@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/guidance/progression-state.shared.resources-config.schemas.js

@@ -15,6 +15,7 @@ import { createResourceConfiguration_Initialization } from '../resources/resourc
 import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
 import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 export const userProgressionStateResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: UserProgressionStateSchema,
     resourceIdentifier: CoreResourceType.USER_PROGRESSION_STATE,
@@ -27,6 +28,28 @@ export const userProgressionStateResourceConfiguration_InitializationFactory = (
         exportSubject: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED
     },
     portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },
+    /**
+     * Subject erasure RETAINS this row and RESETS the achievement records, operation counters and points total to the schema's own defaults.
+     *
+     * The USAGE categories on this resource are accurate — these are observations the product made about a
+     * named person — so `RETAIN_ONLY` would be a false assertion and the factory refuses it. Until
+     * `RedactionType.RESET` existed no treatment could reach these fields at all: they are non-nullable WITH
+     * a `.default()`, so REMOVE (needs clearable) and MASK (needs a string) both refuse. RESET returns each
+     * to what it is when nobody has set it, which for a behavioural record is exactly what erasure should
+     * leave behind.
+     *
+     * The primary scope FK is preserved — severing it is refused outright, because it would leave the
+     * retained row with no tenant anchor, unreachable even to the audited see-through read.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The row is state ABOUT a person rather than the person,
+   *  and its primary scope FK anchors it — the enum prescribes `NO_PRINCIPAL` for that shape. The subject's
+   *  own session ends through the `USERS` row.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.SEARCH,
@@ -37,9 +60,37 @@ export const userProgressionStateResourceConfiguration_InitializationFactory = (
         // when its owning scope is deleted. Without it the cascade throws
         // ErrorType.CONFIGURATION on any scope that has a materialized row.
         CoreResourceOperation.DELETE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY (READ is above).
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.UPDATE_MANY,
     ],
     customOperation: {},
     operationsConfiguration: {
+        /*
+    
+         * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY:
+    
+         * the retention primitives resolve through `getServiceOperationPathDefault`, which matches only
+    
+         * INTERNAL_CALL / API_CALL. UPDATE_MANY is the verb the impersonalize writer uses.
+    
+         */
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [
                 {

package/dist/esm/guidance/progression-state.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"progression-state.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/guidance/progression-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAWhG,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI3K;IACA,UAAU,EAAE,0BAA0B;IACtC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAC7F,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,EAAE;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,kEAAkE;QAClE,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,sEAAsE;oBACtE,0EAA0E;oBAC1E,4EAA4E;oBAC5E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,mEAAmE;QACnE,4EAA4E;QAC5E,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC;AAWH,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAInL;IACA,UAAU,EAAE,kCAAkC;IAC9C,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,kEAAkE;QAClE,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,sEAAsE;oBACtE,0EAA0E;oBAC1E,4EAA4E;oBAC5E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,wEAAwE;QACxE,iEAAiE;QACjE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Progression State Shared Resource Configurations\n *\n * Resource configurations for dual-scope progression state management (USER / ORGANIZATION).\n * Each scope stores milestone achievement progress, operation counts, and category progress.\n * The shared payload schema stays scope-agnostic, while the schema file also owns\n * the scope-aware persisted variants used by these resource configurations.\n */\n\nimport {\n  ProgressionStateSchema,\n  UserProgressionStateSchema,\n  OrganizationProgressionStateSchema,\n} from './progression-state.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// ─── USER PROGRESSION STATE ─────────────────────────────────────────────────────\n\ntype UserProgressionStateCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\nexport const userProgressionStateResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  UserProgressionStateCoreOperations,\n  typeof UserProgressionStateSchema\n>({\n  mainSchema: UserProgressionStateSchema,\n  resourceIdentifier: CoreResourceType.USER_PROGRESSION_STATE,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROGRESSION_STATE],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the self-healing state row is physically removed\n    // when its owning scope is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any scope that has a materialized row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_USER],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (not REPOSITORY_ONLY): the onParentCreate seed's\n          // `createAsSystem` resolves the CREATE op via the service tier, which\n          // rejects REPOSITORY_ONLY → OPERATION_PATH_NOT_FOUND, silent no-seed. See\n          // the org-preferences config + composition-oncreate plan for the rationale.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this self-healing state row is physically removed\n    // when its owning user is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any user that\n    // has a materialized row — these rows self-heal on first READ, so most active\n    // users have one. Super-admin/HIGH: a privileged teardown, not the APP_USER\n    // self-write. See composition-oncreate-lifecycle plan (systemic DELETE gap).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n  },\n});\n\n// ─── ORGANIZATION PROGRESSION STATE ─────────────────────────────────────────────\n\ntype OrganizationProgressionStateCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\nexport const organizationProgressionStateResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  OrganizationProgressionStateCoreOperations,\n  typeof OrganizationProgressionStateSchema\n>({\n  mainSchema: OrganizationProgressionStateSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_PROGRESSION_STATE,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_PROGRESSION_STATE],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the self-healing state row is physically removed\n    // when its owning scope is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any scope that has a materialized row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_ORG_ROLES.ORG_MEMBER],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (not REPOSITORY_ONLY): the onParentCreate seed's\n          // `createAsSystem` resolves the CREATE op via the service tier, which\n          // rejects REPOSITORY_ONLY → OPERATION_PATH_NOT_FOUND, silent no-seed. See\n          // the org-preferences config + composition-oncreate plan for the rationale.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this self-healing state row is physically removed\n    // when its owning organization is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any org that has\n    // a materialized row — these rows self-heal on first READ, so most active orgs\n    // have one. ORG_ADMIN/HIGH: the org-scope admin tier for a privileged teardown\n    // (org progression writes are ORG_MEMBER, but teardown is admin-gated).\n    // See composition-oncreate-lifecycle plan (systemic DELETE gap).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"progression-state.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/guidance/progression-state.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAcvH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI3K;IACA,UAAU,EAAE,0BAA0B;IACtC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAC7F,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,EAAE;IAE3E;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,kEAAkE;QAClE,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;QAC5B,oFAAoF;QACpF,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAE5B,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAE1C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,sEAAsE;oBACtE,0EAA0E;oBAC1E,4EAA4E;oBAC5E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,mEAAmE;QACnE,4EAA4E;QAC5E,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC;AAWH,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAInL;IACA,UAAU,EAAE,kCAAkC;IAC9C,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,kEAAkE;QAClE,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,sEAAsE;oBACtE,0EAA0E;oBAC1E,4EAA4E;oBAC5E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,wEAAwE;QACxE,iEAAiE;QACjE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Progression State Shared Resource Configurations\n *\n * Resource configurations for dual-scope progression state management (USER / ORGANIZATION).\n * Each scope stores milestone achievement progress, operation counts, and category progress.\n * The shared payload schema stays scope-agnostic, while the schema file also owns\n * the scope-aware persisted variants used by these resource configurations.\n */\n\nimport {\n  ProgressionStateSchema,\n  UserProgressionStateSchema,\n  OrganizationProgressionStateSchema,\n} from './progression-state.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// ─── USER PROGRESSION STATE ─────────────────────────────────────────────────────\n\ntype UserProgressionStateCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const userProgressionStateResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  UserProgressionStateCoreOperations,\n  typeof UserProgressionStateSchema\n>({\n  mainSchema: UserProgressionStateSchema,\n  resourceIdentifier: CoreResourceType.USER_PROGRESSION_STATE,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROGRESSION_STATE],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED, create: ResourceSystemAccessMode.ALLOWED },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.DERIVED },\n\n  /**\n   * Subject erasure RETAINS this row and RESETS the achievement records, operation counters and points total to the schema's own defaults.\n   *\n   * The USAGE categories on this resource are accurate — these are observations the product made about a\n   * named person — so `RETAIN_ONLY` would be a false assertion and the factory refuses it. Until\n   * `RedactionType.RESET` existed no treatment could reach these fields at all: they are non-nullable WITH\n   * a `.default()`, so REMOVE (needs clearable) and MASK (needs a string) both refuse. RESET returns each\n   * to what it is when nobody has set it, which for a behavioural record is exactly what erasure should\n   * leave behind.\n   *\n   * The primary scope FK is preserved — severing it is refused outright, because it would leave the\n   * retained row with no tenant anchor, unreachable even to the audited see-through read.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Erasing one of these rows revokes NO session. The row is state ABOUT a person rather than the person,\n *  and its primary scope FK anchors it — the enum prescribes `NO_PRINCIPAL` for that shape. The subject's\n *  own session ends through the `USERS` row.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the self-healing state row is physically removed\n    // when its owning scope is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any scope that has a materialized row.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY (READ is above).\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n\n    /*\n\n     * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY:\n\n     * the retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n     * INTERNAL_CALL / API_CALL. UPDATE_MANY is the verb the impersonalize writer uses.\n\n     */\n\n    [CoreResourceOperation.LIST]: {\n\n      variants: [{\n\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n        isDefault: true,\n\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n        riskLevel: ResourceOperationRiskLevel.LOW,\n\n      }],\n\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n\n      variants: [{\n\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n        isDefault: true,\n\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n        riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n      }],\n\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_USER],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (not REPOSITORY_ONLY): the onParentCreate seed's\n          // `createAsSystem` resolves the CREATE op via the service tier, which\n          // rejects REPOSITORY_ONLY → OPERATION_PATH_NOT_FOUND, silent no-seed. See\n          // the org-preferences config + composition-oncreate plan for the rationale.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this self-healing state row is physically removed\n    // when its owning user is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any user that\n    // has a materialized row — these rows self-heal on first READ, so most active\n    // users have one. Super-admin/HIGH: a privileged teardown, not the APP_USER\n    // self-write. See composition-oncreate-lifecycle plan (systemic DELETE gap).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n  },\n});\n\n// ─── ORGANIZATION PROGRESSION STATE ─────────────────────────────────────────────\n\ntype OrganizationProgressionStateCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\nexport const organizationProgressionStateResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  OrganizationProgressionStateCoreOperations,\n  typeof OrganizationProgressionStateSchema\n>({\n  mainSchema: OrganizationProgressionStateSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_PROGRESSION_STATE,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_PROGRESSION_STATE],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the self-healing state row is physically removed\n    // when its owning scope is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any scope that has a materialized row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_ORG_ROLES.ORG_MEMBER],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (not REPOSITORY_ONLY): the onParentCreate seed's\n          // `createAsSystem` resolves the CREATE op via the service tier, which\n          // rejects REPOSITORY_ONLY → OPERATION_PATH_NOT_FOUND, silent no-seed. See\n          // the org-preferences config + composition-oncreate plan for the rationale.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this self-healing state row is physically removed\n    // when its owning organization is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any org that has\n    // a materialized row — these rows self-heal on first READ, so most active orgs\n    // have one. ORG_ADMIN/HIGH: the org-scope admin tier for a privileged teardown\n    // (org progression writes are ORG_MEMBER, but teardown is admin-gated).\n    // See composition-oncreate-lifecycle plan (systemic DELETE gap).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/guidance/progression-state.shared.schemas.d.ts

@@ -8,6 +8,40 @@ export declare const ProgressionMilestoneAchievedSchema: z.ZodObject<{
     count: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strip>;
 export type ProgressionMilestoneAchieved = z.infer<typeof ProgressionMilestoneAchievedSchema>;
+/** ──────────────────────────────────────────────────────────────
+ * Progression State — Value Moment Record
+ * ────────────────────────────────────────────────────────────── */
+/**
+ * A value moment's state for one scope: what it has observed, and whether it fired.
+ *
+ * ## Why this lives on the progression state rather than in a resource of its own
+ *
+ * A value moment is an achievement keyed by an identifier, measured per USER or per ORGANIZATION,
+ * derived from the same operation stream — the exact shape this row already holds for milestones,
+ * with the same `PersonalDataCategory.USAGE` classification, the same erasure treatment, the same
+ * subject-export provenance and the same `onParentCreate` / `onParentDelete` lifecycle. A second
+ * resource would have re-declared every one of those obligations (#414).
+ *
+ * ## Why it is a SEPARATE FIELD from `milestonesAchieved`
+ *
+ * The two vocabularies are semantically distinct and their identifier spaces are independent: a
+ * milestone is AUTHORED progression (dependencies, conditions, points, categories); a value moment
+ * is a MEASURED behavioural moment (a `ValueMomentRole`, `ANY`/`ALL` composition over typed signals,
+ * a cooldown, a suppressing `beforeStage`). Sharing one map would let a `milestoneRef` and a
+ * `momentIdentifier` collide silently, and neither vocabulary constrains the other.
+ *
+ * ## What is NOT here, and why
+ *
+ * `ValueMomentRole.ANTI_PATTERN` is declared as NOT persisted — it re-fires on a cooldown rather than
+ * being achieved once — so no anti-pattern ever writes a record here. Its cooldown is in-process; in
+ * a multi-instance deployment each instance therefore keeps its own, which is what "not persisted"
+ * means rather than a defect to fix here.
+ */
+export declare const ValueMomentStateSchema: z.ZodObject<{
+    signalsObserved: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    achievedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
+}, z.core.$strip>;
+export type ValueMomentState = z.infer<typeof ValueMomentStateSchema>;
 /** ──────────────────────────────────────────────────────────────
  * Progression State — Per-Category Aggregated Progress
  * ────────────────────────────────────────────────────────────── */
@@ -30,6 +64,10 @@ export declare const ProgressionStateSchema: z.ZodObject<{
     }, z.core.$strip>>>>;
     operationCounts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>>;
     totalPoints: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    valueMomentsAchieved: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        signalsObserved: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        achievedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
+    }, z.core.$strip>>>>;
     categoriesProgress: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         completedCount: z.ZodDefault<z.ZodNumber>;
         totalPoints: z.ZodDefault<z.ZodNumber>;
@@ -43,6 +81,10 @@ export declare const UserProgressionStateSchema: z.ZodObject<{
     }, z.core.$strip>>>>;
     operationCounts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>>;
     totalPoints: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    valueMomentsAchieved: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        signalsObserved: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        achievedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
+    }, z.core.$strip>>>>;
     categoriesProgress: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         completedCount: z.ZodDefault<z.ZodNumber>;
         totalPoints: z.ZodDefault<z.ZodNumber>;
@@ -57,6 +99,10 @@ export declare const OrganizationProgressionStateSchema: z.ZodObject<{
     }, z.core.$strip>>>>;
     operationCounts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>>;
     totalPoints: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>>;
+    valueMomentsAchieved: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        signalsObserved: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        achievedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
+    }, z.core.$strip>>>>;
     categoriesProgress: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         completedCount: z.ZodDefault<z.ZodNumber>;
         totalPoints: z.ZodDefault<z.ZodNumber>;

package/dist/esm/guidance/progression-state.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"progression-state.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/guidance/progression-state.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;oEAEoE;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,kCAAkC;;;iBAK7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;oEAEoE;AAEpE,uCAAuC;AACvC,eAAO,MAAM,iCAAiC;;;iBAK5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;oEAEoE;AAEpE;;wDAEwD;AACxD,eAAO,MAAM,sBAAsB;;;;;;;;;;;iBAYjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;iBAErC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAE7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,GAAG,4BAA4B,CAAC"}
+{"version":3,"file":"progression-state.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/guidance/progression-state.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;oEAEoE;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,kCAAkC;;;iBAK7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;oEAEoE;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,sBAAsB;;;iBASjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;oEAEoE;AAEpE,uCAAuC;AACvC,eAAO,MAAM,iCAAiC;;;iBAK5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;oEAEoE;AAEpE;;wDAEwD;AACxD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;iBA8CjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;iBAErC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;iBAE7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,GAAG,4BAA4B,CAAC"}

package/dist/esm/guidance/progression-state.shared.schemas.js

@@ -1,5 +1,7 @@
 import { z } from 'zod';
 import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
+import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
+import { addImpersonalizeWith } from '@wildo-ai/zod-decorators';
 /** ──────────────────────────────────────────────────────────────
  * Progression State — Milestone Achievement Record
  * ────────────────────────────────────────────────────────────── */
@@ -10,6 +12,45 @@ export const ProgressionMilestoneAchievedSchema = z.object({
     /** How many times the triggering operation occurred (for COUNT_THRESHOLD context) */
     count: z.number().int().default(0),
 });
+/** ──────────────────────────────────────────────────────────────
+ * Progression State — Value Moment Record
+ * ────────────────────────────────────────────────────────────── */
+/**
+ * A value moment's state for one scope: what it has observed, and whether it fired.
+ *
+ * ## Why this lives on the progression state rather than in a resource of its own
+ *
+ * A value moment is an achievement keyed by an identifier, measured per USER or per ORGANIZATION,
+ * derived from the same operation stream — the exact shape this row already holds for milestones,
+ * with the same `PersonalDataCategory.USAGE` classification, the same erasure treatment, the same
+ * subject-export provenance and the same `onParentCreate` / `onParentDelete` lifecycle. A second
+ * resource would have re-declared every one of those obligations (#414).
+ *
+ * ## Why it is a SEPARATE FIELD from `milestonesAchieved`
+ *
+ * The two vocabularies are semantically distinct and their identifier spaces are independent: a
+ * milestone is AUTHORED progression (dependencies, conditions, points, categories); a value moment
+ * is a MEASURED behavioural moment (a `ValueMomentRole`, `ANY`/`ALL` composition over typed signals,
+ * a cooldown, a suppressing `beforeStage`). Sharing one map would let a `milestoneRef` and a
+ * `momentIdentifier` collide silently, and neither vocabulary constrains the other.
+ *
+ * ## What is NOT here, and why
+ *
+ * `ValueMomentRole.ANTI_PATTERN` is declared as NOT persisted — it re-fires on a cooldown rather than
+ * being achieved once — so no anti-pattern ever writes a record here. Its cooldown is in-process; in
+ * a multi-instance deployment each instance therefore keeps its own, which is what "not persisted"
+ * means rather than a defect to fix here.
+ */
+export const ValueMomentStateSchema = z.object({
+    /**
+     * Signal keys observed so far, for `ValueMomentMode.ALL` composition. A moment in `ANY` mode fires
+     * on the first signal and never needs this, but it is recorded for both so a moment whose mode is
+     * changed after the fact does not silently lose the progress it already had.
+     */
+    signalsObserved: z.array(z.string()).default([]),
+    /** When the moment fired. Absent while it is still accumulating signals. */
+    achievedAt: z.coerce.date().optional(),
+});
 /** ──────────────────────────────────────────────────────────────
  * Progression State — Per-Category Aggregated Progress
  * ────────────────────────────────────────────────────────────── */
@@ -29,13 +70,35 @@ export const ProgressionCategoryProgressSchema = z.object({
 export const ProgressionStateSchema = z.object({
     /** Map of milestoneRef → achievement record. Populated when a milestone is achieved. */
     // USAGE — a per-person record of what they accomplished and how often they acted.
-    milestonesAchieved: z.record(z.string(), ProgressionMilestoneAchievedSchema).default({})
-        .dataCategories(PersonalDataCategory.USAGE),
+    // RESET on erasure — returns this field to its schema default. It holds what this person achieved and when,
+    // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK
+    // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK
+    // needs a string. The value comes from the schema, so there is no second copy to drift.
+    milestonesAchieved: addImpersonalizeWith(z.record(z.string(), ProgressionMilestoneAchievedSchema).default({})
+        .dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET),
     /** Map of `${resourceType}:${operation}` → count. Incremented on every matching operation.
      *  This is the raw data used by COUNT_THRESHOLD conditions. */
-    operationCounts: z.record(z.string(), z.number().int()).default({}).dataCategories(PersonalDataCategory.USAGE),
+    // RESET on erasure — returns this field to its schema default. It holds how often they performed each operation,
+    // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK
+    // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK
+    // needs a string. The value comes from the schema, so there is no second copy to drift.
+    operationCounts: addImpersonalizeWith(z.record(z.string(), z.number().int()).default({}).dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET),
     /** Total points across all achieved milestones. Updated atomically with achievements. */
-    totalPoints: z.number().int().default(0).isSummaryField().dataCategories(PersonalDataCategory.USAGE),
+    // RESET on erasure — returns this field to its schema default. It holds their points total,
+    // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK
+    // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK
+    // needs a string. The value comes from the schema, so there is no second copy to drift.
+    totalPoints: addImpersonalizeWith(z.number().int().default(0).isSummaryField().dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET),
+    /** Map of momentIdentifier → value-moment state. See `ValueMomentStateSchema` for why it is
+     *  separate from `milestonesAchieved`. */
+    // USAGE — a per-person record of which product moments they reached and when.
+    // RESET on erasure — the same treatment as `milestonesAchieved` beside it, and for the same
+    // reasons: the USAGE category is accurate (these are observations the product made about a named
+    // person, so RETAIN_ONLY would be a false assertion), and the field is non-nullable WITH a
+    // `.default()`, so REMOVE needs a clearable field and MASK needs a string. RESET returns it to
+    // what it is when nobody has been observed, which is what erasure should leave behind.
+    valueMomentsAchieved: addImpersonalizeWith(z.record(z.string(), ValueMomentStateSchema).default({})
+        .dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET),
     /** Per-category progress. Pre-aggregated for frontend display efficiency. */
     categoriesProgress: z.record(z.string(), ProgressionCategoryProgressSchema).default({}),
 });

package/dist/esm/guidance/progression-state.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"progression-state.shared.schemas.js","sourceRoot":"","sources":["../../../../src/guidance/progression-state.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;oEAEoE;AAEpE,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC3B,qFAAqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAGH;;oEAEoE;AAEpE,uCAAuC;AACvC,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,sDAAsD;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH;;oEAEoE;AAEpE;;wDAEwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,wFAAwF;IACxF,kFAAkF;IAClF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACrF,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC7C;mEAC+D;IAC/D,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC9G,yFAAyF;IACzF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACpG,6EAA6E;IAC7E,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,MAAM,CAAC;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CAC5F,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,sBAAsB,CAAC,MAAM,CAAC;IAC9E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/** ──────────────────────────────────────────────────────────────\n * Progression State — Milestone Achievement Record\n * ────────────────────────────────────────────────────────────── */\n\n/** Record of a single milestone achievement */\nexport const ProgressionMilestoneAchievedSchema = z.object({\n  /** When the milestone was achieved */\n  achievedAt: z.coerce.date(),\n  /** How many times the triggering operation occurred (for COUNT_THRESHOLD context) */\n  count: z.number().int().default(0),\n});\nexport type ProgressionMilestoneAchieved = z.infer<typeof ProgressionMilestoneAchievedSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Progression State — Per-Category Aggregated Progress\n * ────────────────────────────────────────────────────────────── */\n\n/** Per-category aggregated progress */\nexport const ProgressionCategoryProgressSchema = z.object({\n  /** Number of milestones completed in this category */\n  completedCount: z.number().int().default(0),\n  /** Total points earned in this category */\n  totalPoints: z.number().int().default(0),\n});\nexport type ProgressionCategoryProgress = z.infer<typeof ProgressionCategoryProgressSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Progression State — Top-Level Document\n * ────────────────────────────────────────────────────────────── */\n\n/** Shared progression state payload body.\n *  Scope-specific state resources extend this schema with their owning FK\n *  (`userId` / `organizationId`) before persistence. */\nexport const ProgressionStateSchema = z.object({\n  /** Map of milestoneRef → achievement record. Populated when a milestone is achieved. */\n  // USAGE — a per-person record of what they accomplished and how often they acted.\n  milestonesAchieved: z.record(z.string(), ProgressionMilestoneAchievedSchema).default({})\n    .dataCategories(PersonalDataCategory.USAGE),\n  /** Map of `${resourceType}:${operation}` → count. Incremented on every matching operation.\n   *  This is the raw data used by COUNT_THRESHOLD conditions. */\n  operationCounts: z.record(z.string(), z.number().int()).default({}).dataCategories(PersonalDataCategory.USAGE),\n  /** Total points across all achieved milestones. Updated atomically with achievements. */\n  totalPoints: z.number().int().default(0).isSummaryField().dataCategories(PersonalDataCategory.USAGE),\n  /** Per-category progress. Pre-aggregated for frontend display efficiency. */\n  categoriesProgress: z.record(z.string(), ProgressionCategoryProgressSchema).default({}),\n});\nexport type ProgressionState = z.infer<typeof ProgressionStateSchema>;\n\nexport const UserProgressionStateSchema = ProgressionStateSchema.extend({\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\nexport type UserProgressionState = z.infer<typeof UserProgressionStateSchema>;\n\nexport const OrganizationProgressionStateSchema = ProgressionStateSchema.extend({\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\nexport type OrganizationProgressionState = z.infer<typeof OrganizationProgressionStateSchema>;\n\nexport type PersistedProgressionState = UserProgressionState | OrganizationProgressionState;\n"]}
+{"version":3,"file":"progression-state.shared.schemas.js","sourceRoot":"","sources":["../../../../src/guidance/progression-state.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;oEAEoE;AAEpE,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC3B,qFAAqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAGH;;oEAEoE;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH;;oEAEoE;AAEpE,uCAAuC;AACvC,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,sDAAsD;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH;;oEAEoE;AAEpE;;wDAEwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,wFAAwF;IACxF,kFAAkF;IAClF,4GAA4G;IAC5G,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,kBAAkB,EAAE,oBAAoB,CACxC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SAC/D,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;IACD;mEAC+D;IAC/D,iHAAiH;IACjH,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,eAAe,EAAE,oBAAoB,CACrC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC3F,aAAa,CAAC,KAAK,CACpB;IACD,yFAAyF;IACzF,4FAA4F;IAC5F,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,WAAW,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EACrF,aAAa,CAAC,KAAK,CACpB;IACD;8CAC0C;IAC1C,8EAA8E;IAC9E,4FAA4F;IAC5F,iGAAiG;IACjG,2FAA2F;IAC3F,+FAA+F;IAC/F,uFAAuF;IACvF,oBAAoB,EAAE,oBAAoB,CACxC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACrD,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;IACD,6EAA6E;IAC7E,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,MAAM,CAAC;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CAC5F,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,sBAAsB,CAAC,MAAM,CAAC;IAC9E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\n/** ──────────────────────────────────────────────────────────────\n * Progression State — Milestone Achievement Record\n * ────────────────────────────────────────────────────────────── */\n\n/** Record of a single milestone achievement */\nexport const ProgressionMilestoneAchievedSchema = z.object({\n  /** When the milestone was achieved */\n  achievedAt: z.coerce.date(),\n  /** How many times the triggering operation occurred (for COUNT_THRESHOLD context) */\n  count: z.number().int().default(0),\n});\nexport type ProgressionMilestoneAchieved = z.infer<typeof ProgressionMilestoneAchievedSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Progression State — Value Moment Record\n * ────────────────────────────────────────────────────────────── */\n\n/**\n * A value moment's state for one scope: what it has observed, and whether it fired.\n *\n * ## Why this lives on the progression state rather than in a resource of its own\n *\n * A value moment is an achievement keyed by an identifier, measured per USER or per ORGANIZATION,\n * derived from the same operation stream — the exact shape this row already holds for milestones,\n * with the same `PersonalDataCategory.USAGE` classification, the same erasure treatment, the same\n * subject-export provenance and the same `onParentCreate` / `onParentDelete` lifecycle. A second\n * resource would have re-declared every one of those obligations (#414).\n *\n * ## Why it is a SEPARATE FIELD from `milestonesAchieved`\n *\n * The two vocabularies are semantically distinct and their identifier spaces are independent: a\n * milestone is AUTHORED progression (dependencies, conditions, points, categories); a value moment\n * is a MEASURED behavioural moment (a `ValueMomentRole`, `ANY`/`ALL` composition over typed signals,\n * a cooldown, a suppressing `beforeStage`). Sharing one map would let a `milestoneRef` and a\n * `momentIdentifier` collide silently, and neither vocabulary constrains the other.\n *\n * ## What is NOT here, and why\n *\n * `ValueMomentRole.ANTI_PATTERN` is declared as NOT persisted — it re-fires on a cooldown rather than\n * being achieved once — so no anti-pattern ever writes a record here. Its cooldown is in-process; in\n * a multi-instance deployment each instance therefore keeps its own, which is what \"not persisted\"\n * means rather than a defect to fix here.\n */\nexport const ValueMomentStateSchema = z.object({\n  /**\n   * Signal keys observed so far, for `ValueMomentMode.ALL` composition. A moment in `ANY` mode fires\n   * on the first signal and never needs this, but it is recorded for both so a moment whose mode is\n   * changed after the fact does not silently lose the progress it already had.\n   */\n  signalsObserved: z.array(z.string()).default([]),\n  /** When the moment fired. Absent while it is still accumulating signals. */\n  achievedAt: z.coerce.date().optional(),\n});\nexport type ValueMomentState = z.infer<typeof ValueMomentStateSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Progression State — Per-Category Aggregated Progress\n * ────────────────────────────────────────────────────────────── */\n\n/** Per-category aggregated progress */\nexport const ProgressionCategoryProgressSchema = z.object({\n  /** Number of milestones completed in this category */\n  completedCount: z.number().int().default(0),\n  /** Total points earned in this category */\n  totalPoints: z.number().int().default(0),\n});\nexport type ProgressionCategoryProgress = z.infer<typeof ProgressionCategoryProgressSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Progression State — Top-Level Document\n * ────────────────────────────────────────────────────────────── */\n\n/** Shared progression state payload body.\n *  Scope-specific state resources extend this schema with their owning FK\n *  (`userId` / `organizationId`) before persistence. */\nexport const ProgressionStateSchema = z.object({\n  /** Map of milestoneRef → achievement record. Populated when a milestone is achieved. */\n  // USAGE — a per-person record of what they accomplished and how often they acted.\n  // RESET on erasure — returns this field to its schema default. It holds what this person achieved and when,\n  // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n  // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n  // needs a string. The value comes from the schema, so there is no second copy to drift.\n  milestonesAchieved: addImpersonalizeWith(\n  z.record(z.string(), ProgressionMilestoneAchievedSchema).default({})\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  /** Map of `${resourceType}:${operation}` → count. Incremented on every matching operation.\n   *  This is the raw data used by COUNT_THRESHOLD conditions. */\n  // RESET on erasure — returns this field to its schema default. It holds how often they performed each operation,\n  // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n  // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n  // needs a string. The value comes from the schema, so there is no second copy to drift.\n  operationCounts: addImpersonalizeWith(\n  z.record(z.string(), z.number().int()).default({}).dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  /** Total points across all achieved milestones. Updated atomically with achievements. */\n  // RESET on erasure — returns this field to its schema default. It holds their points total,\n  // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n  // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n  // needs a string. The value comes from the schema, so there is no second copy to drift.\n  totalPoints: addImpersonalizeWith(\n  z.number().int().default(0).isSummaryField().dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  /** Map of momentIdentifier → value-moment state. See `ValueMomentStateSchema` for why it is\n   *  separate from `milestonesAchieved`. */\n  // USAGE — a per-person record of which product moments they reached and when.\n  // RESET on erasure — the same treatment as `milestonesAchieved` beside it, and for the same\n  // reasons: the USAGE category is accurate (these are observations the product made about a named\n  // person, so RETAIN_ONLY would be a false assertion), and the field is non-nullable WITH a\n  // `.default()`, so REMOVE needs a clearable field and MASK needs a string. RESET returns it to\n  // what it is when nobody has been observed, which is what erasure should leave behind.\n  valueMomentsAchieved: addImpersonalizeWith(\n    z.record(z.string(), ValueMomentStateSchema).default({})\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  /** Per-category progress. Pre-aggregated for frontend display efficiency. */\n  categoriesProgress: z.record(z.string(), ProgressionCategoryProgressSchema).default({}),\n});\nexport type ProgressionState = z.infer<typeof ProgressionStateSchema>;\n\nexport const UserProgressionStateSchema = ProgressionStateSchema.extend({\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\nexport type UserProgressionState = z.infer<typeof UserProgressionStateSchema>;\n\nexport const OrganizationProgressionStateSchema = ProgressionStateSchema.extend({\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\nexport type OrganizationProgressionState = z.infer<typeof OrganizationProgressionStateSchema>;\n\nexport type PersistedProgressionState = UserProgressionState | OrganizationProgressionState;\n"]}