@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.d.ts

@@ -9,30 +9,147 @@
  * it never reads its own AnonymousUser row. See the READ variant note for why anon
  * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).
  */
+import { z } from 'zod';
+import { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
 import { ResourceRelationship } from '../resources/resources.shared.schemas';
-export declare const anonymousUsersResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, import("zod").ZodObject<{
-    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
-    uuidRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>;
-    privacy: import("zod").ZodObject<{
-        dataProcessingConsent: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("..").DataProcessingConsent>>;
-    }, import("zod/v4/core").$strip>;
-    userAgent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
-    ipHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
-    marketingMetadata: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodObject<{
-        utm: import("zod").ZodOptional<import("zod").ZodObject<{
-            source: import("zod").ZodOptional<import("zod").ZodString>;
-            medium: import("zod").ZodOptional<import("zod").ZodString>;
-            campaign: import("zod").ZodOptional<import("zod").ZodString>;
-            term: import("zod").ZodOptional<import("zod").ZodString>;
-            content: import("zod").ZodOptional<import("zod").ZodString>;
-        }, import("zod/v4/core").$strip>>;
-        referrer: import("zod").ZodOptional<import("zod").ZodString>;
-        landingPath: import("zod").ZodOptional<import("zod").ZodString>;
-        acceptLanguage: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>>>>;
-    convertedToUserId: import("zod").ZodOptional<import("zod").ZodString>;
-    transpositionStatus: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodEnum<typeof import("./anonymous-users.shared.schema").AnonymousUserTranspositionStatus>>>;
-    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>;
-}, import("zod/v4/core").$strip>>;
+/**
+ * Custom operations on the anonymous identity anchor.
+ *
+ * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent
+ * decision was declared on this resource's UPDATE — *"a visitor's or a lead's consent decision is as
+ * recordable as a member's"* — while every operation here is `INTERNAL_CALL` or super-admin, so no
+ * visitor could reach it. The recording contract was written for a door nobody built (#1258).
+ */
+export declare enum AnonymousUsers_Operations {
+    RECORD_CONSENT = "record_consent",
+    /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */
+    RECORD_NOTICE_DELIVERED = "record_notice_delivered"
+}
+/**
+ * What a visitor's consent surface sends when they decide.
+ *
+ * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise
+ *
+ * A decision is `(granted subset-of offered, at an instant)` — see
+ * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the
+ * person saw, and the server does not know it: the marketing website is statically built and derives
+ * its panel from its OWN live providers, which this backend never sees. So the client is the only
+ * party that can state it.
+ *
+ * The blast radius is confined by construction, which is what makes that acceptable:
+ *
+ * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the
+ *   request, so no visitor can describe another visitor's decision;
+ * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes
+ *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an
+ *   account that has already decided;
+ * - it grants no privilege a visitor does not already have — they may tick the same boxes on the
+ *   application's own consent surface a minute later.
+ *
+ * The residual is a shared browser whose first visitor lies: the next person to register from it
+ * starts with grants they did not make. That is the pre-existing shared-browser exposure of any
+ * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.
+ *
+ * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same
+ * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the
+ * fact that a decision happened.
+ */
+export declare const AnonymousUsersRecordConsentRequestDtoSchema: z.ZodObject<{
+    grantedPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+    offeredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+}, z.core.$strip>;
+export type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;
+/**
+ * What the visitor gets back: their OWN decision, and nothing else.
+ *
+ * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`
+ * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the
+ * controller's response validation — measured live as `controller_resource_validation_failed` after
+ * the write had already succeeded (#1267).
+ *
+ * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and
+ * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`
+ * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a
+ * consent click would disclose more than the click.
+ *
+ * The decision itself IS safe to return to the session that just made it, and useful: a client can
+ * reconcile what the server stored — including the instant, which the server owns — without a read
+ * door on a resource whose READ is deliberately admin-only.
+ */
+export declare const AnonymousUsersRecordConsentResponseDtoSchema: z.ZodObject<{
+    consentedPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+    offeredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+    consentDecidedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodISODateTime]>>;
+}, z.core.$strip>;
+export type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;
+/**
+ * What a visitor's public-document page sends when a governed document renders for them (#1258 Step
+ * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,
+ * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers
+ * have different security characteristics and each already has a proven pattern to reuse.
+ *
+ * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from
+ * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to
+ * have met a release that was never in force, or the wrong version of one that was.
+ */
+export declare const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema: z.ZodObject<{
+    documentRef: z.ZodString;
+}, z.core.$strip>;
+export type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;
+/**
+ * Declared rather than inherited, for the same reason as its consent sibling: a custom operation
+ * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at
+ * all, so there is no row to fail validation against — an explicit, minimal response avoids
+ * reintroducing that trap by construction.
+ *
+ * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to
+ * the audit trail against its in-force release, and `false` when nothing was written — no release of
+ * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.
+ * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,
+ * and the caller does not act on it: the page has already been shown.
+ */
+export declare const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema: z.ZodObject<{
+    recorded: z.ZodBoolean;
+}, z.core.$strip>;
+export type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;
+/**
+ * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed
+ * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,
+ * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the
+ * resource or operation identifier changes, on a public door nobody monitors.
+ *
+ * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that
+ * carve (it cannot import the resources layer), and this door is reached only from the signed-out
+ * pages of the APPLICATION itself, which already imports this package freely.
+ */
+export declare const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH: string;
+/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */
+export declare const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = "PUT";
+export declare const anonymousUsersResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<typeof AnonymousUsers_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    uuidRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+        consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+        offeredPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+        consentDecidedAt: z.ZodOptional<z.ZodDate>;
+    }, z.core.$strip>>>;
+    userAgent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    ipHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    marketingMetadata: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodObject<{
+        utm: z.ZodOptional<z.ZodObject<{
+            source: z.ZodOptional<z.ZodString>;
+            medium: z.ZodOptional<z.ZodString>;
+            campaign: z.ZodOptional<z.ZodString>;
+            term: z.ZodOptional<z.ZodString>;
+            content: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        referrer: z.ZodOptional<z.ZodString>;
+        landingPath: z.ZodOptional<z.ZodString>;
+        acceptLanguage: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>;
+    convertedToUserId: z.ZodOptional<z.ZodString>;
+    transpositionStatus: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof import("./anonymous-users.shared.schema").AnonymousUserTranspositionStatus>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>;
+}, z.core.$strip>>;
 //# sourceMappingURL=anonymous-users.shared.resources-config.schemas.d.ts.map

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI,eAAO,MAAM,yDAAyD,GACpE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;iCAuG9C,CAAC"}
+{"version":3,"file":"anonymous-users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAA4B,MAAM,+CAA+C,CAAC;AAGzG,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,cAAc,mBAAmB;IACjC,sFAAsF;IACtF,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,2CAA2C;;;iBAOtD,CAAC;AAEH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C;;;;iBAOvD,CAAC;AAEH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH;;;;;;;;;GASG;AACH,eAAO,MAAM,mDAAmD;;iBAG9D,CAAC;AACH,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAEhI;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oDAAoD;;iBAG/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,QAC0H,CAAC;AAE9K,0KAA0K;AAC1K,eAAO,MAAM,wCAAwC,QAAQ,CAAC;AAE9D,eAAO,MAAM,yDAAyD,GACpE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;kBAsP9C,CAAC"}

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.js

@@ -9,12 +9,134 @@
  * it never reads its own AnonymousUser row. See the READ variant note for why anon
  * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).
  */
+import { z } from 'zod';
 import { AnonymousUserSchema } from './anonymous-users.shared.schema.js';
+import { ConsentPurpose, normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared.js';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
 import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { ResourcesConfigNamingUtils } from '../resources/utils/resources-config-naming.utils.js';
 import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+/**
+ * Custom operations on the anonymous identity anchor.
+ *
+ * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent
+ * decision was declared on this resource's UPDATE — *"a visitor's or a lead's consent decision is as
+ * recordable as a member's"* — while every operation here is `INTERNAL_CALL` or super-admin, so no
+ * visitor could reach it. The recording contract was written for a door nobody built (#1258).
+ */
+export var AnonymousUsers_Operations;
+(function (AnonymousUsers_Operations) {
+    AnonymousUsers_Operations["RECORD_CONSENT"] = "record_consent";
+    /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */
+    AnonymousUsers_Operations["RECORD_NOTICE_DELIVERED"] = "record_notice_delivered";
+})(AnonymousUsers_Operations || (AnonymousUsers_Operations = {}));
+/**
+ * What a visitor's consent surface sends when they decide.
+ *
+ * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise
+ *
+ * A decision is `(granted subset-of offered, at an instant)` — see
+ * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the
+ * person saw, and the server does not know it: the marketing website is statically built and derives
+ * its panel from its OWN live providers, which this backend never sees. So the client is the only
+ * party that can state it.
+ *
+ * The blast radius is confined by construction, which is what makes that acceptable:
+ *
+ * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the
+ *   request, so no visitor can describe another visitor's decision;
+ * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes
+ *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an
+ *   account that has already decided;
+ * - it grants no privilege a visitor does not already have — they may tick the same boxes on the
+ *   application's own consent surface a minute later.
+ *
+ * The residual is a shared browser whose first visitor lies: the next person to register from it
+ * starts with grants they did not make. That is the pre-existing shared-browser exposure of any
+ * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.
+ *
+ * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same
+ * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the
+ * fact that a decision happened.
+ */
+export const AnonymousUsersRecordConsentRequestDtoSchema = z.object({
+    /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */
+    grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16)
+        .describe('Every purpose the visitor granted, as a complete set: a purpose left out is not granted. A purpose not also listed in `offeredPurposes` is ignored.'),
+    /** The purposes the surface actually put in front of them. What is absent was never asked. */
+    offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16)
+        .describe('The purposes the consent surface actually asked the visitor about. A purpose absent from this list is recorded as never asked, not as declined.'),
+});
+/**
+ * What the visitor gets back: their OWN decision, and nothing else.
+ *
+ * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`
+ * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the
+ * controller's response validation — measured live as `controller_resource_validation_failed` after
+ * the write had already succeeded (#1267).
+ *
+ * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and
+ * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`
+ * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a
+ * consent click would disclose more than the click.
+ *
+ * The decision itself IS safe to return to the session that just made it, and useful: a client can
+ * reconcile what the server stored — including the instant, which the server owns — without a read
+ * door on a resource whose READ is deliberately admin-only.
+ */
+export const AnonymousUsersRecordConsentResponseDtoSchema = z.object({
+    consentedPurposes: z.array(z.enum(ConsentPurpose))
+        .describe('The purposes now recorded as granted for this anonymous session: the granted purposes that were also offered.'),
+    offeredPurposes: z.array(z.enum(ConsentPurpose))
+        .describe('The purposes recorded as offered to the visitor with this decision.'),
+    consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional()
+        .describe("When the decision was recorded, taken from the server's clock."),
+});
+/**
+ * What a visitor's public-document page sends when a governed document renders for them (#1258 Step
+ * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,
+ * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers
+ * have different security characteristics and each already has a proven pattern to reuse.
+ *
+ * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from
+ * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to
+ * have met a release that was never in force, or the wrong version of one that was.
+ */
+export const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({
+    documentRef: z.string().trim().min(1)
+        .describe('Reference of the governed document the visitor was shown, such as the privacy notice. The delivery is recorded against the release of that document currently in force, when one allows it; a client cannot name a version.'),
+});
+/**
+ * Declared rather than inherited, for the same reason as its consent sibling: a custom operation
+ * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at
+ * all, so there is no row to fail validation against — an explicit, minimal response avoids
+ * reintroducing that trap by construction.
+ *
+ * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to
+ * the audit trail against its in-force release, and `false` when nothing was written — no release of
+ * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.
+ * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,
+ * and the caller does not act on it: the page has already been shown.
+ */
+export const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({
+    recorded: z.boolean()
+        .describe('Whether this showing of the document was recorded. `false` when no release of the document in force records deliveries, or the record could not be written; the page itself is unaffected.'),
+});
+/**
+ * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed
+ * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,
+ * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the
+ * resource or operation identifier changes, on a public door nobody monitors.
+ *
+ * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that
+ * carve (it cannot import the resources layer), and this door is reached only from the signed-out
+ * pages of the APPLICATION itself, which already imports this package freely.
+ */
+export const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH = `/${ResourcesConfigNamingUtils.toKebabCase(CoreResourceType.ANONYMOUS_USERS)}/${ResourcesConfigNamingUtils.toKebabCase(AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED)}`;
+/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */
+export const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = 'PUT';
 export const anonymousUsersResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: AnonymousUserSchema,
     resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,
@@ -34,6 +156,7 @@ export const anonymousUsersResourceConfiguration_InitializationFactory = (resour
         CoreResourceOperation.UPDATE,
         CoreResourceOperation.DELETE,
     ],
+    customOperation: AnonymousUsers_Operations,
     operationsConfiguration: {
         [CoreResourceOperation.CREATE]: {
             variants: [
@@ -100,6 +223,17 @@ export const anonymousUsersResourceConfiguration_InitializationFactory = (resour
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so
+                    // without this declaration the change would leave no row at all — and a consent change that
+                    // emits nothing is indistinguishable from no consent change, which is exactly what
+                    // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the
+                    // preference UPDATE doors: the declaration, never a raised risk level, because buying the row
+                    // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control
+                    // reads. Only the marked decision leaves (`consentedPurposes`) enter the
+                    // evidence, so the row carries the previous and resulting choice and not the whole block.
+                    // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision
+                    // is as recordable as a member's.
+                    auditableEvent: { auditBelowRiskFloor: true },
                 },
             ],
         },
@@ -113,6 +247,136 @@ export const anonymousUsersResourceConfiguration_InitializationFactory = (resour
                 },
             ],
         },
+        /**
+         * The visitor's own consent decision, recorded against their anonymous session (#1258).
+         *
+         * ## Why it is COLLECTION-level and carries no id
+         *
+         * `resourceOperationLike: UPDATE_MANY` puts it at the collection path with its own name segment
+         * and NO entity id — the `reset-features` shape. That is not a convenience: it is what keeps the
+         * door safe.
+         *
+         * An entity-addressed variant would resolve `{ _id: <value> }`, and an anonymous session's
+         * identity is its client `uuidRef` while its `_id` is a server ObjectId — the exact trap the READ
+         * variant above documents, and the reason anon self-read was never offered. Worse, it would put
+         * the row's address in the REQUEST, where a visitor could name another visitor's session.
+         *
+         * With no id, the custom implementation selects the row by `uuidRef` taken from the verified
+         * session JWT (`executionContext.anonymousUserId`). The selector is server-derived, so describing
+         * another visitor's decision is not expressible rather than merely refused.
+         *
+         * **This resource is its own scope ROOT**, so both repositories blacklist the anonymous axis and
+         * the contextual filter contributes NO predicate here (that is why LIST is super-admin). Nothing
+         * confines this write except the selector the implementation builds, which is why the selector is
+         * the thing under test.
+         *
+         * LOW risk: it writes one person's own privacy choice on a pre-identity row holding no account.
+         * `auditBelowRiskFloor` is what makes it leave a row anyway — the same declaration, and the same
+         * reasoning, as the UPDATE variant above and the lead's CREATE: buying the row by mis-declaring
+         * the verb's danger would corrupt the risk vocabulary every other control reads.
+         *
+         * Rate-limited per IP like the lead form, because it is a public unauthenticated write and an
+         * anonymous session is free to mint.
+         *
+         * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's own decision is recordable before
+         * they have an account, against the session it was made in.
+         */
+        [AnonymousUsers_Operations.RECORD_CONSENT]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ANONYMOUS],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE_MANY,
+                    requestDto: AnonymousUsersRecordConsentRequestDtoSchema,
+                    customResponseDto: AnonymousUsersRecordConsentResponseDtoSchema,
+                    rateLimit: {
+                        requestsPerMinute: 5,
+                        requestsPerHour: 30,
+                    },
+                    /*
+                     * Without this the operation answers 403 to the only caller it exists for (#1267), and the
+                     * gate that refuses it is RIGHT: a collection-shaped write on a scope root reads as an
+                     * unconfined DIRECTORY write, and `enforceApplicationWideReadAdmission` then demands a
+                     * two-person elevation no visitor can hold.
+                     *
+                     * The declaration says the missing half: this write IS confined, by
+                     * `createAnonymousConsentFactories`, to `{ uuidRef: executionContext.anonymousUserId }` —
+                     * the value the session JWT was verified to carry, never anything from the request. The
+                     * collection shape is a CONSEQUENCE of making the row unaddressable, not evidence that a
+                     * set is being written.
+                     *
+                     * That confinement is the obligation the flag creates, and it is pinned in
+                     * `anonymous-consent.custom-impl.backend.service.test.ts` with a hostile payload naming
+                     * another session in `uuidRef`, `_id` and `anonymousUserId`.
+                     */
+                    admitsSelfConfinedScopeRootWrite: true,
+                    /*
+                     * Map the REQUEST shape onto the RESOURCE shape before the pipeline validates it — the
+                     * `reset-to-defaults` idiom. The request names two purpose LISTS, which are not schema
+                     * paths; the service tier validates against the resource schema, so without this the whole
+                     * payload is unrecognised and the operation answers `service_resource_validation_failed`
+                     * (measured live, #1267).
+                     *
+                     * The intersection is applied HERE so the stored grants can never exceed what the same
+                     * request claims to have offered, whatever a later handler does with them. No
+                     * `consentDecidedAt`: the custom implementation stamps the server's clock through
+                     * `buildConsentDecisionPatch`, so a caller-authored instant cannot enter.
+                     */
+                    basicPrefixOperation: ({ inputDto }) => {
+                        const request = AnonymousUsersRecordConsentRequestDtoSchema.parse(inputDto);
+                        const offeredPurposes = normalizeConsentPurposes(request.offeredPurposes);
+                        return {
+                            privacy: {
+                                consentedPurposes: normalizeConsentPurposes(request.grantedPurposes)
+                                    .filter((purpose) => offeredPurposes.includes(purpose)),
+                                offeredPurposes,
+                            },
+                        };
+                    },
+                    // No `authoritativeFields`: the request contract is two purpose LISTS and carries no
+                    // `privacy` block, so there is no caller-supplied value to overwrite. The custom
+                    // implementation composes the stored block itself. Declaring one here would be a guard over
+                    // a field nothing can send — an untested claim that reads as protection.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                },
+            ],
+        },
+        /**
+         * A visitor's own public-document page tells the server it rendered — `NOTICE_DELIVERED`, the
+         * anonymous half of #1258 Step 5 / R11. Same shape as `RECORD_CONSENT` and the same reasons:
+         * public, unauthenticated, one collection-level write with no id in the URL, so the request
+         * cannot name a row. Unlike its sibling, this write touches NO row on this resource at all — it
+         * only needs the verified session identity to attribute a `GOVERNED_DOCUMENT_INTERACTION_RECORDED`
+         * audit row, via `recordGovernedDocumentNoticeDelivered`.
+         *
+         * Rate-limited per IP like its sibling: a public unauthenticated write, and an anonymous session
+         * is free to mint.
+         */
+        [AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ANONYMOUS],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE_MANY,
+                    requestDto: AnonymousUsersRecordNoticeDeliveredRequestDtoSchema,
+                    customResponseDto: AnonymousUsersRecordNoticeDeliveredResponseDtoSchema,
+                    rateLimit: {
+                        requestsPerMinute: 5,
+                        requestsPerHour: 30,
+                    },
+                    // Same obligation as `RECORD_CONSENT`, for the same reason (#1267): a collection-shaped
+                    // write on this scope-root resource is otherwise read as an unconfined directory write.
+                    // The custom implementation confines it to the verified session's own identity and writes
+                    // no row at all — nothing here is a directory write in substance, only in HTTP shape.
+                    admitsSelfConfinedScopeRootWrite: true,
+                    auditableEvent: { auditBelowRiskFloor: true },
+                },
+            ],
+        },
     },
 });
 //# sourceMappingURL=anonymous-users.shared.resources-config.schemas.js.map

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAC,MAAM,yDAAyD,GAAG,CACvE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,eAAe;IACpD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC7F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,iFAAiF;IACjF,6EAA6E;IAC7E,kFAAkF;IAClF,8EAA8E;IAC9E,sFAAsF;IACtF,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAChE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,6EAA6E;oBAC7E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,gFAAgF;oBAChF,gFAAgF;oBAChF,kEAAkE;oBAClE,iFAAiF;oBACjF,wFAAwF;oBACxF,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wGAAwG;oBACvJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser Resource Configuration (W7.3a)\n *\n * System resource — identity anchor for anonymous sessions.\n * CREATE, UPDATE, and DELETE are INTERNAL_CALL (managed by AnonymousSessionBackendService via service layer).\n * READ is admin-only (super-admin inspection). The anonymous session reaches its OWNED\n * data through the nested `/anonymous-users/{uuidRef}/…` routes (which filter\n * children by the `anonymousUserId` FK = `uuidRef`) and validates itself via the JWT —\n * it never reads its own AnonymousUser row. See the READ variant note for why anon\n * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).\n */\n\nimport { AnonymousUserSchema } from './anonymous-users.shared.schema';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport const anonymousUsersResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof AnonymousUserSchema\n>({\n  mainSchema: AnonymousUserSchema,\n  resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ANONYMOUS_USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Session-init (`AnonymousSessionBackendService.createAnonymousUser`) writes the\n  // first-touch `marketingMetadata` (`.isBackendOnly()`) and a client-supplied\n  // custom `_id` in-process, with no HTTP request context to survive the strict-DTO\n  // strip. `createAsSystem` re-attaches the backend-only field after the parse,\n  // fail-closed behind this opt-in. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Admin-only (super-admin inspection). Intentionally NOT anon-self-read: the\n          // framework resolves a direct read-by-identifier to `{ _id: <value> }`, but an\n          // anonymous session's identity is its client `uuidRef` (its `_id` is a server\n          // ObjectId), so a self-read would look up `{ _id: <uuidRef> }` and never match.\n          // The anonymous session never needs this — it reaches owned data via the nested\n          // `/anonymous-users/{uuidRef}/…` routes (children filtered by the\n          // `anonymousUserId` FK = `uuidRef`) and validates via the JWT. If anon self-read\n          // is ever required, implement it to resolve by `uuidRef` (custom read impl), not `_id`.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    /**\n     * APPLICATION-WIDE by design, and unconfined by construction — recorded 2026-08-12 because it\n     * previously said nothing, and silence is what this resource class keeps getting wrong.\n     *\n     * `anonymousUsers` is its own scope ROOT: `resourceFieldIdentifier` IS the ANONYMOUS scope's\n     * field, so both repositories blacklist that axis and this LIST compiles with no scope predicate\n     * (`base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep).\n     *\n     * Unlike `organizations`, that is CORRECT here rather than a hole, and the reason is semantic\n     * rather than a judgement call: an anonymous session is a pre-authentication visitor of the\n     * APPLICATION. It has no organization — there is no tenant to confine it to — so a \"confined\"\n     * anonymous listing would name a relationship that does not exist. `super-admin` is therefore\n     * the whole of the control, and it is the right one.\n     *\n     * ⚠️ If anonymous sessions ever gain a tenant association, this becomes an ORGANIZATIONS-axis\n     * question and `assignScopeRootCollectionConfinementToFilter` is where it is answered — that\n     * authority is deliberately scoped to the tenant axis today.\n     *\n     * The sibling decisions live in `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Application-wide by design — see the block above; there is no tenant to confine a pre-auth visitor to\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"anonymous-users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAIX;AAJD,WAAY,yBAAyB;IACnC,8DAAiC,CAAA;IACjC,sFAAsF;IACtF,gFAAmD,CAAA;AACrD,CAAC,EAJW,yBAAyB,KAAzB,yBAAyB,QAIpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SACrD,QAAQ,CAAC,qJAAqJ,CAAC;IAClK,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SAC5D,QAAQ,CAAC,iJAAiJ,CAAC;CAC/J,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC/C,QAAQ,CAAC,+GAA+G,CAAC;IAC5H,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC7C,QAAQ,CAAC,qEAAqE,CAAC;IAClF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC/D,QAAQ,CAAC,gEAAgE,CAAC;CAC9E,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAClC,QAAQ,CAAC,6NAA6N,CAAC;CAC3O,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;SAClB,QAAQ,CAAC,4LAA4L,CAAC;CAC1M,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,0BAA0B,CAAC,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,WAAW,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE,CAAC;AAE9K,0KAA0K;AAC1K,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,yDAAyD,GAAG,CACvE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,eAAe;IACpD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC7F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,iFAAiF;IACjF,6EAA6E;IAC7E,kFAAkF;IAClF,8EAA8E;IAC9E,sFAAsF;IACtF,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAChE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,yBAAyB;IAC1C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,6EAA6E;oBAC7E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,gFAAgF;oBAChF,gFAAgF;oBAChF,kEAAkE;oBAClE,iFAAiF;oBACjF,wFAAwF;oBACxF,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wGAAwG;oBACvJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,CAAC,yBAAyB,CAAC,cAAc,CAAC,EAAE;YAC1C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,2CAA2C;oBACvD,iBAAiB,EAAE,4CAA4C;oBAC/D,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD;;;;;;;;;;;;;;;uBAeG;oBACH,gCAAgC,EAAE,IAAI;oBACtC;;;;;;;;;;;uBAWG;oBACH,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACrC,MAAM,OAAO,GAAG,2CAA2C,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC1E,OAAO;4BACL,OAAO,EAAE;gCACP,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC;qCACjE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gCACzD,eAAe;6BAChB;yBACF,CAAC;oBACJ,CAAC;oBACD,qFAAqF;oBACrF,iFAAiF;oBACjF,4FAA4F;oBAC5F,yEAAyE;oBACzE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD;;;;;;;;;;WAUG;QACH,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,mDAAmD;oBAC/D,iBAAiB,EAAE,oDAAoD;oBACvE,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,wFAAwF;oBACxF,wFAAwF;oBACxF,0FAA0F;oBAC1F,sFAAsF;oBACtF,gCAAgC,EAAE,IAAI;oBACtC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser Resource Configuration (W7.3a)\n *\n * System resource — identity anchor for anonymous sessions.\n * CREATE, UPDATE, and DELETE are INTERNAL_CALL (managed by AnonymousSessionBackendService via service layer).\n * READ is admin-only (super-admin inspection). The anonymous session reaches its OWNED\n * data through the nested `/anonymous-users/{uuidRef}/…` routes (which filter\n * children by the `anonymousUserId` FK = `uuidRef`) and validates itself via the JWT —\n * it never reads its own AnonymousUser row. See the READ variant note for why anon\n * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).\n */\n\nimport { z } from 'zod';\n\nimport { AnonymousUserSchema } from './anonymous-users.shared.schema';\nimport { ConsentPurpose, normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourcesConfigNamingUtils } from '../resources/utils/resources-config-naming.utils';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * Custom operations on the anonymous identity anchor.\n *\n * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent\n * decision was declared on this resource's UPDATE — *\"a visitor's or a lead's consent decision is as\n * recordable as a member's\"* — while every operation here is `INTERNAL_CALL` or super-admin, so no\n * visitor could reach it. The recording contract was written for a door nobody built (#1258).\n */\nexport enum AnonymousUsers_Operations {\n  RECORD_CONSENT = 'record_consent',\n  /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */\n  RECORD_NOTICE_DELIVERED = 'record_notice_delivered',\n}\n\n/**\n * What a visitor's consent surface sends when they decide.\n *\n * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise\n *\n * A decision is `(granted subset-of offered, at an instant)` — see\n * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the\n * person saw, and the server does not know it: the marketing website is statically built and derives\n * its panel from its OWN live providers, which this backend never sees. So the client is the only\n * party that can state it.\n *\n * The blast radius is confined by construction, which is what makes that acceptable:\n *\n * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the\n *   request, so no visitor can describe another visitor's decision;\n * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes\n *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an\n *   account that has already decided;\n * - it grants no privilege a visitor does not already have — they may tick the same boxes on the\n *   application's own consent surface a minute later.\n *\n * The residual is a shared browser whose first visitor lies: the next person to register from it\n * starts with grants they did not make. That is the pre-existing shared-browser exposure of any\n * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.\n *\n * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same\n * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the\n * fact that a decision happened.\n */\nexport const AnonymousUsersRecordConsentRequestDtoSchema = z.object({\n  /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */\n  grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16)\n    .describe('Every purpose the visitor granted, as a complete set: a purpose left out is not granted. A purpose not also listed in `offeredPurposes` is ignored.'),\n  /** The purposes the surface actually put in front of them. What is absent was never asked. */\n  offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16)\n    .describe('The purposes the consent surface actually asked the visitor about. A purpose absent from this list is recorded as never asked, not as declined.'),\n});\n\nexport type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;\n\n/**\n * What the visitor gets back: their OWN decision, and nothing else.\n *\n * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`\n * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the\n * controller's response validation — measured live as `controller_resource_validation_failed` after\n * the write had already succeeded (#1267).\n *\n * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and\n * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`\n * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a\n * consent click would disclose more than the click.\n *\n * The decision itself IS safe to return to the session that just made it, and useful: a client can\n * reconcile what the server stored — including the instant, which the server owns — without a read\n * door on a resource whose READ is deliberately admin-only.\n */\nexport const AnonymousUsersRecordConsentResponseDtoSchema = z.object({\n  consentedPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes now recorded as granted for this anonymous session: the granted purposes that were also offered.'),\n  offeredPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes recorded as offered to the visitor with this decision.'),\n  consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional()\n    .describe(\"When the decision was recorded, taken from the server's clock.\"),\n});\n\nexport type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;\n\n/**\n * What a visitor's public-document page sends when a governed document renders for them (#1258 Step\n * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,\n * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers\n * have different security characteristics and each already has a proven pattern to reuse.\n *\n * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from\n * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to\n * have met a release that was never in force, or the wrong version of one that was.\n */\nexport const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({\n  documentRef: z.string().trim().min(1)\n    .describe('Reference of the governed document the visitor was shown, such as the privacy notice. The delivery is recorded against the release of that document currently in force, when one allows it; a client cannot name a version.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;\n\n/**\n * Declared rather than inherited, for the same reason as its consent sibling: a custom operation\n * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at\n * all, so there is no row to fail validation against — an explicit, minimal response avoids\n * reintroducing that trap by construction.\n *\n * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to\n * the audit trail against its in-force release, and `false` when nothing was written — no release of\n * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.\n * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,\n * and the caller does not act on it: the page has already been shown.\n */\nexport const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({\n  recorded: z.boolean()\n    .describe('Whether this showing of the document was recorded. `false` when no release of the document in force records deliveries, or the record could not be written; the page itself is unaffected.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;\n\n/**\n * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed\n * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,\n * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the\n * resource or operation identifier changes, on a public door nobody monitors.\n *\n * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that\n * carve (it cannot import the resources layer), and this door is reached only from the signed-out\n * pages of the APPLICATION itself, which already imports this package freely.\n */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH =\n  `/${ResourcesConfigNamingUtils.toKebabCase(CoreResourceType.ANONYMOUS_USERS)}/${ResourcesConfigNamingUtils.toKebabCase(AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED)}`;\n\n/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = 'PUT';\n\nexport const anonymousUsersResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<typeof AnonymousUsers_Operations,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof AnonymousUserSchema\n>({\n  mainSchema: AnonymousUserSchema,\n  resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ANONYMOUS_USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Session-init (`AnonymousSessionBackendService.createAnonymousUser`) writes the\n  // first-touch `marketingMetadata` (`.isBackendOnly()`) and a client-supplied\n  // custom `_id` in-process, with no HTTP request context to survive the strict-DTO\n  // strip. `createAsSystem` re-attaches the backend-only field after the parse,\n  // fail-closed behind this opt-in. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: AnonymousUsers_Operations,\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Admin-only (super-admin inspection). Intentionally NOT anon-self-read: the\n          // framework resolves a direct read-by-identifier to `{ _id: <value> }`, but an\n          // anonymous session's identity is its client `uuidRef` (its `_id` is a server\n          // ObjectId), so a self-read would look up `{ _id: <uuidRef> }` and never match.\n          // The anonymous session never needs this — it reaches owned data via the nested\n          // `/anonymous-users/{uuidRef}/…` routes (children filtered by the\n          // `anonymousUserId` FK = `uuidRef`) and validates via the JWT. If anon self-read\n          // is ever required, implement it to resolve by `uuidRef` (custom read impl), not `_id`.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    /**\n     * APPLICATION-WIDE by design, and unconfined by construction — recorded 2026-08-12 because it\n     * previously said nothing, and silence is what this resource class keeps getting wrong.\n     *\n     * `anonymousUsers` is its own scope ROOT: `resourceFieldIdentifier` IS the ANONYMOUS scope's\n     * field, so both repositories blacklist that axis and this LIST compiles with no scope predicate\n     * (`base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep).\n     *\n     * Unlike `organizations`, that is CORRECT here rather than a hole, and the reason is semantic\n     * rather than a judgement call: an anonymous session is a pre-authentication visitor of the\n     * APPLICATION. It has no organization — there is no tenant to confine it to — so a \"confined\"\n     * anonymous listing would name a relationship that does not exist. `super-admin` is therefore\n     * the whole of the control, and it is the right one.\n     *\n     * ⚠️ If anonymous sessions ever gain a tenant association, this becomes an ORGANIZATIONS-axis\n     * question and `assignScopeRootCollectionConfinementToFilter` is where it is answered — that\n     * authority is deliberately scoped to the tenant axis today.\n     *\n     * The sibling decisions live in `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Application-wide by design — see the block above; there is no tenant to confine a pre-auth visitor to\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    /**\n     * The visitor's own consent decision, recorded against their anonymous session (#1258).\n     *\n     * ## Why it is COLLECTION-level and carries no id\n     *\n     * `resourceOperationLike: UPDATE_MANY` puts it at the collection path with its own name segment\n     * and NO entity id — the `reset-features` shape. That is not a convenience: it is what keeps the\n     * door safe.\n     *\n     * An entity-addressed variant would resolve `{ _id: <value> }`, and an anonymous session's\n     * identity is its client `uuidRef` while its `_id` is a server ObjectId — the exact trap the READ\n     * variant above documents, and the reason anon self-read was never offered. Worse, it would put\n     * the row's address in the REQUEST, where a visitor could name another visitor's session.\n     *\n     * With no id, the custom implementation selects the row by `uuidRef` taken from the verified\n     * session JWT (`executionContext.anonymousUserId`). The selector is server-derived, so describing\n     * another visitor's decision is not expressible rather than merely refused.\n     *\n     * **This resource is its own scope ROOT**, so both repositories blacklist the anonymous axis and\n     * the contextual filter contributes NO predicate here (that is why LIST is super-admin). Nothing\n     * confines this write except the selector the implementation builds, which is why the selector is\n     * the thing under test.\n     *\n     * LOW risk: it writes one person's own privacy choice on a pre-identity row holding no account.\n     * `auditBelowRiskFloor` is what makes it leave a row anyway — the same declaration, and the same\n     * reasoning, as the UPDATE variant above and the lead's CREATE: buying the row by mis-declaring\n     * the verb's danger would corrupt the risk vocabulary every other control reads.\n     *\n     * Rate-limited per IP like the lead form, because it is a public unauthenticated write and an\n     * anonymous session is free to mint.\n     *\n     * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's own decision is recordable before\n     * they have an account, against the session it was made in.\n     */\n    [AnonymousUsers_Operations.RECORD_CONSENT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordConsentRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordConsentResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          /*\n           * Without this the operation answers 403 to the only caller it exists for (#1267), and the\n           * gate that refuses it is RIGHT: a collection-shaped write on a scope root reads as an\n           * unconfined DIRECTORY write, and `enforceApplicationWideReadAdmission` then demands a\n           * two-person elevation no visitor can hold.\n           *\n           * The declaration says the missing half: this write IS confined, by\n           * `createAnonymousConsentFactories`, to `{ uuidRef: executionContext.anonymousUserId }` —\n           * the value the session JWT was verified to carry, never anything from the request. The\n           * collection shape is a CONSEQUENCE of making the row unaddressable, not evidence that a\n           * set is being written.\n           *\n           * That confinement is the obligation the flag creates, and it is pinned in\n           * `anonymous-consent.custom-impl.backend.service.test.ts` with a hostile payload naming\n           * another session in `uuidRef`, `_id` and `anonymousUserId`.\n           */\n          admitsSelfConfinedScopeRootWrite: true,\n          /*\n           * Map the REQUEST shape onto the RESOURCE shape before the pipeline validates it — the\n           * `reset-to-defaults` idiom. The request names two purpose LISTS, which are not schema\n           * paths; the service tier validates against the resource schema, so without this the whole\n           * payload is unrecognised and the operation answers `service_resource_validation_failed`\n           * (measured live, #1267).\n           *\n           * The intersection is applied HERE so the stored grants can never exceed what the same\n           * request claims to have offered, whatever a later handler does with them. No\n           * `consentDecidedAt`: the custom implementation stamps the server's clock through\n           * `buildConsentDecisionPatch`, so a caller-authored instant cannot enter.\n           */\n          basicPrefixOperation: ({ inputDto }) => {\n            const request = AnonymousUsersRecordConsentRequestDtoSchema.parse(inputDto);\n            const offeredPurposes = normalizeConsentPurposes(request.offeredPurposes);\n            return {\n              privacy: {\n                consentedPurposes: normalizeConsentPurposes(request.grantedPurposes)\n                  .filter((purpose) => offeredPurposes.includes(purpose)),\n                offeredPurposes,\n              },\n            };\n          },\n          // No `authoritativeFields`: the request contract is two purpose LISTS and carries no\n          // `privacy` block, so there is no caller-supplied value to overwrite. The custom\n          // implementation composes the stored block itself. Declaring one here would be a guard over\n          // a field nothing can send — an untested claim that reads as protection.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    /**\n     * A visitor's own public-document page tells the server it rendered — `NOTICE_DELIVERED`, the\n     * anonymous half of #1258 Step 5 / R11. Same shape as `RECORD_CONSENT` and the same reasons:\n     * public, unauthenticated, one collection-level write with no id in the URL, so the request\n     * cannot name a row. Unlike its sibling, this write touches NO row on this resource at all — it\n     * only needs the verified session identity to attribute a `GOVERNED_DOCUMENT_INTERACTION_RECORDED`\n     * audit row, via `recordGovernedDocumentNoticeDelivered`.\n     *\n     * Rate-limited per IP like its sibling: a public unauthenticated write, and an anonymous session\n     * is free to mint.\n     */\n    [AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordNoticeDeliveredRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordNoticeDeliveredResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // Same obligation as `RECORD_CONSENT`, for the same reason (#1267): a collection-shaped\n          // write on this scope-root resource is otherwise read as an unconfined directory write.\n          // The custom implementation confines it to the verified session's own identity and writes\n          // no row at all — nothing here is a directory write in substance, only in HTTP shape.\n          admitsSelfConfinedScopeRootWrite: true,\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/anonymous-users.shared.schema.d.ts

@@ -8,9 +8,11 @@ export declare enum AnonymousUserTranspositionStatus {
 declare const _AnonymousUserSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     uuidRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
-    privacy: z.ZodObject<{
-        dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof import("..").DataProcessingConsent>>;
-    }, z.core.$strip>;
+    privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+        consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").ConsentPurpose>>>>;
+        offeredPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").ConsentPurpose>>>>;
+        consentDecidedAt: z.ZodOptional<z.ZodDate>;
+    }, z.core.$strip>>>;
     userAgent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     ipHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     marketingMetadata: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodObject<{

package/dist/esm/users/anonymous-users.shared.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.schema.d.ts","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,wEAAwE;AACxE,oBAAY,gCAAgC;IAC1C,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;iBAuExB,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,OAAO,oBAA2C,CAAC;AACrF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"anonymous-users.shared.schema.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,wEAAwE;AACxE,oBAAY,gCAAgC;IAC1C,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;iBAwFxB,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,OAAO,oBAA2C,CAAC;AACrF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/users/anonymous-users.shared.schema.js

@@ -54,7 +54,24 @@ const _AnonymousUserSchema = z.object({
      * holds it, and it grants only zero-value anonymous access).
      */
     uuidRef: z.string().min(1).isDBIndexed().isUnique({ scope: 'global', sparse: false }).excludeFromUpdate(),
-    privacy: AnonymousUserPrivacySchema,
+    /**
+     * The visitor's consent decision. CREATE cannot carry it: a session starts undecided, and the
+     * contract says so rather than trusting every caller to.
+     *
+     * A decision is written only by the doors that record it: the collection-level `record_consent`
+     * and the admin UPDATE, both of which emit an audit row
+     * (`evidence-requirement:consent-decision-transition-record` C2). CREATE sits below the automatic
+     * audit floor, so a consent value accepted there would be stored and leave no trace. That was not
+     * hypothetical: session start once wrote keys the schema did not have, and every visitor silently
+     * received a default consent level (#534). Excluding the block, rather than auditing every session
+     * start, states the truth (nothing is decided at creation) and costs no row per visitor.
+     *
+     * The default is exactly the "never asked" state: no grants, nothing offered, no decision instant.
+     *
+     * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a verb that cannot write a consent decision
+     * cannot write one silently.
+     */
+    privacy: AnonymousUserPrivacySchema.default(AnonymousUserPrivacySchema.parse({})).excludeFromCreate(),
     // An anonymous user IS a person — one without an account. This resource declares no
     // `exportSubject`, which is why a subject-export-based sweep misses it entirely; the categories are
     // owed regardless of whether the row is exportable.