@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts

@@ -46,7 +46,8 @@ export declare const InboundContactSchema: z.ZodObject<{
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
     privacy: z.ZodObject<{
-        dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof import("..").DataProcessingConsent>>;
+        consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").ConsentPurpose>>>>;
+        consentDecidedAt: z.ZodOptional<z.ZodDate>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type InboundContact = z.infer<typeof InboundContactSchema>;

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;iBA4G/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBA4G/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/users/user-consent-decision.shared.utils.d.ts

@@ -0,0 +1,127 @@
+import type { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';
+/**
+ * Any record carrying a consent `privacy` block — user preferences, an inbound contact, an anonymous
+ * visitor. Structural on purpose: the rule below is the same for every holder, and a per-resource
+ * copy is how two doors come to disagree about when a decision happened.
+ */
+export interface ConsentDecisionHolder {
+    privacy?: {
+        consentedPurposes?: readonly (ConsentPurpose | string)[];
+        consentDecidedAt?: Date | string;
+        [otherPrivacyField: string]: unknown;
+    };
+}
+/**
+ * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of
+ * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there
+ * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.
+ *
+ * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller
+ *
+ * It records WHEN a person made an affirmative consent choice, and it is what separates "declined
+ * everything" from "was never asked". A client-authored instant would let any caller backdate or
+ * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and
+ * the recorded instant is the server's clock.
+ *
+ * ## When a write counts as a decision
+ *
+ * - The purpose SET changed → a decision. Always stamped.
+ * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an
+ *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.
+ * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.
+ *   This is the ordinary preferences form re-submitting every field while the person edited something
+ *   else; stamping there would fabricate a consent choice nobody made.
+ *
+ * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a
+ * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the
+ * returned block carries the STORED purposes and instant forward.
+ * Without that, the write would replace the whole `privacy` object and the stored consent would be lost
+ * while reading as a withdrawal (#534 review F1).
+ *
+ * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —
+ * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the
+ * purpose set it accompanies is audit evidence on the same UPDATE.
+ */
+export declare function buildConsentDecisionPatch<THolder extends ConsentDecisionHolder>(input: Partial<THolder> | undefined, current: THolder | undefined, now?: Date): Partial<THolder>;
+/**
+ * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW
+ * purposes on a person's behalf — honouring a withdrawal request received another way — but may never
+ * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same
+ * server-stamped instant as the person's own choice and could not be told apart from it.
+ *
+ * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision
+ * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch
+ * consent — passes through unchanged.
+ */
+export declare function buildAdministratorConsentDecisionPatch<THolder extends ConsentDecisionHolder>(input: Partial<THolder> | undefined, current: THolder | undefined, now?: Date): Partial<THolder>;
+/**
+ * What an anonymous visitor's consent decision contributes to the account they just became (#1258).
+ *
+ * ## The one thing that dies at this boundary today
+ *
+ * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their
+ * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.
+ * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,
+ * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves
+ * neither. So a visitor who declines analytics on the marketing site is asked again inside the
+ * application, and under a declared service-consent requirement is BLOCKED there, over a question they
+ * answered minutes earlier.
+ *
+ * ## Why this takes `applicationAsks` and not just two privacy blocks
+ *
+ * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see
+ * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different
+ * questions. `consentDecidedAt` is read everywhere as *"this person was asked and answered"*, so
+ * stamping it when the visitor's surface offered LESS than the application asks would record a
+ * decision about a purpose nobody displayed, and the application would stop prompting for it.
+ *
+ * Hence the split outcome, which is the whole design:
+ *
+ * | the visitor was offered | what carries |
+ * |---|---|
+ * | everything this application asks | grants **and** the decision instant — nothing more to ask |
+ * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |
+ * | nothing (never asked) | nothing |
+ *
+ * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.
+ *
+ * ## The account always wins, and that is what makes a shared browser safe
+ *
+ * An account that has already recorded a decision receives NOTHING: their own answer stands, and a
+ * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp
+ * an instant, the residual risk of a shared browser — visitor A decides, does not register, and
+ * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited
+ * decision: B is still ASKED, and their answer replaces the seed.
+ *
+ * ## Defensive, because the anonymous row is written by a public door
+ *
+ * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That
+ * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a
+ * caller's claim about their own decision; only their intersection is a statement this function is
+ * willing to repeat onto an identified person.
+ *
+ * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,
+ * which the framework merges as a no-op.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto
+ * the person it belonged to, with its own instant, and never widened past what they were shown.
+ */
+export declare function buildAnonymousConsentCarryPatch<THolder extends ConsentDecisionHolder>(params: {
+    /** The converting visitor's `AnonymousUser.privacy`. */
+    readonly anonymous: {
+        readonly consentedPurposes?: readonly (ConsentPurpose | string)[];
+        readonly offeredPurposes?: readonly (ConsentPurpose | string)[];
+        readonly consentDecidedAt?: Date | string;
+    } | undefined;
+    /** The account's current privacy block, or undefined when it has none. */
+    readonly account: ConsentDecisionHolder['privacy'] | undefined;
+    /**
+     * The purposes this application's own consent surface would put to the person — the gate's
+     * `optionalPurposes` plus anything it requires. Passing an empty list means the application asks
+     * nothing, so a carried decision is complete by definition.
+     */
+    readonly applicationAsks: readonly (ConsentPurpose | string)[];
+}): Partial<THolder>;
+//# sourceMappingURL=user-consent-decision.shared.utils.d.ts.map

package/dist/esm/users/user-consent-decision.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-consent-decision.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QACzD,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QACjC,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;KACtC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,SAAS,qBAAqB,EAC7E,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAyClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CAAC,OAAO,SAAS,qBAAqB,EAC1F,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,qBAAqB,EAAE,MAAM,EAAE;IAC7F,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;KAC3C,GAAG,SAAS,CAAC;IACd,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;CAChE,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCnB"}

package/dist/esm/users/user-consent-decision.shared.utils.js

@@ -0,0 +1,189 @@
+import { ZodError } from 'zod';
+import { normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared.js';
+/**
+ * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of
+ * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there
+ * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.
+ *
+ * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller
+ *
+ * It records WHEN a person made an affirmative consent choice, and it is what separates "declined
+ * everything" from "was never asked". A client-authored instant would let any caller backdate or
+ * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and
+ * the recorded instant is the server's clock.
+ *
+ * ## When a write counts as a decision
+ *
+ * - The purpose SET changed → a decision. Always stamped.
+ * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an
+ *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.
+ * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.
+ *   This is the ordinary preferences form re-submitting every field while the person edited something
+ *   else; stamping there would fabricate a consent choice nobody made.
+ *
+ * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a
+ * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the
+ * returned block carries the STORED purposes and instant forward.
+ * Without that, the write would replace the whole `privacy` object and the stored consent would be lost
+ * while reading as a withdrawal (#534 review F1).
+ *
+ * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —
+ * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the
+ * purpose set it accompanies is audit evidence on the same UPDATE.
+ */
+export function buildConsentDecisionPatch(input, current, now = new Date()) {
+    const incoming = input?.privacy;
+    if (incoming === undefined)
+        return {};
+    const currentPrivacy = current?.privacy;
+    if (incoming.consentedPurposes === undefined) {
+        const carried = {
+            ...(currentPrivacy ?? {}),
+            ...incoming,
+            consentedPurposes: normalizeConsentPurposes(currentPrivacy?.consentedPurposes),
+        };
+        // A caller-sent instant without a purpose set is not a decision; the stored instant stands.
+        if (currentPrivacy?.consentDecidedAt !== undefined)
+            carried.consentDecidedAt = currentPrivacy.consentDecidedAt;
+        else
+            delete carried.consentDecidedAt;
+        return { privacy: carried };
+    }
+    const nextPurposes = normalizeConsentPurposes(incoming.consentedPurposes);
+    const previousPurposes = normalizeConsentPurposes(currentPrivacy?.consentedPurposes);
+    const setChanged = nextPurposes.length !== previousPurposes.length
+        || nextPurposes.some((purpose, index) => purpose !== previousPurposes[index]);
+    const claimedAt = incoming.consentDecidedAt === undefined ? undefined : new Date(incoming.consentDecidedAt).getTime();
+    const storedAt = currentPrivacy?.consentDecidedAt === undefined ? undefined : new Date(currentPrivacy.consentDecidedAt).getTime();
+    const explicitReconfirmation = claimedAt !== undefined && claimedAt !== storedAt;
+    const decided = setChanged || explicitReconfirmation;
+    const privacy = {
+        ...(currentPrivacy ?? {}),
+        ...incoming,
+        consentedPurposes: nextPurposes,
+    };
+    if (decided) {
+        privacy.consentDecidedAt = now;
+    }
+    else if (currentPrivacy?.consentDecidedAt !== undefined) {
+        privacy.consentDecidedAt = currentPrivacy.consentDecidedAt;
+    }
+    else {
+        delete privacy.consentDecidedAt;
+    }
+    return { privacy };
+}
+/**
+ * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW
+ * purposes on a person's behalf — honouring a withdrawal request received another way — but may never
+ * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same
+ * server-stamped instant as the person's own choice and could not be told apart from it.
+ *
+ * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision
+ * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch
+ * consent — passes through unchanged.
+ */
+export function buildAdministratorConsentDecisionPatch(input, current, now = new Date()) {
+    const requested = input?.privacy?.consentedPurposes;
+    if (requested !== undefined) {
+        const stored = normalizeConsentPurposes(current?.privacy?.consentedPurposes);
+        const added = normalizeConsentPurposes(requested).filter((purpose) => !stored.includes(purpose));
+        if (added.length > 0) {
+            throw new ZodError([{
+                    code: 'custom',
+                    path: ['privacy', 'consentedPurposes'],
+                    message: `An administrator may withdraw consent purposes but cannot grant them on a person's behalf; refused: ${added.join(', ')}.`,
+                    input: requested,
+                }]);
+        }
+    }
+    return buildConsentDecisionPatch(input, current, now);
+}
+/**
+ * What an anonymous visitor's consent decision contributes to the account they just became (#1258).
+ *
+ * ## The one thing that dies at this boundary today
+ *
+ * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their
+ * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.
+ * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,
+ * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves
+ * neither. So a visitor who declines analytics on the marketing site is asked again inside the
+ * application, and under a declared service-consent requirement is BLOCKED there, over a question they
+ * answered minutes earlier.
+ *
+ * ## Why this takes `applicationAsks` and not just two privacy blocks
+ *
+ * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see
+ * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different
+ * questions. `consentDecidedAt` is read everywhere as *"this person was asked and answered"*, so
+ * stamping it when the visitor's surface offered LESS than the application asks would record a
+ * decision about a purpose nobody displayed, and the application would stop prompting for it.
+ *
+ * Hence the split outcome, which is the whole design:
+ *
+ * | the visitor was offered | what carries |
+ * |---|---|
+ * | everything this application asks | grants **and** the decision instant — nothing more to ask |
+ * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |
+ * | nothing (never asked) | nothing |
+ *
+ * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.
+ *
+ * ## The account always wins, and that is what makes a shared browser safe
+ *
+ * An account that has already recorded a decision receives NOTHING: their own answer stands, and a
+ * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp
+ * an instant, the residual risk of a shared browser — visitor A decides, does not register, and
+ * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited
+ * decision: B is still ASKED, and their answer replaces the seed.
+ *
+ * ## Defensive, because the anonymous row is written by a public door
+ *
+ * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That
+ * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a
+ * caller's claim about their own decision; only their intersection is a statement this function is
+ * willing to repeat onto an identified person.
+ *
+ * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,
+ * which the framework merges as a no-op.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto
+ * the person it belonged to, with its own instant, and never widened past what they were shown.
+ */
+export function buildAnonymousConsentCarryPatch(params) {
+    const { anonymous, account, applicationAsks } = params;
+    // Never asked, or asked nothing: there is no decision to carry, and seeding grants from a
+    // non-decision would invent one.
+    if (anonymous?.consentDecidedAt === undefined)
+        return {};
+    const offered = normalizeConsentPurposes(anonymous.offeredPurposes);
+    if (offered.length === 0)
+        return {};
+    // The account's own answer stands. `consentDecidedAt` is the decision marker; a non-empty grant set
+    // is checked too, so a row that somehow holds grants without an instant is still not overwritten.
+    const accountDecided = account?.consentDecidedAt !== undefined
+        || normalizeConsentPurposes(account?.consentedPurposes).length > 0;
+    if (accountDecided)
+        return {};
+    // Only what the visitor was actually shown AND granted.
+    const carriedGrants = normalizeConsentPurposes(anonymous.consentedPurposes).filter((purpose) => offered.includes(purpose));
+    const asked = normalizeConsentPurposes(applicationAsks);
+    const coversEverythingAsked = asked.every((purpose) => offered.includes(purpose));
+    const privacy = {
+        ...(account ?? {}),
+        consentedPurposes: carriedGrants,
+    };
+    if (coversEverythingAsked) {
+        // The visitor's own instant, not the carry's: the moment they decided is the fact being recorded.
+        privacy.consentDecidedAt = new Date(anonymous.consentDecidedAt);
+    }
+    else {
+        // Seed the grants and leave the question open, so the application still prompts.
+        delete privacy.consentDecidedAt;
+    }
+    return { privacy };
+}
+//# sourceMappingURL=user-consent-decision.shared.utils.js.map

package/dist/esm/users/user-consent-decision.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-consent-decision.shared.utils.js","sourceRoot":"","sources":["../../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAgBzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAO,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,cAAc,GAAG,OAAO,EAAE,OAAO,CAAC;IACxC,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAkD;YAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YACzB,GAAG,QAAQ;YACX,iBAAiB,EAAE,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC;SAC/E,CAAC;QACF,4FAA4F;QAC5F,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS;YAAE,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;;YAC1G,OAAO,OAAO,CAAC,gBAAgB,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAsB,CAAC;IAClD,CAAC;IAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;WAC7D,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACvI,MAAM,QAAQ,GAAG,cAAc,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnJ,MAAM,sBAAsB,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC;IAEjF,MAAM,OAAO,GAAG,UAAU,IAAI,sBAAsB,CAAC;IACrD,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzB,GAAG,QAAQ;QACX,iBAAiB,EAAE,YAAY;KAChC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACjC,CAAC;SAAM,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CACpD,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,SAAS,GAAG,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC;IACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,CAAC;oBAClB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;oBACtC,OAAO,EAAE,uGAAuG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACnI,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,+BAA+B,CAAwC,MAetF;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEvD,0FAA0F;IAC1F,iCAAiC;IACjC,IAAI,SAAS,EAAE,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,wBAAwB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,oGAAoG;IACpG,kGAAkG;IAClG,MAAM,cAAc,GAAG,OAAO,EAAE,gBAAgB,KAAK,SAAS;WACzD,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,IAAI,cAAc;QAAE,OAAO,EAAE,CAAC;IAE9B,wDAAwD;IACxD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3H,MAAM,KAAK,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClB,iBAAiB,EAAE,aAAa;KACjC,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,kGAAkG;QAClG,OAAO,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,iFAAiF;QACjF,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC","sourcesContent":["import { ZodError } from 'zod';\n\nimport { normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport type { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';\n\n/**\n * Any record carrying a consent `privacy` block — user preferences, an inbound contact, an anonymous\n * visitor. Structural on purpose: the rule below is the same for every holder, and a per-resource\n * copy is how two doors come to disagree about when a decision happened.\n */\nexport interface ConsentDecisionHolder {\n  privacy?: {\n    consentedPurposes?: readonly (ConsentPurpose | string)[];\n    consentDecidedAt?: Date | string;\n    [otherPrivacyField: string]: unknown;\n  };\n}\n\n/**\n * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of\n * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there\n * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.\n *\n * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller\n *\n * It records WHEN a person made an affirmative consent choice, and it is what separates \"declined\n * everything\" from \"was never asked\". A client-authored instant would let any caller backdate or\n * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and\n * the recorded instant is the server's clock.\n *\n * ## When a write counts as a decision\n *\n * - The purpose SET changed → a decision. Always stamped.\n * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an\n *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.\n * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.\n *   This is the ordinary preferences form re-submitting every field while the person edited something\n *   else; stamping there would fabricate a consent choice nobody made.\n *\n * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a\n * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the\n * returned block carries the STORED purposes and instant forward.\n * Without that, the write would replace the whole `privacy` object and the stored consent would be lost\n * while reading as a withdrawal (#534 review F1).\n *\n * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —\n * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the\n * purpose set it accompanies is audit evidence on the same UPDATE.\n */\nexport function buildConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n  input: Partial<THolder> | undefined,\n  current: THolder | undefined,\n  now: Date = new Date(),\n): Partial<THolder> {\n  const incoming = input?.privacy;\n  if (incoming === undefined) return {};\n\n  const currentPrivacy = current?.privacy;\n  if (incoming.consentedPurposes === undefined) {\n    const carried: NonNullable<ConsentDecisionHolder['privacy']> = {\n      ...(currentPrivacy ?? {}),\n      ...incoming,\n      consentedPurposes: normalizeConsentPurposes(currentPrivacy?.consentedPurposes),\n    };\n    // A caller-sent instant without a purpose set is not a decision; the stored instant stands.\n    if (currentPrivacy?.consentDecidedAt !== undefined) carried.consentDecidedAt = currentPrivacy.consentDecidedAt;\n    else delete carried.consentDecidedAt;\n    return { privacy: carried } as Partial<THolder>;\n  }\n\n  const nextPurposes = normalizeConsentPurposes(incoming.consentedPurposes);\n  const previousPurposes = normalizeConsentPurposes(currentPrivacy?.consentedPurposes);\n\n  const setChanged = nextPurposes.length !== previousPurposes.length\n    || nextPurposes.some((purpose, index) => purpose !== previousPurposes[index]);\n  const claimedAt = incoming.consentDecidedAt === undefined ? undefined : new Date(incoming.consentDecidedAt as Date | string).getTime();\n  const storedAt = currentPrivacy?.consentDecidedAt === undefined ? undefined : new Date(currentPrivacy.consentDecidedAt as Date | string).getTime();\n  const explicitReconfirmation = claimedAt !== undefined && claimedAt !== storedAt;\n\n  const decided = setChanged || explicitReconfirmation;\n  const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n    ...(currentPrivacy ?? {}),\n    ...incoming,\n    consentedPurposes: nextPurposes,\n  };\n  if (decided) {\n    privacy.consentDecidedAt = now;\n  } else if (currentPrivacy?.consentDecidedAt !== undefined) {\n    privacy.consentDecidedAt = currentPrivacy.consentDecidedAt;\n  } else {\n    delete privacy.consentDecidedAt;\n  }\n\n  return { privacy } as Partial<THolder>;\n}\n\n/**\n * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW\n * purposes on a person's behalf — honouring a withdrawal request received another way — but may never\n * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same\n * server-stamped instant as the person's own choice and could not be told apart from it.\n *\n * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision\n * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch\n * consent — passes through unchanged.\n */\nexport function buildAdministratorConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n  input: Partial<THolder> | undefined,\n  current: THolder | undefined,\n  now: Date = new Date(),\n): Partial<THolder> {\n  const requested = input?.privacy?.consentedPurposes;\n  if (requested !== undefined) {\n    const stored = normalizeConsentPurposes(current?.privacy?.consentedPurposes);\n    const added = normalizeConsentPurposes(requested).filter((purpose) => !stored.includes(purpose));\n    if (added.length > 0) {\n      throw new ZodError([{\n        code: 'custom',\n        path: ['privacy', 'consentedPurposes'],\n        message: `An administrator may withdraw consent purposes but cannot grant them on a person's behalf; refused: ${added.join(', ')}.`,\n        input: requested,\n      }]);\n    }\n  }\n  return buildConsentDecisionPatch(input, current, now);\n}\n\n/**\n * What an anonymous visitor's consent decision contributes to the account they just became (#1258).\n *\n * ## The one thing that dies at this boundary today\n *\n * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their\n * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.\n * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,\n * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves\n * neither. So a visitor who declines analytics on the marketing site is asked again inside the\n * application, and under a declared service-consent requirement is BLOCKED there, over a question they\n * answered minutes earlier.\n *\n * ## Why this takes `applicationAsks` and not just two privacy blocks\n *\n * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see\n * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different\n * questions. `consentDecidedAt` is read everywhere as *\"this person was asked and answered\"*, so\n * stamping it when the visitor's surface offered LESS than the application asks would record a\n * decision about a purpose nobody displayed, and the application would stop prompting for it.\n *\n * Hence the split outcome, which is the whole design:\n *\n * | the visitor was offered | what carries |\n * |---|---|\n * | everything this application asks | grants **and** the decision instant — nothing more to ask |\n * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |\n * | nothing (never asked) | nothing |\n *\n * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.\n *\n * ## The account always wins, and that is what makes a shared browser safe\n *\n * An account that has already recorded a decision receives NOTHING: their own answer stands, and a\n * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp\n * an instant, the residual risk of a shared browser — visitor A decides, does not register, and\n * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited\n * decision: B is still ASKED, and their answer replaces the seed.\n *\n * ## Defensive, because the anonymous row is written by a public door\n *\n * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That\n * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a\n * caller's claim about their own decision; only their intersection is a statement this function is\n * willing to repeat onto an identified person.\n *\n * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,\n * which the framework merges as a no-op.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto\n * the person it belonged to, with its own instant, and never widened past what they were shown.\n */\nexport function buildAnonymousConsentCarryPatch<THolder extends ConsentDecisionHolder>(params: {\n  /** The converting visitor's `AnonymousUser.privacy`. */\n  readonly anonymous: {\n    readonly consentedPurposes?: readonly (ConsentPurpose | string)[];\n    readonly offeredPurposes?: readonly (ConsentPurpose | string)[];\n    readonly consentDecidedAt?: Date | string;\n  } | undefined;\n  /** The account's current privacy block, or undefined when it has none. */\n  readonly account: ConsentDecisionHolder['privacy'] | undefined;\n  /**\n   * The purposes this application's own consent surface would put to the person — the gate's\n   * `optionalPurposes` plus anything it requires. Passing an empty list means the application asks\n   * nothing, so a carried decision is complete by definition.\n   */\n  readonly applicationAsks: readonly (ConsentPurpose | string)[];\n}): Partial<THolder> {\n  const { anonymous, account, applicationAsks } = params;\n\n  // Never asked, or asked nothing: there is no decision to carry, and seeding grants from a\n  // non-decision would invent one.\n  if (anonymous?.consentDecidedAt === undefined) return {};\n  const offered = normalizeConsentPurposes(anonymous.offeredPurposes);\n  if (offered.length === 0) return {};\n\n  // The account's own answer stands. `consentDecidedAt` is the decision marker; a non-empty grant set\n  // is checked too, so a row that somehow holds grants without an instant is still not overwritten.\n  const accountDecided = account?.consentDecidedAt !== undefined\n    || normalizeConsentPurposes(account?.consentedPurposes).length > 0;\n  if (accountDecided) return {};\n\n  // Only what the visitor was actually shown AND granted.\n  const carriedGrants = normalizeConsentPurposes(anonymous.consentedPurposes).filter((purpose) => offered.includes(purpose));\n\n  const asked = normalizeConsentPurposes(applicationAsks);\n  const coversEverythingAsked = asked.every((purpose) => offered.includes(purpose));\n\n  const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n    ...(account ?? {}),\n    consentedPurposes: carriedGrants,\n  };\n  if (coversEverythingAsked) {\n    // The visitor's own instant, not the carry's: the moment they decided is the fact being recorded.\n    privacy.consentDecidedAt = new Date(anonymous.consentDecidedAt);\n  } else {\n    // Seed the grants and leave the question open, so the application still prompts.\n    delete privacy.consentDecidedAt;\n  }\n\n  return { privacy } as Partial<THolder>;\n}\n"]}

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts

@@ -20,6 +20,7 @@ export declare const userIdentityLinksResourceConfiguration_InitializationFactor
     providerDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     providerAvatarUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>>;
+    scimExternalId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     scopeType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodEnum<typeof import("..").AuthScopeType>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}
+{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}

package/dist/esm/users/user-identity-links.shared.schemas.d.ts

@@ -28,6 +28,7 @@ export declare const UserIdentityLinkSchema: import("@wildo-ai/zod-decorators").
     providerDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     providerAvatarUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+    scimExternalId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     scopeType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;

package/dist/esm/users/user-identity-links.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAmJjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;kBAqLjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/esm/users/user-identity-links.shared.schemas.js

@@ -65,6 +65,36 @@ export const UserIdentityLinkSchema = z.object({
     // exactly why it must be scrubbed: an unclassifiable blob is not an empty one.
     providerRawProfile: addImpersonalizeWith(z.record(z.string(), z.unknown()).optional().isBackendOnly(), RedactionType.REMOVE)
         .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),
+    /**
+     * The DIRECTORY's own identifier for this person, as SCIM `externalId` — and deliberately NOT
+     * {@link UserIdentityLinkSchema.shape.providerUserId}.
+     *
+     * ## Why it cannot share a column with `providerUserId`
+     *
+     * `providerUserId` is the AUTHENTICATION KEY. `createIdentityLink` resolves an existing link by it
+     * (with `providerRef`, `connectionType` and the scope) and refuses with
+     * `enterprise_identity_already_linked_to_another_user` when it points at somebody else. It is also
+     * part of this resource's business key.
+     *
+     * SCIM `externalId` is not that. RFC 7643 §3.1 makes it the CLIENT's identifier, which the service
+     * provider stores; the provider's own identifier is `id`. Microsoft Entra maps it from
+     * `[mailNickname]` by default — a mutable handle — so writing it into `providerUserId` would
+     * re-key a live SSO identity from an attribute an administrator can change in the directory. The
+     * next sign-in asserting the original subject would find no link.
+     *
+     * ## What it was before (#1402)
+     *
+     * `SCIM_USER_ATTRIBUTE_MAP` mapped `externalId` → `providerUserId`, and the SCIM PATCH/PUT path
+     * folded it into the profile update bag — which writes `USER_PROFILES`, a resource that does not
+     * own the field. It was stripped by the strict re-parse and the directory was told `200`. Measured
+     * against a live Entra tenant on 2026-09-21: it reported updating `externalId` for two users, and
+     * neither value was stored, so it re-sent the same update on every cycle.
+     *
+     * Optional because only a directory sets it: a social or interactive SSO link has none. Not
+     * indexed and not part of any key — it is a value to hand back, not to resolve by; resolving by it
+     * is what the whole comment above exists to prevent.
+     */
+    scimExternalId: addImpersonalizeWith(z.string().optional().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),
     /** Enterprise tenant kind. Absent for social links. */
     scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),
     /** Organization tenant identifier. Present only for organization-scoped enterprise links. */

package/dist/esm/users/user-identity-links.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAE5C;IACF,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC;QAClC,sBAAsB,CAAC,MAAM;QAC7B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;IACF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC;QACtC,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExE,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE7D,+BAA+B;IAC/B,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,uFAAuF;IACvF,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CACrC;IAED,yBAAyB;IACzB,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED,4BAA4B;IAC5B,mBAAmB,EAAE,oBAAoB,CACvC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,0BAA0B;IAC1B,iBAAiB,EAAE,oBAAoB,CACrC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;;OAOG;IACH,iGAAiG;IACjG,+FAA+F;IAC/F,+EAA+E;IAC/E,kBAAkB,EAAE,oBAAoB,CACtC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAC5D,aAAa,CAAC,MAAM,CACrB;SACE,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAErF,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEzD,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEpD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEnD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,oDAAoD;IACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElG,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACrG,CAAC,CAAC,cAAc,CAAC;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,cAAc;CACf,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,cAAc,cAAc;SAClG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACrD,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;eACzB,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,YAAY,KAAK,SAAS,EAClC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["/**\n * User Identity Links Schema\n *\n * Tracks OAuth2/SSO provider connections per user.\n * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).\n *\n * Canonical identity key: connection type + provider + provider user + exact enterprise\n * scope/connection coordinates. The database compound unique index prevents the same\n * external identity from being bound to two Wildo users inside one tenant connection.\n */\n\nimport { z } from 'zod';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { ERASED_USER_EMAIL, ERASED_IDENTITY_VALUE } from './users.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport {\n  AuthScopeType,\n  ExternalIdentitySource,\n  SsoConnectionType,\n} from '../security/authentications/authentication.shared.schemas';\n\n/**\n * Valid provenance mechanisms for each connection ownership class.\n *\n * OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately\n * spans both. Keeping this relationship beside the persisted link schema makes\n * invalid cross-products impossible at every repository boundary.\n */\nexport const IDENTITY_SOURCES_BY_CONNECTION_TYPE: Readonly<\n  Record<SsoConnectionType, ReadonlySet<ExternalIdentitySource>>\n> = {\n  [SsoConnectionType.SOCIAL]: new Set([\n    ExternalIdentitySource.OAUTH2,\n    ExternalIdentitySource.OIDC,\n  ]),\n  [SsoConnectionType.ENTERPRISE]: new Set([\n    ExternalIdentitySource.OIDC,\n    ExternalIdentitySource.SAML,\n    ExternalIdentitySource.SCIM,\n  ]),\n};\n\nexport const UserIdentityLinkSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** FK → USERS — the user who owns this identity link */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  /** Distinguishes social vs enterprise links */\n  connectionType: z.enum(SsoConnectionType).isDBIndexed().isSummaryField(),\n\n  /** Matches external connector ref (e.g., \"google\", \"microsoft\", \"github\", \"oidc\") */\n  providerRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The user's ID at the IdP */\n  // MASK, not REMOVE: `min(1)` and part of the compound business key, so a null fails the re-parse.\n  // Two erased links for one connection would share this masked value — which is safe because a\n  // declared retention policy makes the planner emit that unique index RETENTION-SCOPED, so retained\n  // rows fall outside the constraint. Confirmed in the generated migration, not assumed.\n  providerUserId: addImpersonalizeWith(\n    z.string().min(1).isDBIndexed().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_IDENTITY_VALUE },\n  ),\n\n  /** Email from the IdP */\n  providerEmail: addImpersonalizeWith(\n    z.string().isDBIndexed().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_EMAIL },\n  ),\n\n  /** Display name from IdP */\n  providerDisplayName: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /** Avatar URL from IdP */\n  providerAvatarUrl: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /**\n   * Raw claims from the IdP for debugging — backend only.\n   *\n   * The one field on this resource whose contents the framework does not control: an IdP may put\n   * anything in a claim set, including a special category. IDENTITY + USER_CONTENT is what the field\n   * is FOR; it is not a certification of what a given IdP will send. An application whose IdP is\n   * known to emit a special-category claim should say so on its own copy.\n   */\n  // The provider's own payload about the person, unbounded in shape — whatever that provider chose\n  // to send. It carries no `dataCategories` because nothing can classify it in advance, which is\n  // exactly why it must be scrubbed: an unclassifiable blob is not an empty one.\n  providerRawProfile: addImpersonalizeWith(\n    z.record(z.string(), z.unknown()).optional().isBackendOnly(),\n    RedactionType.REMOVE,\n  )\n    .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),\n\n  /** Enterprise tenant kind. Absent for social links. */\n  scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),\n\n  /** Organization tenant identifier. Present only for organization-scoped enterprise links. */\n  organizationId: z.string().optional().isForeignKey(),\n\n  /** Application tenant identifier. Present only for application-scoped enterprise links. */\n  applicationId: z.string().optional().isForeignKey(),\n\n  /** Enterprise connection identifier within the owning scope. */\n  connectionId: z.string().optional(),\n\n  /** Authentication source that created this link. */\n  source: z.enum(ExternalIdentitySource),\n\n  /** When this identity link was created */\n  linkedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  /** Last time this identity link was used for authentication */\n  lastUsedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'connectionType',\n  'providerRef',\n  'providerUserId',\n  'scopeType',\n  'organizationId',\n  'applicationId',\n  'connectionId',\n]).superRefine((link, ctx) => {\n  if (!IDENTITY_SOURCES_BY_CONNECTION_TYPE[link.connectionType].has(link.source)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['source'],\n      message: `Identity source ${link.source} is incompatible with ${link.connectionType} connections`,\n    });\n  }\n\n  if (link.connectionType === SsoConnectionType.SOCIAL) {\n    if (\n      link.scopeType !== undefined\n      || link.organizationId !== undefined\n      || link.applicationId !== undefined\n      || link.connectionId !== undefined\n    ) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['scopeType'],\n        message: 'Social identity links must not carry enterprise scope fields',\n      });\n    }\n    return;\n  }\n\n  if (!link.connectionId) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['connectionId'],\n      message: 'Enterprise identity links require connectionId',\n    });\n  }\n\n  if (link.scopeType === AuthScopeType.ORGANIZATION) {\n    if (!link.organizationId || link.applicationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['organizationId'],\n        message: 'Organization-scoped identity links require only organizationId',\n      });\n    }\n    return;\n  }\n\n  if (link.scopeType === AuthScopeType.APPLICATION) {\n    if (!link.applicationId || link.organizationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['applicationId'],\n        message: 'Application-scoped identity links require only applicationId',\n      });\n    }\n    return;\n  }\n\n  ctx.addIssue({\n    code: 'custom',\n    path: ['scopeType'],\n    message: 'Enterprise identity links require an explicit scopeType',\n  });\n});\n\n\nexport type UserIdentityLink = z.infer<typeof UserIdentityLinkSchema>;\n"]}
+{"version":3,"file":"user-identity-links.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAE5C;IACF,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC;QAClC,sBAAsB,CAAC,MAAM;QAC7B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;IACF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC;QACtC,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExE,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE7D,+BAA+B;IAC/B,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,uFAAuF;IACvF,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CACrC;IAED,yBAAyB;IACzB,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED,4BAA4B;IAC5B,mBAAmB,EAAE,oBAAoB,CACvC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,0BAA0B;IAC1B,iBAAiB,EAAE,oBAAoB,CACrC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;;OAOG;IACH,iGAAiG;IACjG,+FAA+F;IAC/F,+EAA+E;IAC/E,kBAAkB,EAAE,oBAAoB,CACtC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAC5D,aAAa,CAAC,MAAM,CACrB;SACE,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEzD,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEpD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEnD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,oDAAoD;IACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElG,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACrG,CAAC,CAAC,cAAc,CAAC;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,cAAc;CACf,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,cAAc,cAAc;SAClG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACrD,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;eACzB,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,YAAY,KAAK,SAAS,EAClC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["/**\n * User Identity Links Schema\n *\n * Tracks OAuth2/SSO provider connections per user.\n * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).\n *\n * Canonical identity key: connection type + provider + provider user + exact enterprise\n * scope/connection coordinates. The database compound unique index prevents the same\n * external identity from being bound to two Wildo users inside one tenant connection.\n */\n\nimport { z } from 'zod';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { ERASED_USER_EMAIL, ERASED_IDENTITY_VALUE } from './users.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport {\n  AuthScopeType,\n  ExternalIdentitySource,\n  SsoConnectionType,\n} from '../security/authentications/authentication.shared.schemas';\n\n/**\n * Valid provenance mechanisms for each connection ownership class.\n *\n * OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately\n * spans both. Keeping this relationship beside the persisted link schema makes\n * invalid cross-products impossible at every repository boundary.\n */\nexport const IDENTITY_SOURCES_BY_CONNECTION_TYPE: Readonly<\n  Record<SsoConnectionType, ReadonlySet<ExternalIdentitySource>>\n> = {\n  [SsoConnectionType.SOCIAL]: new Set([\n    ExternalIdentitySource.OAUTH2,\n    ExternalIdentitySource.OIDC,\n  ]),\n  [SsoConnectionType.ENTERPRISE]: new Set([\n    ExternalIdentitySource.OIDC,\n    ExternalIdentitySource.SAML,\n    ExternalIdentitySource.SCIM,\n  ]),\n};\n\nexport const UserIdentityLinkSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** FK → USERS — the user who owns this identity link */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  /** Distinguishes social vs enterprise links */\n  connectionType: z.enum(SsoConnectionType).isDBIndexed().isSummaryField(),\n\n  /** Matches external connector ref (e.g., \"google\", \"microsoft\", \"github\", \"oidc\") */\n  providerRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The user's ID at the IdP */\n  // MASK, not REMOVE: `min(1)` and part of the compound business key, so a null fails the re-parse.\n  // Two erased links for one connection would share this masked value — which is safe because a\n  // declared retention policy makes the planner emit that unique index RETENTION-SCOPED, so retained\n  // rows fall outside the constraint. Confirmed in the generated migration, not assumed.\n  providerUserId: addImpersonalizeWith(\n    z.string().min(1).isDBIndexed().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_IDENTITY_VALUE },\n  ),\n\n  /** Email from the IdP */\n  providerEmail: addImpersonalizeWith(\n    z.string().isDBIndexed().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_EMAIL },\n  ),\n\n  /** Display name from IdP */\n  providerDisplayName: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /** Avatar URL from IdP */\n  providerAvatarUrl: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /**\n   * Raw claims from the IdP for debugging — backend only.\n   *\n   * The one field on this resource whose contents the framework does not control: an IdP may put\n   * anything in a claim set, including a special category. IDENTITY + USER_CONTENT is what the field\n   * is FOR; it is not a certification of what a given IdP will send. An application whose IdP is\n   * known to emit a special-category claim should say so on its own copy.\n   */\n  // The provider's own payload about the person, unbounded in shape — whatever that provider chose\n  // to send. It carries no `dataCategories` because nothing can classify it in advance, which is\n  // exactly why it must be scrubbed: an unclassifiable blob is not an empty one.\n  providerRawProfile: addImpersonalizeWith(\n    z.record(z.string(), z.unknown()).optional().isBackendOnly(),\n    RedactionType.REMOVE,\n  )\n    .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),\n\n  /**\n   * The DIRECTORY's own identifier for this person, as SCIM `externalId` — and deliberately NOT\n   * {@link UserIdentityLinkSchema.shape.providerUserId}.\n   *\n   * ## Why it cannot share a column with `providerUserId`\n   *\n   * `providerUserId` is the AUTHENTICATION KEY. `createIdentityLink` resolves an existing link by it\n   * (with `providerRef`, `connectionType` and the scope) and refuses with\n   * `enterprise_identity_already_linked_to_another_user` when it points at somebody else. It is also\n   * part of this resource's business key.\n   *\n   * SCIM `externalId` is not that. RFC 7643 §3.1 makes it the CLIENT's identifier, which the service\n   * provider stores; the provider's own identifier is `id`. Microsoft Entra maps it from\n   * `[mailNickname]` by default — a mutable handle — so writing it into `providerUserId` would\n   * re-key a live SSO identity from an attribute an administrator can change in the directory. The\n   * next sign-in asserting the original subject would find no link.\n   *\n   * ## What it was before (#1402)\n   *\n   * `SCIM_USER_ATTRIBUTE_MAP` mapped `externalId` → `providerUserId`, and the SCIM PATCH/PUT path\n   * folded it into the profile update bag — which writes `USER_PROFILES`, a resource that does not\n   * own the field. It was stripped by the strict re-parse and the directory was told `200`. Measured\n   * against a live Entra tenant on 2026-09-21: it reported updating `externalId` for two users, and\n   * neither value was stored, so it re-sent the same update on every cycle.\n   *\n   * Optional because only a directory sets it: a social or interactive SSO link has none. Not\n   * indexed and not part of any key — it is a value to hand back, not to resolve by; resolving by it\n   * is what the whole comment above exists to prevent.\n   */\n  scimExternalId: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /** Enterprise tenant kind. Absent for social links. */\n  scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),\n\n  /** Organization tenant identifier. Present only for organization-scoped enterprise links. */\n  organizationId: z.string().optional().isForeignKey(),\n\n  /** Application tenant identifier. Present only for application-scoped enterprise links. */\n  applicationId: z.string().optional().isForeignKey(),\n\n  /** Enterprise connection identifier within the owning scope. */\n  connectionId: z.string().optional(),\n\n  /** Authentication source that created this link. */\n  source: z.enum(ExternalIdentitySource),\n\n  /** When this identity link was created */\n  linkedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  /** Last time this identity link was used for authentication */\n  lastUsedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'connectionType',\n  'providerRef',\n  'providerUserId',\n  'scopeType',\n  'organizationId',\n  'applicationId',\n  'connectionId',\n]).superRefine((link, ctx) => {\n  if (!IDENTITY_SOURCES_BY_CONNECTION_TYPE[link.connectionType].has(link.source)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['source'],\n      message: `Identity source ${link.source} is incompatible with ${link.connectionType} connections`,\n    });\n  }\n\n  if (link.connectionType === SsoConnectionType.SOCIAL) {\n    if (\n      link.scopeType !== undefined\n      || link.organizationId !== undefined\n      || link.applicationId !== undefined\n      || link.connectionId !== undefined\n    ) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['scopeType'],\n        message: 'Social identity links must not carry enterprise scope fields',\n      });\n    }\n    return;\n  }\n\n  if (!link.connectionId) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['connectionId'],\n      message: 'Enterprise identity links require connectionId',\n    });\n  }\n\n  if (link.scopeType === AuthScopeType.ORGANIZATION) {\n    if (!link.organizationId || link.applicationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['organizationId'],\n        message: 'Organization-scoped identity links require only organizationId',\n      });\n    }\n    return;\n  }\n\n  if (link.scopeType === AuthScopeType.APPLICATION) {\n    if (!link.applicationId || link.organizationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['applicationId'],\n        message: 'Application-scoped identity links require only applicationId',\n      });\n    }\n    return;\n  }\n\n  ctx.addIssue({\n    code: 'custom',\n    path: ['scopeType'],\n    message: 'Enterprise identity links require an explicit scopeType',\n  });\n});\n\n\nexport type UserIdentityLink = z.infer<typeof UserIdentityLinkSchema>;\n"]}

package/dist/esm/users/user-preferences-reset.shared.utils.d.ts

@@ -16,7 +16,7 @@
  * the write against that same DTO, and Mongoose drops every non-schema path. A request naming
  * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset
  * nothing. That is the class of defect catalogued in
- * `.claude/plans/routed-unimplemented-operations-fail-closed.md`.
+ * the 2026-08-01 routed-but-unimplemented operation sweep (#1275).
  *
  * ## How the reset reaches the database now
  *
@@ -61,18 +61,18 @@ export type UserPreferencesResetRequest = z.infer<typeof UserPreferencesResetReq
  * unnamed block is left exactly as it was.
  *
  * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}
- * returns `dataProcessingConsent` to its default, which IS a consent decision. It leaves a trail
+ * returns `consentedPurposes` to the empty set and clears `consentDecidedAt`, which IS a consent
+ * decision — a withdrawal of everything, after which a consent surface asks again. It leaves a trail
  * naming the previous and resulting value: the operation is CRITICAL, so it sits above the
  * framework's automatic audit floor and emits `resource_operation_performed`, and
- * `dataProcessingConsent` / `privacyLevel` carry `.isAuditEvidence()` so their VALUES ride on that
- * record. Governed-document receipts are neither preference members nor resettable values.
+ * `consentedPurposes` carries `.isAuditEvidence()` so its VALUES ride on that record. Governed-document receipts are neither preference members nor resettable values.
  *
  * @param request - the parsed request body. Re-parse `inputDto` through
  *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the
  *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the
  *   operation's request DTO.
- * @param currentPreferences - the row being reset, needed by blocks whose reset is not a pure
- *   default (today: privacy, whose consent receipts are carried through).
+ * @param currentPreferences - the row being reset, supplied to each block factory. Current
+ *   factories return schema defaults; governed-document receipts live outside this resource.
  */
 export declare function buildUserPreferencesResetPatch(request: UserPreferencesResetRequest, currentPreferences: UserPreferences | undefined): Partial<UserPreferences>;
 //# sourceMappingURL=user-preferences-reset.shared.utils.d.ts.map

package/dist/esm/users/user-preferences-reset.shared.utils.js

@@ -16,7 +16,7 @@
  * the write against that same DTO, and Mongoose drops every non-schema path. A request naming
  * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset
  * nothing. That is the class of defect catalogued in
- * `.claude/plans/routed-unimplemented-operations-fail-closed.md`.
+ * the 2026-08-01 routed-but-unimplemented operation sweep (#1275).
  *
  * ## How the reset reaches the database now
  *
@@ -73,18 +73,18 @@ const USER_PREFERENCE_GROUP_RESET_FACTORIES = {
  * unnamed block is left exactly as it was.
  *
  * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}
- * returns `dataProcessingConsent` to its default, which IS a consent decision. It leaves a trail
+ * returns `consentedPurposes` to the empty set and clears `consentDecidedAt`, which IS a consent
+ * decision — a withdrawal of everything, after which a consent surface asks again. It leaves a trail
  * naming the previous and resulting value: the operation is CRITICAL, so it sits above the
  * framework's automatic audit floor and emits `resource_operation_performed`, and
- * `dataProcessingConsent` / `privacyLevel` carry `.isAuditEvidence()` so their VALUES ride on that
- * record. Governed-document receipts are neither preference members nor resettable values.
+ * `consentedPurposes` carries `.isAuditEvidence()` so its VALUES ride on that record. Governed-document receipts are neither preference members nor resettable values.
  *
  * @param request - the parsed request body. Re-parse `inputDto` through
  *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the
  *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the
  *   operation's request DTO.
- * @param currentPreferences - the row being reset, needed by blocks whose reset is not a pure
- *   default (today: privacy, whose consent receipts are carried through).
+ * @param currentPreferences - the row being reset, supplied to each block factory. Current
+ *   factories return schema defaults; governed-document receipts live outside this resource.
  */
 export function buildUserPreferencesResetPatch(request, currentPreferences) {
     const patch = {};