@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAIX;AAJD,WAAY,yBAAyB;IACnC,8DAAiC,CAAA;IACjC,sFAAsF;IACtF,gFAAmD,CAAA;AACrD,CAAC,EAJW,yBAAyB,KAAzB,yBAAyB,QAIpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACxD,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAChE,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,0BAA0B,CAAC,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,WAAW,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE,CAAC;AAE9K,0KAA0K;AAC1K,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,yDAAyD,GAAG,CACvE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,eAAe;IACpD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC7F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,iFAAiF;IACjF,6EAA6E;IAC7E,kFAAkF;IAClF,8EAA8E;IAC9E,sFAAsF;IACtF,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAChE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,yBAAyB;IAC1C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,6EAA6E;oBAC7E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,gFAAgF;oBAChF,gFAAgF;oBAChF,kEAAkE;oBAClE,iFAAiF;oBACjF,wFAAwF;oBACxF,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wGAAwG;oBACvJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,CAAC,yBAAyB,CAAC,cAAc,CAAC,EAAE;YAC1C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,2CAA2C;oBACvD,iBAAiB,EAAE,4CAA4C;oBAC/D,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD;;;;;;;;;;;;;;;uBAeG;oBACH,gCAAgC,EAAE,IAAI;oBACtC;;;;;;;;;;;uBAWG;oBACH,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACrC,MAAM,OAAO,GAAG,2CAA2C,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC1E,OAAO;4BACL,OAAO,EAAE;gCACP,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC;qCACjE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gCACzD,eAAe;6BAChB;yBACF,CAAC;oBACJ,CAAC;oBACD,qFAAqF;oBACrF,iFAAiF;oBACjF,4FAA4F;oBAC5F,yEAAyE;oBACzE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD;;;;;;;;;;WAUG;QACH,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,mDAAmD;oBAC/D,iBAAiB,EAAE,oDAAoD;oBACvE,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,wFAAwF;oBACxF,wFAAwF;oBACxF,0FAA0F;oBAC1F,sFAAsF;oBACtF,gCAAgC,EAAE,IAAI;oBACtC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser Resource Configuration (W7.3a)\n *\n * System resource — identity anchor for anonymous sessions.\n * CREATE, UPDATE, and DELETE are INTERNAL_CALL (managed by AnonymousSessionBackendService via service layer).\n * READ is admin-only (super-admin inspection). The anonymous session reaches its OWNED\n * data through the nested `/anonymous-users/{uuidRef}/…` routes (which filter\n * children by the `anonymousUserId` FK = `uuidRef`) and validates itself via the JWT —\n * it never reads its own AnonymousUser row. See the READ variant note for why anon\n * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).\n */\n\nimport { z } from 'zod';\n\nimport { AnonymousUserSchema } from './anonymous-users.shared.schema';\nimport { ConsentPurpose, normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourcesConfigNamingUtils } from '../resources/utils/resources-config-naming.utils';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * Custom operations on the anonymous identity anchor.\n *\n * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent\n * decision was declared on this resource's UPDATE — *\"a visitor's or a lead's consent decision is as\n * recordable as a member's\"* — while every operation here is `INTERNAL_CALL` or super-admin, so no\n * visitor could reach it. The recording contract was written for a door nobody built (#1258).\n */\nexport enum AnonymousUsers_Operations {\n  RECORD_CONSENT = 'record_consent',\n  /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */\n  RECORD_NOTICE_DELIVERED = 'record_notice_delivered',\n}\n\n/**\n * What a visitor's consent surface sends when they decide.\n *\n * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise\n *\n * A decision is `(granted subset-of offered, at an instant)` — see\n * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the\n * person saw, and the server does not know it: the marketing website is statically built and derives\n * its panel from its OWN live providers, which this backend never sees. So the client is the only\n * party that can state it.\n *\n * The blast radius is confined by construction, which is what makes that acceptable:\n *\n * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the\n *   request, so no visitor can describe another visitor's decision;\n * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes\n *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an\n *   account that has already decided;\n * - it grants no privilege a visitor does not already have — they may tick the same boxes on the\n *   application's own consent surface a minute later.\n *\n * The residual is a shared browser whose first visitor lies: the next person to register from it\n * starts with grants they did not make. That is the pre-existing shared-browser exposure of any\n * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.\n *\n * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same\n * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the\n * fact that a decision happened.\n */\nexport const AnonymousUsersRecordConsentRequestDtoSchema = z.object({\n  /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */\n  grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16),\n  /** The purposes the surface actually put in front of them. What is absent was never asked. */\n  offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16),\n});\n\nexport type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;\n\n/**\n * What the visitor gets back: their OWN decision, and nothing else.\n *\n * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`\n * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the\n * controller's response validation — measured live as `controller_resource_validation_failed` after\n * the write had already succeeded (#1267).\n *\n * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and\n * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`\n * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a\n * consent click would disclose more than the click.\n *\n * The decision itself IS safe to return to the session that just made it, and useful: a client can\n * reconcile what the server stored — including the instant, which the server owns — without a read\n * door on a resource whose READ is deliberately admin-only.\n */\nexport const AnonymousUsersRecordConsentResponseDtoSchema = z.object({\n  consentedPurposes: z.array(z.enum(ConsentPurpose)),\n  offeredPurposes: z.array(z.enum(ConsentPurpose)),\n  consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional(),\n});\n\nexport type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;\n\n/**\n * What a visitor's public-document page sends when a governed document renders for them (#1258 Step\n * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,\n * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers\n * have different security characteristics and each already has a proven pattern to reuse.\n *\n * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from\n * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to\n * have met a release that was never in force, or the wrong version of one that was.\n */\nexport const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({\n  documentRef: z.string().trim().min(1),\n});\nexport type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;\n\n/**\n * Declared rather than inherited, for the same reason as its consent sibling: a custom operation\n * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at\n * all, so there is no row to fail validation against — an explicit, minimal response avoids\n * reintroducing that trap by construction.\n *\n * `recorded: false` is not an error — it means the resolved release does not permit\n * `NOTICE_DELIVERED`, or nothing is in force for that document right now. The caller does not act on\n * this value; it exists for the rare case a session wants to know whether the call did anything.\n */\nexport const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({\n  recorded: z.boolean(),\n});\nexport type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;\n\n/**\n * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed\n * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,\n * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the\n * resource or operation identifier changes, on a public door nobody monitors.\n *\n * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that\n * carve (it cannot import the resources layer), and this door is reached only from the signed-out\n * pages of the APPLICATION itself, which already imports this package freely.\n */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH =\n  `/${ResourcesConfigNamingUtils.toKebabCase(CoreResourceType.ANONYMOUS_USERS)}/${ResourcesConfigNamingUtils.toKebabCase(AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED)}`;\n\n/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = 'PUT';\n\nexport const anonymousUsersResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<typeof AnonymousUsers_Operations,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof AnonymousUserSchema\n>({\n  mainSchema: AnonymousUserSchema,\n  resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ANONYMOUS_USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Session-init (`AnonymousSessionBackendService.createAnonymousUser`) writes the\n  // first-touch `marketingMetadata` (`.isBackendOnly()`) and a client-supplied\n  // custom `_id` in-process, with no HTTP request context to survive the strict-DTO\n  // strip. `createAsSystem` re-attaches the backend-only field after the parse,\n  // fail-closed behind this opt-in. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: AnonymousUsers_Operations,\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Admin-only (super-admin inspection). Intentionally NOT anon-self-read: the\n          // framework resolves a direct read-by-identifier to `{ _id: <value> }`, but an\n          // anonymous session's identity is its client `uuidRef` (its `_id` is a server\n          // ObjectId), so a self-read would look up `{ _id: <uuidRef> }` and never match.\n          // The anonymous session never needs this — it reaches owned data via the nested\n          // `/anonymous-users/{uuidRef}/…` routes (children filtered by the\n          // `anonymousUserId` FK = `uuidRef`) and validates via the JWT. If anon self-read\n          // is ever required, implement it to resolve by `uuidRef` (custom read impl), not `_id`.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    /**\n     * APPLICATION-WIDE by design, and unconfined by construction — recorded 2026-08-12 because it\n     * previously said nothing, and silence is what this resource class keeps getting wrong.\n     *\n     * `anonymousUsers` is its own scope ROOT: `resourceFieldIdentifier` IS the ANONYMOUS scope's\n     * field, so both repositories blacklist that axis and this LIST compiles with no scope predicate\n     * (`base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep).\n     *\n     * Unlike `organizations`, that is CORRECT here rather than a hole, and the reason is semantic\n     * rather than a judgement call: an anonymous session is a pre-authentication visitor of the\n     * APPLICATION. It has no organization — there is no tenant to confine it to — so a \"confined\"\n     * anonymous listing would name a relationship that does not exist. `super-admin` is therefore\n     * the whole of the control, and it is the right one.\n     *\n     * ⚠️ If anonymous sessions ever gain a tenant association, this becomes an ORGANIZATIONS-axis\n     * question and `assignScopeRootCollectionConfinementToFilter` is where it is answered — that\n     * authority is deliberately scoped to the tenant axis today.\n     *\n     * The sibling decisions live in `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Application-wide by design — see the block above; there is no tenant to confine a pre-auth visitor to\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    /**\n     * The visitor's own consent decision, recorded against their anonymous session (#1258).\n     *\n     * ## Why it is COLLECTION-level and carries no id\n     *\n     * `resourceOperationLike: UPDATE_MANY` puts it at the collection path with its own name segment\n     * and NO entity id — the `reset-features` shape. That is not a convenience: it is what keeps the\n     * door safe.\n     *\n     * An entity-addressed variant would resolve `{ _id: <value> }`, and an anonymous session's\n     * identity is its client `uuidRef` while its `_id` is a server ObjectId — the exact trap the READ\n     * variant above documents, and the reason anon self-read was never offered. Worse, it would put\n     * the row's address in the REQUEST, where a visitor could name another visitor's session.\n     *\n     * With no id, the custom implementation selects the row by `uuidRef` taken from the verified\n     * session JWT (`executionContext.anonymousUserId`). The selector is server-derived, so describing\n     * another visitor's decision is not expressible rather than merely refused.\n     *\n     * **This resource is its own scope ROOT**, so both repositories blacklist the anonymous axis and\n     * the contextual filter contributes NO predicate here (that is why LIST is super-admin). Nothing\n     * confines this write except the selector the implementation builds, which is why the selector is\n     * the thing under test.\n     *\n     * LOW risk: it writes one person's own privacy choice on a pre-identity row holding no account.\n     * `auditBelowRiskFloor` is what makes it leave a row anyway — the same declaration, and the same\n     * reasoning, as the UPDATE variant above and the lead's CREATE: buying the row by mis-declaring\n     * the verb's danger would corrupt the risk vocabulary every other control reads.\n     *\n     * Rate-limited per IP like the lead form, because it is a public unauthenticated write and an\n     * anonymous session is free to mint.\n     *\n     * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's own decision is recordable before\n     * they have an account, against the session it was made in.\n     */\n    [AnonymousUsers_Operations.RECORD_CONSENT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordConsentRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordConsentResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          /*\n           * Without this the operation answers 403 to the only caller it exists for (#1267), and the\n           * gate that refuses it is RIGHT: a collection-shaped write on a scope root reads as an\n           * unconfined DIRECTORY write, and `enforceApplicationWideReadAdmission` then demands a\n           * two-person elevation no visitor can hold.\n           *\n           * The declaration says the missing half: this write IS confined, by\n           * `createAnonymousConsentFactories`, to `{ uuidRef: executionContext.anonymousUserId }` —\n           * the value the session JWT was verified to carry, never anything from the request. The\n           * collection shape is a CONSEQUENCE of making the row unaddressable, not evidence that a\n           * set is being written.\n           *\n           * That confinement is the obligation the flag creates, and it is pinned in\n           * `anonymous-consent.custom-impl.backend.service.test.ts` with a hostile payload naming\n           * another session in `uuidRef`, `_id` and `anonymousUserId`.\n           */\n          admitsSelfConfinedScopeRootWrite: true,\n          /*\n           * Map the REQUEST shape onto the RESOURCE shape before the pipeline validates it — the\n           * `reset-to-defaults` idiom. The request names two purpose LISTS, which are not schema\n           * paths; the service tier validates against the resource schema, so without this the whole\n           * payload is unrecognised and the operation answers `service_resource_validation_failed`\n           * (measured live, #1267).\n           *\n           * The intersection is applied HERE so the stored grants can never exceed what the same\n           * request claims to have offered, whatever a later handler does with them. No\n           * `consentDecidedAt`: the custom implementation stamps the server's clock through\n           * `buildConsentDecisionPatch`, so a caller-authored instant cannot enter.\n           */\n          basicPrefixOperation: ({ inputDto }) => {\n            const request = AnonymousUsersRecordConsentRequestDtoSchema.parse(inputDto);\n            const offeredPurposes = normalizeConsentPurposes(request.offeredPurposes);\n            return {\n              privacy: {\n                consentedPurposes: normalizeConsentPurposes(request.grantedPurposes)\n                  .filter((purpose) => offeredPurposes.includes(purpose)),\n                offeredPurposes,\n              },\n            };\n          },\n          // No `authoritativeFields`: the request contract is two purpose LISTS and carries no\n          // `privacy` block, so there is no caller-supplied value to overwrite. The custom\n          // implementation composes the stored block itself. Declaring one here would be a guard over\n          // a field nothing can send — an untested claim that reads as protection.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    /**\n     * A visitor's own public-document page tells the server it rendered — `NOTICE_DELIVERED`, the\n     * anonymous half of #1258 Step 5 / R11. Same shape as `RECORD_CONSENT` and the same reasons:\n     * public, unauthenticated, one collection-level write with no id in the URL, so the request\n     * cannot name a row. Unlike its sibling, this write touches NO row on this resource at all — it\n     * only needs the verified session identity to attribute a `GOVERNED_DOCUMENT_INTERACTION_RECORDED`\n     * audit row, via `recordGovernedDocumentNoticeDelivered`.\n     *\n     * Rate-limited per IP like its sibling: a public unauthenticated write, and an anonymous session\n     * is free to mint.\n     */\n    [AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordNoticeDeliveredRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordNoticeDeliveredResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // Same obligation as `RECORD_CONSENT`, for the same reason (#1267): a collection-shaped\n          // write on this scope-root resource is otherwise read as an unconfined directory write.\n          // The custom implementation confines it to the verified session's own identity and writes\n          // no row at all — nothing here is a directory write in substance, only in HTTP shape.\n          admitsSelfConfinedScopeRootWrite: true,\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"anonymous-users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAIX;AAJD,WAAY,yBAAyB;IACnC,8DAAiC,CAAA;IACjC,sFAAsF;IACtF,gFAAmD,CAAA;AACrD,CAAC,EAJW,yBAAyB,KAAzB,yBAAyB,QAIpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SACrD,QAAQ,CAAC,qJAAqJ,CAAC;IAClK,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SAC5D,QAAQ,CAAC,iJAAiJ,CAAC;CAC/J,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC/C,QAAQ,CAAC,+GAA+G,CAAC;IAC5H,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC7C,QAAQ,CAAC,qEAAqE,CAAC;IAClF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC/D,QAAQ,CAAC,gEAAgE,CAAC;CAC9E,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAClC,QAAQ,CAAC,6NAA6N,CAAC;CAC3O,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;SAClB,QAAQ,CAAC,4LAA4L,CAAC;CAC1M,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,0BAA0B,CAAC,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,WAAW,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE,CAAC;AAE9K,0KAA0K;AAC1K,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,yDAAyD,GAAG,CACvE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,eAAe;IACpD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC7F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,iFAAiF;IACjF,6EAA6E;IAC7E,kFAAkF;IAClF,8EAA8E;IAC9E,sFAAsF;IACtF,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAChE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,yBAAyB;IAC1C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,6EAA6E;oBAC7E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,gFAAgF;oBAChF,gFAAgF;oBAChF,kEAAkE;oBAClE,iFAAiF;oBACjF,wFAAwF;oBACxF,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wGAAwG;oBACvJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,CAAC,yBAAyB,CAAC,cAAc,CAAC,EAAE;YAC1C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,2CAA2C;oBACvD,iBAAiB,EAAE,4CAA4C;oBAC/D,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD;;;;;;;;;;;;;;;uBAeG;oBACH,gCAAgC,EAAE,IAAI;oBACtC;;;;;;;;;;;uBAWG;oBACH,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACrC,MAAM,OAAO,GAAG,2CAA2C,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC1E,OAAO;4BACL,OAAO,EAAE;gCACP,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC;qCACjE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gCACzD,eAAe;6BAChB;yBACF,CAAC;oBACJ,CAAC;oBACD,qFAAqF;oBACrF,iFAAiF;oBACjF,4FAA4F;oBAC5F,yEAAyE;oBACzE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD;;;;;;;;;;WAUG;QACH,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,mDAAmD;oBAC/D,iBAAiB,EAAE,oDAAoD;oBACvE,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,wFAAwF;oBACxF,wFAAwF;oBACxF,0FAA0F;oBAC1F,sFAAsF;oBACtF,gCAAgC,EAAE,IAAI;oBACtC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser Resource Configuration (W7.3a)\n *\n * System resource — identity anchor for anonymous sessions.\n * CREATE, UPDATE, and DELETE are INTERNAL_CALL (managed by AnonymousSessionBackendService via service layer).\n * READ is admin-only (super-admin inspection). The anonymous session reaches its OWNED\n * data through the nested `/anonymous-users/{uuidRef}/…` routes (which filter\n * children by the `anonymousUserId` FK = `uuidRef`) and validates itself via the JWT —\n * it never reads its own AnonymousUser row. See the READ variant note for why anon\n * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).\n */\n\nimport { z } from 'zod';\n\nimport { AnonymousUserSchema } from './anonymous-users.shared.schema';\nimport { ConsentPurpose, normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourcesConfigNamingUtils } from '../resources/utils/resources-config-naming.utils';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * Custom operations on the anonymous identity anchor.\n *\n * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent\n * decision was declared on this resource's UPDATE — *\"a visitor's or a lead's consent decision is as\n * recordable as a member's\"* — while every operation here is `INTERNAL_CALL` or super-admin, so no\n * visitor could reach it. The recording contract was written for a door nobody built (#1258).\n */\nexport enum AnonymousUsers_Operations {\n  RECORD_CONSENT = 'record_consent',\n  /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */\n  RECORD_NOTICE_DELIVERED = 'record_notice_delivered',\n}\n\n/**\n * What a visitor's consent surface sends when they decide.\n *\n * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise\n *\n * A decision is `(granted subset-of offered, at an instant)` — see\n * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the\n * person saw, and the server does not know it: the marketing website is statically built and derives\n * its panel from its OWN live providers, which this backend never sees. So the client is the only\n * party that can state it.\n *\n * The blast radius is confined by construction, which is what makes that acceptable:\n *\n * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the\n *   request, so no visitor can describe another visitor's decision;\n * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes\n *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an\n *   account that has already decided;\n * - it grants no privilege a visitor does not already have — they may tick the same boxes on the\n *   application's own consent surface a minute later.\n *\n * The residual is a shared browser whose first visitor lies: the next person to register from it\n * starts with grants they did not make. That is the pre-existing shared-browser exposure of any\n * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.\n *\n * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same\n * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the\n * fact that a decision happened.\n */\nexport const AnonymousUsersRecordConsentRequestDtoSchema = z.object({\n  /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */\n  grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16)\n    .describe('Every purpose the visitor granted, as a complete set: a purpose left out is not granted. A purpose not also listed in `offeredPurposes` is ignored.'),\n  /** The purposes the surface actually put in front of them. What is absent was never asked. */\n  offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16)\n    .describe('The purposes the consent surface actually asked the visitor about. A purpose absent from this list is recorded as never asked, not as declined.'),\n});\n\nexport type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;\n\n/**\n * What the visitor gets back: their OWN decision, and nothing else.\n *\n * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`\n * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the\n * controller's response validation — measured live as `controller_resource_validation_failed` after\n * the write had already succeeded (#1267).\n *\n * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and\n * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`\n * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a\n * consent click would disclose more than the click.\n *\n * The decision itself IS safe to return to the session that just made it, and useful: a client can\n * reconcile what the server stored — including the instant, which the server owns — without a read\n * door on a resource whose READ is deliberately admin-only.\n */\nexport const AnonymousUsersRecordConsentResponseDtoSchema = z.object({\n  consentedPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes now recorded as granted for this anonymous session: the granted purposes that were also offered.'),\n  offeredPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes recorded as offered to the visitor with this decision.'),\n  consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional()\n    .describe(\"When the decision was recorded, taken from the server's clock.\"),\n});\n\nexport type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;\n\n/**\n * What a visitor's public-document page sends when a governed document renders for them (#1258 Step\n * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,\n * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers\n * have different security characteristics and each already has a proven pattern to reuse.\n *\n * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from\n * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to\n * have met a release that was never in force, or the wrong version of one that was.\n */\nexport const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({\n  documentRef: z.string().trim().min(1)\n    .describe('Reference of the governed document the visitor was shown, such as the privacy notice. The delivery is recorded against the release of that document currently in force, when one allows it; a client cannot name a version.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;\n\n/**\n * Declared rather than inherited, for the same reason as its consent sibling: a custom operation\n * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at\n * all, so there is no row to fail validation against — an explicit, minimal response avoids\n * reintroducing that trap by construction.\n *\n * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to\n * the audit trail against its in-force release, and `false` when nothing was written — no release of\n * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.\n * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,\n * and the caller does not act on it: the page has already been shown.\n */\nexport const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({\n  recorded: z.boolean()\n    .describe('Whether this showing of the document was recorded. `false` when no release of the document in force records deliveries, or the record could not be written; the page itself is unaffected.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;\n\n/**\n * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed\n * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,\n * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the\n * resource or operation identifier changes, on a public door nobody monitors.\n *\n * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that\n * carve (it cannot import the resources layer), and this door is reached only from the signed-out\n * pages of the APPLICATION itself, which already imports this package freely.\n */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH =\n  `/${ResourcesConfigNamingUtils.toKebabCase(CoreResourceType.ANONYMOUS_USERS)}/${ResourcesConfigNamingUtils.toKebabCase(AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED)}`;\n\n/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = 'PUT';\n\nexport const anonymousUsersResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<typeof AnonymousUsers_Operations,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof AnonymousUserSchema\n>({\n  mainSchema: AnonymousUserSchema,\n  resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ANONYMOUS_USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Session-init (`AnonymousSessionBackendService.createAnonymousUser`) writes the\n  // first-touch `marketingMetadata` (`.isBackendOnly()`) and a client-supplied\n  // custom `_id` in-process, with no HTTP request context to survive the strict-DTO\n  // strip. `createAsSystem` re-attaches the backend-only field after the parse,\n  // fail-closed behind this opt-in. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: AnonymousUsers_Operations,\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Admin-only (super-admin inspection). Intentionally NOT anon-self-read: the\n          // framework resolves a direct read-by-identifier to `{ _id: <value> }`, but an\n          // anonymous session's identity is its client `uuidRef` (its `_id` is a server\n          // ObjectId), so a self-read would look up `{ _id: <uuidRef> }` and never match.\n          // The anonymous session never needs this — it reaches owned data via the nested\n          // `/anonymous-users/{uuidRef}/…` routes (children filtered by the\n          // `anonymousUserId` FK = `uuidRef`) and validates via the JWT. If anon self-read\n          // is ever required, implement it to resolve by `uuidRef` (custom read impl), not `_id`.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    /**\n     * APPLICATION-WIDE by design, and unconfined by construction — recorded 2026-08-12 because it\n     * previously said nothing, and silence is what this resource class keeps getting wrong.\n     *\n     * `anonymousUsers` is its own scope ROOT: `resourceFieldIdentifier` IS the ANONYMOUS scope's\n     * field, so both repositories blacklist that axis and this LIST compiles with no scope predicate\n     * (`base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep).\n     *\n     * Unlike `organizations`, that is CORRECT here rather than a hole, and the reason is semantic\n     * rather than a judgement call: an anonymous session is a pre-authentication visitor of the\n     * APPLICATION. It has no organization — there is no tenant to confine it to — so a \"confined\"\n     * anonymous listing would name a relationship that does not exist. `super-admin` is therefore\n     * the whole of the control, and it is the right one.\n     *\n     * ⚠️ If anonymous sessions ever gain a tenant association, this becomes an ORGANIZATIONS-axis\n     * question and `assignScopeRootCollectionConfinementToFilter` is where it is answered — that\n     * authority is deliberately scoped to the tenant axis today.\n     *\n     * The sibling decisions live in `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Application-wide by design — see the block above; there is no tenant to confine a pre-auth visitor to\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    /**\n     * The visitor's own consent decision, recorded against their anonymous session (#1258).\n     *\n     * ## Why it is COLLECTION-level and carries no id\n     *\n     * `resourceOperationLike: UPDATE_MANY` puts it at the collection path with its own name segment\n     * and NO entity id — the `reset-features` shape. That is not a convenience: it is what keeps the\n     * door safe.\n     *\n     * An entity-addressed variant would resolve `{ _id: <value> }`, and an anonymous session's\n     * identity is its client `uuidRef` while its `_id` is a server ObjectId — the exact trap the READ\n     * variant above documents, and the reason anon self-read was never offered. Worse, it would put\n     * the row's address in the REQUEST, where a visitor could name another visitor's session.\n     *\n     * With no id, the custom implementation selects the row by `uuidRef` taken from the verified\n     * session JWT (`executionContext.anonymousUserId`). The selector is server-derived, so describing\n     * another visitor's decision is not expressible rather than merely refused.\n     *\n     * **This resource is its own scope ROOT**, so both repositories blacklist the anonymous axis and\n     * the contextual filter contributes NO predicate here (that is why LIST is super-admin). Nothing\n     * confines this write except the selector the implementation builds, which is why the selector is\n     * the thing under test.\n     *\n     * LOW risk: it writes one person's own privacy choice on a pre-identity row holding no account.\n     * `auditBelowRiskFloor` is what makes it leave a row anyway — the same declaration, and the same\n     * reasoning, as the UPDATE variant above and the lead's CREATE: buying the row by mis-declaring\n     * the verb's danger would corrupt the risk vocabulary every other control reads.\n     *\n     * Rate-limited per IP like the lead form, because it is a public unauthenticated write and an\n     * anonymous session is free to mint.\n     *\n     * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's own decision is recordable before\n     * they have an account, against the session it was made in.\n     */\n    [AnonymousUsers_Operations.RECORD_CONSENT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordConsentRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordConsentResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          /*\n           * Without this the operation answers 403 to the only caller it exists for (#1267), and the\n           * gate that refuses it is RIGHT: a collection-shaped write on a scope root reads as an\n           * unconfined DIRECTORY write, and `enforceApplicationWideReadAdmission` then demands a\n           * two-person elevation no visitor can hold.\n           *\n           * The declaration says the missing half: this write IS confined, by\n           * `createAnonymousConsentFactories`, to `{ uuidRef: executionContext.anonymousUserId }` —\n           * the value the session JWT was verified to carry, never anything from the request. The\n           * collection shape is a CONSEQUENCE of making the row unaddressable, not evidence that a\n           * set is being written.\n           *\n           * That confinement is the obligation the flag creates, and it is pinned in\n           * `anonymous-consent.custom-impl.backend.service.test.ts` with a hostile payload naming\n           * another session in `uuidRef`, `_id` and `anonymousUserId`.\n           */\n          admitsSelfConfinedScopeRootWrite: true,\n          /*\n           * Map the REQUEST shape onto the RESOURCE shape before the pipeline validates it — the\n           * `reset-to-defaults` idiom. The request names two purpose LISTS, which are not schema\n           * paths; the service tier validates against the resource schema, so without this the whole\n           * payload is unrecognised and the operation answers `service_resource_validation_failed`\n           * (measured live, #1267).\n           *\n           * The intersection is applied HERE so the stored grants can never exceed what the same\n           * request claims to have offered, whatever a later handler does with them. No\n           * `consentDecidedAt`: the custom implementation stamps the server's clock through\n           * `buildConsentDecisionPatch`, so a caller-authored instant cannot enter.\n           */\n          basicPrefixOperation: ({ inputDto }) => {\n            const request = AnonymousUsersRecordConsentRequestDtoSchema.parse(inputDto);\n            const offeredPurposes = normalizeConsentPurposes(request.offeredPurposes);\n            return {\n              privacy: {\n                consentedPurposes: normalizeConsentPurposes(request.grantedPurposes)\n                  .filter((purpose) => offeredPurposes.includes(purpose)),\n                offeredPurposes,\n              },\n            };\n          },\n          // No `authoritativeFields`: the request contract is two purpose LISTS and carries no\n          // `privacy` block, so there is no caller-supplied value to overwrite. The custom\n          // implementation composes the stored block itself. Declaring one here would be a guard over\n          // a field nothing can send — an untested claim that reads as protection.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    /**\n     * A visitor's own public-document page tells the server it rendered — `NOTICE_DELIVERED`, the\n     * anonymous half of #1258 Step 5 / R11. Same shape as `RECORD_CONSENT` and the same reasons:\n     * public, unauthenticated, one collection-level write with no id in the URL, so the request\n     * cannot name a row. Unlike its sibling, this write touches NO row on this resource at all — it\n     * only needs the verified session identity to attribute a `GOVERNED_DOCUMENT_INTERACTION_RECORDED`\n     * audit row, via `recordGovernedDocumentNoticeDelivered`.\n     *\n     * Rate-limited per IP like its sibling: a public unauthenticated write, and an anonymous session\n     * is free to mint.\n     */\n    [AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordNoticeDeliveredRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordNoticeDeliveredResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // Same obligation as `RECORD_CONSENT`, for the same reason (#1267): a collection-shaped\n          // write on this scope-root resource is otherwise read as an unconfined directory write.\n          // The custom implementation confines it to the verified session's own identity and writes\n          // no row at all — nothing here is a directory write in substance, only in HTTP shape.\n          admitsSelfConfinedScopeRootWrite: true,\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAG/C,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;iCAoL9C,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAI/C,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;iCAyL9C,CAAC"}

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.js

@@ -39,6 +39,7 @@ import { ResourceSystemAccessMode } from '../resources/resources-config.shared.s
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier, } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { SubmissionChallengeAction } from '../security/submission-challenge/submission-challenge.shared.js';
 export const inboundContactsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: InboundContactSchema,
     resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,
@@ -118,6 +119,11 @@ export const inboundContactsResourceConfiguration_InitializationFactory = (resou
                         requestsPerMinute: 5,
                         requestsPerHour: 30,
                     },
+                    // …and, when the application declares a captcha provider, a visitor answers a challenge before the lead is
+                    // written (#1985): the engine asks it in `doOperation`, documents the header in the API reference, and refuses
+                    // an unanswered or refused submission with 400. The rate limit stays the primary control: a bot can always
+                    // choose the proof of work, which costs it milliseconds.
+                    submissionChallenge: { action: SubmissionChallengeAction.INBOUND_CONTACT },
                     // The lead's marketing opt-in is a consent DECISION: the server stamps its instant (#534).
                     basicPrefixOperation: ({ inputDto }) => buildConsentDecisionPatch(inputDto, undefined),
                     authoritativeFields: ['privacy'],

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAU7C;IACA,UAAU,EAAE,oBAAoB;IAChC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kEAAkE;IAClE,qEAAqE;IACrE,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,oDAAoD;IACpD,kBAAkB,EAAE;QAChB,ydAAyd;QACzd,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAE/F;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,mIAAmI;gBACnI;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,kEAAkE;oBAClE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,iEAAiE;oBACjE,gBAAgB;oBAChB,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,2FAA2F;oBAC3F,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC;oBACtF,mBAAmB,EAAE,CAAC,SAAS,CAAC;oBAChC,mFAAmF;oBACnF,wFAAwF;oBACxF,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,8EAA8E;oBAC9E,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;gBACD,2EAA2E;aAC5E;YACD,kEAAkE;YAClE,sEAAsE;YACtE,6DAA6D;YAC7D,0EAA0E;YAC1E,0EAA0E;YAC1E,4DAA4D;YAC5D,yEAAyE;YACzE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,gDAAgD;SACjD;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * InboundContact Resource Configuration (Phase 0.5, Q-E=B path)\n *\n * Lead-capture resource for the public marketing site.\n * APPLICATION-scope (anchored via the `ANONYMOUS_USERS → INBOUND_CONTACTS`\n * relationship row in `coreSharedResourceRelationship`), NO\n * `isAnonymizable: true` — the framework's anonymizable transposition\n * pipeline gates on USER_SELF semantics, but `INBOUND_CONTACTS` is\n * conceptually an org-owned admin resource. Transposition is handled\n * by a focused manual hook in `AnonymousSessionBackendService` that\n * UPDATEs `{ anonymousUserId } → { userId, anonymousUserId: null }`\n * when the lead converts to an authenticated user.\n *\n * Operations:\n * - CREATE       : public — `APP_ANONYMOUS` role, requires an active\n *                  anonymous session. Per-endpoint rate-limit declared\n *                  on the variant itself (5 req/min + 30 req/hour per IP),\n *                  enforced at the controller pre-flight seam by\n *                  `RateLimitBackendService.checkPolicyForVariant`\n *                  BEFORE execution-context creation.\n * - READ / LIST  : `APP_ADMIN_MARKETING_EDITOR` (admin marketing dashboard).\n * - SEARCH       : `APP_ADMIN_MARKETING_EDITOR`.\n * - UPDATE       : INTERNAL_CALL only — used by the manual transposition\n *                  hook in `AnonymousSessionBackendService` to set\n *                  `{ userId, anonymousUserId: null }` on lead conversion.\n *                  Not exposed as a public API (no admin-edit surface in\n *                  Phase 0.5 — leads are read-only in the dashboard).\n * - DELETE       : `APP_ADMIN_SUPER_ADMIN` (compliance / data-cleanup).\n *\n * Marketing attribution does NOT live on this row. First-touch\n * attribution is on `AnonymousUser.marketingMetadata` (Q-D=β); analytics\n * joins via `anonymousUserId`.\n */\n\nimport { InboundContactSchema } from './inbound-contacts.shared.schemas';\nimport { buildConsentDecisionPatch } from './user-consent-decision.shared.utils';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport const inboundContactsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE,\n  typeof InboundContactSchema\n>({\n  mainSchema: InboundContactSchema,\n  resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_CONTACTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Lead-conversion transposition (`AnonymousSessionBackendService`\n  // .transposeInboundContactsOwnership) UPDATEs `{ anonymousUserId } →\n  // { userId, anonymousUserId: null }` in-process. Both FKs are context-auto-\n  // populated names the client-shaped request DTO strips, so a plain update is a\n  // silent no-op; `updateAsSystem` re-attaches them after the strict parse,\n  // fail-closed behind this opt-in. INBOUND_CONTACTS is APPLICATION-scoped (not\n  // `isAnonymizable`), so the grant is authored explicitly here rather than\n  // derived by the factory's anonymizable enrichment.\n  systemAccessPolicy: {\n      // Subject-export disclosure. Lead records the subject is the data subject of. ⚠️ Art. 15(4): if an app stores third-party notes ABOUT the subject on these rows, mark those fields `.isBackendOnly()` so the export's security floor withholds them. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the inbound contact.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: an inbound contact IS contact details — email, names, phone — and all\n   * are scrubbed. The row is retained because it may be the only record that a contact attempt\n   * happened, which an operator can legitimately need to account for, and once scrubbed it carries no\n   * personal datum.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject reaches this row through EITHER `userId` or `anonymousUserId` — an inbound contact can\n   * predate the account. `SELF_PRINCIPAL` names the person the row is about either way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the boot-time guard and then fails to resolve at erasure time.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        /** @wildo_source:part:start example.rate-limit.resource-operation-surface facet:kind:usage-example facet:audience:app-developer */\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Public anonymous CREATE — declares the per-IP rate-limit on the\n          // default API_CALL variant. Two windows (a short burst limit + an\n          // hourly cap) are AND-ed and enforced at the controller pre-flight\n          // seam; no bucket-key choice is needed here because IP is the only\n          // identity available before execution-context creation. The global\n          // HTTP limiter remains the safety net for any path that bypasses\n          // this surface.\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // The lead's marketing opt-in is a consent DECISION: the server stamps its instant (#534).\n          basicPrefixOperation: ({ inputDto }) => buildConsentDecisionPatch(inputDto, undefined),\n          authoritativeFields: ['privacy'],\n          // …and a decision the server stamps must leave a row. LOW sits below the automatic\n          // HIGH/CRITICAL floor, so without this the one consent a LEAD ever gives us was the one\n          // consent nothing recorded. The declaration rather than a raised risk level, for the reason\n          // the api-key reissue records: buying the row by mis-declaring the verb's danger corrupts the\n          // risk vocabulary every other control reads. Only the marked decision leaves enter the\n          // evidence, so the row carries the choice and not the lead's contact details.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the lead's own decision is recordable.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n        /** @wildo_source:part:end example.rate-limit.resource-operation-surface */\n      ],\n      // No `userNotifications` on CREATE. A Phase-0.5 draft declared an\n      // `INBOUND_CONTACT` + `EMAIL` notification, but the dispatcher has no\n      // email-by-target recipient resolution for `INBOUND_CONTACT`\n      // (`getUserIdsForTarget` falls through to `[]`, so the email was a silent\n      // no-op) and there is no template for it. `INBOUND_CONTACT` is wired only\n      // for the WEBSOCKET channel (admin in-app alerts) — declare\n      // `{ target: INBOUND_CONTACT, channel: WEBSOCKET }` here if an app wants\n      // that. For a visitor acknowledgement email, use the email-by-address\n      // path — `{ channel: EMAIL, recipientEmailField: 'email' }` (see\n      // `organization-member-invitations` CREATE). The paired resource spec\n      // asserts no email delivery; keep both in sync.\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8DAA8D,CAAC;AAEzG,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAU7C;IACA,UAAU,EAAE,oBAAoB;IAChC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kEAAkE;IAClE,qEAAqE;IACrE,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,oDAAoD;IACpD,kBAAkB,EAAE;QAChB,ydAAyd;QACzd,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAE/F;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,mIAAmI;gBACnI;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,kEAAkE;oBAClE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,iEAAiE;oBACjE,gBAAgB;oBAChB,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,2GAA2G;oBAC3G,+GAA+G;oBAC/G,2GAA2G;oBAC3G,yDAAyD;oBACzD,mBAAmB,EAAE,EAAE,MAAM,EAAE,yBAAyB,CAAC,eAAe,EAAE;oBAC1E,2FAA2F;oBAC3F,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC;oBACtF,mBAAmB,EAAE,CAAC,SAAS,CAAC;oBAChC,mFAAmF;oBACnF,wFAAwF;oBACxF,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,8EAA8E;oBAC9E,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;gBACD,2EAA2E;aAC5E;YACD,kEAAkE;YAClE,sEAAsE;YACtE,6DAA6D;YAC7D,0EAA0E;YAC1E,0EAA0E;YAC1E,4DAA4D;YAC5D,yEAAyE;YACzE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,gDAAgD;SACjD;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * InboundContact Resource Configuration (Phase 0.5, Q-E=B path)\n *\n * Lead-capture resource for the public marketing site.\n * APPLICATION-scope (anchored via the `ANONYMOUS_USERS → INBOUND_CONTACTS`\n * relationship row in `coreSharedResourceRelationship`), NO\n * `isAnonymizable: true` — the framework's anonymizable transposition\n * pipeline gates on USER_SELF semantics, but `INBOUND_CONTACTS` is\n * conceptually an org-owned admin resource. Transposition is handled\n * by a focused manual hook in `AnonymousSessionBackendService` that\n * UPDATEs `{ anonymousUserId } → { userId, anonymousUserId: null }`\n * when the lead converts to an authenticated user.\n *\n * Operations:\n * - CREATE       : public — `APP_ANONYMOUS` role, requires an active\n *                  anonymous session. Per-endpoint rate-limit declared\n *                  on the variant itself (5 req/min + 30 req/hour per IP),\n *                  enforced at the controller pre-flight seam by\n *                  `RateLimitBackendService.checkPolicyForVariant`\n *                  BEFORE execution-context creation.\n * - READ / LIST  : `APP_ADMIN_MARKETING_EDITOR` (admin marketing dashboard).\n * - SEARCH       : `APP_ADMIN_MARKETING_EDITOR`.\n * - UPDATE       : INTERNAL_CALL only — used by the manual transposition\n *                  hook in `AnonymousSessionBackendService` to set\n *                  `{ userId, anonymousUserId: null }` on lead conversion.\n *                  Not exposed as a public API (no admin-edit surface in\n *                  Phase 0.5 — leads are read-only in the dashboard).\n * - DELETE       : `APP_ADMIN_SUPER_ADMIN` (compliance / data-cleanup).\n *\n * Marketing attribution does NOT live on this row. First-touch\n * attribution is on `AnonymousUser.marketingMetadata` (Q-D=β); analytics\n * joins via `anonymousUserId`.\n */\n\nimport { InboundContactSchema } from './inbound-contacts.shared.schemas';\nimport { buildConsentDecisionPatch } from './user-consent-decision.shared.utils';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { SubmissionChallengeAction } from '../security/submission-challenge/submission-challenge.shared';\n\nexport const inboundContactsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE,\n  typeof InboundContactSchema\n>({\n  mainSchema: InboundContactSchema,\n  resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_CONTACTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Lead-conversion transposition (`AnonymousSessionBackendService`\n  // .transposeInboundContactsOwnership) UPDATEs `{ anonymousUserId } →\n  // { userId, anonymousUserId: null }` in-process. Both FKs are context-auto-\n  // populated names the client-shaped request DTO strips, so a plain update is a\n  // silent no-op; `updateAsSystem` re-attaches them after the strict parse,\n  // fail-closed behind this opt-in. INBOUND_CONTACTS is APPLICATION-scoped (not\n  // `isAnonymizable`), so the grant is authored explicitly here rather than\n  // derived by the factory's anonymizable enrichment.\n  systemAccessPolicy: {\n      // Subject-export disclosure. Lead records the subject is the data subject of. ⚠️ Art. 15(4): if an app stores third-party notes ABOUT the subject on these rows, mark those fields `.isBackendOnly()` so the export's security floor withholds them. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the inbound contact.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: an inbound contact IS contact details — email, names, phone — and all\n   * are scrubbed. The row is retained because it may be the only record that a contact attempt\n   * happened, which an operator can legitimately need to account for, and once scrubbed it carries no\n   * personal datum.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject reaches this row through EITHER `userId` or `anonymousUserId` — an inbound contact can\n   * predate the account. `SELF_PRINCIPAL` names the person the row is about either way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the boot-time guard and then fails to resolve at erasure time.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        /** @wildo_source:part:start example.rate-limit.resource-operation-surface facet:kind:usage-example facet:audience:app-developer */\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Public anonymous CREATE — declares the per-IP rate-limit on the\n          // default API_CALL variant. Two windows (a short burst limit + an\n          // hourly cap) are AND-ed and enforced at the controller pre-flight\n          // seam; no bucket-key choice is needed here because IP is the only\n          // identity available before execution-context creation. The global\n          // HTTP limiter remains the safety net for any path that bypasses\n          // this surface.\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // …and, when the application declares a captcha provider, a visitor answers a challenge before the lead is\n          // written (#1985): the engine asks it in `doOperation`, documents the header in the API reference, and refuses\n          // an unanswered or refused submission with 400. The rate limit stays the primary control: a bot can always\n          // choose the proof of work, which costs it milliseconds.\n          submissionChallenge: { action: SubmissionChallengeAction.INBOUND_CONTACT },\n          // The lead's marketing opt-in is a consent DECISION: the server stamps its instant (#534).\n          basicPrefixOperation: ({ inputDto }) => buildConsentDecisionPatch(inputDto, undefined),\n          authoritativeFields: ['privacy'],\n          // …and a decision the server stamps must leave a row. LOW sits below the automatic\n          // HIGH/CRITICAL floor, so without this the one consent a LEAD ever gives us was the one\n          // consent nothing recorded. The declaration rather than a raised risk level, for the reason\n          // the api-key reissue records: buying the row by mis-declaring the verb's danger corrupts the\n          // risk vocabulary every other control reads. Only the marked decision leaves enter the\n          // evidence, so the row carries the choice and not the lead's contact details.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the lead's own decision is recordable.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n        /** @wildo_source:part:end example.rate-limit.resource-operation-surface */\n      ],\n      // No `userNotifications` on CREATE. A Phase-0.5 draft declared an\n      // `INBOUND_CONTACT` + `EMAIL` notification, but the dispatcher has no\n      // email-by-target recipient resolution for `INBOUND_CONTACT`\n      // (`getUserIdsForTarget` falls through to `[]`, so the email was a silent\n      // no-op) and there is no template for it. `INBOUND_CONTACT` is wired only\n      // for the WEBSOCKET channel (admin in-app alerts) — declare\n      // `{ target: INBOUND_CONTACT, channel: WEBSOCKET }` here if an app wants\n      // that. For a visitor acknowledgement email, use the email-by-address\n      // path — `{ channel: EMAIL, recipientEmailField: 'email' }` (see\n      // `organization-member-invitations` CREATE). The paired resource spec\n      // asserts no email delivery; keep both in sync.\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/user-preferences-reset.shared.utils.js

@@ -35,7 +35,7 @@
  * `.excludeFromUpdate()`.
  */
 import { z } from "zod";
-import { EnumEditMode } from "@wildo-ai/zod-decorators";
+import { EnumMultipleEditMode } from "@wildo-ai/zod-decorators";
 import { UserPreferenceGroup, UserLanguagePreferencesSchema, UserPreferences_NotificationsSchema, UserPreferences_RegionalSchema, UserPreferences_UI_ThemeSchema, } from "./users.shared.schemas.js";
 import { UserPrivacySchema } from "../compliance/privacy/privacy.shared.schemas.js";
 /**
@@ -51,7 +51,7 @@ import { UserPrivacySchema } from "../compliance/privacy/privacy.shared.schemas.
  * matching how `fallbackLanguages` presents a compact multi-select in the same settings surface.
  */
 export const UserPreferencesResetRequestSchema = z.object({
-    groups: z.array(z.enum(UserPreferenceGroup).enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).min(1),
+    groups: z.array(z.enum(UserPreferenceGroup).enumUI({ edit: { multipleEditMode: EnumMultipleEditMode.COMBOBOX } })).min(1).describe("The preference blocks to return to their defaults, by field name: `notifications`, `privacy`, `ui`, `regional` or `languagePreferences`. At least one is required, and blocks not named are left unchanged. Resetting `privacy` withdraws every consent the user has given; resetting `regional` clears the user's own regional choices so the organization's apply."),
 });
 /**
  * Every block is preference state. Governed-document interaction receipts live in their own

package/dist/esm/users/user-preferences-reset.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences-reset.shared.utils.js","sourceRoot":"","sources":["../../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EACL,mBAAmB,EAEnB,6BAA6B,EAC7B,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1G,CAAC,CAAC;AAiBH;;;GAGG;AACH,MAAM,qCAAqC,GAAsC;IAC/E,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9E,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7E,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;CACjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAoC,EACpC,kBAA+C;IAE/C,MAAM,KAAK,GAA6B,EAAE,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,sFAAsF;QACtF,yFAAyF;QACxF,KAAiC,CAAC,KAAK,CAAC,GAAG,qCAAqC,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * User Preferences Reset — the shared contract behind `reset_to_defaults`.\n *\n * ONE authority for the self-service reset of a preferences row. `USER_SELF_PREFERENCES`\n * resolves to the `USER_PREFERENCES` persistence collection, but the administrator-addressed\n * resource deliberately exposes no reset operation: a second public verb would be a second\n * contract for the same mutation, free to drift. Administrators have the generic UPDATE for an\n * explicit correction; subjects own selective reset here.\n *\n * ## Why this file exists at all\n *\n * The operation used to declare six booleans (`resetNotifications`, `resetPrivacy`, `resetUI`,\n * `resetRegional`, `resetLanguage`, `resetAll`). None of them is a field on\n * `UserPreferencesSchema`, and a payload is stripped THREE times on the way to the database —\n * the controller parses the body against the operation `requestDto`, the repository re-parses\n * the write against that same DTO, and Mongoose drops every non-schema path. A request naming\n * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset\n * nothing. That is the class of defect catalogued in\n * the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n *\n * ## How the reset reaches the database now\n *\n * `requestDto` names the caller-facing vocabulary ({@link UserPreferenceGroup}); a\n * `basicPrefixOperation` turns it into the patch this module builds. The framework merges a\n * prefix's return value onto the payload and whitelists the keys the prefix ADDED into\n * `preserveServerInjectedFields`, which the repository re-attaches after its strict parse. So\n * the group fields persist while the `groups` array itself — a client-supplied key, never\n * whitelisted — is stripped before it can reach a document.\n *\n * The patch is deliberately PARTIAL. The repository `$set`s it with no dot-path flattening, so\n * naming a group replaces that whole subdocument (which is exactly what \"reset this block\"\n * means), while an unnamed group is not in the `$set` at all and is left untouched. Spreading\n * the current row instead — the shape `todo-lists`/`todos` use — would make `_id` and `userId`\n * prefix-injected keys and re-write `userId` on every reset, despite it being\n * `.excludeFromUpdate()`.\n */\n\nimport { z } from \"zod\";\nimport { EnumEditMode } from \"@wildo-ai/zod-decorators\";\n\nimport {\n  UserPreferenceGroup,\n  UserPreferences,\n  UserLanguagePreferencesSchema,\n  UserPreferences_NotificationsSchema,\n  UserPreferences_RegionalSchema,\n  UserPreferences_UI_ThemeSchema,\n} from \"./users.shared.schemas\";\nimport { UserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\n\n/**\n * The `reset_to_defaults` request body for the subject-facing preferences resource.\n *\n * `.min(1)` is load-bearing, not decoration: a reset naming no group would write nothing and\n * answer 200, re-creating the exact silent no-op this operation was fixed for. Rejecting it at\n * the DTO makes that unrepresentable — the controller's strict parse turns it into a 400 before\n * any dispatch, and the repository's re-parse of the write enforces the same rule on every\n * non-HTTP path.\n *\n * `COMBOBOX` renders the array as a chips multi-select rather than an add-a-row array field,\n * matching how `fallbackLanguages` presents a compact multi-select in the same settings surface.\n */\nexport const UserPreferencesResetRequestSchema = z.object({\n  groups: z.array(z.enum(UserPreferenceGroup).enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).min(1),\n});\n\nexport type UserPreferencesResetRequest = z.infer<typeof UserPreferencesResetRequestSchema>;\n\n/**\n * How each preference block returns to its defaults.\n *\n * The mapped type is the integrity proof: `UserPreferences[Group]` only type-checks when every\n * {@link UserPreferenceGroup} value is a real field of `UserPreferences`. Typo a value, rename a\n * group field without renaming the enum value, or add a group member without a factory, and\n * this stops compiling — instead of shipping a patch key Mongoose silently drops, which is the\n * failure mode that made the old contract a no-op.\n */\ntype UserPreferenceGroupResetFactories = {\n  [Group in UserPreferenceGroup]: (currentPreferences: UserPreferences | undefined) => UserPreferences[Group];\n};\n\n/**\n * Every block is preference state. Governed-document interaction receipts live in their own\n * immutable release-bound store and therefore cannot be erased or forged by this reset path.\n */\nconst USER_PREFERENCE_GROUP_RESET_FACTORIES: UserPreferenceGroupResetFactories = {\n  [UserPreferenceGroup.NOTIFICATIONS]: () => UserPreferences_NotificationsSchema.parse({}),\n  [UserPreferenceGroup.UI]: () => UserPreferences_UI_ThemeSchema.parse({}),\n  [UserPreferenceGroup.REGIONAL]: () => UserPreferences_RegionalSchema.parse({}),\n  [UserPreferenceGroup.LANGUAGE]: () => UserLanguagePreferencesSchema.parse({}),\n  [UserPreferenceGroup.PRIVACY]: () => UserPrivacySchema.parse({}),\n};\n\n/**\n * The persistence patch for a `reset_to_defaults` request — one key per requested block, and\n * nothing else.\n *\n * Returned from a `basicPrefixOperation`, so the framework merges it onto the payload and the\n * core UPDATE persists it. Keys absent from the patch are absent from the `$set`, so an\n * unnamed block is left exactly as it was.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}\n * returns `consentedPurposes` to the empty set and clears `consentDecidedAt`, which IS a consent\n * decision — a withdrawal of everything, after which a consent surface asks again. It leaves a trail\n * naming the previous and resulting value: the operation is CRITICAL, so it sits above the\n * framework's automatic audit floor and emits `resource_operation_performed`, and\n * `consentedPurposes` carries `.isAuditEvidence()` so its VALUES ride on that record. Governed-document receipts are neither preference members nor resettable values.\n *\n * @param request - the parsed request body. Re-parse `inputDto` through\n *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the\n *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the\n *   operation's request DTO.\n * @param currentPreferences - the row being reset, supplied to each block factory. Current\n *   factories return schema defaults; governed-document receipts live outside this resource.\n */\nexport function buildUserPreferencesResetPatch(\n  request: UserPreferencesResetRequest,\n  currentPreferences: UserPreferences | undefined,\n): Partial<UserPreferences> {\n  const patch: Partial<UserPreferences> = {};\n\n  for (const group of request.groups) {\n    // Same correlated-write widening as above: the factory is selected by the same key it\n    // writes, so the value type is right by construction and only the assignment is widened.\n    (patch as Record<string, unknown>)[group] = USER_PREFERENCE_GROUP_RESET_FACTORIES[group](currentPreferences);\n  }\n\n  return patch;\n}\n"]}
+{"version":3,"file":"user-preferences-reset.shared.utils.js","sourceRoot":"","sources":["../../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EACL,mBAAmB,EAEnB,6BAA6B,EAC7B,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sWAAsW,CAAC;CAC3e,CAAC,CAAC;AAiBH;;;GAGG;AACH,MAAM,qCAAqC,GAAsC;IAC/E,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9E,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7E,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;CACjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAoC,EACpC,kBAA+C;IAE/C,MAAM,KAAK,GAA6B,EAAE,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,sFAAsF;QACtF,yFAAyF;QACxF,KAAiC,CAAC,KAAK,CAAC,GAAG,qCAAqC,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * User Preferences Reset — the shared contract behind `reset_to_defaults`.\n *\n * ONE authority for the self-service reset of a preferences row. `USER_SELF_PREFERENCES`\n * resolves to the `USER_PREFERENCES` persistence collection, but the administrator-addressed\n * resource deliberately exposes no reset operation: a second public verb would be a second\n * contract for the same mutation, free to drift. Administrators have the generic UPDATE for an\n * explicit correction; subjects own selective reset here.\n *\n * ## Why this file exists at all\n *\n * The operation used to declare six booleans (`resetNotifications`, `resetPrivacy`, `resetUI`,\n * `resetRegional`, `resetLanguage`, `resetAll`). None of them is a field on\n * `UserPreferencesSchema`, and a payload is stripped THREE times on the way to the database —\n * the controller parses the body against the operation `requestDto`, the repository re-parses\n * the write against that same DTO, and Mongoose drops every non-schema path. A request naming\n * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset\n * nothing. That is the class of defect catalogued in\n * the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n *\n * ## How the reset reaches the database now\n *\n * `requestDto` names the caller-facing vocabulary ({@link UserPreferenceGroup}); a\n * `basicPrefixOperation` turns it into the patch this module builds. The framework merges a\n * prefix's return value onto the payload and whitelists the keys the prefix ADDED into\n * `preserveServerInjectedFields`, which the repository re-attaches after its strict parse. So\n * the group fields persist while the `groups` array itself — a client-supplied key, never\n * whitelisted — is stripped before it can reach a document.\n *\n * The patch is deliberately PARTIAL. The repository `$set`s it with no dot-path flattening, so\n * naming a group replaces that whole subdocument (which is exactly what \"reset this block\"\n * means), while an unnamed group is not in the `$set` at all and is left untouched. Spreading\n * the current row instead — the shape `todo-lists`/`todos` use — would make `_id` and `userId`\n * prefix-injected keys and re-write `userId` on every reset, despite it being\n * `.excludeFromUpdate()`.\n */\n\nimport { z } from \"zod\";\nimport { EnumMultipleEditMode } from \"@wildo-ai/zod-decorators\";\n\nimport {\n  UserPreferenceGroup,\n  UserPreferences,\n  UserLanguagePreferencesSchema,\n  UserPreferences_NotificationsSchema,\n  UserPreferences_RegionalSchema,\n  UserPreferences_UI_ThemeSchema,\n} from \"./users.shared.schemas\";\nimport { UserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\n\n/**\n * The `reset_to_defaults` request body for the subject-facing preferences resource.\n *\n * `.min(1)` is load-bearing, not decoration: a reset naming no group would write nothing and\n * answer 200, re-creating the exact silent no-op this operation was fixed for. Rejecting it at\n * the DTO makes that unrepresentable — the controller's strict parse turns it into a 400 before\n * any dispatch, and the repository's re-parse of the write enforces the same rule on every\n * non-HTTP path.\n *\n * `COMBOBOX` renders the array as a chips multi-select rather than an add-a-row array field,\n * matching how `fallbackLanguages` presents a compact multi-select in the same settings surface.\n */\nexport const UserPreferencesResetRequestSchema = z.object({\n  groups: z.array(z.enum(UserPreferenceGroup).enumUI({ edit: { multipleEditMode: EnumMultipleEditMode.COMBOBOX } })).min(1).describe(\"The preference blocks to return to their defaults, by field name: `notifications`, `privacy`, `ui`, `regional` or `languagePreferences`. At least one is required, and blocks not named are left unchanged. Resetting `privacy` withdraws every consent the user has given; resetting `regional` clears the user's own regional choices so the organization's apply.\"),\n});\n\nexport type UserPreferencesResetRequest = z.infer<typeof UserPreferencesResetRequestSchema>;\n\n/**\n * How each preference block returns to its defaults.\n *\n * The mapped type is the integrity proof: `UserPreferences[Group]` only type-checks when every\n * {@link UserPreferenceGroup} value is a real field of `UserPreferences`. Typo a value, rename a\n * group field without renaming the enum value, or add a group member without a factory, and\n * this stops compiling — instead of shipping a patch key Mongoose silently drops, which is the\n * failure mode that made the old contract a no-op.\n */\ntype UserPreferenceGroupResetFactories = {\n  [Group in UserPreferenceGroup]: (currentPreferences: UserPreferences | undefined) => UserPreferences[Group];\n};\n\n/**\n * Every block is preference state. Governed-document interaction receipts live in their own\n * immutable release-bound store and therefore cannot be erased or forged by this reset path.\n */\nconst USER_PREFERENCE_GROUP_RESET_FACTORIES: UserPreferenceGroupResetFactories = {\n  [UserPreferenceGroup.NOTIFICATIONS]: () => UserPreferences_NotificationsSchema.parse({}),\n  [UserPreferenceGroup.UI]: () => UserPreferences_UI_ThemeSchema.parse({}),\n  [UserPreferenceGroup.REGIONAL]: () => UserPreferences_RegionalSchema.parse({}),\n  [UserPreferenceGroup.LANGUAGE]: () => UserLanguagePreferencesSchema.parse({}),\n  [UserPreferenceGroup.PRIVACY]: () => UserPrivacySchema.parse({}),\n};\n\n/**\n * The persistence patch for a `reset_to_defaults` request — one key per requested block, and\n * nothing else.\n *\n * Returned from a `basicPrefixOperation`, so the framework merges it onto the payload and the\n * core UPDATE persists it. Keys absent from the patch are absent from the `$set`, so an\n * unnamed block is left exactly as it was.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}\n * returns `consentedPurposes` to the empty set and clears `consentDecidedAt`, which IS a consent\n * decision — a withdrawal of everything, after which a consent surface asks again. It leaves a trail\n * naming the previous and resulting value: the operation is CRITICAL, so it sits above the\n * framework's automatic audit floor and emits `resource_operation_performed`, and\n * `consentedPurposes` carries `.isAuditEvidence()` so its VALUES ride on that record. Governed-document receipts are neither preference members nor resettable values.\n *\n * @param request - the parsed request body. Re-parse `inputDto` through\n *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the\n *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the\n *   operation's request DTO.\n * @param currentPreferences - the row being reset, supplied to each block factory. Current\n *   factories return schema defaults; governed-document receipts live outside this resource.\n */\nexport function buildUserPreferencesResetPatch(\n  request: UserPreferencesResetRequest,\n  currentPreferences: UserPreferences | undefined,\n): Partial<UserPreferences> {\n  const patch: Partial<UserPreferences> = {};\n\n  for (const group of request.groups) {\n    // Same correlated-write widening as above: the factory is selected by the same key it\n    // writes, so the value type is right by construction and only the assignment is widened.\n    (patch as Record<string, unknown>)[group] = USER_PREFERENCE_GROUP_RESET_FACTORIES[group](currentPreferences);\n  }\n\n  return patch;\n}\n"]}

package/dist/esm/users/user-preferences.shared.resources-config.schemas.d.ts

@@ -57,8 +57,6 @@ export declare const userPreferencesResourceConfiguration_InitializationFactory:
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
     notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
         email: z.ZodDefault<z.ZodBoolean>;
-        push: z.ZodDefault<z.ZodBoolean>;
-        sms: z.ZodDefault<z.ZodBoolean>;
         inApp: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>>;
     privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
@@ -77,7 +75,6 @@ export declare const userPreferencesResourceConfiguration_InitializationFactory:
     languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
         primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
         fallbackLanguages: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>>;
-        autoDetect: z.ZodDefault<z.ZodBoolean>;
         useOrganizationDefault: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>>>;
 }, z.core.$strip>>;

package/dist/esm/users/user-preferences.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAWzG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,0BAA0B;IACpC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iDAAiD;;;;;iBAE5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkNvH,CAAC"}
+{"version":3,"file":"user-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAWzG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,0BAA0B;IACpC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iDAAiD;;;;;iBAE5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;kBAkNvH,CAAC"}

package/dist/esm/users/user-self-preferences.shared.resources-config.schemas.d.ts

@@ -16,8 +16,6 @@ export declare const userSelfPreferencesResourceConfiguration_InitializationFact
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>>>;
     notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodObject<{
         email: import("zod").ZodDefault<import("zod").ZodBoolean>;
-        push: import("zod").ZodDefault<import("zod").ZodBoolean>;
-        sms: import("zod").ZodDefault<import("zod").ZodBoolean>;
         inApp: import("zod").ZodDefault<import("zod").ZodBoolean>;
     }, import("zod/v4/core").$strip>>>;
     privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodObject<{
@@ -36,7 +34,6 @@ export declare const userSelfPreferencesResourceConfiguration_InitializationFact
     languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodObject<{
         primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
         fallbackLanguages: import("zod").ZodDefault<import("zod").ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>>;
-        autoDetect: import("zod").ZodDefault<import("zod").ZodBoolean>;
         useOrganizationDefault: import("zod").ZodDefault<import("zod").ZodBoolean>;
     }, import("zod/v4/core").$strip>>>>;
 }, import("zod/v4/core").$strip>>;

package/dist/esm/users/user-self-preferences.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-self-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-self-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAgBzI,oBAAY,8BAA8B;IACxC,iBAAiB,sBAAsB;CACxC;AAED,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCA8K3H,CAAC"}
+{"version":3,"file":"user-self-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-self-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAgBzI,oBAAY,8BAA8B;IACxC,iBAAiB,sBAAsB;CACxC;AAED,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;iCA8K3H,CAAC"}

package/dist/esm/users/user-self.shared.resources-config.schemas.js

@@ -337,7 +337,7 @@ export const userSelfResourceConfiguration_InitializationFactory = (resourcesRel
                     // system principal can dispatch. That is the case that actually matters — an operator who
                     // said "seven days" must get seven days.
                     requestDto: z.object({
-                        reason: z.string().max(500).optional(),
+                        reason: z.string().max(500).optional().describe('Why you are deactivating your account, if you want to say. Recorded on the audit trail, not on the account.'),
                     }),
                     enabledCondition: ({ currentObject }) => {
                         return currentObject.status === UserStatus.ACTIVE;

package/dist/esm/users/user-self.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-self.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-self.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,kDAAkD;AAClD,EAAE;AACF,2FAA2F;AAC3F,0EAA0E;AAC1E,6FAA6F;AAC7F,8FAA8F;AAC9F,4FAA4F;AAC5F,iGAAiG;AACjG,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,4FAA4F;AAC5F,0FAA0F;AAC1F,2FAA2F;AAC3F,wFAAwF;AACxF,4FAA4F;AAC5F,8EAA8E;AAC9E,qDAAqD;AACrD,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,oFAAoF;AACpF,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,SAAS;AACT,oGAAoG;AACpG,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,yDAAyD;AACzD,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,6EAA6E;AAC7E,mGAAmG;AACnG,2EAA2E;AAC3E,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,8FAA8F;AAC9F,+FAA+F;AAC/F,uBAAuB;AACvB,mGAAmG;AACnG,iGAAiG;AACjG,oFAAoF;AACpF,oGAAoG;AACpG,uDAAuD;AACvD,+FAA+F;AAC/F,kGAAkG;AAClG,2FAA2F;AAC3F,oGAAoG;AACpG,oGAAoG;AACpG,+EAA+E;AAC/E,mGAAmG;AACnG,oGAAoG;AACpG,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,gFAAgF;AAChF,4FAA4F;AAC5F,0FAA0F;AAC1F,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,oFAAoF;AACpF,kGAAkG;AAClG,wFAAwF;AACxF,iGAAiG;AACjG,wEAAwE;AACxE,uEAAuE;AACvE,EAAE;AACF,oFAAoF;AACpF,iGAAiG;AACjG,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,gEAAyC,CAAA;IACzC,gEAAyC,CAAA;AAC3C,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B;AAQD;;EAEE;AACF,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI/J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;IAC9C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,SAAS,CAAC;IACvF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,cAAc;IAEtC;;;;;;;;;;;OAWG;IACH,6BAA6B,EAAE,IAAI;IAEnC;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEvE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,6FAA6F;QAC7F,oFAAoF;QACpF,gGAAgG;QAChG,qEAAqE;QACrE,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,mBAAmB;IAGpC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,4CAA4C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,+CAA+C;iBAChD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,mFAAmF;oBACnF,wFAAwF;oBACxF,uFAAuF;oBACvF,0EAA0E;oBAC1E,EAAE;oBACF,uFAAuF;oBACvF,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,6EAA6E;oBAC7E,qFAAqF;oBACrF,kFAAkF;oBAClF,sFAAsF;oBACtF,qFAAqF;oBACrF,uFAAuF;oBACvF,uFAAuF;oBACvF,sCAAsC;oBACtC,EAAE;oBACF,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,0DAA0D;oBAC1D,kEAAkE;oBAClE,+EAA+E;oBAC/E,kFAAkF;oBAClF,sFAAsF;oBACtF,0EAA0E;oBAC1E,EAAE;oBACF,sFAAsF;oBACtF,oFAAoF;oBACpF,mFAAmF;oBACnF,oFAAoF;oBACpF,+DAA+D;oBAC/D,EAAE;oBACF,sFAAsF;oBACtF,qFAAqF;oBACrF,+EAA+E;oBAC/E,iFAAiF;oBACjF,kEAAkE;oBAClE,EAAE;oBACF,2EAA2E;oBAC3E,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,iFAAiF;oBACjF,6EAA6E;oBAC7E,iFAAiF;oBACjF,8EAA8E;oBAC9E,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,0FAA0F;oBAC1F,wFAAwF;oBACxF,6FAA6F;oBAC7F,gGAAgG;oBAChG,yFAAyF;oBACzF,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,2EAA2E;QAC3E,6FAA6F;QAC7F,8FAA8F;QAC9F,2FAA2F;QAC3F,8FAA8F;QAC9F,mDAAmD;QACnD,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,2CAA2C;oBAC7E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yFAAyF;oBACzF,yFAAyF;oBACzF,wFAAwF;oBACxF,+DAA+D;oBAC/D,2FAA2F;oBAC3F,yFAAyF;oBACzF,wFAAwF;oBACxF,kDAAkD;oBAClD,EAAE;oBACF,sEAAsE;oBACtE,2FAA2F;oBAC3F,wFAAwF;oBACxF,qFAAqF;oBACrF,2FAA2F;oBAC3F,wFAAwF;oBACxF,oBAAoB;oBACpB,EAAE;oBACF,mFAAmF;oBACnF,oFAAoF;oBACpF,0BAA0B;oBAC1B,EAAE;oBACF,qFAAqF;oBACrF,mFAAmF;oBACnF,yFAAyF;oBACzF,mFAAmF;oBACnF,6FAA6F;oBAC7F,yFAAyF;oBACzF,kCAAkC;oBAClC,EAAE;oBACF,+EAA+E;oBAC/E,oFAAoF;oBACpF,kFAAkF;oBAClF,sFAAsF;oBACtF,yFAAyF;oBACzF,4EAA4E;oBAC5E,EAAE;oBACF,yFAAyF;oBACzF,sFAAsF;oBACtF,qFAAqF;oBACrF,wFAAwF;oBACxF,uFAAuF;oBACvF,mBAAmB;oBACnB,EAAE;oBACF,yFAAyF;oBACzF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,yCAAyC;oBACzC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qFAAqF;oBACrF,wFAAwF;oBACxF,kFAAkF;oBAClF,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,4BAA4B;oBAC9D,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,mFAAmF;oBACnF,mFAAmF;oBACnF,4EAA4E;oBAC5E,kFAAkF;oBAClF,+EAA+E;oBAC/E,gBAAgB;oBAChB,sFAAsF;oBACtF,2BAA2B;oBAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,yFAAyF;oBACzF,2EAA2E;oBAC3E,EAAE;oBACF,2EAA2E;oBAC3E,uFAAuF;oBACvF,uFAAuF;oBACvF,2EAA2E;oBAC3E,uFAAuF;oBACvF,qFAAqF;oBACrF,wBAAwB;oBACxB,EAAE;oBACF,uEAAuE;oBACvE,qFAAqF;oBACrF,+EAA+E;oBAC/E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qFAAqF;oBACrF,wFAAwF;oBACxF,kFAAkF;oBAClF,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Self Shared Resource Configuration\n *\n * Resource configuration for user self-management operations.\n * Handles profile management, preferences, and personal data operations.\n */\n\nimport { z } from 'zod';\nimport { UserSchema, UserStatus } from './users.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Custom operations enum for user self management\n//\n// PASSWORD CHANGE IS NOT A RESOURCE OPERATION — IT IS AN AUTH ROUTE. `CHANGE_PASSWORD` was\n// declared here as an `APP_USER`-gated `riskLevel: HIGH` operation taking\n// `{ currentPassword, newPassword, confirmPassword }`, and was removed on 2026-08-01: it was\n// ROUTED but never implemented, so the request fell through to the generic core UPDATE, which\n// persists only fields the resource schema declares. A password verifier is not one of them\n// (credentials are a separate store), so every call answered **HTTP 200 having changed nothing**\n// — the caller is told their password rotated while the old one still works.\n//\n// The real implementation already exists and is the ONLY correct home for it:\n// `POST /auth/password/change` → `AuthMethodManagementBackendService.changePassword`, which\n// verifies the current-password proof, applies the per-user-type password policy, hashes,\n// invalidates every refresh token for the user, and writes a `USER_PASSWORD_CHANGED` audit\n// record. It is rate-limited (5/min/IP) and parses its body with `z.strictObject` so an\n// identity field smuggled into the payload is rejected loudly rather than silently ignored.\n// The frontend already calls exactly that route (`AppPage_SecuritySettings` →\n// `getManualCallsHttpClient().passwordChange(...)`).\n//\n// Do NOT re-declare this as a resource operation. Beyond duplicating a solved problem, it would\n// route a plaintext credential through the generic resource-write pipeline (DTO parse, repository\n// projection, notification fan-out) that the auth route deliberately bypasses.\n// See the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n//\n// NOR ARE PROFILE / PREFERENCES WRITES — THEY BELONG TO THEIR OWN RESOURCES. `UPDATE_PROFILE` and\n// `UPDATE_PREFERENCES` were removed on 2026-08-01. Both ran `resourceOperationLike: UPDATE` against\n// THIS resource — whose `mainSchema` is the USER — while declaring the request DTO of a DIFFERENT\n// resource (`UserProfileSchema.partial()` / `UserPreferencesSchema.partial()`). A core UPDATE writes\n// only its own resource's row, so every declared field was dropped; the single intersecting key was\n// `_id`, which `ResourceOperationsHelper.cleanInputData` force-deletes before validation. The write\n// was therefore empty and the route answered **HTTP 200 having persisted nothing**.\n//\n// The persisted documents already have dedicated self-scoped resources, and they are already the\n// wired path: `USER_SELF_PROFILES` exposes READ/CREATE/UPDATE over its own `mainSchema`, while\n// `USER_SELF_PREFERENCES` exposes READ/UPDATE plus its selective reset operation over the eagerly\n// seeded preferences row. Both are embedded as child resources of this one in the frontend preset,\n// carry their own resource specifications, and — for preferences — are the MCP-exposed read/update\n// tools.\n// This resource's own specification already directed engineers there for \"the persisted documents\".\n//\n// Do NOT re-declare either verb here. A single `user_self`-rooted write across child resources\n// cannot be a core UPDATE at all; it would need a custom multi-resource implementation declaring\n// `transactionParticipants` — new machinery duplicating a path that already exists. Route clients\n// to `userSelfProfiles` / `userSelfPreferences` instead.\n//\n// NOR IS SELF-SERVICE ACCOUNT DELETION — DATA-SUBJECT ERASURE IS A SYSTEM-LEVEL API WITH NO ROUTE.\n// `DELETE_ACCOUNT` was removed on 2026-08-01. It was an `APP_USER`-gated `riskLevel: CRITICAL`\n// operation taking `{ password, reason }` and declaring a scheduled-deletion\n// `customResponseDto: { scheduledDeletionDate, recoveryPeriodDays, dataExportUrl }`. It was broken\n// in four independent ways, each verified against the built configuration:\n//\n//   - **The password was never verified.** Neither declared field is a persisted `UserSchema` path\n//     and no custom implementation was bound to the operation path, so the built `repositoryDto`\n//     was EMPTY: the controller strict-parsed the body, the repository re-parsed it, and both\n//     fields were discarded. A UI collecting the password as a confirmation gate was providing\n//     false assurance.\n//   - **It could never answer successfully.** `transformOutput` skips default-envelope composition\n//     for an op declaring a `customResponseDto` and validates the raw service output against it.\n//     A core DELETE returns the deleted `_id` as a bare string, so every call threw\n//     `service_resource_transformation_failed` → HTTP 500. Retries too: a second call returns `''`,\n//     which is not `null`, so it fails the same parse.\n//   - **Its destructive effect was NONDETERMINISTIC.** `resourceOperationLike: DELETE` reaches\n//     `_doDelete` through the repository's operations map (which holds custom ops), bypassing the\n//     `coreOperations` gate this config never opened — and fires `onParentDelete`. Neither\n//     `USER_SELF_PROFILES` nor `USER_SELF_PREFERENCES` declares a DELETE, so a user WITH either row\n//     hit `ErrorType.CONFIGURATION` inside the delete transaction and was rolled back, while a user\n//     with NEITHER row was destroyed. Same 500, opposite persistence outcomes.\n//   - **It contradicted this resource's own retention contract.** `retentionPolicy` below declares\n//     `RETAIN_AND_IMPERSONALIZE`: user rows are RETAINED and scrubbed in place, never hard-deleted.\n//\n// The erasure capability already exists and is the only correct home: `eraseSubjectAsSystem` /\n// `eraseSubjectInPlace` walk every dependent edge, derive delete-vs-retain from each edge's own\n// `onParentDelete` declaration, fail closed on unclassified edges, and return a\n// `SubjectErasureReport`. Like the four export/portability verbs removed the same day, they\n// **deliberately ship with NO ROUTE** — data-subject rights are a system-level API, not a\n// self-service HTTP verb. `dataExportUrl` compounded this: it named the portability artifact that\n// removal established does not exist.\n//\n// Do NOT re-declare this as a resource operation. Voluntary self-service closure is\n// `DEACTIVATE_ACCOUNT` below; actual erasure runs through the compliance capability. If a product\n// ever needs a user-initiated erasure REQUEST, it is a scheduling verb over a persisted\n// request state (with its own cancel path and a batch that calls `eraseSubjectAsSystem`) — not a\n// routed DELETE, and not something the generic core delete can express.\n// See the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n//\n// assurance-control: WILDO.DATA.SECURE_LIFECYCLE — a destructive identity operation\n// must verify the principal and leave evidence; erasure must honour the declared retention mode.\nexport enum UserSelf_Operations {\n  DEACTIVATE_ACCOUNT = 'deactivate_account', // Temporarily deactivate account\n  REACTIVATE_ACCOUNT = 'reactivate_account', // Reactivate account\n}\n\ntype UserSelfCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY;\n\n/*\nUser Self Resource Configuration Factory\n*/\nexport const userSelfResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof UserSelf_Operations,\n  UserSelfCoreOperations,\n  typeof UserSchema\n>({\n  mainSchema: UserSchema,\n  resourceIdentifier: CoreResourceType.USER_SELF,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_SELF],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Self-scoped\n\n  /**\n   * `/user-self/{userId}` names the CALLER. Declared EXPLICITLY even though `true` is the default,\n   * because the sibling `USERS` configuration — over the SAME collection, with the SAME\n   * `resourceFieldIdentifier` — declares `false`, and a reader comparing the two must be able to see\n   * that the difference is intentional rather than an omission.\n   *\n   * This is the value that keeps the horizontal-IDOR refusal alive: user A addressing user B's\n   * self row is refused `403 authorization_user_id_mismatch` by the identity-coherence guard. Pinned\n   * by `external-access-auth.e2e.ts` (M4) and `users-administration.e2e.ts` (U-11). Flipping this to\n   * `false` would open that hole silently — nothing downstream would catch it, because the addressed\n   * id still reaches the contextual filter and would scope the read to B.\n   */\n  primaryKeyIdentifiesInitiator: true,\n\n  /**\n   * ⚠️ MUST MIRROR `USERS`. This config and `USERS` are two doors onto the SAME rows: they share\n   * `UserSchema` above and, per `getCollectionNameForResource` in the zod→mongoose convertor,\n   * `USER_SELF` builds a SEPARATE Mongoose model over the `USERS` COLLECTION.\n   *\n   * Retention governance is per-resource-config, so a `USERS`-only opt-in would leave two holes on\n   * these shared rows:\n   *  - an ERASED user's row would stay READABLE and UPDATABLE through this door, whose READ/UPDATE\n   *    are open to `APP_USER` and would carry neither the retention hide filter nor the freeze;\n   *  - this model would emit a PLAIN unique index on `email` next to the `USERS` model's\n   *    retention-scoped one, so the SECOND erased user would collide (E11000) on the shared mask\n   *    address and abort the erasure.\n   *\n   * Declaring the same mode makes both models inject the same marker and emit the identical partial\n   * index, so the collection has one coherent retention contract. Change the two configs together.\n   * The scrub treatment needs no restating — it lives on the shared `UserSchema`.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Same subject as `USERS` over the same collection — the self-service door onto the identity row.\n   * Mirrors that config's `SELF_PRINCIPAL` declaration; the two must be changed together.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  /**\n   * Subject-export disclosure. The self-service export subject. The identity row is what the user signed up with.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject-export disclosure. The self-service export subject. The identity row is what the user signed up with.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    // LIST + UPDATE_MANY exist for the retention capability ONLY, as INTERNAL_CALL variants that\n    // register no route: `retentionPolicy` requires UPDATE_MANY (the in-place scrub via\n    // `updateManyAsSystem`) plus READ + LIST (the audited see-through read of retained rows). There\n    // is deliberately no HTTP \"list my selves\" — see the variants below.\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: UserSelf_Operations,\n\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, user reading their own data\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Default variant returns basic User data only\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // Retention capability only — INTERNAL_CALL registers NO HTTP route. A user-facing\n          // \"list my selves\" would be meaningless (this resource is addressed as the caller's own\n          // row); the op exists solely so `listRetainedAsSystem` has a read path through which a\n          // compliance auditor can see-through to retained rows on this collection.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY — see the UPDATE_MANY note below for why the\n          // distinction is load-bearing. `roles` is inert on a non-URL-bearing variant.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          // ⚠️ INTERNAL_CALL — registers NO HTTP route. This was an `API_CALL` open to\n          // `APP_USER` with an auto-derived request DTO, and on THIS resource the auto-derived\n          // user update DTO is `{status, appRoles, userTypes}`: every writable field on the\n          // `USER_SELF` row is server-owned. `email` is `.excludeFromUpdate()` and the editable\n          // self data (names, avatar, bio, phone / notification + UI preferences) lives on the\n          // `USER_SELF_PROFILES` and `USER_SELF_PREFERENCES` child resources, which is where the\n          // UI actually writes it. So the route offered a self-service caller nothing legitimate\n          // and three things it must never set:\n          //\n          //   - `appRoles`  — the app-level authorization axis. No ceiling gate exists on this\n          //     path (`assertRequestedRolesWithinCallerCeiling` is wired into org-member CREATE,\n          //     org-unit-members, oauth-clients and api-keys only, and no custom implementation is\n          //     registered for `USERS` / `USER_SELF`), so a plain authenticated user could grant\n          //     themselves any role, up to `APP_ADMIN_SUPER_ADMIN`.\n          //   - `userTypes` — selects auth policy and registration context.\n          //   - `status`    — the account lifecycle axis, which belongs to the dedicated\n          //     DEACTIVATE_ACCOUNT / REACTIVATE_ACCOUNT transitions below (and to the admin\n          //     SUSPEND_USER / UNSUSPEND_USER verbs on the `USERS` door). A self-service caller\n          //     flipping it directly bypasses every state gate those verbs declare.\n          //\n          // Narrowing `requestDto` would have left the route in place answering an empty write;\n          // removing the HTTP surface is the honest fix, because no caller wants it. Verified\n          // before the change: the engine presets surface no `UPDATE` action for `USER_SELF`\n          // (self edits go to the child resources), and no backend caller invokes `USER_SELF`\n          // update — the trusted internal door for user rows is `USERS`.\n          //\n          // The operation itself is KEPT (not dropped from `coreOperations`) because the custom\n          // self verbs borrow it through `resourceOperationLike: UPDATE`, and INTERNAL_CALL is\n          // the resource's established idiom for a route-less operation — see `LIST` and\n          // `UPDATE_MANY` above/below, and the note there on why INTERNAL_CALL rather than\n          // REPOSITORY_ONLY. `roles` is inert on a non-URL-bearing variant.\n          //\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a self-service surface\n          // must not be a privilege-assignment or lifecycle-override surface.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          // Retention capability only — INTERNAL_CALL registers NO HTTP route. Required by\n          // `retentionPolicy` because the impersonalize writer scrubs in place through\n          // `updateManyAsSystem`. A user bulk-updating rows through the self door would be\n          // nonsensical AND dangerous, so the only caller is the trusted system writer.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY. Both are route-less, but the three retention\n          // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n          // through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL / API_CALL /\n          // API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is excluded there and served by the separate\n          // `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant would satisfy the\n          // factory's boot guard and then FAIL TO RESOLVE when an erasure actually runs. `roles` is inert\n          // on a non-URL-bearing variant; the real gate is the derived `systemAccessPolicy` grant.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }\n      ],\n    },\n\n    // Profile / preferences writes ride the dedicated `USER_SELF_PROFILES` and\n    // `USER_SELF_PREFERENCES` resources — the `UPDATE_PROFILE` / `UPDATE_PREFERENCES` verbs were\n    // removed on 2026-08-01 (they declared another resource's schema, so they answered 200 having\n    // persisted nothing). Self-service account DELETION was removed the same day: erasure is a\n    // system-level API with no route, and a hard delete contradicted the `retentionPolicy` above.\n    // Both removals are explained in the enum comment.\n    [UserSelf_Operations.DEACTIVATE_ACCOUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, high risk - affects access\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory (ACTIVE → INACTIVE). INACTIVE, not\n          // SUSPENDED: the distinction is the point — SUSPENDED is imposed and only an admin lifts\n          // it, while INACTIVE is chosen and the user lifts it themselves via REACTIVATE_ACCOUNT.\n          // NO `reactivationDate`. It was declared here and persisted to\n          // `User.scheduledReactivationAt`, but nothing could ever honour it: the reactivation sweep\n          // dispatches each resource's own lifecycle verb, and the only verb that lifts `INACTIVE`\n          // is REACTIVATE_ACCOUNT below — self-scoped and `APP_USER`-gated, so a system principal\n          // cannot address another person's row through it.\n          //\n          // The two ways to make it work were both worse than the gap. Widening\n          // `users | unsuspend_user` to accept `INACTIVE` merges an IMPOSED suspension with a CHOSEN\n          // deactivation into one verb — two states whose whole distinction is who may lift them.\n          // And `admitsCrossSubjectUserAdministration` (the framework's per-variant \"this verb\n          // administers another person\" opt-in) relaxes WHOSE row may be addressed but never WHO may\n          // call, so putting it on an `APP_USER` verb would let any authenticated user reactivate\n          // anyone's account.\n          //\n          // Minting a new admin-tier reactivation verb purely to give the sweep a door would\n          // manufacture a routed surface nobody asked for — the exact pattern this workstream\n          // removed six times over.\n          //\n          // CORRECTED 2026-09-08 (#430). This paragraph used to end \"Voluntary deactivation is\n          // reversible by its subject at any time through REACTIVATE_ACCOUNT, so a scheduled\n          // auto-return was a convenience, not a promise\". That is FALSE, and it was load-bearing:\n          // it is the stated reason the auto-return was rejected. REACTIVATE_ACCOUNT needs a\n          // SESSION, and `_enforceUserStatus` (authentication-orchestrator.backend.service.ts:709-716)\n          // refuses every non-ACTIVE status at sign-in — so a self-deactivated person cannot reach\n          // the verb that would reverse it.\n          //\n          // RESOLVED, and the answer is that reversal is an ADMINISTRATIVE act: `users |\n          // reactivate_user` (INACTIVE → ACTIVE, `APP_ADMIN_SUPER_ADMIN`, mandatory `reason`,\n          // audited) is the door. So deactivation is NOT reversible by its subject, and the\n          // operation's own SPECIFICATION says so — that is where the words a person reads come\n          // from (`.claude/rules/display-text-comes-from-i18n.md`: display text is authored in the\n          // spec and generated into the label tree, never invented at the call site).\n          //\n          // The two alternatives rejected above are still rejected for the reasons given, which is\n          // why they are kept: widening `unsuspend_user` conflates an imposed suspension with a\n          // chosen departure, and `admitsCrossSubjectUserAdministration` on an `APP_USER` verb\n          // would let any authenticated user reactivate anyone. The third — admitting INACTIVE at\n          // sign-in with a session scoped to one verb — was rejected on #430 for widening what a\n          // sign-in returns.\n          //\n          // Note the ADMIN time-boxing is unaffected and IS honoured: `users | suspend_user` takes\n          // `suspensionDuration` and the hourly sweep lifts it, because `unsuspend_user` is a door a\n          // system principal can dispatch. That is the case that actually matters — an operator who\n          // said \"seven days\" must get seven days.\n          requestDto: z.object({\n            reason: z.string().max(500).optional(),\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          // Delivered even to a person who switched email notifications off (#409). An account\n          // lifecycle change is the alert that matters most precisely when the account holder did\n          // NOT perform it, and this email is how they find out. A preference about routine\n          // notifications must not be able to silence it.\n          alwaysDeliver: true,\n        }\n      ]\n    },\n\n    [UserSelf_Operations.REACTIVATE_ACCOUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, medium risk\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Self-service reactivation FORCES the one transition it names. Omitting\n          // `requestDto` would auto-derive the FULL user update DTO — which on this resource\n          // is `{status, appRoles, userTypes}` — so an end-user-facing verb would accept its\n          // own `appRoles` and `userTypes`, with no ceiling gate anywhere on the path\n          // (`assertRequestedRolesWithinCallerCeiling` is not called here). Narrowing to an\n          // empty contract removes the role surface entirely, which is why this needs no\n          // ceiling call.\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a self-service verb must not be a\n          // role-assignment surface.\n          requestDto: z.object({}),\n          // The transition itself is implemented by the SHARED status-transition factory, like its\n          // inverse DEACTIVATE_ACCOUNT above — not by a `basicPrefixOperation` here.\n          //\n          // It used to be the hook, and the asymmetry cost three things: the pending\n          // `scheduledReactivationAt` was never cleared (leaving a date on an ACTIVE row that no\n          // longer described anything), no transition audit row was emitted (so the self-service\n          // pair was half-trailed — the departure recorded, the return not), and the\n          // administrative-continuity floors did not run. Harmless individually, but it made the\n          // one lifecycle verb in the family that bypassed the shared authority the one nobody\n          // would think to check.\n          //\n          // The factory's registration declares `authoritativeFields: ['status',\n          // 'scheduledReactivationAt']`, which is what carries the patch past the repository's\n          // strict re-parse — the protection the hook's own declaration used to provide.\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          // Delivered even to a person who switched email notifications off (#409). An account\n          // lifecycle change is the alert that matters most precisely when the account holder did\n          // NOT perform it, and this email is how they find out. A preference about routine\n          // notifications must not be able to silence it.\n          alwaysDeliver: true,\n        }\n      ]\n    }\n  },\n});\n"]}
+{"version":3,"file":"user-self.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-self.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,kDAAkD;AAClD,EAAE;AACF,2FAA2F;AAC3F,0EAA0E;AAC1E,6FAA6F;AAC7F,8FAA8F;AAC9F,4FAA4F;AAC5F,iGAAiG;AACjG,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,4FAA4F;AAC5F,0FAA0F;AAC1F,2FAA2F;AAC3F,wFAAwF;AACxF,4FAA4F;AAC5F,8EAA8E;AAC9E,qDAAqD;AACrD,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,oFAAoF;AACpF,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,SAAS;AACT,oGAAoG;AACpG,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,yDAAyD;AACzD,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,6EAA6E;AAC7E,mGAAmG;AACnG,2EAA2E;AAC3E,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,8FAA8F;AAC9F,+FAA+F;AAC/F,uBAAuB;AACvB,mGAAmG;AACnG,iGAAiG;AACjG,oFAAoF;AACpF,oGAAoG;AACpG,uDAAuD;AACvD,+FAA+F;AAC/F,kGAAkG;AAClG,2FAA2F;AAC3F,oGAAoG;AACpG,oGAAoG;AACpG,+EAA+E;AAC/E,mGAAmG;AACnG,oGAAoG;AACpG,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,gFAAgF;AAChF,4FAA4F;AAC5F,0FAA0F;AAC1F,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,oFAAoF;AACpF,kGAAkG;AAClG,wFAAwF;AACxF,iGAAiG;AACjG,wEAAwE;AACxE,uEAAuE;AACvE,EAAE;AACF,oFAAoF;AACpF,iGAAiG;AACjG,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,gEAAyC,CAAA;IACzC,gEAAyC,CAAA;AAC3C,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B;AAQD;;EAEE;AACF,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI/J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;IAC9C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,SAAS,CAAC;IACvF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,cAAc;IAEtC;;;;;;;;;;;OAWG;IACH,6BAA6B,EAAE,IAAI;IAEnC;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEvE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,6FAA6F;QAC7F,oFAAoF;QACpF,gGAAgG;QAChG,qEAAqE;QACrE,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,mBAAmB;IAGpC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,4CAA4C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,+CAA+C;iBAChD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,mFAAmF;oBACnF,wFAAwF;oBACxF,uFAAuF;oBACvF,0EAA0E;oBAC1E,EAAE;oBACF,uFAAuF;oBACvF,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,6EAA6E;oBAC7E,qFAAqF;oBACrF,kFAAkF;oBAClF,sFAAsF;oBACtF,qFAAqF;oBACrF,uFAAuF;oBACvF,uFAAuF;oBACvF,sCAAsC;oBACtC,EAAE;oBACF,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,0DAA0D;oBAC1D,kEAAkE;oBAClE,+EAA+E;oBAC/E,kFAAkF;oBAClF,sFAAsF;oBACtF,0EAA0E;oBAC1E,EAAE;oBACF,sFAAsF;oBACtF,oFAAoF;oBACpF,mFAAmF;oBACnF,oFAAoF;oBACpF,+DAA+D;oBAC/D,EAAE;oBACF,sFAAsF;oBACtF,qFAAqF;oBACrF,+EAA+E;oBAC/E,iFAAiF;oBACjF,kEAAkE;oBAClE,EAAE;oBACF,2EAA2E;oBAC3E,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,iFAAiF;oBACjF,6EAA6E;oBAC7E,iFAAiF;oBACjF,8EAA8E;oBAC9E,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,0FAA0F;oBAC1F,wFAAwF;oBACxF,6FAA6F;oBAC7F,gGAAgG;oBAChG,yFAAyF;oBACzF,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,2EAA2E;QAC3E,6FAA6F;QAC7F,8FAA8F;QAC9F,2FAA2F;QAC3F,8FAA8F;QAC9F,mDAAmD;QACnD,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,2CAA2C;oBAC7E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yFAAyF;oBACzF,yFAAyF;oBACzF,wFAAwF;oBACxF,+DAA+D;oBAC/D,2FAA2F;oBAC3F,yFAAyF;oBACzF,wFAAwF;oBACxF,kDAAkD;oBAClD,EAAE;oBACF,sEAAsE;oBACtE,2FAA2F;oBAC3F,wFAAwF;oBACxF,qFAAqF;oBACrF,2FAA2F;oBAC3F,wFAAwF;oBACxF,oBAAoB;oBACpB,EAAE;oBACF,mFAAmF;oBACnF,oFAAoF;oBACpF,0BAA0B;oBAC1B,EAAE;oBACF,qFAAqF;oBACrF,mFAAmF;oBACnF,yFAAyF;oBACzF,mFAAmF;oBACnF,6FAA6F;oBAC7F,yFAAyF;oBACzF,kCAAkC;oBAClC,EAAE;oBACF,+EAA+E;oBAC/E,oFAAoF;oBACpF,kFAAkF;oBAClF,sFAAsF;oBACtF,yFAAyF;oBACzF,4EAA4E;oBAC5E,EAAE;oBACF,yFAAyF;oBACzF,sFAAsF;oBACtF,qFAAqF;oBACrF,wFAAwF;oBACxF,uFAAuF;oBACvF,mBAAmB;oBACnB,EAAE;oBACF,yFAAyF;oBACzF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,yCAAyC;oBACzC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6GAA6G,CAAC;qBAC/J,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qFAAqF;oBACrF,wFAAwF;oBACxF,kFAAkF;oBAClF,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,4BAA4B;oBAC9D,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,mFAAmF;oBACnF,mFAAmF;oBACnF,4EAA4E;oBAC5E,kFAAkF;oBAClF,+EAA+E;oBAC/E,gBAAgB;oBAChB,sFAAsF;oBACtF,2BAA2B;oBAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,yFAAyF;oBACzF,2EAA2E;oBAC3E,EAAE;oBACF,2EAA2E;oBAC3E,uFAAuF;oBACvF,uFAAuF;oBACvF,2EAA2E;oBAC3E,uFAAuF;oBACvF,qFAAqF;oBACrF,wBAAwB;oBACxB,EAAE;oBACF,uEAAuE;oBACvE,qFAAqF;oBACrF,+EAA+E;oBAC/E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qFAAqF;oBACrF,wFAAwF;oBACxF,kFAAkF;oBAClF,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Self Shared Resource Configuration\n *\n * Resource configuration for user self-management operations.\n * Handles profile management, preferences, and personal data operations.\n */\n\nimport { z } from 'zod';\nimport { UserSchema, UserStatus } from './users.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Custom operations enum for user self management\n//\n// PASSWORD CHANGE IS NOT A RESOURCE OPERATION — IT IS AN AUTH ROUTE. `CHANGE_PASSWORD` was\n// declared here as an `APP_USER`-gated `riskLevel: HIGH` operation taking\n// `{ currentPassword, newPassword, confirmPassword }`, and was removed on 2026-08-01: it was\n// ROUTED but never implemented, so the request fell through to the generic core UPDATE, which\n// persists only fields the resource schema declares. A password verifier is not one of them\n// (credentials are a separate store), so every call answered **HTTP 200 having changed nothing**\n// — the caller is told their password rotated while the old one still works.\n//\n// The real implementation already exists and is the ONLY correct home for it:\n// `POST /auth/password/change` → `AuthMethodManagementBackendService.changePassword`, which\n// verifies the current-password proof, applies the per-user-type password policy, hashes,\n// invalidates every refresh token for the user, and writes a `USER_PASSWORD_CHANGED` audit\n// record. It is rate-limited (5/min/IP) and parses its body with `z.strictObject` so an\n// identity field smuggled into the payload is rejected loudly rather than silently ignored.\n// The frontend already calls exactly that route (`AppPage_SecuritySettings` →\n// `getManualCallsHttpClient().passwordChange(...)`).\n//\n// Do NOT re-declare this as a resource operation. Beyond duplicating a solved problem, it would\n// route a plaintext credential through the generic resource-write pipeline (DTO parse, repository\n// projection, notification fan-out) that the auth route deliberately bypasses.\n// See the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n//\n// NOR ARE PROFILE / PREFERENCES WRITES — THEY BELONG TO THEIR OWN RESOURCES. `UPDATE_PROFILE` and\n// `UPDATE_PREFERENCES` were removed on 2026-08-01. Both ran `resourceOperationLike: UPDATE` against\n// THIS resource — whose `mainSchema` is the USER — while declaring the request DTO of a DIFFERENT\n// resource (`UserProfileSchema.partial()` / `UserPreferencesSchema.partial()`). A core UPDATE writes\n// only its own resource's row, so every declared field was dropped; the single intersecting key was\n// `_id`, which `ResourceOperationsHelper.cleanInputData` force-deletes before validation. The write\n// was therefore empty and the route answered **HTTP 200 having persisted nothing**.\n//\n// The persisted documents already have dedicated self-scoped resources, and they are already the\n// wired path: `USER_SELF_PROFILES` exposes READ/CREATE/UPDATE over its own `mainSchema`, while\n// `USER_SELF_PREFERENCES` exposes READ/UPDATE plus its selective reset operation over the eagerly\n// seeded preferences row. Both are embedded as child resources of this one in the frontend preset,\n// carry their own resource specifications, and — for preferences — are the MCP-exposed read/update\n// tools.\n// This resource's own specification already directed engineers there for \"the persisted documents\".\n//\n// Do NOT re-declare either verb here. A single `user_self`-rooted write across child resources\n// cannot be a core UPDATE at all; it would need a custom multi-resource implementation declaring\n// `transactionParticipants` — new machinery duplicating a path that already exists. Route clients\n// to `userSelfProfiles` / `userSelfPreferences` instead.\n//\n// NOR IS SELF-SERVICE ACCOUNT DELETION — DATA-SUBJECT ERASURE IS A SYSTEM-LEVEL API WITH NO ROUTE.\n// `DELETE_ACCOUNT` was removed on 2026-08-01. It was an `APP_USER`-gated `riskLevel: CRITICAL`\n// operation taking `{ password, reason }` and declaring a scheduled-deletion\n// `customResponseDto: { scheduledDeletionDate, recoveryPeriodDays, dataExportUrl }`. It was broken\n// in four independent ways, each verified against the built configuration:\n//\n//   - **The password was never verified.** Neither declared field is a persisted `UserSchema` path\n//     and no custom implementation was bound to the operation path, so the built `repositoryDto`\n//     was EMPTY: the controller strict-parsed the body, the repository re-parsed it, and both\n//     fields were discarded. A UI collecting the password as a confirmation gate was providing\n//     false assurance.\n//   - **It could never answer successfully.** `transformOutput` skips default-envelope composition\n//     for an op declaring a `customResponseDto` and validates the raw service output against it.\n//     A core DELETE returns the deleted `_id` as a bare string, so every call threw\n//     `service_resource_transformation_failed` → HTTP 500. Retries too: a second call returns `''`,\n//     which is not `null`, so it fails the same parse.\n//   - **Its destructive effect was NONDETERMINISTIC.** `resourceOperationLike: DELETE` reaches\n//     `_doDelete` through the repository's operations map (which holds custom ops), bypassing the\n//     `coreOperations` gate this config never opened — and fires `onParentDelete`. Neither\n//     `USER_SELF_PROFILES` nor `USER_SELF_PREFERENCES` declares a DELETE, so a user WITH either row\n//     hit `ErrorType.CONFIGURATION` inside the delete transaction and was rolled back, while a user\n//     with NEITHER row was destroyed. Same 500, opposite persistence outcomes.\n//   - **It contradicted this resource's own retention contract.** `retentionPolicy` below declares\n//     `RETAIN_AND_IMPERSONALIZE`: user rows are RETAINED and scrubbed in place, never hard-deleted.\n//\n// The erasure capability already exists and is the only correct home: `eraseSubjectAsSystem` /\n// `eraseSubjectInPlace` walk every dependent edge, derive delete-vs-retain from each edge's own\n// `onParentDelete` declaration, fail closed on unclassified edges, and return a\n// `SubjectErasureReport`. Like the four export/portability verbs removed the same day, they\n// **deliberately ship with NO ROUTE** — data-subject rights are a system-level API, not a\n// self-service HTTP verb. `dataExportUrl` compounded this: it named the portability artifact that\n// removal established does not exist.\n//\n// Do NOT re-declare this as a resource operation. Voluntary self-service closure is\n// `DEACTIVATE_ACCOUNT` below; actual erasure runs through the compliance capability. If a product\n// ever needs a user-initiated erasure REQUEST, it is a scheduling verb over a persisted\n// request state (with its own cancel path and a batch that calls `eraseSubjectAsSystem`) — not a\n// routed DELETE, and not something the generic core delete can express.\n// See the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n//\n// assurance-control: WILDO.DATA.SECURE_LIFECYCLE — a destructive identity operation\n// must verify the principal and leave evidence; erasure must honour the declared retention mode.\nexport enum UserSelf_Operations {\n  DEACTIVATE_ACCOUNT = 'deactivate_account', // Temporarily deactivate account\n  REACTIVATE_ACCOUNT = 'reactivate_account', // Reactivate account\n}\n\ntype UserSelfCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY;\n\n/*\nUser Self Resource Configuration Factory\n*/\nexport const userSelfResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof UserSelf_Operations,\n  UserSelfCoreOperations,\n  typeof UserSchema\n>({\n  mainSchema: UserSchema,\n  resourceIdentifier: CoreResourceType.USER_SELF,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_SELF],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Self-scoped\n\n  /**\n   * `/user-self/{userId}` names the CALLER. Declared EXPLICITLY even though `true` is the default,\n   * because the sibling `USERS` configuration — over the SAME collection, with the SAME\n   * `resourceFieldIdentifier` — declares `false`, and a reader comparing the two must be able to see\n   * that the difference is intentional rather than an omission.\n   *\n   * This is the value that keeps the horizontal-IDOR refusal alive: user A addressing user B's\n   * self row is refused `403 authorization_user_id_mismatch` by the identity-coherence guard. Pinned\n   * by `external-access-auth.e2e.ts` (M4) and `users-administration.e2e.ts` (U-11). Flipping this to\n   * `false` would open that hole silently — nothing downstream would catch it, because the addressed\n   * id still reaches the contextual filter and would scope the read to B.\n   */\n  primaryKeyIdentifiesInitiator: true,\n\n  /**\n   * ⚠️ MUST MIRROR `USERS`. This config and `USERS` are two doors onto the SAME rows: they share\n   * `UserSchema` above and, per `getCollectionNameForResource` in the zod→mongoose convertor,\n   * `USER_SELF` builds a SEPARATE Mongoose model over the `USERS` COLLECTION.\n   *\n   * Retention governance is per-resource-config, so a `USERS`-only opt-in would leave two holes on\n   * these shared rows:\n   *  - an ERASED user's row would stay READABLE and UPDATABLE through this door, whose READ/UPDATE\n   *    are open to `APP_USER` and would carry neither the retention hide filter nor the freeze;\n   *  - this model would emit a PLAIN unique index on `email` next to the `USERS` model's\n   *    retention-scoped one, so the SECOND erased user would collide (E11000) on the shared mask\n   *    address and abort the erasure.\n   *\n   * Declaring the same mode makes both models inject the same marker and emit the identical partial\n   * index, so the collection has one coherent retention contract. Change the two configs together.\n   * The scrub treatment needs no restating — it lives on the shared `UserSchema`.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Same subject as `USERS` over the same collection — the self-service door onto the identity row.\n   * Mirrors that config's `SELF_PRINCIPAL` declaration; the two must be changed together.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  /**\n   * Subject-export disclosure. The self-service export subject. The identity row is what the user signed up with.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject-export disclosure. The self-service export subject. The identity row is what the user signed up with.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    // LIST + UPDATE_MANY exist for the retention capability ONLY, as INTERNAL_CALL variants that\n    // register no route: `retentionPolicy` requires UPDATE_MANY (the in-place scrub via\n    // `updateManyAsSystem`) plus READ + LIST (the audited see-through read of retained rows). There\n    // is deliberately no HTTP \"list my selves\" — see the variants below.\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: UserSelf_Operations,\n\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, user reading their own data\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Default variant returns basic User data only\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // Retention capability only — INTERNAL_CALL registers NO HTTP route. A user-facing\n          // \"list my selves\" would be meaningless (this resource is addressed as the caller's own\n          // row); the op exists solely so `listRetainedAsSystem` has a read path through which a\n          // compliance auditor can see-through to retained rows on this collection.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY — see the UPDATE_MANY note below for why the\n          // distinction is load-bearing. `roles` is inert on a non-URL-bearing variant.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          // ⚠️ INTERNAL_CALL — registers NO HTTP route. This was an `API_CALL` open to\n          // `APP_USER` with an auto-derived request DTO, and on THIS resource the auto-derived\n          // user update DTO is `{status, appRoles, userTypes}`: every writable field on the\n          // `USER_SELF` row is server-owned. `email` is `.excludeFromUpdate()` and the editable\n          // self data (names, avatar, bio, phone / notification + UI preferences) lives on the\n          // `USER_SELF_PROFILES` and `USER_SELF_PREFERENCES` child resources, which is where the\n          // UI actually writes it. So the route offered a self-service caller nothing legitimate\n          // and three things it must never set:\n          //\n          //   - `appRoles`  — the app-level authorization axis. No ceiling gate exists on this\n          //     path (`assertRequestedRolesWithinCallerCeiling` is wired into org-member CREATE,\n          //     org-unit-members, oauth-clients and api-keys only, and no custom implementation is\n          //     registered for `USERS` / `USER_SELF`), so a plain authenticated user could grant\n          //     themselves any role, up to `APP_ADMIN_SUPER_ADMIN`.\n          //   - `userTypes` — selects auth policy and registration context.\n          //   - `status`    — the account lifecycle axis, which belongs to the dedicated\n          //     DEACTIVATE_ACCOUNT / REACTIVATE_ACCOUNT transitions below (and to the admin\n          //     SUSPEND_USER / UNSUSPEND_USER verbs on the `USERS` door). A self-service caller\n          //     flipping it directly bypasses every state gate those verbs declare.\n          //\n          // Narrowing `requestDto` would have left the route in place answering an empty write;\n          // removing the HTTP surface is the honest fix, because no caller wants it. Verified\n          // before the change: the engine presets surface no `UPDATE` action for `USER_SELF`\n          // (self edits go to the child resources), and no backend caller invokes `USER_SELF`\n          // update — the trusted internal door for user rows is `USERS`.\n          //\n          // The operation itself is KEPT (not dropped from `coreOperations`) because the custom\n          // self verbs borrow it through `resourceOperationLike: UPDATE`, and INTERNAL_CALL is\n          // the resource's established idiom for a route-less operation — see `LIST` and\n          // `UPDATE_MANY` above/below, and the note there on why INTERNAL_CALL rather than\n          // REPOSITORY_ONLY. `roles` is inert on a non-URL-bearing variant.\n          //\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a self-service surface\n          // must not be a privilege-assignment or lifecycle-override surface.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          // Retention capability only — INTERNAL_CALL registers NO HTTP route. Required by\n          // `retentionPolicy` because the impersonalize writer scrubs in place through\n          // `updateManyAsSystem`. A user bulk-updating rows through the self door would be\n          // nonsensical AND dangerous, so the only caller is the trusted system writer.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY. Both are route-less, but the three retention\n          // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n          // through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL / API_CALL /\n          // API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is excluded there and served by the separate\n          // `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant would satisfy the\n          // factory's boot guard and then FAIL TO RESOLVE when an erasure actually runs. `roles` is inert\n          // on a non-URL-bearing variant; the real gate is the derived `systemAccessPolicy` grant.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }\n      ],\n    },\n\n    // Profile / preferences writes ride the dedicated `USER_SELF_PROFILES` and\n    // `USER_SELF_PREFERENCES` resources — the `UPDATE_PROFILE` / `UPDATE_PREFERENCES` verbs were\n    // removed on 2026-08-01 (they declared another resource's schema, so they answered 200 having\n    // persisted nothing). Self-service account DELETION was removed the same day: erasure is a\n    // system-level API with no route, and a hard delete contradicted the `retentionPolicy` above.\n    // Both removals are explained in the enum comment.\n    [UserSelf_Operations.DEACTIVATE_ACCOUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, high risk - affects access\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory (ACTIVE → INACTIVE). INACTIVE, not\n          // SUSPENDED: the distinction is the point — SUSPENDED is imposed and only an admin lifts\n          // it, while INACTIVE is chosen and the user lifts it themselves via REACTIVATE_ACCOUNT.\n          // NO `reactivationDate`. It was declared here and persisted to\n          // `User.scheduledReactivationAt`, but nothing could ever honour it: the reactivation sweep\n          // dispatches each resource's own lifecycle verb, and the only verb that lifts `INACTIVE`\n          // is REACTIVATE_ACCOUNT below — self-scoped and `APP_USER`-gated, so a system principal\n          // cannot address another person's row through it.\n          //\n          // The two ways to make it work were both worse than the gap. Widening\n          // `users | unsuspend_user` to accept `INACTIVE` merges an IMPOSED suspension with a CHOSEN\n          // deactivation into one verb — two states whose whole distinction is who may lift them.\n          // And `admitsCrossSubjectUserAdministration` (the framework's per-variant \"this verb\n          // administers another person\" opt-in) relaxes WHOSE row may be addressed but never WHO may\n          // call, so putting it on an `APP_USER` verb would let any authenticated user reactivate\n          // anyone's account.\n          //\n          // Minting a new admin-tier reactivation verb purely to give the sweep a door would\n          // manufacture a routed surface nobody asked for — the exact pattern this workstream\n          // removed six times over.\n          //\n          // CORRECTED 2026-09-08 (#430). This paragraph used to end \"Voluntary deactivation is\n          // reversible by its subject at any time through REACTIVATE_ACCOUNT, so a scheduled\n          // auto-return was a convenience, not a promise\". That is FALSE, and it was load-bearing:\n          // it is the stated reason the auto-return was rejected. REACTIVATE_ACCOUNT needs a\n          // SESSION, and `_enforceUserStatus` (authentication-orchestrator.backend.service.ts:709-716)\n          // refuses every non-ACTIVE status at sign-in — so a self-deactivated person cannot reach\n          // the verb that would reverse it.\n          //\n          // RESOLVED, and the answer is that reversal is an ADMINISTRATIVE act: `users |\n          // reactivate_user` (INACTIVE → ACTIVE, `APP_ADMIN_SUPER_ADMIN`, mandatory `reason`,\n          // audited) is the door. So deactivation is NOT reversible by its subject, and the\n          // operation's own SPECIFICATION says so — that is where the words a person reads come\n          // from (`.claude/rules/display-text-comes-from-i18n.md`: display text is authored in the\n          // spec and generated into the label tree, never invented at the call site).\n          //\n          // The two alternatives rejected above are still rejected for the reasons given, which is\n          // why they are kept: widening `unsuspend_user` conflates an imposed suspension with a\n          // chosen departure, and `admitsCrossSubjectUserAdministration` on an `APP_USER` verb\n          // would let any authenticated user reactivate anyone. The third — admitting INACTIVE at\n          // sign-in with a session scoped to one verb — was rejected on #430 for widening what a\n          // sign-in returns.\n          //\n          // Note the ADMIN time-boxing is unaffected and IS honoured: `users | suspend_user` takes\n          // `suspensionDuration` and the hourly sweep lifts it, because `unsuspend_user` is a door a\n          // system principal can dispatch. That is the case that actually matters — an operator who\n          // said \"seven days\" must get seven days.\n          requestDto: z.object({\n            reason: z.string().max(500).optional().describe('Why you are deactivating your account, if you want to say. Recorded on the audit trail, not on the account.'),\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          // Delivered even to a person who switched email notifications off (#409). An account\n          // lifecycle change is the alert that matters most precisely when the account holder did\n          // NOT perform it, and this email is how they find out. A preference about routine\n          // notifications must not be able to silence it.\n          alwaysDeliver: true,\n        }\n      ]\n    },\n\n    [UserSelf_Operations.REACTIVATE_ACCOUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, medium risk\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Self-service reactivation FORCES the one transition it names. Omitting\n          // `requestDto` would auto-derive the FULL user update DTO — which on this resource\n          // is `{status, appRoles, userTypes}` — so an end-user-facing verb would accept its\n          // own `appRoles` and `userTypes`, with no ceiling gate anywhere on the path\n          // (`assertRequestedRolesWithinCallerCeiling` is not called here). Narrowing to an\n          // empty contract removes the role surface entirely, which is why this needs no\n          // ceiling call.\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a self-service verb must not be a\n          // role-assignment surface.\n          requestDto: z.object({}),\n          // The transition itself is implemented by the SHARED status-transition factory, like its\n          // inverse DEACTIVATE_ACCOUNT above — not by a `basicPrefixOperation` here.\n          //\n          // It used to be the hook, and the asymmetry cost three things: the pending\n          // `scheduledReactivationAt` was never cleared (leaving a date on an ACTIVE row that no\n          // longer described anything), no transition audit row was emitted (so the self-service\n          // pair was half-trailed — the departure recorded, the return not), and the\n          // administrative-continuity floors did not run. Harmless individually, but it made the\n          // one lifecycle verb in the family that bypassed the shared authority the one nobody\n          // would think to check.\n          //\n          // The factory's registration declares `authoritativeFields: ['status',\n          // 'scheduledReactivationAt']`, which is what carries the patch past the repository's\n          // strict re-parse — the protection the hook's own declaration used to provide.\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          // Delivered even to a person who switched email notifications off (#409). An account\n          // lifecycle change is the alert that matters most precisely when the account holder did\n          // NOT perform it, and this email is how they find out. A preference about routine\n          // notifications must not be able to silence it.\n          alwaysDeliver: true,\n        }\n      ]\n    }\n  },\n});\n"]}

package/dist/esm/users/users.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AA4HjF,oBAAY,gBAAgB;IAC1B,YAAY,iBAAiB,CAAE,2BAA2B;IAC1D,YAAY,iBAAiB,CAAE,2BAA2B;IAC1D,YAAY,iBAAiB,CAAE,uBAAuB;IACtD,cAAc,mBAAmB,CAAE,yBAAyB;IAC5D,eAAe,oBAAoB,CAAE,4DAA4D;IACjG,oBAAoB,yBAAyB,CAAE,uBAAuB;IACtE;;;;;;;;;;;;;OAaG;IACH,aAAa,kBAAkB;CAChC;AAED,KAAK,mBAAmB,GACpB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,gDAAgD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;kBAioB7G,CAAC"}
+{"version":3,"file":"users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AA6JjF,oBAAY,gBAAgB;IAC1B,YAAY,iBAAiB,CAAE,2BAA2B;IAC1D,YAAY,iBAAiB,CAAE,2BAA2B;IAC1D,YAAY,iBAAiB,CAAE,uBAAuB;IACtD,cAAc,mBAAmB,CAAE,yBAAyB;IAC5D,eAAe,oBAAoB,CAAE,4DAA4D;IACjG,oBAAoB,yBAAyB,CAAE,uBAAuB;IACtE;;;;;;;;;;;;;OAaG;IACH,aAAa,kBAAkB;CAChC;AAED,KAAK,mBAAmB,GACpB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,gDAAgD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;kBAkqB7G,CAAC"}