * reject the stored `Date` on the output/internalDto parse → HTTP 500
+     * `service_resource_transformation_failed` on every create/read. Matches the
+     * framework-wide timestamp convention (35+ resources, e.g. `AnonymousUser`).
+     */
+    createdAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
+    updatedAt: z.date().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     privacy: InboundContactPrivacySchema,
-    relatedUserId: z.string().isDBIndexed().optional()
 });
-//# sourceMappingURL=inbound-contacts.shared.schemas.js.map
+//# sourceMappingURL=inbound-contacts.shared.schemas.js.map

package/dist/esm/users/inbound-contacts.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAG3F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,KAAK,EAAG,CAAC,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE;IAClC,SAAS,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAClD,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACjD,KAAK,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE;IACpC,SAAS,EAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClF,OAAO,EAAG,2BAA2B;IACrC,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAGnG;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,4BAUX;AAVD,WAAY,4BAA4B;IACtC,kEAAkE;IAClE,6CAAa,CAAA;IACb,2EAA2E;IAC3E,2DAA2B,CAAA;IAC3B;;;OAGG;IACH,+DAA+B,CAAA;AACjC,CAAC,EAVW,4BAA4B,KAA5B,4BAA4B,QAUvC;AAGD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzC,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,KAAK,EAAG,CAAC,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC;IACvF,SAAS,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAChG,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAC/F,KAAK,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC;IAElF;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEzF;;;;;;;OAOG;IACH,MAAM,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEhF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IAEvE;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,EAAG,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEtK;;;;;;;;OAQG;IACH,SAAS,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC3F,SAAS,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1E,OAAO,EAAG,2BAA2B;CACxC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { InboundContactPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n\n/**\n * Server-computed lead-triage signal: whether the lead's email corresponded to\n * an existing `users` account at capture time, and — because the caller only\n * flagged \"active, or not\" — whether that account was ACTIVE.\n *\n * This is a TRIAGE / dedup HINT, **not** an ownership link. It NEVER sets\n * `userId`/`relatedUserId`: an anonymous visitor typing an email does not prove\n * they own it, so attributing the lead to a real account on an unverified string\n * would be an account-takeover hole. Ownership is established only by proven\n * authentication (the transposition hook) or a manual sales tag (`relatedUserId`).\n */\nexport enum InboundContactEmailUserMatch {\n  /** No existing `users` row carried this email at capture time. */\n  NONE = 'NONE',\n  /** Email matched an existing user whose lifecycle `status` is `ACTIVE`. */\n  ACTIVE_USER = 'ACTIVE_USER',\n  /**\n   * Email matched an existing user that is NOT active — any of `INACTIVE`,\n   * `SUSPENDED`, `PENDING_VERIFICATION`, `PENDING_INVITATION`, `DELETED`.\n   */\n  INACTIVE_USER = 'INACTIVE_USER',\n}\n\n\n/**\n * InboundContact — lead / contact-form submission captured from the\n * public marketing site (Phase 0.5). APPLICATION-scoped (Q-E=B), no\n * `isAnonymizable: true` — transposition is handled by a focused\n * manual hook in `AnonymousSessionBackendService.transposeOwnership`\n * that updates `{ anonymousUserId, userId }` (see\n * .cursor/plans/saas-website-slice.md § 0.5.a).\n *\n * Attribution data (UTM, referrer, landing path, IP fingerprint) does\n * NOT live here. It lives ONCE on `AnonymousUser` (Q-D=β first-touch\n * attribution); analytics joins via the `anonymousUserId` FK.\n */\nexport const InboundContactSchema = z.object({\n\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    email : z.email().isSummaryField().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    firstName : z.string().optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    lastName : z.string().optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    phone : z.string().optional().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n\n    /**\n     * Anonymous session that created this lead. FK to `AnonymousUser`.\n     * Carries first-touch marketing attribution (utm, referrer,\n     * landingPath) via `AnonymousUser.marketingMetadata` (Q-D=β —\n     * attribution lives on the session, not the conversion row).\n     * Cleared to `null` by the manual transposition hook on\n     * `AnonymousSessionBackendService` once the user converts and\n     * `userId` is set.\n     *\n     * Server-set on anonymous-session creates by the write-path context\n     * enrichment (`ResourceOperationHelperBackendService.enrichDataWithContext`),\n     * which injects `executionContext.initiatorIds.anonymousUserId` — the client\n     * `uuidRef` (the AnonymousUser's relational identity), NOT its server-minted\n     * `_id`. This resource is APPLICATION-scoped and standalone-created (no nested\n     * `/anonymous-users/{uuidRef}/…` URL segment carries the FK, and it is\n     * deliberately NOT `isAnonymizable`), so the enrichment resolves the FK from the\n     * anonymous initiator identity rather than the URL scope map. Never client-authored.\n     */\n    anonymousUserId : z.string().nullable().isDBIndexed().excludeFromCreate().isBackendOnly(),\n\n    /**\n     * Authenticated user AFTER anonymous-session transposition (W7.3a).\n     * Auto-set by the manual transposition hook on\n     * `AnonymousSessionBackendService` when the anonymous user signs up\n     * or logs in. `null` for leads that never converted to an\n     * authenticated user. Distinct from `relatedUserId` below — see\n     * `relatedUserId` JSDoc for the semantic boundary.\n     */\n    userId : z.string().nullable().isDBIndexed().excludeFromCreate().isBackendOnly(),\n\n    /**\n     * Manually-linked existing customer profile by sales / support\n     * (e.g. a salesperson tags an inbound lead as \"this is the same\n     * human as CRM contact X\"). **Not** auto-populated by\n     * anonymous-session transposition — that slot is `userId` above.\n     *\n     * A lead can legitimately have both populated:\n     * - `userId`        = the user who eventually signed up from this\n     *                     lead session (auto-set by transposition).\n     * - `relatedUserId` = the user a human rep manually associated\n     *                     (may be a different person, e.g. the lead is\n     *                     for a colleague of an existing customer).\n     *\n     * Kept on the schema for zero-cost preservation (no migration);\n     * the disambiguating JSDoc here exists so future readers do not\n     * conflate it with `userId`.\n     *\n     * `.excludeFromCreate()` is a HARD requirement, not polish: the public\n     * INBOUND_CONTACTS CREATE is anonymous (`APP_ANONYMOUS`), so a client-\n     * authorable `relatedUserId` would let an unauthenticated visitor tag a\n     * lead as \"related to\" an arbitrary existing user (a data-integrity /\n     * attribution-forgery hole). It is set ONLY post-create by a sales/support\n     * admin via a privileged update, never on the public capture request.\n     */\n    relatedUserId : z.string().isDBIndexed().optional().excludeFromCreate(),\n\n    /**\n     * Lead-triage signal (see `InboundContactEmailUserMatch`): did this lead's\n     * email match an existing user at capture time, and was that user active?\n     *\n     * Server-computed by the INBOUND_CONTACTS CREATE custom implementation\n     * (`prefixCoreOperations`) via a privileged users-by-email lookup — the\n     * anonymous create context cannot read `users`, so the lookup runs in a\n     * dedicated internal super-admin context and the result is stamped here.\n     *\n     * `.isBackendOnly()` is a HARD requirement, not polish: the CREATE response\n     * is returned to the anonymous submitter, so exposing the match would turn\n     * lead capture into an account-enumeration oracle. Backend-only keeps it out\n     * of every client response; admin / analytics surfaces read it through the\n     * internal DTO. `.excludeFromCreate()` (server-set, never client-authored)\n     * and `.excludeFromUpdate()` (immutable capture-time snapshot); `.default`\n     * `NONE` is the fail-safe when the email is absent or the lookup fails.\n     */\n    emailUserMatch : z.enum(InboundContactEmailUserMatch).default(InboundContactEmailUserMatch.NONE).isDBIndexed().excludeFromCreate().excludeFromUpdate().isBackendOnly(),\n\n    /**\n     * Mongoose-managed timestamps. Declared `z.date()` (NOT `z.iso.datetime()`)\n     * because the persistence layer stores them as BSON `Date`s and the DTO\n     * builder's network-boundary coercion (`applyNetworkBoundaryCoercion`)\n     * rewrites `z.date()` → `z.coerce.date()`. A `z.iso.datetime()` string validator would\n     * reject the stored `Date` on the output/internalDto parse → HTTP 500\n     * `service_resource_transformation_failed` on every create/read. Matches the\n     * framework-wide timestamp convention (35+ resources, e.g. `AnonymousUser`).\n     */\n    createdAt : z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n    updatedAt : z.date().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n    privacy : InboundContactPrivacySchema,\n});\n\n\nexport type InboundContact = z.infer<typeof InboundContactSchema>;\n"]}

package/dist/esm/users/user-credentials.shared.resources-config.schemas.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { CoreResourceOperation } from '../resources/resources.shared.core.definitions.js';
-import { ResourceRelationship } from '../resources/resources.shared.schemas.js';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../resources/resources.shared.schemas';
 /**
  * User Credentials Resource Configuration (Internal-only)
  *
@@ -8,16 +8,16 @@ import { ResourceRelationship } from '../resources/resources.shared.schemas.js';
  * Operations are INTERNAL_CALL: accessible through the service layer pipeline
  * by trusted internal code, but not exposed as HTTP endpoints.
  */
-export declare const userCredentialsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../index.js").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, z.ZodObject<{
+export declare const userCredentialsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    passwordHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    secretBase32: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    passwordHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodString>>>>;
+    secretBase32: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodString>>>>;
     totpVerified: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-    backupCodesHashed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-    totpVerifiedAt: z.ZodOptional<z.ZodDate>;
+    backupCodesHashed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+    totpVerifiedAt: z.ZodOptional<z.ZodNullable<z.ZodDate>>;
     passwordChangedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;
-    passkeyCredentials: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodObject<{
+    passkeyCredentials: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodObject<{
         credentialId: z.ZodString;
         publicKey: z.ZodString;
         counter: z.ZodDefault<z.ZodNumber>;
@@ -28,14 +28,14 @@ export declare const userCredentialsResourceConfiguration_InitializationFactory:
         aaguid: z.ZodOptional<z.ZodString>;
         createdAt: z.ZodDefault<z.ZodDate>;
         lastUsedAt: z.ZodOptional<z.ZodDate>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>>;
+    }, z.core.$strip>>>>>;
     firstMfaPromptAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;
-    mfaEnrollmentState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../index.js").MfaEnrollmentState>>>;
+    mfaEnrollmentState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("..").MfaEnrollmentState>>>;
     consecutiveLockouts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
-    phoneNumber: z.ZodOptional<z.ZodString>;
+    phoneNumber: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     phoneNumberVerified: z.ZodDefault<z.ZodBoolean>;
     phoneVerifiedAt: z.ZodOptional<z.ZodDate>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 //# sourceMappingURL=user-credentials.shared.resources-config.schemas.d.ts.map

package/dist/esm/users/user-credentials.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAuE9C,CAAC"}
+{"version":3,"file":"user-credentials.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+E9C,CAAC"}

package/dist/esm/users/user-credentials.shared.resources-config.schemas.js

@@ -1,5 +1,6 @@
 import { UserCredentialsSchema } from './user-credentials.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
@@ -16,6 +17,15 @@ export const userCredentialsResourceConfiguration_InitializationFactory = (resou
     resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_CREDENTIALS],
     resourceRelationships: resourcesRelationships,
     isSystemResource: true,
+    // Registration / password-reset / MFA flows write credentials in-process on a
+    // pre-auth (or system) EC that carries no request context, so the client-shaped
+    // request DTO would strip `userId` (context FK) and `passwordHash` /
+    // `secretBase32` / … (backendOnly). Opt CREATE + UPDATE into the trusted
+    // `createAsSystem` / `updateAsSystem` path, which re-attaches exactly those
+    // fields after the strict parse. INTERNAL_CALL-only resource → never HTTP-reachable.
+    systemAccessPolicy: {
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN, create: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED
+    },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
@@ -78,4 +88,4 @@ export const userCredentialsResourceConfiguration_InitializationFactory = (resou
         },
     },
 });
-//# sourceMappingURL=user-credentials.shared.resources-config.schemas.js.map
+//# sourceMappingURL=user-credentials.shared.resources-config.schemas.js.map

package/dist/esm/users/user-credentials.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,qBAAqB;IACjC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,0CAA0C;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,0CAA0C;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"user-credentials.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,qBAAqB;IACjC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,8EAA8E;IAC9E,gFAAgF;IAChF,qEAAqE;IACrE,yEAAyE;IACzE,4EAA4E;IAC5E,qFAAqF;IACrF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IACzI,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,0CAA0C;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,0CAA0C;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { UserCredentialsSchema } from './user-credentials.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * User Credentials Resource Configuration (Internal-only)\n *\n * System resource — no auto-generated API controller.\n * Operations are INTERNAL_CALL: accessible through the service layer pipeline\n * by trusted internal code, but not exposed as HTTP endpoints.\n */\nexport const userCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof UserCredentialsSchema\n>({\n  mainSchema: UserCredentialsSchema,\n  resourceIdentifier: CoreResourceType.USER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Registration / password-reset / MFA flows write credentials in-process on a\n  // pre-auth (or system) EC that carries no request context, so the client-shaped\n  // request DTO would strip `userId` (context FK) and `passwordHash` /\n  // `secretBase32` / … (backendOnly). Opt CREATE + UPDATE into the trusted\n  // `createAsSystem` / `updateAsSystem` path, which re-attaches exactly those\n  // fields after the strict parse. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN, create: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // requestDto auto-derived from decorators\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // requestDto auto-derived from decorators\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n\n\n"]}

package/dist/esm/users/user-credentials.shared.schemas.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { MfaEnrollmentState } from '../security/authentications/authentication.shared.schemas.js';
+import { MfaEnrollmentState } from '../security/authentications/authentication.shared.schemas';
 /**
  * Individual WebAuthn/Passkey credential entry.
  * Stores the data returned by @simplewebauthn/server after registration verification.
@@ -15,13 +15,18 @@ export declare const PasskeyCredentialEntrySchema: z.ZodObject<{
     aaguid: z.ZodOptional<z.ZodString>;
     createdAt: z.ZodDefault<z.ZodDate>;
     lastUsedAt: z.ZodOptional<z.ZodDate>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type PasskeyCredentialEntry = z.infer<typeof PasskeyCredentialEntrySchema>;
 /**
  * User Credentials Schema
  * Stores all authentication secrets for a user: password hash + optional TOTP.
  * All fields are compatible with MongoDB via zod-to-mongoose converter.
  *
+ * The local first-factor / TOTP secret fields (`passwordHash`, `secretBase32`,
+ * `totpVerifiedAt`) are `.nullish()` — absent when never set, or explicitly `null`
+ * once a compliance clear physically destroys them (directory-managed reconciliation,
+ * TOTP-disable). See each field's JSDoc for the null-vs-absent contract.
+ *
  * TOTP fields (optional — user may have password-only auth):
  * - `secretBase32`: base32-encoded TOTP secret (backendOnly). Used with otpauth library.
  *    NOTE: stored as plaintext base32. For production hardening, add AES-256-GCM encryption at rest.
@@ -32,13 +37,13 @@ export type PasskeyCredentialEntry = z.infer<typeof PasskeyCredentialEntrySchema
 export declare const UserCredentialsSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    passwordHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    secretBase32: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    passwordHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodString>>>>;
+    secretBase32: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodString>>>>;
     totpVerified: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-    backupCodesHashed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-    totpVerifiedAt: z.ZodOptional<z.ZodDate>;
+    backupCodesHashed: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+    totpVerifiedAt: z.ZodOptional<z.ZodNullable<z.ZodDate>>;
     passwordChangedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;
-    passkeyCredentials: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodObject<{
+    passkeyCredentials: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodObject<{
         credentialId: z.ZodString;
         publicKey: z.ZodString;
         counter: z.ZodDefault<z.ZodNumber>;
@@ -49,15 +54,15 @@ export declare const UserCredentialsSchema: z.ZodObject<{
         aaguid: z.ZodOptional<z.ZodString>;
         createdAt: z.ZodDefault<z.ZodDate>;
         lastUsedAt: z.ZodOptional<z.ZodDate>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>>;
+    }, z.core.$strip>>>>>;
     firstMfaPromptAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;
     mfaEnrollmentState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof MfaEnrollmentState>>>;
     consecutiveLockouts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
-    phoneNumber: z.ZodOptional<z.ZodString>;
+    phoneNumber: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     phoneNumberVerified: z.ZodDefault<z.ZodBoolean>;
     phoneVerifiedAt: z.ZodOptional<z.ZodDate>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type UserCredentials = z.infer<typeof UserCredentialsSchema>;
 //# sourceMappingURL=user-credentials.shared.schemas.d.ts.map

package/dist/esm/users/user-credentials.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;uCAWvC,CAAC;AAGH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAkChC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"user-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAG/F;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAWvC,CAAC;AAGH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwEhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}