npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1032) hide show

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts CHANGED Viewed

@@ -46,7 +46,8 @@ export declare const InboundContactSchema: z.ZodObject<{
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
     privacy: z.ZodObject<{
-        dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof import("..").DataProcessingConsent>>;
+        consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").ConsentPurpose>>>>;
+        consentDecidedAt: z.ZodOptional<z.ZodDate>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type InboundContact = z.infer<typeof InboundContactSchema>;

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB~~;;;;;;;;;;;;;;;~~iBA4G/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
1	+ {"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBA4G/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/users/user-consent-decision.shared.utils.d.ts ADDED Viewed

@@ -0,0 +1,127 @@
+import type { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';
+/**
+ * Any record carrying a consent `privacy` block — user preferences, an inbound contact, an anonymous
+ * visitor. Structural on purpose: the rule below is the same for every holder, and a per-resource
+ * copy is how two doors come to disagree about when a decision happened.
+ */
+export interface ConsentDecisionHolder {
+    privacy?: {
+        consentedPurposes?: readonly (ConsentPurpose | string)[];
+        consentDecidedAt?: Date | string;
+        [otherPrivacyField: string]: unknown;
+    };
+}
+/**
+ * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of
+ * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there
+ * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.
+ *
+ * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller
+ *
+ * It records WHEN a person made an affirmative consent choice, and it is what separates "declined
+ * everything" from "was never asked". A client-authored instant would let any caller backdate or
+ * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and
+ * the recorded instant is the server's clock.
+ *
+ * ## When a write counts as a decision
+ *
+ * - The purpose SET changed → a decision. Always stamped.
+ * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an
+ *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.
+ * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.
+ *   This is the ordinary preferences form re-submitting every field while the person edited something
+ *   else; stamping there would fabricate a consent choice nobody made.
+ *
+ * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a
+ * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the
+ * returned block carries the STORED purposes and instant forward.
+ * Without that, the write would replace the whole `privacy` object and the stored consent would be lost
+ * while reading as a withdrawal (#534 review F1).
+ *
+ * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —
+ * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the
+ * purpose set it accompanies is audit evidence on the same UPDATE.
+ */
+export declare function buildConsentDecisionPatch<THolder extends ConsentDecisionHolder>(input: Partial<THolder> | undefined, current: THolder | undefined, now?: Date): Partial<THolder>;
+/**
+ * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW
+ * purposes on a person's behalf — honouring a withdrawal request received another way — but may never
+ * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same
+ * server-stamped instant as the person's own choice and could not be told apart from it.
+ *
+ * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision
+ * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch
+ * consent — passes through unchanged.
+ */
+export declare function buildAdministratorConsentDecisionPatch<THolder extends ConsentDecisionHolder>(input: Partial<THolder> | undefined, current: THolder | undefined, now?: Date): Partial<THolder>;
+/**
+ * What an anonymous visitor's consent decision contributes to the account they just became (#1258).
+ *
+ * ## The one thing that dies at this boundary today
+ *
+ * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their
+ * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.
+ * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,
+ * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves
+ * neither. So a visitor who declines analytics on the marketing site is asked again inside the
+ * application, and under a declared service-consent requirement is BLOCKED there, over a question they
+ * answered minutes earlier.
+ *
+ * ## Why this takes `applicationAsks` and not just two privacy blocks
+ *
+ * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see
+ * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different
+ * questions. `consentDecidedAt` is read everywhere as *"this person was asked and answered"*, so
+ * stamping it when the visitor's surface offered LESS than the application asks would record a
+ * decision about a purpose nobody displayed, and the application would stop prompting for it.
+ *
+ * Hence the split outcome, which is the whole design:
+ *
+ * | the visitor was offered | what carries |
+ * |---|---|
+ * | everything this application asks | grants **and** the decision instant — nothing more to ask |
+ * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |
+ * | nothing (never asked) | nothing |
+ *
+ * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.
+ *
+ * ## The account always wins, and that is what makes a shared browser safe
+ *
+ * An account that has already recorded a decision receives NOTHING: their own answer stands, and a
+ * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp
+ * an instant, the residual risk of a shared browser — visitor A decides, does not register, and
+ * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited
+ * decision: B is still ASKED, and their answer replaces the seed.
+ *
+ * ## Defensive, because the anonymous row is written by a public door
+ *
+ * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That
+ * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a
+ * caller's claim about their own decision; only their intersection is a statement this function is
+ * willing to repeat onto an identified person.
+ *
+ * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,
+ * which the framework merges as a no-op.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto
+ * the person it belonged to, with its own instant, and never widened past what they were shown.
+ */
+export declare function buildAnonymousConsentCarryPatch<THolder extends ConsentDecisionHolder>(params: {
+    /** The converting visitor's `AnonymousUser.privacy`. */
+    readonly anonymous: {
+        readonly consentedPurposes?: readonly (ConsentPurpose | string)[];
+        readonly offeredPurposes?: readonly (ConsentPurpose | string)[];
+        readonly consentDecidedAt?: Date | string;
+    } | undefined;
+    /** The account's current privacy block, or undefined when it has none. */
+    readonly account: ConsentDecisionHolder['privacy'] | undefined;
+    /**
+     * The purposes this application's own consent surface would put to the person — the gate's
+     * `optionalPurposes` plus anything it requires. Passing an empty list means the application asks
+     * nothing, so a carried decision is complete by definition.
+     */
+    readonly applicationAsks: readonly (ConsentPurpose | string)[];
+}): Partial<THolder>;
+//# sourceMappingURL=user-consent-decision.shared.utils.d.ts.map

package/dist/esm/users/user-consent-decision.shared.utils.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"user-consent-decision.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QACzD,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QACjC,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;KACtC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,SAAS,qBAAqB,EAC7E,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAyClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CAAC,OAAO,SAAS,qBAAqB,EAC1F,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,qBAAqB,EAAE,MAAM,EAAE;IAC7F,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;KAC3C,GAAG,SAAS,CAAC;IACd,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;CAChE,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCnB"}

package/dist/esm/users/user-consent-decision.shared.utils.js ADDED Viewed

@@ -0,0 +1,189 @@
+import { ZodError } from 'zod';
+import { normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared.js';
+/**
+ * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of
+ * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there
+ * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.
+ *
+ * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller
+ *
+ * It records WHEN a person made an affirmative consent choice, and it is what separates "declined
+ * everything" from "was never asked". A client-authored instant would let any caller backdate or
+ * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and
+ * the recorded instant is the server's clock.
+ *
+ * ## When a write counts as a decision
+ *
+ * - The purpose SET changed → a decision. Always stamped.
+ * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an
+ *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.
+ * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.
+ *   This is the ordinary preferences form re-submitting every field while the person edited something
+ *   else; stamping there would fabricate a consent choice nobody made.
+ *
+ * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a
+ * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the
+ * returned block carries the STORED purposes and instant forward.
+ * Without that, the write would replace the whole `privacy` object and the stored consent would be lost
+ * while reading as a withdrawal (#534 review F1).
+ *
+ * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —
+ * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the
+ * purpose set it accompanies is audit evidence on the same UPDATE.
+ */
+export function buildConsentDecisionPatch(input, current, now = new Date()) {
+    const incoming = input?.privacy;
+    if (incoming === undefined)
+        return {};
+    const currentPrivacy = current?.privacy;
+    if (incoming.consentedPurposes === undefined) {
+        const carried = {
+            ...(currentPrivacy ?? {}),
+            ...incoming,
+            consentedPurposes: normalizeConsentPurposes(currentPrivacy?.consentedPurposes),
+        };
+        // A caller-sent instant without a purpose set is not a decision; the stored instant stands.
+        if (currentPrivacy?.consentDecidedAt !== undefined)
+            carried.consentDecidedAt = currentPrivacy.consentDecidedAt;
+        else
+            delete carried.consentDecidedAt;
+        return { privacy: carried };
+    }
+    const nextPurposes = normalizeConsentPurposes(incoming.consentedPurposes);
+    const previousPurposes = normalizeConsentPurposes(currentPrivacy?.consentedPurposes);
+    const setChanged = nextPurposes.length !== previousPurposes.length
+        || nextPurposes.some((purpose, index) => purpose !== previousPurposes[index]);
+    const claimedAt = incoming.consentDecidedAt === undefined ? undefined : new Date(incoming.consentDecidedAt).getTime();
+    const storedAt = currentPrivacy?.consentDecidedAt === undefined ? undefined : new Date(currentPrivacy.consentDecidedAt).getTime();
+    const explicitReconfirmation = claimedAt !== undefined && claimedAt !== storedAt;
+    const decided = setChanged || explicitReconfirmation;
+    const privacy = {
+        ...(currentPrivacy ?? {}),
+        ...incoming,
+        consentedPurposes: nextPurposes,
+    };
+    if (decided) {
+        privacy.consentDecidedAt = now;
+    }
+    else if (currentPrivacy?.consentDecidedAt !== undefined) {
+        privacy.consentDecidedAt = currentPrivacy.consentDecidedAt;
+    }
+    else {
+        delete privacy.consentDecidedAt;
+    }
+    return { privacy };
+}
+/**
+ * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW
+ * purposes on a person's behalf — honouring a withdrawal request received another way — but may never
+ * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same
+ * server-stamped instant as the person's own choice and could not be told apart from it.
+ *
+ * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision
+ * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch
+ * consent — passes through unchanged.
+ */
+export function buildAdministratorConsentDecisionPatch(input, current, now = new Date()) {
+    const requested = input?.privacy?.consentedPurposes;
+    if (requested !== undefined) {
+        const stored = normalizeConsentPurposes(current?.privacy?.consentedPurposes);
+        const added = normalizeConsentPurposes(requested).filter((purpose) => !stored.includes(purpose));
+        if (added.length > 0) {
+            throw new ZodError([{
+                    code: 'custom',
+                    path: ['privacy', 'consentedPurposes'],
+                    message: `An administrator may withdraw consent purposes but cannot grant them on a person's behalf; refused: ${added.join(', ')}.`,
+                    input: requested,
+                }]);
+        }
+    }
+    return buildConsentDecisionPatch(input, current, now);
+}
+/**
+ * What an anonymous visitor's consent decision contributes to the account they just became (#1258).
+ *
+ * ## The one thing that dies at this boundary today
+ *
+ * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their
+ * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.
+ * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,
+ * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves
+ * neither. So a visitor who declines analytics on the marketing site is asked again inside the
+ * application, and under a declared service-consent requirement is BLOCKED there, over a question they
+ * answered minutes earlier.
+ *
+ * ## Why this takes `applicationAsks` and not just two privacy blocks
+ *
+ * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see
+ * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different
+ * questions. `consentDecidedAt` is read everywhere as *"this person was asked and answered"*, so
+ * stamping it when the visitor's surface offered LESS than the application asks would record a
+ * decision about a purpose nobody displayed, and the application would stop prompting for it.
+ *
+ * Hence the split outcome, which is the whole design:
+ *
+ * | the visitor was offered | what carries |
+ * |---|---|
+ * | everything this application asks | grants **and** the decision instant — nothing more to ask |
+ * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |
+ * | nothing (never asked) | nothing |
+ *
+ * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.
+ *
+ * ## The account always wins, and that is what makes a shared browser safe
+ *
+ * An account that has already recorded a decision receives NOTHING: their own answer stands, and a
+ * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp
+ * an instant, the residual risk of a shared browser — visitor A decides, does not register, and
+ * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited
+ * decision: B is still ASKED, and their answer replaces the seed.
+ *
+ * ## Defensive, because the anonymous row is written by a public door
+ *
+ * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That
+ * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a
+ * caller's claim about their own decision; only their intersection is a statement this function is
+ * willing to repeat onto an identified person.
+ *
+ * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,
+ * which the framework merges as a no-op.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto
+ * the person it belonged to, with its own instant, and never widened past what they were shown.
+ */
+export function buildAnonymousConsentCarryPatch(params) {
+    const { anonymous, account, applicationAsks } = params;
+    // Never asked, or asked nothing: there is no decision to carry, and seeding grants from a
+    // non-decision would invent one.
+    if (anonymous?.consentDecidedAt === undefined)
+        return {};
+    const offered = normalizeConsentPurposes(anonymous.offeredPurposes);
+    if (offered.length === 0)
+        return {};
+    // The account's own answer stands. `consentDecidedAt` is the decision marker; a non-empty grant set
+    // is checked too, so a row that somehow holds grants without an instant is still not overwritten.
+    const accountDecided = account?.consentDecidedAt !== undefined
+        || normalizeConsentPurposes(account?.consentedPurposes).length > 0;
+    if (accountDecided)
+        return {};
+    // Only what the visitor was actually shown AND granted.
+    const carriedGrants = normalizeConsentPurposes(anonymous.consentedPurposes).filter((purpose) => offered.includes(purpose));
+    const asked = normalizeConsentPurposes(applicationAsks);
+    const coversEverythingAsked = asked.every((purpose) => offered.includes(purpose));
+    const privacy = {
+        ...(account ?? {}),
+        consentedPurposes: carriedGrants,
+    };
+    if (coversEverythingAsked) {
+        // The visitor's own instant, not the carry's: the moment they decided is the fact being recorded.
+        privacy.consentDecidedAt = new Date(anonymous.consentDecidedAt);
+    }
+    else {
+        // Seed the grants and leave the question open, so the application still prompts.
+        delete privacy.consentDecidedAt;
+    }
+    return { privacy };
+}
+//# sourceMappingURL=user-consent-decision.shared.utils.js.map

package/dist/esm/users/user-consent-decision.shared.utils.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"user-consent-decision.shared.utils.js","sourceRoot":"","sources":["../../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAgBzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAO,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,cAAc,GAAG,OAAO,EAAE,OAAO,CAAC;IACxC,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAkD;YAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YACzB,GAAG,QAAQ;YACX,iBAAiB,EAAE,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC;SAC/E,CAAC;QACF,4FAA4F;QAC5F,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS;YAAE,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;;YAC1G,OAAO,OAAO,CAAC,gBAAgB,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAsB,CAAC;IAClD,CAAC;IAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;WAC7D,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACvI,MAAM,QAAQ,GAAG,cAAc,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnJ,MAAM,sBAAsB,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC;IAEjF,MAAM,OAAO,GAAG,UAAU,IAAI,sBAAsB,CAAC;IACrD,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzB,GAAG,QAAQ;QACX,iBAAiB,EAAE,YAAY;KAChC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACjC,CAAC;SAAM,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CACpD,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,SAAS,GAAG,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC;IACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,CAAC;oBAClB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;oBACtC,OAAO,EAAE,uGAAuG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACnI,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,+BAA+B,CAAwC,MAetF;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEvD,0FAA0F;IAC1F,iCAAiC;IACjC,IAAI,SAAS,EAAE,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,wBAAwB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,oGAAoG;IACpG,kGAAkG;IAClG,MAAM,cAAc,GAAG,OAAO,EAAE,gBAAgB,KAAK,SAAS;WACzD,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,IAAI,cAAc;QAAE,OAAO,EAAE,CAAC;IAE9B,wDAAwD;IACxD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3H,MAAM,KAAK,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClB,iBAAiB,EAAE,aAAa;KACjC,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,kGAAkG;QAClG,OAAO,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,iFAAiF;QACjF,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC","sourcesContent":["import { ZodError } from 'zod';\n\nimport { normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport type { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';\n\n/**\n * Any record carrying a consent `privacy` block — user preferences, an inbound contact, an anonymous\n * visitor. Structural on purpose: the rule below is the same for every holder, and a per-resource\n * copy is how two doors come to disagree about when a decision happened.\n */\nexport interface ConsentDecisionHolder {\n privacy?: {\n consentedPurposes?: readonly (ConsentPurpose | string)[];\n consentDecidedAt?: Date | string;\n [otherPrivacyField: string]: unknown;\n };\n}\n\n/**\n * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of\n * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there\n * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.\n *\n * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller\n *\n * It records WHEN a person made an affirmative consent choice, and it is what separates \"declined\n * everything\" from \"was never asked\". A client-authored instant would let any caller backdate or\n * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and\n * the recorded instant is the server's clock.\n *\n * ## When a write counts as a decision\n *\n * - The purpose SET changed → a decision. Always stamped.\n * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an\n * explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.\n * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.\n * This is the ordinary preferences form re-submitting every field while the person edited something\n * else; stamping there would fabricate a consent choice nobody made.\n *\n * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a\n * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the\n * returned block carries the STORED purposes and instant forward.\n * Without that, the write would replace the whole `privacy` object and the stored consent would be lost\n * while reading as a withdrawal (#534 review F1).\n *\n * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —\n * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the\n * purpose set it accompanies is audit evidence on the same UPDATE.\n */\nexport function buildConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n input: Partial<THolder> | undefined,\n current: THolder | undefined,\n now: Date = new Date(),\n): Partial<THolder> {\n const incoming = input?.privacy;\n if (incoming === undefined) return {};\n\n const currentPrivacy = current?.privacy;\n if (incoming.consentedPurposes === undefined) {\n const carried: NonNullable<ConsentDecisionHolder['privacy']> = {\n ...(currentPrivacy ?? {}),\n ...incoming,\n consentedPurposes: normalizeConsentPurposes(currentPrivacy?.consentedPurposes),\n };\n // A caller-sent instant without a purpose set is not a decision; the stored instant stands.\n if (currentPrivacy?.consentDecidedAt !== undefined) carried.consentDecidedAt = currentPrivacy.consentDecidedAt;\n else delete carried.consentDecidedAt;\n return { privacy: carried } as Partial<THolder>;\n }\n\n const nextPurposes = normalizeConsentPurposes(incoming.consentedPurposes);\n const previousPurposes = normalizeConsentPurposes(currentPrivacy?.consentedPurposes);\n\n const setChanged = nextPurposes.length !== previousPurposes.length\n || nextPurposes.some((purpose, index) => purpose !== previousPurposes[index]);\n const claimedAt = incoming.consentDecidedAt === undefined ? undefined : new Date(incoming.consentDecidedAt as Date | string).getTime();\n const storedAt = currentPrivacy?.consentDecidedAt === undefined ? undefined : new Date(currentPrivacy.consentDecidedAt as Date | string).getTime();\n const explicitReconfirmation = claimedAt !== undefined && claimedAt !== storedAt;\n\n const decided = setChanged || explicitReconfirmation;\n const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n ...(currentPrivacy ?? {}),\n ...incoming,\n consentedPurposes: nextPurposes,\n };\n if (decided) {\n privacy.consentDecidedAt = now;\n } else if (currentPrivacy?.consentDecidedAt !== undefined) {\n privacy.consentDecidedAt = currentPrivacy.consentDecidedAt;\n } else {\n delete privacy.consentDecidedAt;\n }\n\n return { privacy } as Partial<THolder>;\n}\n\n/**\n * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW\n * purposes on a person's behalf — honouring a withdrawal request received another way — but may never\n * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same\n * server-stamped instant as the person's own choice and could not be told apart from it.\n *\n * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision\n * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch\n * consent — passes through unchanged.\n */\nexport function buildAdministratorConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n input: Partial<THolder> | undefined,\n current: THolder | undefined,\n now: Date = new Date(),\n): Partial<THolder> {\n const requested = input?.privacy?.consentedPurposes;\n if (requested !== undefined) {\n const stored = normalizeConsentPurposes(current?.privacy?.consentedPurposes);\n const added = normalizeConsentPurposes(requested).filter((purpose) => !stored.includes(purpose));\n if (added.length > 0) {\n throw new ZodError([{\n code: 'custom',\n path: ['privacy', 'consentedPurposes'],\n message: `An administrator may withdraw consent purposes but cannot grant them on a person's behalf; refused: ${added.join(', ')}.`,\n input: requested,\n }]);\n }\n }\n return buildConsentDecisionPatch(input, current, now);\n}\n\n/**\n * What an anonymous visitor's consent decision contributes to the account they just became (#1258).\n *\n * ## The one thing that dies at this boundary today\n *\n * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their\n * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.\n * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,\n * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves\n * neither. So a visitor who declines analytics on the marketing site is asked again inside the\n * application, and under a declared service-consent requirement is BLOCKED there, over a question they\n * answered minutes earlier.\n *\n * ## Why this takes `applicationAsks` and not just two privacy blocks\n *\n * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see\n * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different\n * questions. `consentDecidedAt` is read everywhere as *\"this person was asked and answered\"*, so\n * stamping it when the visitor's surface offered LESS than the application asks would record a\n * decision about a purpose nobody displayed, and the application would stop prompting for it.\n *\n * Hence the split outcome, which is the whole design:\n *\n * | the visitor was offered | what carries |\n * |---|---|\n * | everything this application asks | grants **and** the decision instant — nothing more to ask |\n * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |\n * | nothing (never asked) | nothing |\n *\n * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.\n *\n * ## The account always wins, and that is what makes a shared browser safe\n *\n * An account that has already recorded a decision receives NOTHING: their own answer stands, and a\n * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp\n * an instant, the residual risk of a shared browser — visitor A decides, does not register, and\n * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited\n * decision: B is still ASKED, and their answer replaces the seed.\n *\n * ## Defensive, because the anonymous row is written by a public door\n *\n * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That\n * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a\n * caller's claim about their own decision; only their intersection is a statement this function is\n * willing to repeat onto an identified person.\n *\n * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,\n * which the framework merges as a no-op.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto\n * the person it belonged to, with its own instant, and never widened past what they were shown.\n */\nexport function buildAnonymousConsentCarryPatch<THolder extends ConsentDecisionHolder>(params: {\n /** The converting visitor's `AnonymousUser.privacy`. */\n readonly anonymous: {\n readonly consentedPurposes?: readonly (ConsentPurpose | string)[];\n readonly offeredPurposes?: readonly (ConsentPurpose | string)[];\n readonly consentDecidedAt?: Date | string;\n } | undefined;\n /** The account's current privacy block, or undefined when it has none. */\n readonly account: ConsentDecisionHolder['privacy'] | undefined;\n /**\n * The purposes this application's own consent surface would put to the person — the gate's\n * `optionalPurposes` plus anything it requires. Passing an empty list means the application asks\n * nothing, so a carried decision is complete by definition.\n */\n readonly applicationAsks: readonly (ConsentPurpose | string)[];\n}): Partial<THolder> {\n const { anonymous, account, applicationAsks } = params;\n\n // Never asked, or asked nothing: there is no decision to carry, and seeding grants from a\n // non-decision would invent one.\n if (anonymous?.consentDecidedAt === undefined) return {};\n const offered = normalizeConsentPurposes(anonymous.offeredPurposes);\n if (offered.length === 0) return {};\n\n // The account's own answer stands. `consentDecidedAt` is the decision marker; a non-empty grant set\n // is checked too, so a row that somehow holds grants without an instant is still not overwritten.\n const accountDecided = account?.consentDecidedAt !== undefined\n || normalizeConsentPurposes(account?.consentedPurposes).length > 0;\n if (accountDecided) return {};\n\n // Only what the visitor was actually shown AND granted.\n const carriedGrants = normalizeConsentPurposes(anonymous.consentedPurposes).filter((purpose) => offered.includes(purpose));\n\n const asked = normalizeConsentPurposes(applicationAsks);\n const coversEverythingAsked = asked.every((purpose) => offered.includes(purpose));\n\n const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n ...(account ?? {}),\n consentedPurposes: carriedGrants,\n };\n if (coversEverythingAsked) {\n // The visitor's own instant, not the carry's: the moment they decided is the fact being recorded.\n privacy.consentDecidedAt = new Date(anonymous.consentDecidedAt);\n } else {\n // Seed the grants and leave the question open, so the application still prompts.\n delete privacy.consentDecidedAt;\n }\n\n return { privacy } as Partial<THolder>;\n}\n"]}

package/dist/esm/users/user-credentials.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-credentials.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsH9C,CAAC"}
1	+ {"version":3,"file":"user-credentials.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsH9C,CAAC"}

package/dist/esm/users/user-credentials.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAK/F;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAWvC,CAAC;AAGH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2FhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
1	+ {"version":3,"file":"user-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAK/F;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAWvC,CAAC;AAGH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2FhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -20,6 +20,7 @@ export declare const userIdentityLinksResourceConfiguration_InitializationFactor
     providerDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     providerAvatarUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>>;
+    scimExternalId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     scopeType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodEnum<typeof import("..").AuthScopeType>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE~~;;;;;;;;;;;;;;;;;~~kCAkI9C,CAAC"}
1	+ {"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}

package/dist/esm/users/user-identity-links.shared.schemas.d.ts CHANGED Viewed

@@ -28,6 +28,7 @@ export declare const UserIdentityLinkSchema: import("@wildo-ai/zod-decorators").
     providerDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     providerAvatarUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+    scimExternalId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     scopeType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;

package/dist/esm/users/user-identity-links.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB~~;;;;;;;;;;;;;;;;;kBAmJjC~~,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
1	+ {"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;kBAqLjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/esm/users/user-identity-links.shared.schemas.js CHANGED Viewed

@@ -65,6 +65,36 @@ export const UserIdentityLinkSchema = z.object({
     // exactly why it must be scrubbed: an unclassifiable blob is not an empty one.
     providerRawProfile: addImpersonalizeWith(z.record(z.string(), z.unknown()).optional().isBackendOnly(), RedactionType.REMOVE)
         .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),
+    /**
+     * The DIRECTORY's own identifier for this person, as SCIM `externalId` — and deliberately NOT
+     * {@link UserIdentityLinkSchema.shape.providerUserId}.
+     *
+     * ## Why it cannot share a column with `providerUserId`
+     *
+     * `providerUserId` is the AUTHENTICATION KEY. `createIdentityLink` resolves an existing link by it
+     * (with `providerRef`, `connectionType` and the scope) and refuses with
+     * `enterprise_identity_already_linked_to_another_user` when it points at somebody else. It is also
+     * part of this resource's business key.
+     *
+     * SCIM `externalId` is not that. RFC 7643 §3.1 makes it the CLIENT's identifier, which the service
+     * provider stores; the provider's own identifier is `id`. Microsoft Entra maps it from
+     * `[mailNickname]` by default — a mutable handle — so writing it into `providerUserId` would
+     * re-key a live SSO identity from an attribute an administrator can change in the directory. The
+     * next sign-in asserting the original subject would find no link.
+     *
+     * ## What it was before (#1402)
+     *
+     * `SCIM_USER_ATTRIBUTE_MAP` mapped `externalId` → `providerUserId`, and the SCIM PATCH/PUT path
+     * folded it into the profile update bag — which writes `USER_PROFILES`, a resource that does not
+     * own the field. It was stripped by the strict re-parse and the directory was told `200`. Measured
+     * against a live Entra tenant on 2026-09-21: it reported updating `externalId` for two users, and
+     * neither value was stored, so it re-sent the same update on every cycle.
+     *
+     * Optional because only a directory sets it: a social or interactive SSO link has none. Not
+     * indexed and not part of any key — it is a value to hand back, not to resolve by; resolving by it
+     * is what the whole comment above exists to prevent.
+     */
+    scimExternalId: addImpersonalizeWith(z.string().optional().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),
     /** Enterprise tenant kind. Absent for social links. */
     scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),
     /** Organization tenant identifier. Present only for organization-scoped enterprise links. */

package/dist/esm/users/user-identity-links.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-identity-links.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAE5C;IACF,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC;QAClC,sBAAsB,CAAC,MAAM;QAC7B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;IACF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC;QACtC,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExE,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE7D,+BAA+B;IAC/B,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,uFAAuF;IACvF,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CACrC;IAED,yBAAyB;IACzB,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED,4BAA4B;IAC5B,mBAAmB,EAAE,oBAAoB,CACvC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,0BAA0B;IAC1B,iBAAiB,EAAE,oBAAoB,CACrC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;;OAOG;IACH,iGAAiG;IACjG,+FAA+F;IAC/F,+EAA+E;IAC/E,kBAAkB,EAAE,oBAAoB,CACtC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAC5D,aAAa,CAAC,MAAM,CACrB;SACE,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAErF,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEzD,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEpD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEnD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,oDAAoD;IACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElG,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACrG,CAAC,CAAC,cAAc,CAAC;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,cAAc;CACf,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,cAAc,cAAc;SAClG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACrD,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;eACzB,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,YAAY,KAAK,SAAS,EAClC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["/*\n User Identity Links Schema\n \n Tracks OAuth2/SSO provider connections per user.\n * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).\n \n Canonical identity key: connection type + provider + provider user + exact enterprise\n * scope/connection coordinates. The database compound unique index prevents the same\n * external identity from being bound to two Wildo users inside one tenant connection.\n /\n\nimport { z } from 'zod';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { ERASED_USER_EMAIL, ERASED_IDENTITY_VALUE } from './users.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport {\n AuthScopeType,\n ExternalIdentitySource,\n SsoConnectionType,\n} from '../security/authentications/authentication.shared.schemas';\n\n/\n Valid provenance mechanisms for each connection ownership class.\n \n OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately\n * spans both. Keeping this relationship beside the persisted link schema makes\n * invalid cross-products impossible at every repository boundary.\n /\nexport const IDENTITY_SOURCES_BY_CONNECTION_TYPE: Readonly<\n Record<SsoConnectionType, ReadonlySet<ExternalIdentitySource>>\n> = {\n [SsoConnectionType.SOCIAL]: new Set([\n ExternalIdentitySource.OAUTH2,\n ExternalIdentitySource.OIDC,\n ]),\n [SsoConnectionType.ENTERPRISE]: new Set([\n ExternalIdentitySource.OIDC,\n ExternalIdentitySource.SAML,\n ExternalIdentitySource.SCIM,\n ]),\n};\n\nexport const UserIdentityLinkSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* FK → USERS — the user who owns this identity link /\n userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n /* Distinguishes social vs enterprise links /\n connectionType: z.enum(SsoConnectionType).isDBIndexed().isSummaryField(),\n\n /* Matches external connector ref (e.g., \"google\", \"microsoft\", \"github\", \"oidc\") /\n providerRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n /* The user's ID at the IdP /\n // MASK, not REMOVE: `min(1)` and part of the compound business key, so a null fails the re-parse.\n // Two erased links for one connection would share this masked value — which is safe because a\n // declared retention policy makes the planner emit that unique index RETENTION-SCOPED, so retained\n // rows fall outside the constraint. Confirmed in the generated migration, not assumed.\n providerUserId: addImpersonalizeWith(\n z.string().min(1).isDBIndexed().dataCategories(PersonalDataCategory.IDENTITY),\n RedactionType.MASK,\n { maskValue: ERASED_IDENTITY_VALUE },\n ),\n\n /* Email from the IdP /\n providerEmail: addImpersonalizeWith(\n z.string().isDBIndexed().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n RedactionType.MASK,\n { maskValue: ERASED_USER_EMAIL },\n ),\n\n /* Display name from IdP /\n providerDisplayName: addImpersonalizeWith(\n z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n RedactionType.REMOVE,\n ),\n\n /* Avatar URL from IdP /\n providerAvatarUrl: addImpersonalizeWith(\n z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n RedactionType.REMOVE,\n ),\n\n /\n Raw claims from the IdP for debugging — backend only.\n \n The one field on this resource whose contents the framework does not control: an IdP may put\n * anything in a claim set, including a special category. IDENTITY + USER_CONTENT is what the field\n * is FOR; it is not a certification of what a given IdP will send. An application whose IdP is\n * known to emit a special-category claim should say so on its own copy.\n /\n // The provider's own payload about the person, unbounded in shape — whatever that provider chose\n // to send. It carries no `dataCategories` because nothing can classify it in advance, which is\n // exactly why it must be scrubbed: an unclassifiable blob is not an empty one.\n providerRawProfile: addImpersonalizeWith(\n z.record(z.string(), z.unknown()).optional().isBackendOnly(),\n RedactionType.REMOVE,\n )\n .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),\n\n /* Enterprise tenant kind. Absent for social links. /\n scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),\n\n /* Organization tenant identifier. Present only for organization-scoped enterprise links. /\n organizationId: z.string().optional().isForeignKey(),\n\n /* Application tenant identifier. Present only for application-scoped enterprise links. /\n applicationId: z.string().optional().isForeignKey(),\n\n /* Enterprise connection identifier within the owning scope. /\n connectionId: z.string().optional(),\n\n /* Authentication source that created this link. /\n source: z.enum(ExternalIdentitySource),\n\n /* When this identity link was created /\n linkedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n /* Last time this identity link was used for authentication */\n lastUsedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n 'connectionType',\n 'providerRef',\n 'providerUserId',\n 'scopeType',\n 'organizationId',\n 'applicationId',\n 'connectionId',\n]).superRefine((link, ctx) => {\n if (!IDENTITY_SOURCES_BY_CONNECTION_TYPE[link.connectionType].has(link.source)) {\n ctx.addIssue({\n code: 'custom',\n path: ['source'],\n message: `Identity source ${link.source} is incompatible with ${link.connectionType} connections`,\n });\n }\n\n if (link.connectionType === SsoConnectionType.SOCIAL) {\n if (\n link.scopeType !== undefined\n \|\| link.organizationId !== undefined\n \|\| link.applicationId !== undefined\n \|\| link.connectionId !== undefined\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Social identity links must not carry enterprise scope fields',\n });\n }\n return;\n }\n\n if (!link.connectionId) {\n ctx.addIssue({\n code: 'custom',\n path: ['connectionId'],\n message: 'Enterprise identity links require connectionId',\n });\n }\n\n if (link.scopeType === AuthScopeType.ORGANIZATION) {\n if (!link.organizationId \|\| link.applicationId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['organizationId'],\n message: 'Organization-scoped identity links require only organizationId',\n });\n }\n return;\n }\n\n if (link.scopeType === AuthScopeType.APPLICATION) {\n if (!link.applicationId \|\| link.organizationId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['applicationId'],\n message: 'Application-scoped identity links require only applicationId',\n });\n }\n return;\n }\n\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Enterprise identity links require an explicit scopeType',\n });\n});\n\n\nexport type UserIdentityLink = z.infer<typeof UserIdentityLinkSchema>;\n"]}
1	+ {"version":3,"file":"user-identity-links.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAE5C;IACF,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC;QAClC,sBAAsB,CAAC,MAAM;QAC7B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;IACF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC;QACtC,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExE,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE7D,+BAA+B;IAC/B,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,uFAAuF;IACvF,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CACrC;IAED,yBAAyB;IACzB,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED,4BAA4B;IAC5B,mBAAmB,EAAE,oBAAoB,CACvC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,0BAA0B;IAC1B,iBAAiB,EAAE,oBAAoB,CACrC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;;OAOG;IACH,iGAAiG;IACjG,+FAA+F;IAC/F,+EAA+E;IAC/E,kBAAkB,EAAE,oBAAoB,CACtC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAC5D,aAAa,CAAC,MAAM,CACrB;SACE,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEzD,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEpD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEnD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,oDAAoD;IACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElG,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACrG,CAAC,CAAC,cAAc,CAAC;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,cAAc;CACf,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,cAAc,cAAc;SAClG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACrD,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;eACzB,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,YAAY,KAAK,SAAS,EAClC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["/*\n User Identity Links Schema\n \n Tracks OAuth2/SSO provider connections per user.\n * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).\n \n Canonical identity key: connection type + provider + provider user + exact enterprise\n * scope/connection coordinates. The database compound unique index prevents the same\n * external identity from being bound to two Wildo users inside one tenant connection.\n /\n\nimport { z } from 'zod';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { ERASED_USER_EMAIL, ERASED_IDENTITY_VALUE } from './users.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport {\n AuthScopeType,\n ExternalIdentitySource,\n SsoConnectionType,\n} from '../security/authentications/authentication.shared.schemas';\n\n/\n Valid provenance mechanisms for each connection ownership class.\n \n OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately\n * spans both. Keeping this relationship beside the persisted link schema makes\n * invalid cross-products impossible at every repository boundary.\n /\nexport const IDENTITY_SOURCES_BY_CONNECTION_TYPE: Readonly<\n Record<SsoConnectionType, ReadonlySet<ExternalIdentitySource>>\n> = {\n [SsoConnectionType.SOCIAL]: new Set([\n ExternalIdentitySource.OAUTH2,\n ExternalIdentitySource.OIDC,\n ]),\n [SsoConnectionType.ENTERPRISE]: new Set([\n ExternalIdentitySource.OIDC,\n ExternalIdentitySource.SAML,\n ExternalIdentitySource.SCIM,\n ]),\n};\n\nexport const UserIdentityLinkSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* FK → USERS — the user who owns this identity link /\n userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n /* Distinguishes social vs enterprise links /\n connectionType: z.enum(SsoConnectionType).isDBIndexed().isSummaryField(),\n\n /* Matches external connector ref (e.g., \"google\", \"microsoft\", \"github\", \"oidc\") /\n providerRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n /* The user's ID at the IdP /\n // MASK, not REMOVE: `min(1)` and part of the compound business key, so a null fails the re-parse.\n // Two erased links for one connection would share this masked value — which is safe because a\n // declared retention policy makes the planner emit that unique index RETENTION-SCOPED, so retained\n // rows fall outside the constraint. Confirmed in the generated migration, not assumed.\n providerUserId: addImpersonalizeWith(\n z.string().min(1).isDBIndexed().dataCategories(PersonalDataCategory.IDENTITY),\n RedactionType.MASK,\n { maskValue: ERASED_IDENTITY_VALUE },\n ),\n\n /* Email from the IdP /\n providerEmail: addImpersonalizeWith(\n z.string().isDBIndexed().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n RedactionType.MASK,\n { maskValue: ERASED_USER_EMAIL },\n ),\n\n /* Display name from IdP /\n providerDisplayName: addImpersonalizeWith(\n z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n RedactionType.REMOVE,\n ),\n\n /* Avatar URL from IdP /\n providerAvatarUrl: addImpersonalizeWith(\n z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n RedactionType.REMOVE,\n ),\n\n /\n Raw claims from the IdP for debugging — backend only.\n \n The one field on this resource whose contents the framework does not control: an IdP may put\n * anything in a claim set, including a special category. IDENTITY + USER_CONTENT is what the field\n * is FOR; it is not a certification of what a given IdP will send. An application whose IdP is\n * known to emit a special-category claim should say so on its own copy.\n /\n // The provider's own payload about the person, unbounded in shape — whatever that provider chose\n // to send. It carries no `dataCategories` because nothing can classify it in advance, which is\n // exactly why it must be scrubbed: an unclassifiable blob is not an empty one.\n providerRawProfile: addImpersonalizeWith(\n z.record(z.string(), z.unknown()).optional().isBackendOnly(),\n RedactionType.REMOVE,\n )\n .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),\n\n /\n The DIRECTORY's own identifier for this person, as SCIM `externalId` — and deliberately NOT\n * {@link UserIdentityLinkSchema.shape.providerUserId}.\n \n ## Why it cannot share a column with `providerUserId`\n \n `providerUserId` is the AUTHENTICATION KEY. `createIdentityLink` resolves an existing link by it\n * (with `providerRef`, `connectionType` and the scope) and refuses with\n * `enterprise_identity_already_linked_to_another_user` when it points at somebody else. It is also\n * part of this resource's business key.\n \n SCIM `externalId` is not that. RFC 7643 §3.1 makes it the CLIENT's identifier, which the service\n * provider stores; the provider's own identifier is `id`. Microsoft Entra maps it from\n * `[mailNickname]` by default — a mutable handle — so writing it into `providerUserId` would\n * re-key a live SSO identity from an attribute an administrator can change in the directory. The\n * next sign-in asserting the original subject would find no link.\n \n ## What it was before (#1402)\n \n `SCIM_USER_ATTRIBUTE_MAP` mapped `externalId` → `providerUserId`, and the SCIM PATCH/PUT path\n * folded it into the profile update bag — which writes `USER_PROFILES`, a resource that does not\n * own the field. It was stripped by the strict re-parse and the directory was told `200`. Measured\n * against a live Entra tenant on 2026-09-21: it reported updating `externalId` for two users, and\n * neither value was stored, so it re-sent the same update on every cycle.\n \n Optional because only a directory sets it: a social or interactive SSO link has none. Not\n * indexed and not part of any key — it is a value to hand back, not to resolve by; resolving by it\n * is what the whole comment above exists to prevent.\n /\n scimExternalId: addImpersonalizeWith(\n z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n RedactionType.REMOVE,\n ),\n\n /* Enterprise tenant kind. Absent for social links. /\n scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),\n\n /* Organization tenant identifier. Present only for organization-scoped enterprise links. /\n organizationId: z.string().optional().isForeignKey(),\n\n /* Application tenant identifier. Present only for application-scoped enterprise links. /\n applicationId: z.string().optional().isForeignKey(),\n\n /* Enterprise connection identifier within the owning scope. /\n connectionId: z.string().optional(),\n\n /* Authentication source that created this link. /\n source: z.enum(ExternalIdentitySource),\n\n /* When this identity link was created /\n linkedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n /* Last time this identity link was used for authentication */\n lastUsedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n 'connectionType',\n 'providerRef',\n 'providerUserId',\n 'scopeType',\n 'organizationId',\n 'applicationId',\n 'connectionId',\n]).superRefine((link, ctx) => {\n if (!IDENTITY_SOURCES_BY_CONNECTION_TYPE[link.connectionType].has(link.source)) {\n ctx.addIssue({\n code: 'custom',\n path: ['source'],\n message: `Identity source ${link.source} is incompatible with ${link.connectionType} connections`,\n });\n }\n\n if (link.connectionType === SsoConnectionType.SOCIAL) {\n if (\n link.scopeType !== undefined\n \|\| link.organizationId !== undefined\n \|\| link.applicationId !== undefined\n \|\| link.connectionId !== undefined\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Social identity links must not carry enterprise scope fields',\n });\n }\n return;\n }\n\n if (!link.connectionId) {\n ctx.addIssue({\n code: 'custom',\n path: ['connectionId'],\n message: 'Enterprise identity links require connectionId',\n });\n }\n\n if (link.scopeType === AuthScopeType.ORGANIZATION) {\n if (!link.organizationId \|\| link.applicationId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['organizationId'],\n message: 'Organization-scoped identity links require only organizationId',\n });\n }\n return;\n }\n\n if (link.scopeType === AuthScopeType.APPLICATION) {\n if (!link.applicationId \|\| link.organizationId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['applicationId'],\n message: 'Application-scoped identity links require only applicationId',\n });\n }\n return;\n }\n\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Enterprise identity links require an explicit scopeType',\n });\n});\n\n\nexport type UserIdentityLink = z.infer<typeof UserIdentityLinkSchema>;\n"]}

package/dist/esm/users/user-preferences-reset.shared.utils.d.ts CHANGED Viewed

@@ -16,7 +16,7 @@
  * the write against that same DTO, and Mongoose drops every non-schema path. A request naming
  * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset
  * nothing. That is the class of defect catalogued in
- * `.claude/plans/routed-unimplemented-operations-fail-closed.md`.
+ * the 2026-08-01 routed-but-unimplemented operation sweep (#1275).
  *
  * ## How the reset reaches the database now
  *
@@ -61,18 +61,18 @@ export type UserPreferencesResetRequest = z.infer<typeof UserPreferencesResetReq
  * unnamed block is left exactly as it was.
  *
  * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}
- * returns `dataProcessingConsent` to its default, which IS a consent decision. It leaves a trail
+ * returns `consentedPurposes` to the empty set and clears `consentDecidedAt`, which IS a consent
+ * decision — a withdrawal of everything, after which a consent surface asks again. It leaves a trail
  * naming the previous and resulting value: the operation is CRITICAL, so it sits above the
  * framework's automatic audit floor and emits `resource_operation_performed`, and
- * `dataProcessingConsent` / `privacyLevel` carry `.isAuditEvidence()` so their VALUES ride on that
- * record. Governed-document receipts are neither preference members nor resettable values.
+ * `consentedPurposes` carries `.isAuditEvidence()` so its VALUES ride on that record. Governed-document receipts are neither preference members nor resettable values.
  *
  * @param request - the parsed request body. Re-parse `inputDto` through
  *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the
  *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the
  *   operation's request DTO.
- * @param currentPreferences - the row being reset, needed by blocks whose reset is not a pure
- *   default (today: privacy, whose consent receipts are carried through).
+ * @param currentPreferences - the row being reset, supplied to each block factory. Current
+ *   factories return schema defaults; governed-document receipts live outside this resource.
  */
 export declare function buildUserPreferencesResetPatch(request: UserPreferencesResetRequest, currentPreferences: UserPreferences | undefined): Partial<UserPreferences>;
 //# sourceMappingURL=user-preferences-reset.shared.utils.d.ts.map

package/dist/esm/users/user-preferences-reset.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-preferences-reset.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../~~src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,mBAAmB,EACnB,eAAe,EAKhB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA2B5F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,2BAA2B,EACpC,kBAAkB,EAAE,eAAe,GAAG,SAAS,GAC9C,OAAO,CAAC,eAAe,CAAC,CAU1B"}
1	+ {"version":3,"file":"user-preferences-reset.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,mBAAmB,EACnB,eAAe,EAKhB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA2B5F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,2BAA2B,EACpC,kBAAkB,EAAE,eAAe,GAAG,SAAS,GAC9C,OAAO,CAAC,eAAe,CAAC,CAU1B"}

package/dist/esm/users/user-preferences-reset.shared.utils.js CHANGED Viewed

@@ -16,7 +16,7 @@
  * the write against that same DTO, and Mongoose drops every non-schema path. A request naming
  * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset
  * nothing. That is the class of defect catalogued in
- * `.claude/plans/routed-unimplemented-operations-fail-closed.md`.
+ * the 2026-08-01 routed-but-unimplemented operation sweep (#1275).
  *
  * ## How the reset reaches the database now
  *
@@ -73,18 +73,18 @@ const USER_PREFERENCE_GROUP_RESET_FACTORIES = {
  * unnamed block is left exactly as it was.
  *
  * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}
- * returns `dataProcessingConsent` to its default, which IS a consent decision. It leaves a trail
+ * returns `consentedPurposes` to the empty set and clears `consentDecidedAt`, which IS a consent
+ * decision — a withdrawal of everything, after which a consent surface asks again. It leaves a trail
  * naming the previous and resulting value: the operation is CRITICAL, so it sits above the
  * framework's automatic audit floor and emits `resource_operation_performed`, and
- * `dataProcessingConsent` / `privacyLevel` carry `.isAuditEvidence()` so their VALUES ride on that
- * record. Governed-document receipts are neither preference members nor resettable values.
+ * `consentedPurposes` carries `.isAuditEvidence()` so its VALUES ride on that record. Governed-document receipts are neither preference members nor resettable values.
  *
  * @param request - the parsed request body. Re-parse `inputDto` through
  *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the
  *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the
  *   operation's request DTO.
- * @param currentPreferences - the row being reset, needed by blocks whose reset is not a pure
- *   default (today: privacy, whose consent receipts are carried through).
+ * @param currentPreferences - the row being reset, supplied to each block factory. Current
+ *   factories return schema defaults; governed-document receipts live outside this resource.
  */
 export function buildUserPreferencesResetPatch(request, currentPreferences) {
     const patch = {};