@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/users/anonymous-users.shared.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.schema.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAE1G,wEAAwE;AACxE,MAAM,CAAN,IAAY,gCAIX;AAJD,WAAY,gCAAgC;IAC1C,uDAAmB,CAAA;IACnB,yDAAqB,CAAA;IACrB,uDAAmB,CAAA;AACrB,CAAC,EAJW,gCAAgC,KAAhC,gCAAgC,QAI3C;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,EAAE;IACzG,OAAO,EAAE,0BAA0B;IACnC,oFAAoF;IACpF,oGAAoG;IACpG,oDAAoD;IACpD,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5G;;;;;;;;OAQG;IACH,iBAAiB,EAAE,oCAAoC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;SAC/E,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC7C,wDAAwD;IACxD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACzF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;CAC/D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,oBAAoB,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { AnonymousUserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { AnonymousUserMarketingMetadataSchema } from \"./anonymous-user-marketing-metadata.shared.schemas\";\n\n/** W7.3a: Status of anonymous→authenticated ownership transposition. */\nexport enum AnonymousUserTranspositionStatus {\n  PENDING = 'pending',\n  COMPLETE = 'complete',\n  PARTIAL = 'partial',\n}\n\nconst _AnonymousUserSchema = z.object({\n  /**\n   * Server-minted MongoDB identity (ObjectId, surfaced as a hex string).\n   * `.isPrimaryKey()` = the standard server-generated primary key (composite:\n   * excludeFromCreate + hidden + unique + indexed), IDENTICAL to every other\n   * resource — which is what makes session-init a normal create (it is server-minted,\n   * so it is never in the create payload, so it never crashes the strict-DTO parse).\n   *\n   * This is a PURE internal storage id. It is NOT the anonymous user's relational\n   * identity: children (`draft-notes`, `inbound-contacts`) reference {@link uuidRef}\n   * via their `anonymousUserId` FK, the session JWT carries `uuidRef`, and the nested\n   * `/anonymous-users/{uuidRef}/…` routes key off `uuidRef` — never this `_id`.\n   * See {@link uuidRef} for why the relational identity is the client handle, not `_id`.\n   */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n  /**\n   * The anonymous user's RELATIONAL / business identity: a client-generated,\n   * unguessable UUID handle for the session (`crypto.randomUUID()` in the frontend\n   * `AnonymousSessionContext`). Everything client-facing keys off THIS, not `_id`:\n   * the `anonymousUserId` FK on child resources, the session JWT payload, the nested\n   * `/anonymous-users/{uuidRef}/draft-notes` URL param (+ its coherence check),\n   * and the cross-origin handoff. `_id` stays a pure internal DB storage id.\n   *\n   * Why the client generates it and why it is the identity (not `_id`):\n   * - **Cross-origin continuity**: a visitor starts on the marketing site\n   *   (`example.com`) and continues in the app (`app.example.com`) — two origins with\n   *   SEPARATE localStorage. The handle is generated client-side and handed across, so\n   *   the same anonymous user is resolved on both. It also survives page reload / the\n   *   24h JWT expiry (presented again at `x-anonymous-session-init` to re-resolve).\n   * - **Unguessable adoption handle**: presenting this value at init ADOPTS the\n   *   session, so it must be unguessable. A random UUID is; a server `_id`\n   *   (ObjectId = timestamp + counter) is partially enumerable — the wrong primitive.\n   * - **`_id` is a database concern**: the client value must never BE `_id`; it lives\n   *   here as an indexed, unique reference. Using one client-facing identity end-to-end\n   *   (rather than translating a client handle ⇄ a server `_id` at every seam) is why\n   *   children's `anonymousUserId` carries `uuidRef`.\n   *\n   * Set in-process by `AnonymousSessionBackendService.createAnonymousUser` from the\n   * validated init header. Unique-indexed for concurrent-tab / cross-origin\n   * create-or-resolve dedup. `.excludeFromUpdate()` — an immutable identity handle.\n   * Readable (not `.isBackendOnly()`) so the anonymous-session-cleanup batch can filter\n   * a user's children by it; it is not sensitive (the client that generated it already\n   * holds it, and it grants only zero-value anonymous access).\n   */\n  uuidRef: z.string().min(1).isDBIndexed().isUnique({ scope: 'global', sparse: false }).excludeFromUpdate(),\n  privacy: AnonymousUserPrivacySchema,\n  // An anonymous user IS a person — one without an account. This resource declares no\n  // `exportSubject`, which is why a subject-export-based sweep misses it entirely; the categories are\n  // owed regardless of whether the row is exportable.\n  //\n  // USAGE for the user agent (a device/browser observation), IDENTITY for the IP hash: hashing does\n  // not stop it identifying — it is a pseudonymous identifier, GDPR Art. 4(5), the same reading the\n  // audit row's `clientInstanceId` already carries. LOCATION alongside, because an IP narrows where\n  // the person is even when hashed against a rainbow-table attacker rather than against the operator.\n  userAgent: z.string().optional().dataCategories(PersonalDataCategory.USAGE),\n  ipHash: z.string().optional().dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.LOCATION]),\n  /**\n   * Phase 0.5 (Q-D=β): first-touch marketing attribution captured at\n   * session-init time and never overwritten. Lives here on the\n   * `AnonymousUser` (the session anchor) rather than on\n   * `InboundContact` (the conversion row) so we get attribution for\n   * sessions that convert via signup OR contact form OR not at all.\n   * `.isBackendOnly()` strips it from every client-facing response —\n   * marketing analytics joins via `anonymousUserId` server-side only.\n   */\n  marketingMetadata: AnonymousUserMarketingMetadataSchema.optional().isBackendOnly()\n    .dataCategories(PersonalDataCategory.USAGE),\n  /** W7.3a: Set when anonymous user registers/logs in. */\n  convertedToUserId: z.string().optional(),\n  transpositionStatus: z.enum(AnonymousUserTranspositionStatus).optional().isSummaryField(),\n  createdAt: z.date().default(() => new Date()).isSummaryField(),\n});\n\nexport const AnonymousUserSchema: typeof _AnonymousUserSchema = _AnonymousUserSchema;\nexport type AnonymousUser = z.infer<typeof _AnonymousUserSchema>;\n"]}
+{"version":3,"file":"anonymous-users.shared.schema.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAE1G,wEAAwE;AACxE,MAAM,CAAN,IAAY,gCAIX;AAJD,WAAY,gCAAgC;IAC1C,uDAAmB,CAAA;IACnB,yDAAqB,CAAA;IACrB,uDAAmB,CAAA;AACrB,CAAC,EAJW,gCAAgC,KAAhC,gCAAgC,QAI3C;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,EAAE;IACzG;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE;IACrG,oFAAoF;IACpF,oGAAoG;IACpG,oDAAoD;IACpD,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5G;;;;;;;;OAQG;IACH,iBAAiB,EAAE,oCAAoC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;SAC/E,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC7C,wDAAwD;IACxD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACzF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;CAC/D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,oBAAoB,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { AnonymousUserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { AnonymousUserMarketingMetadataSchema } from \"./anonymous-user-marketing-metadata.shared.schemas\";\n\n/** W7.3a: Status of anonymous→authenticated ownership transposition. */\nexport enum AnonymousUserTranspositionStatus {\n  PENDING = 'pending',\n  COMPLETE = 'complete',\n  PARTIAL = 'partial',\n}\n\nconst _AnonymousUserSchema = z.object({\n  /**\n   * Server-minted MongoDB identity (ObjectId, surfaced as a hex string).\n   * `.isPrimaryKey()` = the standard server-generated primary key (composite:\n   * excludeFromCreate + hidden + unique + indexed), IDENTICAL to every other\n   * resource — which is what makes session-init a normal create (it is server-minted,\n   * so it is never in the create payload, so it never crashes the strict-DTO parse).\n   *\n   * This is a PURE internal storage id. It is NOT the anonymous user's relational\n   * identity: children (`draft-notes`, `inbound-contacts`) reference {@link uuidRef}\n   * via their `anonymousUserId` FK, the session JWT carries `uuidRef`, and the nested\n   * `/anonymous-users/{uuidRef}/…` routes key off `uuidRef` — never this `_id`.\n   * See {@link uuidRef} for why the relational identity is the client handle, not `_id`.\n   */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n  /**\n   * The anonymous user's RELATIONAL / business identity: a client-generated,\n   * unguessable UUID handle for the session (`crypto.randomUUID()` in the frontend\n   * `AnonymousSessionContext`). Everything client-facing keys off THIS, not `_id`:\n   * the `anonymousUserId` FK on child resources, the session JWT payload, the nested\n   * `/anonymous-users/{uuidRef}/draft-notes` URL param (+ its coherence check),\n   * and the cross-origin handoff. `_id` stays a pure internal DB storage id.\n   *\n   * Why the client generates it and why it is the identity (not `_id`):\n   * - **Cross-origin continuity**: a visitor starts on the marketing site\n   *   (`example.com`) and continues in the app (`app.example.com`) — two origins with\n   *   SEPARATE localStorage. The handle is generated client-side and handed across, so\n   *   the same anonymous user is resolved on both. It also survives page reload / the\n   *   24h JWT expiry (presented again at `x-anonymous-session-init` to re-resolve).\n   * - **Unguessable adoption handle**: presenting this value at init ADOPTS the\n   *   session, so it must be unguessable. A random UUID is; a server `_id`\n   *   (ObjectId = timestamp + counter) is partially enumerable — the wrong primitive.\n   * - **`_id` is a database concern**: the client value must never BE `_id`; it lives\n   *   here as an indexed, unique reference. Using one client-facing identity end-to-end\n   *   (rather than translating a client handle ⇄ a server `_id` at every seam) is why\n   *   children's `anonymousUserId` carries `uuidRef`.\n   *\n   * Set in-process by `AnonymousSessionBackendService.createAnonymousUser` from the\n   * validated init header. Unique-indexed for concurrent-tab / cross-origin\n   * create-or-resolve dedup. `.excludeFromUpdate()` — an immutable identity handle.\n   * Readable (not `.isBackendOnly()`) so the anonymous-session-cleanup batch can filter\n   * a user's children by it; it is not sensitive (the client that generated it already\n   * holds it, and it grants only zero-value anonymous access).\n   */\n  uuidRef: z.string().min(1).isDBIndexed().isUnique({ scope: 'global', sparse: false }).excludeFromUpdate(),\n  /**\n   * The visitor's consent decision. CREATE cannot carry it: a session starts undecided, and the\n   * contract says so rather than trusting every caller to.\n   *\n   * A decision is written only by the doors that record it: the collection-level `record_consent`\n   * and the admin UPDATE, both of which emit an audit row\n   * (`evidence-requirement:consent-decision-transition-record` C2). CREATE sits below the automatic\n   * audit floor, so a consent value accepted there would be stored and leave no trace. That was not\n   * hypothetical: session start once wrote keys the schema did not have, and every visitor silently\n   * received a default consent level (#534). Excluding the block, rather than auditing every session\n   * start, states the truth (nothing is decided at creation) and costs no row per visitor.\n   *\n   * The default is exactly the \"never asked\" state: no grants, nothing offered, no decision instant.\n   *\n   * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a verb that cannot write a consent decision\n   * cannot write one silently.\n   */\n  privacy: AnonymousUserPrivacySchema.default(AnonymousUserPrivacySchema.parse({})).excludeFromCreate(),\n  // An anonymous user IS a person — one without an account. This resource declares no\n  // `exportSubject`, which is why a subject-export-based sweep misses it entirely; the categories are\n  // owed regardless of whether the row is exportable.\n  //\n  // USAGE for the user agent (a device/browser observation), IDENTITY for the IP hash: hashing does\n  // not stop it identifying — it is a pseudonymous identifier, GDPR Art. 4(5), the same reading the\n  // audit row's `clientInstanceId` already carries. LOCATION alongside, because an IP narrows where\n  // the person is even when hashed against a rainbow-table attacker rather than against the operator.\n  userAgent: z.string().optional().dataCategories(PersonalDataCategory.USAGE),\n  ipHash: z.string().optional().dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.LOCATION]),\n  /**\n   * Phase 0.5 (Q-D=β): first-touch marketing attribution captured at\n   * session-init time and never overwritten. Lives here on the\n   * `AnonymousUser` (the session anchor) rather than on\n   * `InboundContact` (the conversion row) so we get attribution for\n   * sessions that convert via signup OR contact form OR not at all.\n   * `.isBackendOnly()` strips it from every client-facing response —\n   * marketing analytics joins via `anonymousUserId` server-side only.\n   */\n  marketingMetadata: AnonymousUserMarketingMetadataSchema.optional().isBackendOnly()\n    .dataCategories(PersonalDataCategory.USAGE),\n  /** W7.3a: Set when anonymous user registers/logs in. */\n  convertedToUserId: z.string().optional(),\n  transpositionStatus: z.enum(AnonymousUserTranspositionStatus).optional().isSummaryField(),\n  createdAt: z.date().default(() => new Date()).isSummaryField(),\n});\n\nexport const AnonymousUserSchema: typeof _AnonymousUserSchema = _AnonymousUserSchema;\nexport type AnonymousUser = z.infer<typeof _AnonymousUserSchema>;\n"]}

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.d.ts

@@ -46,7 +46,8 @@ export declare const inboundContactsResourceConfiguration_InitializationFactory:
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDate>>>;
     privacy: import("zod").ZodObject<{
-        dataProcessingConsent: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("..").DataProcessingConsent>>;
+        consentedPurposes: import("zod").ZodDefault<import("zod").ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("..").ConsentPurpose>>>>;
+        consentDecidedAt: import("zod").ZodOptional<import("zod").ZodDate>;
     }, import("zod/v4/core").$strip>;
 }, import("zod/v4/core").$strip>>;
 //# sourceMappingURL=inbound-contacts.shared.resources-config.schemas.d.ts.map

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAG/C,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;iCA8J9C,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAI/C,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;iCAyL9C,CAAC"}

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.js

@@ -32,12 +32,14 @@
  * joins via `anonymousUserId`.
  */
 import { InboundContactSchema } from './inbound-contacts.shared.schemas.js';
+import { buildConsentDecisionPatch } from './user-consent-decision.shared.utils.js';
 import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
 import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier, } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { SubmissionChallengeAction } from '../security/submission-challenge/submission-challenge.shared.js';
 export const inboundContactsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: InboundContactSchema,
     resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,
@@ -117,6 +119,22 @@ export const inboundContactsResourceConfiguration_InitializationFactory = (resou
                         requestsPerMinute: 5,
                         requestsPerHour: 30,
                     },
+                    // …and, when the application declares a captcha provider, a visitor answers a challenge before the lead is
+                    // written (#1985): the engine asks it in `doOperation`, documents the header in the API reference, and refuses
+                    // an unanswered or refused submission with 400. The rate limit stays the primary control: a bot can always
+                    // choose the proof of work, which costs it milliseconds.
+                    submissionChallenge: { action: SubmissionChallengeAction.INBOUND_CONTACT },
+                    // The lead's marketing opt-in is a consent DECISION: the server stamps its instant (#534).
+                    basicPrefixOperation: ({ inputDto }) => buildConsentDecisionPatch(inputDto, undefined),
+                    authoritativeFields: ['privacy'],
+                    // …and a decision the server stamps must leave a row. LOW sits below the automatic
+                    // HIGH/CRITICAL floor, so without this the one consent a LEAD ever gives us was the one
+                    // consent nothing recorded. The declaration rather than a raised risk level, for the reason
+                    // the api-key reissue records: buying the row by mis-declaring the verb's danger corrupts the
+                    // risk vocabulary every other control reads. Only the marked decision leaves enter the
+                    // evidence, so the row carries the choice and not the lead's contact details.
+                    // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the lead's own decision is recordable.
+                    auditableEvent: { auditBelowRiskFloor: true },
                 },
                 /** @wildo_source:part:end example.rate-limit.resource-operation-surface */
             ],
@@ -169,6 +187,17 @@ export const inboundContactsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so
+                    // without this declaration the change would leave no row at all — and a consent change that
+                    // emits nothing is indistinguishable from no consent change, which is exactly what
+                    // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the
+                    // preference UPDATE doors: the declaration, never a raised risk level, because buying the row
+                    // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control
+                    // reads. Only the marked decision leaves (`consentedPurposes`) enter the
+                    // evidence, so the row carries the previous and resulting choice and not the whole block.
+                    // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision
+                    // is as recordable as a member's.
+                    auditableEvent: { auditBelowRiskFloor: true },
                 },
             ],
         },

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAU7C;IACA,UAAU,EAAE,oBAAoB;IAChC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kEAAkE;IAClE,qEAAqE;IACrE,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,oDAAoD;IACpD,kBAAkB,EAAE;QAChB,ydAAyd;QACzd,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAE/F;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,mIAAmI;gBACnI;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,kEAAkE;oBAClE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,iEAAiE;oBACjE,gBAAgB;oBAChB,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;iBACF;gBACD,2EAA2E;aAC5E;YACD,kEAAkE;YAClE,sEAAsE;YACtE,6DAA6D;YAC7D,0EAA0E;YAC1E,0EAA0E;YAC1E,4DAA4D;YAC5D,yEAAyE;YACzE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,gDAAgD;SACjD;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * InboundContact Resource Configuration (Phase 0.5, Q-E=B path)\n *\n * Lead-capture resource for the public marketing site.\n * APPLICATION-scope (anchored via the `ANONYMOUS_USERS → INBOUND_CONTACTS`\n * relationship row in `coreSharedResourceRelationship`), NO\n * `isAnonymizable: true` — the framework's anonymizable transposition\n * pipeline gates on USER_SELF semantics, but `INBOUND_CONTACTS` is\n * conceptually an org-owned admin resource. Transposition is handled\n * by a focused manual hook in `AnonymousSessionBackendService` that\n * UPDATEs `{ anonymousUserId } → { userId, anonymousUserId: null }`\n * when the lead converts to an authenticated user.\n *\n * Operations:\n * - CREATE       : public — `APP_ANONYMOUS` role, requires an active\n *                  anonymous session. Per-endpoint rate-limit declared\n *                  on the variant itself (5 req/min + 30 req/hour per IP),\n *                  enforced at the controller pre-flight seam by\n *                  `RateLimitBackendService.checkPolicyForVariant`\n *                  BEFORE execution-context creation.\n * - READ / LIST  : `APP_ADMIN_MARKETING_EDITOR` (admin marketing dashboard).\n * - SEARCH       : `APP_ADMIN_MARKETING_EDITOR`.\n * - UPDATE       : INTERNAL_CALL only — used by the manual transposition\n *                  hook in `AnonymousSessionBackendService` to set\n *                  `{ userId, anonymousUserId: null }` on lead conversion.\n *                  Not exposed as a public API (no admin-edit surface in\n *                  Phase 0.5 — leads are read-only in the dashboard).\n * - DELETE       : `APP_ADMIN_SUPER_ADMIN` (compliance / data-cleanup).\n *\n * Marketing attribution does NOT live on this row. First-touch\n * attribution is on `AnonymousUser.marketingMetadata` (Q-D=β); analytics\n * joins via `anonymousUserId`.\n */\n\nimport { InboundContactSchema } from './inbound-contacts.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport const inboundContactsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE,\n  typeof InboundContactSchema\n>({\n  mainSchema: InboundContactSchema,\n  resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_CONTACTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Lead-conversion transposition (`AnonymousSessionBackendService`\n  // .transposeInboundContactsOwnership) UPDATEs `{ anonymousUserId } →\n  // { userId, anonymousUserId: null }` in-process. Both FKs are context-auto-\n  // populated names the client-shaped request DTO strips, so a plain update is a\n  // silent no-op; `updateAsSystem` re-attaches them after the strict parse,\n  // fail-closed behind this opt-in. INBOUND_CONTACTS is APPLICATION-scoped (not\n  // `isAnonymizable`), so the grant is authored explicitly here rather than\n  // derived by the factory's anonymizable enrichment.\n  systemAccessPolicy: {\n      // Subject-export disclosure. Lead records the subject is the data subject of. ⚠️ Art. 15(4): if an app stores third-party notes ABOUT the subject on these rows, mark those fields `.isBackendOnly()` so the export's security floor withholds them. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the inbound contact.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: an inbound contact IS contact details — email, names, phone — and all\n   * are scrubbed. The row is retained because it may be the only record that a contact attempt\n   * happened, which an operator can legitimately need to account for, and once scrubbed it carries no\n   * personal datum.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject reaches this row through EITHER `userId` or `anonymousUserId` — an inbound contact can\n   * predate the account. `SELF_PRINCIPAL` names the person the row is about either way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the boot-time guard and then fails to resolve at erasure time.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        /** @wildo_source:part:start example.rate-limit.resource-operation-surface facet:kind:usage-example facet:audience:app-developer */\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Public anonymous CREATE — declares the per-IP rate-limit on the\n          // default API_CALL variant. Two windows (a short burst limit + an\n          // hourly cap) are AND-ed and enforced at the controller pre-flight\n          // seam; no bucket-key choice is needed here because IP is the only\n          // identity available before execution-context creation. The global\n          // HTTP limiter remains the safety net for any path that bypasses\n          // this surface.\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n        },\n        /** @wildo_source:part:end example.rate-limit.resource-operation-surface */\n      ],\n      // No `userNotifications` on CREATE. A Phase-0.5 draft declared an\n      // `INBOUND_CONTACT` + `EMAIL` notification, but the dispatcher has no\n      // email-by-target recipient resolution for `INBOUND_CONTACT`\n      // (`getUserIdsForTarget` falls through to `[]`, so the email was a silent\n      // no-op) and there is no template for it. `INBOUND_CONTACT` is wired only\n      // for the WEBSOCKET channel (admin in-app alerts) — declare\n      // `{ target: INBOUND_CONTACT, channel: WEBSOCKET }` here if an app wants\n      // that. For a visitor acknowledgement email, use the email-by-address\n      // path — `{ channel: EMAIL, recipientEmailField: 'email' }` (see\n      // `organization-member-invitations` CREATE). The paired resource spec\n      // asserts no email delivery; keep both in sync.\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8DAA8D,CAAC;AAEzG,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAU7C;IACA,UAAU,EAAE,oBAAoB;IAChC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kEAAkE;IAClE,qEAAqE;IACrE,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,oDAAoD;IACpD,kBAAkB,EAAE;QAChB,ydAAyd;QACzd,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAE/F;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,mIAAmI;gBACnI;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,kEAAkE;oBAClE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,iEAAiE;oBACjE,gBAAgB;oBAChB,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,2GAA2G;oBAC3G,+GAA+G;oBAC/G,2GAA2G;oBAC3G,yDAAyD;oBACzD,mBAAmB,EAAE,EAAE,MAAM,EAAE,yBAAyB,CAAC,eAAe,EAAE;oBAC1E,2FAA2F;oBAC3F,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC;oBACtF,mBAAmB,EAAE,CAAC,SAAS,CAAC;oBAChC,mFAAmF;oBACnF,wFAAwF;oBACxF,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,8EAA8E;oBAC9E,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;gBACD,2EAA2E;aAC5E;YACD,kEAAkE;YAClE,sEAAsE;YACtE,6DAA6D;YAC7D,0EAA0E;YAC1E,0EAA0E;YAC1E,4DAA4D;YAC5D,yEAAyE;YACzE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,gDAAgD;SACjD;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * InboundContact Resource Configuration (Phase 0.5, Q-E=B path)\n *\n * Lead-capture resource for the public marketing site.\n * APPLICATION-scope (anchored via the `ANONYMOUS_USERS → INBOUND_CONTACTS`\n * relationship row in `coreSharedResourceRelationship`), NO\n * `isAnonymizable: true` — the framework's anonymizable transposition\n * pipeline gates on USER_SELF semantics, but `INBOUND_CONTACTS` is\n * conceptually an org-owned admin resource. Transposition is handled\n * by a focused manual hook in `AnonymousSessionBackendService` that\n * UPDATEs `{ anonymousUserId } → { userId, anonymousUserId: null }`\n * when the lead converts to an authenticated user.\n *\n * Operations:\n * - CREATE       : public — `APP_ANONYMOUS` role, requires an active\n *                  anonymous session. Per-endpoint rate-limit declared\n *                  on the variant itself (5 req/min + 30 req/hour per IP),\n *                  enforced at the controller pre-flight seam by\n *                  `RateLimitBackendService.checkPolicyForVariant`\n *                  BEFORE execution-context creation.\n * - READ / LIST  : `APP_ADMIN_MARKETING_EDITOR` (admin marketing dashboard).\n * - SEARCH       : `APP_ADMIN_MARKETING_EDITOR`.\n * - UPDATE       : INTERNAL_CALL only — used by the manual transposition\n *                  hook in `AnonymousSessionBackendService` to set\n *                  `{ userId, anonymousUserId: null }` on lead conversion.\n *                  Not exposed as a public API (no admin-edit surface in\n *                  Phase 0.5 — leads are read-only in the dashboard).\n * - DELETE       : `APP_ADMIN_SUPER_ADMIN` (compliance / data-cleanup).\n *\n * Marketing attribution does NOT live on this row. First-touch\n * attribution is on `AnonymousUser.marketingMetadata` (Q-D=β); analytics\n * joins via `anonymousUserId`.\n */\n\nimport { InboundContactSchema } from './inbound-contacts.shared.schemas';\nimport { buildConsentDecisionPatch } from './user-consent-decision.shared.utils';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { SubmissionChallengeAction } from '../security/submission-challenge/submission-challenge.shared';\n\nexport const inboundContactsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE,\n  typeof InboundContactSchema\n>({\n  mainSchema: InboundContactSchema,\n  resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_CONTACTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Lead-conversion transposition (`AnonymousSessionBackendService`\n  // .transposeInboundContactsOwnership) UPDATEs `{ anonymousUserId } →\n  // { userId, anonymousUserId: null }` in-process. Both FKs are context-auto-\n  // populated names the client-shaped request DTO strips, so a plain update is a\n  // silent no-op; `updateAsSystem` re-attaches them after the strict parse,\n  // fail-closed behind this opt-in. INBOUND_CONTACTS is APPLICATION-scoped (not\n  // `isAnonymizable`), so the grant is authored explicitly here rather than\n  // derived by the factory's anonymizable enrichment.\n  systemAccessPolicy: {\n      // Subject-export disclosure. Lead records the subject is the data subject of. ⚠️ Art. 15(4): if an app stores third-party notes ABOUT the subject on these rows, mark those fields `.isBackendOnly()` so the export's security floor withholds them. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the inbound contact.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: an inbound contact IS contact details — email, names, phone — and all\n   * are scrubbed. The row is retained because it may be the only record that a contact attempt\n   * happened, which an operator can legitimately need to account for, and once scrubbed it carries no\n   * personal datum.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject reaches this row through EITHER `userId` or `anonymousUserId` — an inbound contact can\n   * predate the account. `SELF_PRINCIPAL` names the person the row is about either way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the boot-time guard and then fails to resolve at erasure time.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        /** @wildo_source:part:start example.rate-limit.resource-operation-surface facet:kind:usage-example facet:audience:app-developer */\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Public anonymous CREATE — declares the per-IP rate-limit on the\n          // default API_CALL variant. Two windows (a short burst limit + an\n          // hourly cap) are AND-ed and enforced at the controller pre-flight\n          // seam; no bucket-key choice is needed here because IP is the only\n          // identity available before execution-context creation. The global\n          // HTTP limiter remains the safety net for any path that bypasses\n          // this surface.\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // …and, when the application declares a captcha provider, a visitor answers a challenge before the lead is\n          // written (#1985): the engine asks it in `doOperation`, documents the header in the API reference, and refuses\n          // an unanswered or refused submission with 400. The rate limit stays the primary control: a bot can always\n          // choose the proof of work, which costs it milliseconds.\n          submissionChallenge: { action: SubmissionChallengeAction.INBOUND_CONTACT },\n          // The lead's marketing opt-in is a consent DECISION: the server stamps its instant (#534).\n          basicPrefixOperation: ({ inputDto }) => buildConsentDecisionPatch(inputDto, undefined),\n          authoritativeFields: ['privacy'],\n          // …and a decision the server stamps must leave a row. LOW sits below the automatic\n          // HIGH/CRITICAL floor, so without this the one consent a LEAD ever gives us was the one\n          // consent nothing recorded. The declaration rather than a raised risk level, for the reason\n          // the api-key reissue records: buying the row by mis-declaring the verb's danger corrupts the\n          // risk vocabulary every other control reads. Only the marked decision leaves enter the\n          // evidence, so the row carries the choice and not the lead's contact details.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the lead's own decision is recordable.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n        /** @wildo_source:part:end example.rate-limit.resource-operation-surface */\n      ],\n      // No `userNotifications` on CREATE. A Phase-0.5 draft declared an\n      // `INBOUND_CONTACT` + `EMAIL` notification, but the dispatcher has no\n      // email-by-target recipient resolution for `INBOUND_CONTACT`\n      // (`getUserIdsForTarget` falls through to `[]`, so the email was a silent\n      // no-op) and there is no template for it. `INBOUND_CONTACT` is wired only\n      // for the WEBSOCKET channel (admin in-app alerts) — declare\n      // `{ target: INBOUND_CONTACT, channel: WEBSOCKET }` here if an app wants\n      // that. For a visitor acknowledgement email, use the email-by-address\n      // path — `{ channel: EMAIL, recipientEmailField: 'email' }` (see\n      // `organization-member-invitations` CREATE). The paired resource spec\n      // asserts no email delivery; keep both in sync.\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts

@@ -46,7 +46,8 @@ export declare const InboundContactSchema: z.ZodObject<{
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
     privacy: z.ZodObject<{
-        dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof import("..").DataProcessingConsent>>;
+        consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").ConsentPurpose>>>>;
+        consentDecidedAt: z.ZodOptional<z.ZodDate>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type InboundContact = z.infer<typeof InboundContactSchema>;

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;iBA4G/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBA4G/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/users/user-consent-decision.shared.utils.d.ts

@@ -0,0 +1,127 @@
+import type { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';
+/**
+ * Any record carrying a consent `privacy` block — user preferences, an inbound contact, an anonymous
+ * visitor. Structural on purpose: the rule below is the same for every holder, and a per-resource
+ * copy is how two doors come to disagree about when a decision happened.
+ */
+export interface ConsentDecisionHolder {
+    privacy?: {
+        consentedPurposes?: readonly (ConsentPurpose | string)[];
+        consentDecidedAt?: Date | string;
+        [otherPrivacyField: string]: unknown;
+    };
+}
+/**
+ * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of
+ * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there
+ * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.
+ *
+ * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller
+ *
+ * It records WHEN a person made an affirmative consent choice, and it is what separates "declined
+ * everything" from "was never asked". A client-authored instant would let any caller backdate or
+ * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and
+ * the recorded instant is the server's clock.
+ *
+ * ## When a write counts as a decision
+ *
+ * - The purpose SET changed → a decision. Always stamped.
+ * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an
+ *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.
+ * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.
+ *   This is the ordinary preferences form re-submitting every field while the person edited something
+ *   else; stamping there would fabricate a consent choice nobody made.
+ *
+ * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a
+ * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the
+ * returned block carries the STORED purposes and instant forward.
+ * Without that, the write would replace the whole `privacy` object and the stored consent would be lost
+ * while reading as a withdrawal (#534 review F1).
+ *
+ * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —
+ * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the
+ * purpose set it accompanies is audit evidence on the same UPDATE.
+ */
+export declare function buildConsentDecisionPatch<THolder extends ConsentDecisionHolder>(input: Partial<THolder> | undefined, current: THolder | undefined, now?: Date): Partial<THolder>;
+/**
+ * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW
+ * purposes on a person's behalf — honouring a withdrawal request received another way — but may never
+ * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same
+ * server-stamped instant as the person's own choice and could not be told apart from it.
+ *
+ * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision
+ * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch
+ * consent — passes through unchanged.
+ */
+export declare function buildAdministratorConsentDecisionPatch<THolder extends ConsentDecisionHolder>(input: Partial<THolder> | undefined, current: THolder | undefined, now?: Date): Partial<THolder>;
+/**
+ * What an anonymous visitor's consent decision contributes to the account they just became (#1258).
+ *
+ * ## The one thing that dies at this boundary today
+ *
+ * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their
+ * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.
+ * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,
+ * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves
+ * neither. So a visitor who declines analytics on the marketing site is asked again inside the
+ * application, and under a declared service-consent requirement is BLOCKED there, over a question they
+ * answered minutes earlier.
+ *
+ * ## Why this takes `applicationAsks` and not just two privacy blocks
+ *
+ * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see
+ * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different
+ * questions. `consentDecidedAt` is read everywhere as *"this person was asked and answered"*, so
+ * stamping it when the visitor's surface offered LESS than the application asks would record a
+ * decision about a purpose nobody displayed, and the application would stop prompting for it.
+ *
+ * Hence the split outcome, which is the whole design:
+ *
+ * | the visitor was offered | what carries |
+ * |---|---|
+ * | everything this application asks | grants **and** the decision instant — nothing more to ask |
+ * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |
+ * | nothing (never asked) | nothing |
+ *
+ * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.
+ *
+ * ## The account always wins, and that is what makes a shared browser safe
+ *
+ * An account that has already recorded a decision receives NOTHING: their own answer stands, and a
+ * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp
+ * an instant, the residual risk of a shared browser — visitor A decides, does not register, and
+ * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited
+ * decision: B is still ASKED, and their answer replaces the seed.
+ *
+ * ## Defensive, because the anonymous row is written by a public door
+ *
+ * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That
+ * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a
+ * caller's claim about their own decision; only their intersection is a statement this function is
+ * willing to repeat onto an identified person.
+ *
+ * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,
+ * which the framework merges as a no-op.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto
+ * the person it belonged to, with its own instant, and never widened past what they were shown.
+ */
+export declare function buildAnonymousConsentCarryPatch<THolder extends ConsentDecisionHolder>(params: {
+    /** The converting visitor's `AnonymousUser.privacy`. */
+    readonly anonymous: {
+        readonly consentedPurposes?: readonly (ConsentPurpose | string)[];
+        readonly offeredPurposes?: readonly (ConsentPurpose | string)[];
+        readonly consentDecidedAt?: Date | string;
+    } | undefined;
+    /** The account's current privacy block, or undefined when it has none. */
+    readonly account: ConsentDecisionHolder['privacy'] | undefined;
+    /**
+     * The purposes this application's own consent surface would put to the person — the gate's
+     * `optionalPurposes` plus anything it requires. Passing an empty list means the application asks
+     * nothing, so a carried decision is complete by definition.
+     */
+    readonly applicationAsks: readonly (ConsentPurpose | string)[];
+}): Partial<THolder>;
+//# sourceMappingURL=user-consent-decision.shared.utils.d.ts.map

package/dist/esm/users/user-consent-decision.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-consent-decision.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QACzD,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QACjC,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;KACtC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,SAAS,qBAAqB,EAC7E,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAyClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CAAC,OAAO,SAAS,qBAAqB,EAC1F,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,qBAAqB,EAAE,MAAM,EAAE;IAC7F,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;KAC3C,GAAG,SAAS,CAAC;IACd,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;CAChE,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCnB"}

package/dist/esm/users/user-consent-decision.shared.utils.js

@@ -0,0 +1,189 @@
+import { ZodError } from 'zod';
+import { normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared.js';
+/**
+ * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of
+ * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there
+ * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.
+ *
+ * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller
+ *
+ * It records WHEN a person made an affirmative consent choice, and it is what separates "declined
+ * everything" from "was never asked". A client-authored instant would let any caller backdate or
+ * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and
+ * the recorded instant is the server's clock.
+ *
+ * ## When a write counts as a decision
+ *
+ * - The purpose SET changed → a decision. Always stamped.
+ * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an
+ *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.
+ * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.
+ *   This is the ordinary preferences form re-submitting every field while the person edited something
+ *   else; stamping there would fabricate a consent choice nobody made.
+ *
+ * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a
+ * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the
+ * returned block carries the STORED purposes and instant forward.
+ * Without that, the write would replace the whole `privacy` object and the stored consent would be lost
+ * while reading as a withdrawal (#534 review F1).
+ *
+ * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —
+ * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the
+ * purpose set it accompanies is audit evidence on the same UPDATE.
+ */
+export function buildConsentDecisionPatch(input, current, now = new Date()) {
+    const incoming = input?.privacy;
+    if (incoming === undefined)
+        return {};
+    const currentPrivacy = current?.privacy;
+    if (incoming.consentedPurposes === undefined) {
+        const carried = {
+            ...(currentPrivacy ?? {}),
+            ...incoming,
+            consentedPurposes: normalizeConsentPurposes(currentPrivacy?.consentedPurposes),
+        };
+        // A caller-sent instant without a purpose set is not a decision; the stored instant stands.
+        if (currentPrivacy?.consentDecidedAt !== undefined)
+            carried.consentDecidedAt = currentPrivacy.consentDecidedAt;
+        else
+            delete carried.consentDecidedAt;
+        return { privacy: carried };
+    }
+    const nextPurposes = normalizeConsentPurposes(incoming.consentedPurposes);
+    const previousPurposes = normalizeConsentPurposes(currentPrivacy?.consentedPurposes);
+    const setChanged = nextPurposes.length !== previousPurposes.length
+        || nextPurposes.some((purpose, index) => purpose !== previousPurposes[index]);
+    const claimedAt = incoming.consentDecidedAt === undefined ? undefined : new Date(incoming.consentDecidedAt).getTime();
+    const storedAt = currentPrivacy?.consentDecidedAt === undefined ? undefined : new Date(currentPrivacy.consentDecidedAt).getTime();
+    const explicitReconfirmation = claimedAt !== undefined && claimedAt !== storedAt;
+    const decided = setChanged || explicitReconfirmation;
+    const privacy = {
+        ...(currentPrivacy ?? {}),
+        ...incoming,
+        consentedPurposes: nextPurposes,
+    };
+    if (decided) {
+        privacy.consentDecidedAt = now;
+    }
+    else if (currentPrivacy?.consentDecidedAt !== undefined) {
+        privacy.consentDecidedAt = currentPrivacy.consentDecidedAt;
+    }
+    else {
+        delete privacy.consentDecidedAt;
+    }
+    return { privacy };
+}
+/**
+ * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW
+ * purposes on a person's behalf — honouring a withdrawal request received another way — but may never
+ * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same
+ * server-stamped instant as the person's own choice and could not be told apart from it.
+ *
+ * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision
+ * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch
+ * consent — passes through unchanged.
+ */
+export function buildAdministratorConsentDecisionPatch(input, current, now = new Date()) {
+    const requested = input?.privacy?.consentedPurposes;
+    if (requested !== undefined) {
+        const stored = normalizeConsentPurposes(current?.privacy?.consentedPurposes);
+        const added = normalizeConsentPurposes(requested).filter((purpose) => !stored.includes(purpose));
+        if (added.length > 0) {
+            throw new ZodError([{
+                    code: 'custom',
+                    path: ['privacy', 'consentedPurposes'],
+                    message: `An administrator may withdraw consent purposes but cannot grant them on a person's behalf; refused: ${added.join(', ')}.`,
+                    input: requested,
+                }]);
+        }
+    }
+    return buildConsentDecisionPatch(input, current, now);
+}
+/**
+ * What an anonymous visitor's consent decision contributes to the account they just became (#1258).
+ *
+ * ## The one thing that dies at this boundary today
+ *
+ * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their
+ * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.
+ * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,
+ * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves
+ * neither. So a visitor who declines analytics on the marketing site is asked again inside the
+ * application, and under a declared service-consent requirement is BLOCKED there, over a question they
+ * answered minutes earlier.
+ *
+ * ## Why this takes `applicationAsks` and not just two privacy blocks
+ *
+ * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see
+ * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different
+ * questions. `consentDecidedAt` is read everywhere as *"this person was asked and answered"*, so
+ * stamping it when the visitor's surface offered LESS than the application asks would record a
+ * decision about a purpose nobody displayed, and the application would stop prompting for it.
+ *
+ * Hence the split outcome, which is the whole design:
+ *
+ * | the visitor was offered | what carries |
+ * |---|---|
+ * | everything this application asks | grants **and** the decision instant — nothing more to ask |
+ * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |
+ * | nothing (never asked) | nothing |
+ *
+ * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.
+ *
+ * ## The account always wins, and that is what makes a shared browser safe
+ *
+ * An account that has already recorded a decision receives NOTHING: their own answer stands, and a
+ * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp
+ * an instant, the residual risk of a shared browser — visitor A decides, does not register, and
+ * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited
+ * decision: B is still ASKED, and their answer replaces the seed.
+ *
+ * ## Defensive, because the anonymous row is written by a public door
+ *
+ * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That
+ * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a
+ * caller's claim about their own decision; only their intersection is a statement this function is
+ * willing to repeat onto an identified person.
+ *
+ * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,
+ * which the framework merges as a no-op.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto
+ * the person it belonged to, with its own instant, and never widened past what they were shown.
+ */
+export function buildAnonymousConsentCarryPatch(params) {
+    const { anonymous, account, applicationAsks } = params;
+    // Never asked, or asked nothing: there is no decision to carry, and seeding grants from a
+    // non-decision would invent one.
+    if (anonymous?.consentDecidedAt === undefined)
+        return {};
+    const offered = normalizeConsentPurposes(anonymous.offeredPurposes);
+    if (offered.length === 0)
+        return {};
+    // The account's own answer stands. `consentDecidedAt` is the decision marker; a non-empty grant set
+    // is checked too, so a row that somehow holds grants without an instant is still not overwritten.
+    const accountDecided = account?.consentDecidedAt !== undefined
+        || normalizeConsentPurposes(account?.consentedPurposes).length > 0;
+    if (accountDecided)
+        return {};
+    // Only what the visitor was actually shown AND granted.
+    const carriedGrants = normalizeConsentPurposes(anonymous.consentedPurposes).filter((purpose) => offered.includes(purpose));
+    const asked = normalizeConsentPurposes(applicationAsks);
+    const coversEverythingAsked = asked.every((purpose) => offered.includes(purpose));
+    const privacy = {
+        ...(account ?? {}),
+        consentedPurposes: carriedGrants,
+    };
+    if (coversEverythingAsked) {
+        // The visitor's own instant, not the carry's: the moment they decided is the fact being recorded.
+        privacy.consentDecidedAt = new Date(anonymous.consentDecidedAt);
+    }
+    else {
+        // Seed the grants and leave the question open, so the application still prompts.
+        delete privacy.consentDecidedAt;
+    }
+    return { privacy };
+}
+//# sourceMappingURL=user-consent-decision.shared.utils.js.map

package/dist/esm/users/user-consent-decision.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-consent-decision.shared.utils.js","sourceRoot":"","sources":["../../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAgBzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAO,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,cAAc,GAAG,OAAO,EAAE,OAAO,CAAC;IACxC,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAkD;YAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YACzB,GAAG,QAAQ;YACX,iBAAiB,EAAE,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC;SAC/E,CAAC;QACF,4FAA4F;QAC5F,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS;YAAE,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;;YAC1G,OAAO,OAAO,CAAC,gBAAgB,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAsB,CAAC;IAClD,CAAC;IAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;WAC7D,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACvI,MAAM,QAAQ,GAAG,cAAc,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnJ,MAAM,sBAAsB,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC;IAEjF,MAAM,OAAO,GAAG,UAAU,IAAI,sBAAsB,CAAC;IACrD,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzB,GAAG,QAAQ;QACX,iBAAiB,EAAE,YAAY;KAChC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACjC,CAAC;SAAM,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CACpD,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,SAAS,GAAG,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC;IACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,CAAC;oBAClB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;oBACtC,OAAO,EAAE,uGAAuG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACnI,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,+BAA+B,CAAwC,MAetF;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEvD,0FAA0F;IAC1F,iCAAiC;IACjC,IAAI,SAAS,EAAE,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,wBAAwB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,oGAAoG;IACpG,kGAAkG;IAClG,MAAM,cAAc,GAAG,OAAO,EAAE,gBAAgB,KAAK,SAAS;WACzD,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,IAAI,cAAc;QAAE,OAAO,EAAE,CAAC;IAE9B,wDAAwD;IACxD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3H,MAAM,KAAK,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClB,iBAAiB,EAAE,aAAa;KACjC,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,kGAAkG;QAClG,OAAO,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,iFAAiF;QACjF,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC","sourcesContent":["import { ZodError } from 'zod';\n\nimport { normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport type { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';\n\n/**\n * Any record carrying a consent `privacy` block — user preferences, an inbound contact, an anonymous\n * visitor. Structural on purpose: the rule below is the same for every holder, and a per-resource\n * copy is how two doors come to disagree about when a decision happened.\n */\nexport interface ConsentDecisionHolder {\n  privacy?: {\n    consentedPurposes?: readonly (ConsentPurpose | string)[];\n    consentDecidedAt?: Date | string;\n    [otherPrivacyField: string]: unknown;\n  };\n}\n\n/**\n * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of\n * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there\n * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.\n *\n * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller\n *\n * It records WHEN a person made an affirmative consent choice, and it is what separates \"declined\n * everything\" from \"was never asked\". A client-authored instant would let any caller backdate or\n * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and\n * the recorded instant is the server's clock.\n *\n * ## When a write counts as a decision\n *\n * - The purpose SET changed → a decision. Always stamped.\n * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an\n *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.\n * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.\n *   This is the ordinary preferences form re-submitting every field while the person edited something\n *   else; stamping there would fabricate a consent choice nobody made.\n *\n * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a\n * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the\n * returned block carries the STORED purposes and instant forward.\n * Without that, the write would replace the whole `privacy` object and the stored consent would be lost\n * while reading as a withdrawal (#534 review F1).\n *\n * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —\n * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the\n * purpose set it accompanies is audit evidence on the same UPDATE.\n */\nexport function buildConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n  input: Partial<THolder> | undefined,\n  current: THolder | undefined,\n  now: Date = new Date(),\n): Partial<THolder> {\n  const incoming = input?.privacy;\n  if (incoming === undefined) return {};\n\n  const currentPrivacy = current?.privacy;\n  if (incoming.consentedPurposes === undefined) {\n    const carried: NonNullable<ConsentDecisionHolder['privacy']> = {\n      ...(currentPrivacy ?? {}),\n      ...incoming,\n      consentedPurposes: normalizeConsentPurposes(currentPrivacy?.consentedPurposes),\n    };\n    // A caller-sent instant without a purpose set is not a decision; the stored instant stands.\n    if (currentPrivacy?.consentDecidedAt !== undefined) carried.consentDecidedAt = currentPrivacy.consentDecidedAt;\n    else delete carried.consentDecidedAt;\n    return { privacy: carried } as Partial<THolder>;\n  }\n\n  const nextPurposes = normalizeConsentPurposes(incoming.consentedPurposes);\n  const previousPurposes = normalizeConsentPurposes(currentPrivacy?.consentedPurposes);\n\n  const setChanged = nextPurposes.length !== previousPurposes.length\n    || nextPurposes.some((purpose, index) => purpose !== previousPurposes[index]);\n  const claimedAt = incoming.consentDecidedAt === undefined ? undefined : new Date(incoming.consentDecidedAt as Date | string).getTime();\n  const storedAt = currentPrivacy?.consentDecidedAt === undefined ? undefined : new Date(currentPrivacy.consentDecidedAt as Date | string).getTime();\n  const explicitReconfirmation = claimedAt !== undefined && claimedAt !== storedAt;\n\n  const decided = setChanged || explicitReconfirmation;\n  const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n    ...(currentPrivacy ?? {}),\n    ...incoming,\n    consentedPurposes: nextPurposes,\n  };\n  if (decided) {\n    privacy.consentDecidedAt = now;\n  } else if (currentPrivacy?.consentDecidedAt !== undefined) {\n    privacy.consentDecidedAt = currentPrivacy.consentDecidedAt;\n  } else {\n    delete privacy.consentDecidedAt;\n  }\n\n  return { privacy } as Partial<THolder>;\n}\n\n/**\n * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW\n * purposes on a person's behalf — honouring a withdrawal request received another way — but may never\n * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same\n * server-stamped instant as the person's own choice and could not be told apart from it.\n *\n * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision\n * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch\n * consent — passes through unchanged.\n */\nexport function buildAdministratorConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n  input: Partial<THolder> | undefined,\n  current: THolder | undefined,\n  now: Date = new Date(),\n): Partial<THolder> {\n  const requested = input?.privacy?.consentedPurposes;\n  if (requested !== undefined) {\n    const stored = normalizeConsentPurposes(current?.privacy?.consentedPurposes);\n    const added = normalizeConsentPurposes(requested).filter((purpose) => !stored.includes(purpose));\n    if (added.length > 0) {\n      throw new ZodError([{\n        code: 'custom',\n        path: ['privacy', 'consentedPurposes'],\n        message: `An administrator may withdraw consent purposes but cannot grant them on a person's behalf; refused: ${added.join(', ')}.`,\n        input: requested,\n      }]);\n    }\n  }\n  return buildConsentDecisionPatch(input, current, now);\n}\n\n/**\n * What an anonymous visitor's consent decision contributes to the account they just became (#1258).\n *\n * ## The one thing that dies at this boundary today\n *\n * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their\n * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.\n * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,\n * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves\n * neither. So a visitor who declines analytics on the marketing site is asked again inside the\n * application, and under a declared service-consent requirement is BLOCKED there, over a question they\n * answered minutes earlier.\n *\n * ## Why this takes `applicationAsks` and not just two privacy blocks\n *\n * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see\n * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different\n * questions. `consentDecidedAt` is read everywhere as *\"this person was asked and answered\"*, so\n * stamping it when the visitor's surface offered LESS than the application asks would record a\n * decision about a purpose nobody displayed, and the application would stop prompting for it.\n *\n * Hence the split outcome, which is the whole design:\n *\n * | the visitor was offered | what carries |\n * |---|---|\n * | everything this application asks | grants **and** the decision instant — nothing more to ask |\n * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |\n * | nothing (never asked) | nothing |\n *\n * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.\n *\n * ## The account always wins, and that is what makes a shared browser safe\n *\n * An account that has already recorded a decision receives NOTHING: their own answer stands, and a\n * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp\n * an instant, the residual risk of a shared browser — visitor A decides, does not register, and\n * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited\n * decision: B is still ASKED, and their answer replaces the seed.\n *\n * ## Defensive, because the anonymous row is written by a public door\n *\n * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That\n * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a\n * caller's claim about their own decision; only their intersection is a statement this function is\n * willing to repeat onto an identified person.\n *\n * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,\n * which the framework merges as a no-op.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto\n * the person it belonged to, with its own instant, and never widened past what they were shown.\n */\nexport function buildAnonymousConsentCarryPatch<THolder extends ConsentDecisionHolder>(params: {\n  /** The converting visitor's `AnonymousUser.privacy`. */\n  readonly anonymous: {\n    readonly consentedPurposes?: readonly (ConsentPurpose | string)[];\n    readonly offeredPurposes?: readonly (ConsentPurpose | string)[];\n    readonly consentDecidedAt?: Date | string;\n  } | undefined;\n  /** The account's current privacy block, or undefined when it has none. */\n  readonly account: ConsentDecisionHolder['privacy'] | undefined;\n  /**\n   * The purposes this application's own consent surface would put to the person — the gate's\n   * `optionalPurposes` plus anything it requires. Passing an empty list means the application asks\n   * nothing, so a carried decision is complete by definition.\n   */\n  readonly applicationAsks: readonly (ConsentPurpose | string)[];\n}): Partial<THolder> {\n  const { anonymous, account, applicationAsks } = params;\n\n  // Never asked, or asked nothing: there is no decision to carry, and seeding grants from a\n  // non-decision would invent one.\n  if (anonymous?.consentDecidedAt === undefined) return {};\n  const offered = normalizeConsentPurposes(anonymous.offeredPurposes);\n  if (offered.length === 0) return {};\n\n  // The account's own answer stands. `consentDecidedAt` is the decision marker; a non-empty grant set\n  // is checked too, so a row that somehow holds grants without an instant is still not overwritten.\n  const accountDecided = account?.consentDecidedAt !== undefined\n    || normalizeConsentPurposes(account?.consentedPurposes).length > 0;\n  if (accountDecided) return {};\n\n  // Only what the visitor was actually shown AND granted.\n  const carriedGrants = normalizeConsentPurposes(anonymous.consentedPurposes).filter((purpose) => offered.includes(purpose));\n\n  const asked = normalizeConsentPurposes(applicationAsks);\n  const coversEverythingAsked = asked.every((purpose) => offered.includes(purpose));\n\n  const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n    ...(account ?? {}),\n    consentedPurposes: carriedGrants,\n  };\n  if (coversEverythingAsked) {\n    // The visitor's own instant, not the carry's: the moment they decided is the fact being recorded.\n    privacy.consentDecidedAt = new Date(anonymous.consentDecidedAt);\n  } else {\n    // Seed the grants and leave the question open, so the application still prompts.\n    delete privacy.consentDecidedAt;\n  }\n\n  return { privacy } as Partial<THolder>;\n}\n"]}

package/dist/esm/users/user-credentials.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsH9C,CAAC"}
+{"version":3,"file":"user-credentials.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsH9C,CAAC"}

package/dist/esm/users/user-credentials.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAK/F;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAWvC,CAAC;AAGH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2FhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"user-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAK/F;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAWvC,CAAC;AAGH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2FhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts

@@ -20,6 +20,7 @@ export declare const userIdentityLinksResourceConfiguration_InitializationFactor
     providerDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     providerAvatarUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>>;
+    scimExternalId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     scopeType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodEnum<typeof import("..").AuthScopeType>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}
+{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}

package/dist/esm/users/user-identity-links.shared.schemas.d.ts

@@ -28,6 +28,7 @@ export declare const UserIdentityLinkSchema: import("@wildo-ai/zod-decorators").
     providerDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     providerAvatarUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+    scimExternalId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     scopeType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;