@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/testing/resource-config-builders.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-config-builders.js","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EACL,qBAAqB,GAGtB,MAAM,gDAAgD,CAAC;AAMxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,UAAU,gBAAgB,CAAC,SAAuC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;QAClF,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,oBAAoB,EAAE,SAAS;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrC,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD;;;;;WAKG;QACH,cAAc,EAAE;YACd,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,KAAK;YACvB,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,EAAE;QAC1B,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,IAAI;SACpC;QACD,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAwB,EACxB,sBAA6C,qBAAqB,CAAC,IAAI;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,gBAAgB,EAAE,KAAK;QACvB,mBAAmB;QACnB,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,QAAe;QACnC,2BAA2B,EAAE,EAAE;QAC/B,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,qBAAqB,EAAE,SAAS;QAChC,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,0BAA0B,CAAC,GAAG;QACzC,KAAK,EAAE,EAAE;QACT,gCAAgC,EAAE,EAAE;QACpC,oBAAoB,EAAE,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,sBAAsB,EAAE,KAAK;QAC7B,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,SAAS;KAC4B,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAwB,EACxB,UAA4D;IAE5D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,SAAS;QAC1B,UAAU;QACV,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,2BAA2B,EAAE,SAAS;QACtC,gBAAgB,EAAE,KAAK;QACvB,iGAAiG;QACjG,cAAc,EAAE,KAAK;QACrB,4FAA4F;QAC5F,mBAAmB,EAAE,2BAA2B,CAAC,GAAG;QACpD,UAAU;KACoC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,kBAA0B,EAC1B,qBAA6C;IAE7C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;IAEF,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACxB,CAAC;IAEF,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAE7F,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE7E,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,kBAA0B,EAC1B,qBAA6C;IAE7C,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,EAAE,kBAAkB;QACrC,GAAG,CAAC,aAAa,CAAC,MAAM;QACxB,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CAAC,CACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared helpers for saas-models tests: minimal resource configs, auth fixtures,\n * and relationship processing that mirrors `createResourceConfiguration_Initialization`.\n *\n * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.\n */\nimport type { z } from 'zod';\nimport {\n  EmailVerificationMode,\n  RegistrationMode,\n  type UserTypeAuthPolicy,\n} from '../config/entity-identity-config.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport {\n  CoreResourceOperation,\n  ResourceFieldIdentifier,\n  ResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport type {\n  ResourceConfiguration,\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_ResourceRelationships,\n} from '../resources/resources-config.shared.schemas';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceTranspositionPolicy,\n} from '../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../resources/resources.shared.utils';\n\nexport function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy {\n  return {\n    authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.MAGIC_LINK]: true },\n    mfaPolicy: {\n      requireMFA: false,\n      requireStrongMFA: false,\n      acceptableMFAMethods: undefined,\n      enrollmentGracePeriodDays: 14,\n      passkeyExemptFromMFA: true,\n    },\n    registration: {\n      mode: RegistrationMode.OPEN,\n      allowedMethods: [AuthMethod.PASSWORD],\n      emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n      blockForSSODomains: false,\n    },\n    /*\n     * Mirrors the production default (#1249). It did not: this builder said `requireNumbers: false`\n     * while all five production declarations said `true`, so every test written against it validated a\n     * policy no application had. That is worth more than the fix — a test double that drifts from the\n     * thing it doubles reports on a product that does not exist.\n     */\n    passwordPolicy: {\n      minLength: 15,\n      maxLength: 128,\n      requireUppercase: false,\n      requireLowercase: false,\n      requireNumbers: false,\n      requireSpecialChars: false,\n      expiryDays: 0,\n    },\n    sessionDurationMinutes: 30,\n    lockoutPolicy: {\n      maxLoginAttempts: 5,\n      lockoutDurationMinutes: 30,\n      progressiveLockout: false,\n      maxProgressiveLockoutHours: 24,\n    },\n    autoLinkByEmail: true,\n    methodManagement: {\n      allowUserMethodRemoval: true,\n      requireReauthForMethodChanges: true,\n    },\n    ...overrides,\n  } as UserTypeAuthPolicy;\n}\n\n/**\n * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.\n *\n * **Not** the same symbol as `createTestOperation` in `@wildo-ai/saas-backend-lib/testing`\n * (`feature-test-utils.ts`), which builds operation stubs for **feature-gate** tests.\n */\nexport function createTestOperation(\n  mainSchema: z.ZodTypeAny,\n  operationIdentifier: CoreResourceOperation = CoreResourceOperation.READ\n): ResourceConfiguration_Operation<any, any, any> {\n  return {\n    isDisabled: false,\n    mainSchema,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    isSystemResource: false,\n    operationIdentifier,\n    isOperationDefault: true,\n    serviceRuntimeMode: 'INLINE' as any,\n    notificationBadgeOperations: [],\n    userNotifications: [],\n    m2mNotifications: [],\n    variantType: ResourceOperationVariantType.API_CALL,\n    resourceOperationLike: undefined,\n    requiredFeatures: undefined,\n    riskLevel: ResourceOperationRiskLevel.LOW,\n    roles: [],\n    customServiceImplementationModes: [],\n    basicPrefixOperation: undefined,\n    httpVerb: HttpMethod.GET,\n    isApiKeyAccessDisabled: false,\n    isBulkOperation: false,\n    consumableToken: undefined,\n    enabledCondition: undefined,\n    isDefault: true,\n    variantKey: undefined,\n  } as ResourceConfiguration_Operation<any, any, any>;\n}\n\nexport function createTestResourceConfig(\n  mainSchema: z.ZodTypeAny,\n  operations: ResourceConfiguration_Operation<any, any, any>[]\n): ResourceConfiguration<any, any, any> {\n  return {\n    isDisabled: false,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    coreOperations: [],\n    customOperation: undefined,\n    mainSchema,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    inheritenceSchemaDefinition: undefined,\n    isSystemResource: false,\n    /** W7.3a: test fixtures default to non-anonymizable unless overrides replace the full config. */\n    isAnonymizable: false,\n    /** Required by type; only applied when `isAnonymizable` is true (engine default is ADD). */\n    transpositionPolicy: ResourceTranspositionPolicy.ADD,\n    operations,\n  } satisfies ResourceConfiguration<any, any, any>;\n}\n\n/**\n * Process relationships for a resource — mirrors the logic in createResourceConfiguration_Initialization.\n * M:N relationships are transformed into 1:N relationships for the junction table.\n *\n * The helper expects compiled runtime relationships, matching the production\n * factory output from `createResourcesRelationship()` / registry initialization.\n */\nexport function processResourceRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceConfiguration_ResourceRelationships {\n  const compileSyntheticRelationship = (\n    relationshipDeclaration: ResourceRelationshipDeclaration\n  ): ResourceRelationship =>\n    Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n  const activeRelationships = resourceRelationships.filter((rel) => !rel.isDisabled);\n\n  const isManyToMany = (rel: ResourceRelationship) =>\n    rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n    rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n    rel.jointResourceType;\n\n  const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n    parentRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType2 === resourceIdentifier &&\n        rel.resourceType1 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    childRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    selfRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 === resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n  };\n\n  const manyToManyRelationships = activeRelationships.filter(\n    (rel) =>\n      rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n      rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n      rel.jointResourceType\n  );\n\n  manyToManyRelationships.forEach((m2mRel) => {\n    Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n    const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType } = m2mRel;\n\n    if (resourceIdentifier === jointResourceType) {\n      const relationFromEntity1 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity1Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity1);\n\n      const relationFromEntity2 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity2Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity2);\n    } else if (resourceIdentifier === entity1Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    } else if (resourceIdentifier === entity2Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    }\n  });\n\n  return processedResourceRelationships;\n}\n\n/**\n * Conditional relationships — active only for specific discriminator variants.\n */\nexport function getConditionalRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceRelationship[] {\n  return resourceRelationships.filter(\n    (rel) =>\n      rel.discriminator?.discriminatorField &&\n      rel.discriminator.values &&\n      rel.discriminator.values.length > 0 &&\n      (rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier)\n  );\n}\n"]}
+{"version":3,"file":"resource-config-builders.js","sourceRoot":"","sources":["../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EACL,qBAAqB,GAGtB,MAAM,gDAAgD,CAAC;AAMxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,UAAU,gBAAgB,CAAC,SAAuC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;QAClF,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,oBAAoB,EAAE,SAAS;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrC,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD;;;;;WAKG;QACH,cAAc,EAAE;YACd,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,KAAK;YACvB,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,EAAE;QAC1B,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,IAAI;SACpC;QACD,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAwB,EACxB,sBAA6C,qBAAqB,CAAC,IAAI;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,gBAAgB,EAAE,KAAK;QACvB,mBAAmB;QACnB,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,QAAe;QACnC,2BAA2B,EAAE,EAAE;QAC/B,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,qBAAqB,EAAE,SAAS;QAChC,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,0BAA0B,CAAC,GAAG;QACzC,KAAK,EAAE,EAAE;QACT,gCAAgC,EAAE,EAAE;QACpC,oBAAoB,EAAE,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,sBAAsB,EAAE,KAAK;QAC7B,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,SAAS;KAC4B,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAwB,EACxB,UAA4D;IAE5D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,SAAS;QAC1B,UAAU;QACV,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,2BAA2B,EAAE,SAAS;QACtC,gBAAgB,EAAE,KAAK;QACvB,iGAAiG;QACjG,cAAc,EAAE,KAAK;QACrB,4FAA4F;QAC5F,mBAAmB,EAAE,2BAA2B,CAAC,GAAG;QACpD,UAAU;KACoC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,kBAA0B,EAC1B,qBAA6C;IAE7C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;IAEF,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACxB,CAAC;IAEF,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAE7F,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE7E,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,kBAA0B,EAC1B,qBAA6C;IAE7C,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,EAAE,kBAAkB;QACrC,GAAG,CAAC,aAAa,CAAC,MAAM;QACxB,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CAAC,CACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared helpers for saas-models tests: minimal resource configs, auth fixtures,\n * and relationship processing that mirrors `createResourceConfiguration_Initialization`.\n *\n * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.\n */\nimport type { z } from 'zod';\nimport {\n  EmailVerificationMode,\n  RegistrationMode,\n  type UserTypeAuthPolicy,\n} from '../config/entity-identity-config.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport {\n  CoreResourceOperation,\n  ResourceFieldIdentifier,\n  ResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport type {\n  ResourceConfiguration,\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_ResourceRelationships,\n} from '../resources/resources-config.shared.schemas';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceTranspositionPolicy,\n} from '../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../resources/resources.shared.utils';\n\nexport function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy {\n  return {\n    authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.MAGIC_LINK]: true },\n    mfaPolicy: {\n      requireMFA: false,\n      requireStrongMFA: false,\n      acceptableMFAMethods: undefined,\n      enrollmentGracePeriodDays: 14,\n      passkeyExemptFromMFA: true,\n    },\n    registration: {\n      mode: RegistrationMode.OPEN,\n      allowedMethods: [AuthMethod.PASSWORD],\n      emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n      blockForSSODomains: false,\n    },\n    /*\n     * Mirrors the production default (#1249). It did not: this builder said `requireNumbers: false`\n     * while all five production declarations said `true`, so every test written against it validated a\n     * policy no application had. That is worth more than the fix — a test double that drifts from the\n     * thing it doubles reports on a product that does not exist.\n     */\n    passwordPolicy: {\n      minLength: 15,\n      maxLength: 128,\n      requireUppercase: false,\n      requireLowercase: false,\n      requireNumbers: false,\n      requireSpecialChars: false,\n      expiryDays: 0,\n    },\n    sessionDurationMinutes: 30,\n    lockoutPolicy: {\n      maxLoginAttempts: 5,\n      lockoutDurationMinutes: 30,\n      progressiveLockout: false,\n      maxProgressiveLockoutHours: 24,\n    },\n    autoLinkByEmail: true,\n    methodManagement: {\n      allowUserMethodRemoval: true,\n      requireReauthForMethodChanges: true,\n    },\n    ...overrides,\n  } as UserTypeAuthPolicy;\n}\n\n/**\n * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.\n *\n * **Not** the same symbol as `createTestOperation` in `@wildo-ai/saas-backend-lib/testing`\n * (`feature-test-utils.ts`), which builds operation stubs for **feature-gate** tests.\n */\nexport function createTestOperation(\n  mainSchema: z.ZodTypeAny,\n  operationIdentifier: CoreResourceOperation = CoreResourceOperation.READ\n): ResourceConfiguration_Operation<any, any, any> {\n  return {\n    isDisabled: false,\n    mainSchema,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    isSystemResource: false,\n    operationIdentifier,\n    isOperationDefault: true,\n    serviceRuntimeMode: 'INLINE' as any,\n    notificationBadgeOperations: [],\n    userNotifications: [],\n    m2mNotifications: [],\n    variantType: ResourceOperationVariantType.API_CALL,\n    resourceOperationLike: undefined,\n    requiredFeatures: undefined,\n    riskLevel: ResourceOperationRiskLevel.LOW,\n    roles: [],\n    customServiceImplementationModes: [],\n    basicPrefixOperation: undefined,\n    httpVerb: HttpMethod.GET,\n    isApiKeyAccessDisabled: false,\n    isBulkOperation: false,\n    consumableToken: undefined,\n    enabledCondition: undefined,\n    isDefault: true,\n    variantKey: undefined,\n  } as ResourceConfiguration_Operation<any, any, any>;\n}\n\nexport function createTestResourceConfig(\n  mainSchema: z.ZodTypeAny,\n  operations: ResourceConfiguration_Operation<any, any, any>[]\n): ResourceConfiguration<any, any, any> {\n  return {\n    isDisabled: false,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    coreOperations: [],\n    customOperation: undefined,\n    mainSchema,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    inheritenceSchemaDefinition: undefined,\n    isSystemResource: false,\n    /** W7.3a: test fixtures default to non-anonymizable unless overrides replace the full config. */\n    isAnonymizable: false,\n    /** Required by type; only applied when `isAnonymizable` is true (engine default is ADD). */\n    transpositionPolicy: ResourceTranspositionPolicy.ADD,\n    operations,\n  } satisfies ResourceConfiguration<any, any, any>;\n}\n\n/**\n * Process relationships for a resource — mirrors the logic in createResourceConfiguration_Initialization.\n * M:N relationships are transformed into 1:N relationships for the junction table.\n *\n * The helper expects compiled runtime relationships, matching the production\n * factory output from `createResourcesRelationship()` / registry initialization.\n */\nexport function processResourceRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceConfiguration_ResourceRelationships {\n  const compileSyntheticRelationship = (\n    relationshipDeclaration: ResourceRelationshipDeclaration\n  ): ResourceRelationship =>\n    Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n  const activeRelationships = resourceRelationships.filter((rel) => !rel.isDisabled);\n\n  const isManyToMany = (rel: ResourceRelationship) =>\n    rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n    rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n    rel.jointResourceType;\n\n  const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n    parentRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType2 === resourceIdentifier &&\n        rel.resourceType1 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    childRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    selfRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 === resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n  };\n\n  const manyToManyRelationships = activeRelationships.filter(\n    (rel) =>\n      rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n      rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n      rel.jointResourceType\n  );\n\n  manyToManyRelationships.forEach((m2mRel) => {\n    Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n    const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType } = m2mRel;\n\n    if (resourceIdentifier === jointResourceType) {\n      const relationFromEntity1 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity1Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity1);\n\n      const relationFromEntity2 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity2Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity2);\n    } else if (resourceIdentifier === entity1Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    } else if (resourceIdentifier === entity2Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    }\n  });\n\n  return processedResourceRelationships;\n}\n\n/**\n * Conditional relationships — active only for specific discriminator variants.\n */\nexport function getConditionalRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceRelationship[] {\n  return resourceRelationships.filter(\n    (rel) =>\n      rel.discriminator?.discriminatorField &&\n      rel.discriminator.values &&\n      rel.discriminator.values.length > 0 &&\n      (rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier)\n  );\n}\n"]}

package/dist/esm/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC"}

package/dist/esm/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC","sourcesContent":["/**\n * Public testing surface for @wildo-ai/saas-models.\n * Import from `@wildo-ai/saas-models/testing` — not from the main package entry.\n */\nexport * from './testing/resource-config-builders';\n"]}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC","sourcesContent":["/**\n * Public testing surface for @wildo-ai/saas-models.\n * Import from `@wildo-ai/saas-models/testing` — not from the main package entry.\n */\nexport * from './testing/resource-config-builders';\n"]}

package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;iBAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oCAAoC;;;;;;;;;;;iBAK/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}
+{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;iBAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oCAAoC;;;;;;;;;;;iBAK/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAO,0CAA0C;AAClF,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,OAAO,EAAI,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAc,mBAAmB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAC/D,WAAW,EAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACnE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser First-Touch Marketing Attribution (Phase 0.5, Q-D=β)\n *\n * Captured ONCE at session-init time on `AnonymousUser.marketingMetadata`\n * and never overwritten on subsequent requests (first-touch semantics).\n * Attribution lives on the session, not the conversion row — so a single\n * `AnonymousUser` is the canonical source whether the visitor:\n *   - converts via an `InboundContact` form submission,\n *   - signs up directly,\n *   - or never converts at all (cleaned up by the anonymous-session-cleanup\n *     batch at session TTL).\n *\n * Marketing analytics joins `InboundContact → AnonymousUser →\n * marketingMetadata` via the `anonymousUserId` FK declared in\n * `inbound-contacts.shared.schemas.ts`.\n *\n * Field-by-field rationale:\n *\n * - `utm.*`            — Standard UTM parameters extracted from `req.query`\n *                        on the marketing site landing request. All optional\n *                        because organic / direct traffic has none.\n * - `referrer`         — `Referer` HTTP header (note the historical\n *                        misspelling — kept as `referrer` here to match\n *                        the analytics-industry convention rather than\n *                        the HTTP-header spec spelling).\n * - `landingPath`      — Path of the FIRST page the visitor landed on\n *                        (e.g. `/pricing`, `/blog/post-slug`). Sourced\n *                        from a marketing-site-only `x-landing-path` HTTP\n *                        header (registered in `WildoHeaderKeys`) that\n *                        the marketing-site bootstrap injects on the\n *                        very first request to the anonymous-session-init\n *                        endpoint. We do NOT use `req.path` because the\n *                        anonymous-session-init endpoint URL is itself\n *                        not a marketing landing page.\n * - `acceptLanguage`   — Raw `Accept-Language` header (full string, not\n *                        parsed). Useful for analytics segmentation and\n *                        for inferring locale preference when the visitor\n *                        eventually creates an account.\n *\n * NOT modeled here (already on parent `AnonymousUserSchema`):\n * - `userAgent`         — `AnonymousUser.userAgent` (line 14).\n * - consent            — `AnonymousUserPrivacy.consentedPurposes` (what was granted) and\n *                        `consentDecidedAt` (when the visitor decided — a decision, not necessarily a grant).\n * - `ipHash`            — `AnonymousUser.ipHash` (line 15).\n *\n * Length caps mirror the existing `AnonymousUser.userAgent` truncation\n * pattern (`.substring(0, 256)` in `createAnonymousUser`) — applied at\n * the schema level here so the boundary is explicit and re-used at every\n * write site.\n */\n\nimport { z } from 'zod';\n\nconst MAX_UTM_FIELD_LENGTH = 256;\nconst MAX_REFERRER_LENGTH = 2048;       // URLs can be long (oauth callbacks etc.)\nconst MAX_LANDING_PATH_LENGTH = 2048;\nconst MAX_ACCEPT_LANGUAGE_LENGTH = 256;\n\n/**\n * Standard UTM parameter subobject. Every field optional because\n * organic / direct traffic carries no UTM params at all.\n */\nexport const UtmParametersSchema = z.object({\n  source   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  medium   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  campaign : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  term     : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  content  : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n});\n\nexport type UtmParameters = z.infer<typeof UtmParametersSchema>;\n\nexport const AnonymousUserMarketingMetadataSchema = z.object({\n  utm            : UtmParametersSchema.optional(),\n  referrer       : z.string().max(MAX_REFERRER_LENGTH).optional(),\n  landingPath    : z.string().max(MAX_LANDING_PATH_LENGTH).optional(),\n  acceptLanguage : z.string().max(MAX_ACCEPT_LANGUAGE_LENGTH).optional(),\n});\n\nexport type AnonymousUserMarketingMetadata = z.infer<typeof AnonymousUserMarketingMetadataSchema>;\n"]}
+{"version":3,"file":"anonymous-user-marketing-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/anonymous-user-marketing-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAO,0CAA0C;AAClF,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,MAAM,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,OAAO,EAAI,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAc,mBAAmB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAC/D,WAAW,EAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACnE,cAAc,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser First-Touch Marketing Attribution (Phase 0.5, Q-D=β)\n *\n * Captured ONCE at session-init time on `AnonymousUser.marketingMetadata`\n * and never overwritten on subsequent requests (first-touch semantics).\n * Attribution lives on the session, not the conversion row — so a single\n * `AnonymousUser` is the canonical source whether the visitor:\n *   - converts via an `InboundContact` form submission,\n *   - signs up directly,\n *   - or never converts at all (cleaned up by the anonymous-session-cleanup\n *     batch at session TTL).\n *\n * Marketing analytics joins `InboundContact → AnonymousUser →\n * marketingMetadata` via the `anonymousUserId` FK declared in\n * `inbound-contacts.shared.schemas.ts`.\n *\n * Field-by-field rationale:\n *\n * - `utm.*`            — Standard UTM parameters extracted from `req.query`\n *                        on the marketing site landing request. All optional\n *                        because organic / direct traffic has none.\n * - `referrer`         — `Referer` HTTP header (note the historical\n *                        misspelling — kept as `referrer` here to match\n *                        the analytics-industry convention rather than\n *                        the HTTP-header spec spelling).\n * - `landingPath`      — Path of the FIRST page the visitor landed on\n *                        (e.g. `/pricing`, `/blog/post-slug`). Sourced\n *                        from a marketing-site-only `x-landing-path` HTTP\n *                        header (registered in `WildoHeaderKeys`) that\n *                        the marketing-site bootstrap injects on the\n *                        very first request to the anonymous-session-init\n *                        endpoint. We do NOT use `req.path` because the\n *                        anonymous-session-init endpoint URL is itself\n *                        not a marketing landing page.\n * - `acceptLanguage`   — Raw `Accept-Language` header (full string, not\n *                        parsed). Useful for analytics segmentation and\n *                        for inferring locale preference when the visitor\n *                        eventually creates an account.\n *\n * NOT modeled here (already on parent `AnonymousUserSchema`):\n * - `userAgent`         — `AnonymousUser.userAgent` (line 14).\n * - consent            — `AnonymousUserPrivacy.consentedPurposes` (what was granted) and\n *                        `consentDecidedAt` (when the visitor decided — a decision, not necessarily a grant).\n * - `ipHash`            — `AnonymousUser.ipHash` (line 15).\n *\n * Length caps mirror the existing `AnonymousUser.userAgent` truncation\n * pattern (`.substring(0, 256)` in `createAnonymousUser`) — applied at\n * the schema level here so the boundary is explicit and re-used at every\n * write site.\n */\n\nimport { z } from 'zod';\n\nconst MAX_UTM_FIELD_LENGTH = 256;\nconst MAX_REFERRER_LENGTH = 2048;       // URLs can be long (oauth callbacks etc.)\nconst MAX_LANDING_PATH_LENGTH = 2048;\nconst MAX_ACCEPT_LANGUAGE_LENGTH = 256;\n\n/**\n * Standard UTM parameter subobject. Every field optional because\n * organic / direct traffic carries no UTM params at all.\n */\nexport const UtmParametersSchema = z.object({\n  source   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  medium   : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  campaign : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  term     : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n  content  : z.string().max(MAX_UTM_FIELD_LENGTH).optional(),\n});\n\nexport type UtmParameters = z.infer<typeof UtmParametersSchema>;\n\nexport const AnonymousUserMarketingMetadataSchema = z.object({\n  utm            : UtmParametersSchema.optional(),\n  referrer       : z.string().max(MAX_REFERRER_LENGTH).optional(),\n  landingPath    : z.string().max(MAX_LANDING_PATH_LENGTH).optional(),\n  acceptLanguage : z.string().max(MAX_ACCEPT_LANGUAGE_LENGTH).optional(),\n});\n\nexport type AnonymousUserMarketingMetadata = z.infer<typeof AnonymousUserMarketingMetadataSchema>;\n"]}

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.d.ts

@@ -103,9 +103,11 @@ export type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof Anony
  * all, so there is no row to fail validation against — an explicit, minimal response avoids
  * reintroducing that trap by construction.
  *
- * `recorded: false` is not an error — it means the resolved release does not permit
- * `NOTICE_DELIVERED`, or nothing is in force for that document right now. The caller does not act on
- * this value; it exists for the rare case a session wants to know whether the call did anything.
+ * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to
+ * the audit trail against its in-force release, and `false` when nothing was written — no release of
+ * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.
+ * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,
+ * and the caller does not act on it: the page has already been shown.
  */
 export declare const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema: z.ZodObject<{
     recorded: z.ZodBoolean;

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAA4B,MAAM,+CAA+C,CAAC;AAGzG,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,cAAc,mBAAmB;IACjC,sFAAsF;IACtF,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,2CAA2C;;;iBAKtD,CAAC;AAEH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C;;;;iBAIvD,CAAC;AAEH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH;;;;;;;;;GASG;AACH,eAAO,MAAM,mDAAmD;;iBAE9D,CAAC;AACH,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAEhI;;;;;;;;;GASG;AACH,eAAO,MAAM,oDAAoD;;iBAE/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,QAC0H,CAAC;AAE9K,0KAA0K;AAC1K,eAAO,MAAM,wCAAwC,QAAQ,CAAC;AAE9D,eAAO,MAAM,yDAAyD,GACpE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;kBAsP9C,CAAC"}
+{"version":3,"file":"anonymous-users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAA4B,MAAM,+CAA+C,CAAC;AAGzG,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,cAAc,mBAAmB;IACjC,sFAAsF;IACtF,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,2CAA2C;;;iBAOtD,CAAC;AAEH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C;;;;iBAOvD,CAAC;AAEH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH;;;;;;;;;GASG;AACH,eAAO,MAAM,mDAAmD;;iBAG9D,CAAC;AACH,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAEhI;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oDAAoD;;iBAG/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,QAC0H,CAAC;AAE9K,0KAA0K;AAC1K,eAAO,MAAM,wCAAwC,QAAQ,CAAC;AAE9D,eAAO,MAAM,yDAAyD,GACpE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;kBAsP9C,CAAC"}

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.js

@@ -63,9 +63,11 @@ export var AnonymousUsers_Operations;
  */
 export const AnonymousUsersRecordConsentRequestDtoSchema = z.object({
     /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */
-    grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16),
+    grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16)
+        .describe('Every purpose the visitor granted, as a complete set: a purpose left out is not granted. A purpose not also listed in `offeredPurposes` is ignored.'),
     /** The purposes the surface actually put in front of them. What is absent was never asked. */
-    offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16),
+    offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16)
+        .describe('The purposes the consent surface actually asked the visitor about. A purpose absent from this list is recorded as never asked, not as declined.'),
 });
 /**
  * What the visitor gets back: their OWN decision, and nothing else.
@@ -85,9 +87,12 @@ export const AnonymousUsersRecordConsentRequestDtoSchema = z.object({
  * door on a resource whose READ is deliberately admin-only.
  */
 export const AnonymousUsersRecordConsentResponseDtoSchema = z.object({
-    consentedPurposes: z.array(z.enum(ConsentPurpose)),
-    offeredPurposes: z.array(z.enum(ConsentPurpose)),
-    consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional(),
+    consentedPurposes: z.array(z.enum(ConsentPurpose))
+        .describe('The purposes now recorded as granted for this anonymous session: the granted purposes that were also offered.'),
+    offeredPurposes: z.array(z.enum(ConsentPurpose))
+        .describe('The purposes recorded as offered to the visitor with this decision.'),
+    consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional()
+        .describe("When the decision was recorded, taken from the server's clock."),
 });
 /**
  * What a visitor's public-document page sends when a governed document renders for them (#1258 Step
@@ -100,7 +105,8 @@ export const AnonymousUsersRecordConsentResponseDtoSchema = z.object({
  * have met a release that was never in force, or the wrong version of one that was.
  */
 export const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({
-    documentRef: z.string().trim().min(1),
+    documentRef: z.string().trim().min(1)
+        .describe('Reference of the governed document the visitor was shown, such as the privacy notice. The delivery is recorded against the release of that document currently in force, when one allows it; a client cannot name a version.'),
 });
 /**
  * Declared rather than inherited, for the same reason as its consent sibling: a custom operation
@@ -108,12 +114,15 @@ export const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({
  * all, so there is no row to fail validation against — an explicit, minimal response avoids
  * reintroducing that trap by construction.
  *
- * `recorded: false` is not an error — it means the resolved release does not permit
- * `NOTICE_DELIVERED`, or nothing is in force for that document right now. The caller does not act on
- * this value; it exists for the rare case a session wants to know whether the call did anything.
+ * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to
+ * the audit trail against its in-force release, and `false` when nothing was written — no release of
+ * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.
+ * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,
+ * and the caller does not act on it: the page has already been shown.
  */
 export const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({
-    recorded: z.boolean(),
+    recorded: z.boolean()
+        .describe('Whether this showing of the document was recorded. `false` when no release of the document in force records deliveries, or the record could not be written; the page itself is unaffected.'),
 });
 /**
  * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed

package/dist/esm/users/anonymous-users.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAIX;AAJD,WAAY,yBAAyB;IACnC,8DAAiC,CAAA;IACjC,sFAAsF;IACtF,gFAAmD,CAAA;AACrD,CAAC,EAJW,yBAAyB,KAAzB,yBAAyB,QAIpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACxD,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAChE,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,0BAA0B,CAAC,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,WAAW,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE,CAAC;AAE9K,0KAA0K;AAC1K,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,yDAAyD,GAAG,CACvE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,eAAe;IACpD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC7F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,iFAAiF;IACjF,6EAA6E;IAC7E,kFAAkF;IAClF,8EAA8E;IAC9E,sFAAsF;IACtF,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAChE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,yBAAyB;IAC1C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,6EAA6E;oBAC7E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,gFAAgF;oBAChF,gFAAgF;oBAChF,kEAAkE;oBAClE,iFAAiF;oBACjF,wFAAwF;oBACxF,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wGAAwG;oBACvJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,CAAC,yBAAyB,CAAC,cAAc,CAAC,EAAE;YAC1C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,2CAA2C;oBACvD,iBAAiB,EAAE,4CAA4C;oBAC/D,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD;;;;;;;;;;;;;;;uBAeG;oBACH,gCAAgC,EAAE,IAAI;oBACtC;;;;;;;;;;;uBAWG;oBACH,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACrC,MAAM,OAAO,GAAG,2CAA2C,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC1E,OAAO;4BACL,OAAO,EAAE;gCACP,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC;qCACjE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gCACzD,eAAe;6BAChB;yBACF,CAAC;oBACJ,CAAC;oBACD,qFAAqF;oBACrF,iFAAiF;oBACjF,4FAA4F;oBAC5F,yEAAyE;oBACzE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD;;;;;;;;;;WAUG;QACH,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,mDAAmD;oBAC/D,iBAAiB,EAAE,oDAAoD;oBACvE,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,wFAAwF;oBACxF,wFAAwF;oBACxF,0FAA0F;oBAC1F,sFAAsF;oBACtF,gCAAgC,EAAE,IAAI;oBACtC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser Resource Configuration (W7.3a)\n *\n * System resource — identity anchor for anonymous sessions.\n * CREATE, UPDATE, and DELETE are INTERNAL_CALL (managed by AnonymousSessionBackendService via service layer).\n * READ is admin-only (super-admin inspection). The anonymous session reaches its OWNED\n * data through the nested `/anonymous-users/{uuidRef}/…` routes (which filter\n * children by the `anonymousUserId` FK = `uuidRef`) and validates itself via the JWT —\n * it never reads its own AnonymousUser row. See the READ variant note for why anon\n * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).\n */\n\nimport { z } from 'zod';\n\nimport { AnonymousUserSchema } from './anonymous-users.shared.schema';\nimport { ConsentPurpose, normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourcesConfigNamingUtils } from '../resources/utils/resources-config-naming.utils';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * Custom operations on the anonymous identity anchor.\n *\n * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent\n * decision was declared on this resource's UPDATE — *\"a visitor's or a lead's consent decision is as\n * recordable as a member's\"* — while every operation here is `INTERNAL_CALL` or super-admin, so no\n * visitor could reach it. The recording contract was written for a door nobody built (#1258).\n */\nexport enum AnonymousUsers_Operations {\n  RECORD_CONSENT = 'record_consent',\n  /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */\n  RECORD_NOTICE_DELIVERED = 'record_notice_delivered',\n}\n\n/**\n * What a visitor's consent surface sends when they decide.\n *\n * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise\n *\n * A decision is `(granted subset-of offered, at an instant)` — see\n * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the\n * person saw, and the server does not know it: the marketing website is statically built and derives\n * its panel from its OWN live providers, which this backend never sees. So the client is the only\n * party that can state it.\n *\n * The blast radius is confined by construction, which is what makes that acceptable:\n *\n * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the\n *   request, so no visitor can describe another visitor's decision;\n * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes\n *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an\n *   account that has already decided;\n * - it grants no privilege a visitor does not already have — they may tick the same boxes on the\n *   application's own consent surface a minute later.\n *\n * The residual is a shared browser whose first visitor lies: the next person to register from it\n * starts with grants they did not make. That is the pre-existing shared-browser exposure of any\n * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.\n *\n * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same\n * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the\n * fact that a decision happened.\n */\nexport const AnonymousUsersRecordConsentRequestDtoSchema = z.object({\n  /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */\n  grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16),\n  /** The purposes the surface actually put in front of them. What is absent was never asked. */\n  offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16),\n});\n\nexport type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;\n\n/**\n * What the visitor gets back: their OWN decision, and nothing else.\n *\n * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`\n * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the\n * controller's response validation — measured live as `controller_resource_validation_failed` after\n * the write had already succeeded (#1267).\n *\n * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and\n * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`\n * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a\n * consent click would disclose more than the click.\n *\n * The decision itself IS safe to return to the session that just made it, and useful: a client can\n * reconcile what the server stored — including the instant, which the server owns — without a read\n * door on a resource whose READ is deliberately admin-only.\n */\nexport const AnonymousUsersRecordConsentResponseDtoSchema = z.object({\n  consentedPurposes: z.array(z.enum(ConsentPurpose)),\n  offeredPurposes: z.array(z.enum(ConsentPurpose)),\n  consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional(),\n});\n\nexport type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;\n\n/**\n * What a visitor's public-document page sends when a governed document renders for them (#1258 Step\n * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,\n * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers\n * have different security characteristics and each already has a proven pattern to reuse.\n *\n * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from\n * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to\n * have met a release that was never in force, or the wrong version of one that was.\n */\nexport const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({\n  documentRef: z.string().trim().min(1),\n});\nexport type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;\n\n/**\n * Declared rather than inherited, for the same reason as its consent sibling: a custom operation\n * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at\n * all, so there is no row to fail validation against — an explicit, minimal response avoids\n * reintroducing that trap by construction.\n *\n * `recorded: false` is not an error — it means the resolved release does not permit\n * `NOTICE_DELIVERED`, or nothing is in force for that document right now. The caller does not act on\n * this value; it exists for the rare case a session wants to know whether the call did anything.\n */\nexport const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({\n  recorded: z.boolean(),\n});\nexport type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;\n\n/**\n * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed\n * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,\n * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the\n * resource or operation identifier changes, on a public door nobody monitors.\n *\n * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that\n * carve (it cannot import the resources layer), and this door is reached only from the signed-out\n * pages of the APPLICATION itself, which already imports this package freely.\n */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH =\n  `/${ResourcesConfigNamingUtils.toKebabCase(CoreResourceType.ANONYMOUS_USERS)}/${ResourcesConfigNamingUtils.toKebabCase(AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED)}`;\n\n/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = 'PUT';\n\nexport const anonymousUsersResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<typeof AnonymousUsers_Operations,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof AnonymousUserSchema\n>({\n  mainSchema: AnonymousUserSchema,\n  resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ANONYMOUS_USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Session-init (`AnonymousSessionBackendService.createAnonymousUser`) writes the\n  // first-touch `marketingMetadata` (`.isBackendOnly()`) and a client-supplied\n  // custom `_id` in-process, with no HTTP request context to survive the strict-DTO\n  // strip. `createAsSystem` re-attaches the backend-only field after the parse,\n  // fail-closed behind this opt-in. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: AnonymousUsers_Operations,\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Admin-only (super-admin inspection). Intentionally NOT anon-self-read: the\n          // framework resolves a direct read-by-identifier to `{ _id: <value> }`, but an\n          // anonymous session's identity is its client `uuidRef` (its `_id` is a server\n          // ObjectId), so a self-read would look up `{ _id: <uuidRef> }` and never match.\n          // The anonymous session never needs this — it reaches owned data via the nested\n          // `/anonymous-users/{uuidRef}/…` routes (children filtered by the\n          // `anonymousUserId` FK = `uuidRef`) and validates via the JWT. If anon self-read\n          // is ever required, implement it to resolve by `uuidRef` (custom read impl), not `_id`.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    /**\n     * APPLICATION-WIDE by design, and unconfined by construction — recorded 2026-08-12 because it\n     * previously said nothing, and silence is what this resource class keeps getting wrong.\n     *\n     * `anonymousUsers` is its own scope ROOT: `resourceFieldIdentifier` IS the ANONYMOUS scope's\n     * field, so both repositories blacklist that axis and this LIST compiles with no scope predicate\n     * (`base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep).\n     *\n     * Unlike `organizations`, that is CORRECT here rather than a hole, and the reason is semantic\n     * rather than a judgement call: an anonymous session is a pre-authentication visitor of the\n     * APPLICATION. It has no organization — there is no tenant to confine it to — so a \"confined\"\n     * anonymous listing would name a relationship that does not exist. `super-admin` is therefore\n     * the whole of the control, and it is the right one.\n     *\n     * ⚠️ If anonymous sessions ever gain a tenant association, this becomes an ORGANIZATIONS-axis\n     * question and `assignScopeRootCollectionConfinementToFilter` is where it is answered — that\n     * authority is deliberately scoped to the tenant axis today.\n     *\n     * The sibling decisions live in `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Application-wide by design — see the block above; there is no tenant to confine a pre-auth visitor to\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    /**\n     * The visitor's own consent decision, recorded against their anonymous session (#1258).\n     *\n     * ## Why it is COLLECTION-level and carries no id\n     *\n     * `resourceOperationLike: UPDATE_MANY` puts it at the collection path with its own name segment\n     * and NO entity id — the `reset-features` shape. That is not a convenience: it is what keeps the\n     * door safe.\n     *\n     * An entity-addressed variant would resolve `{ _id: <value> }`, and an anonymous session's\n     * identity is its client `uuidRef` while its `_id` is a server ObjectId — the exact trap the READ\n     * variant above documents, and the reason anon self-read was never offered. Worse, it would put\n     * the row's address in the REQUEST, where a visitor could name another visitor's session.\n     *\n     * With no id, the custom implementation selects the row by `uuidRef` taken from the verified\n     * session JWT (`executionContext.anonymousUserId`). The selector is server-derived, so describing\n     * another visitor's decision is not expressible rather than merely refused.\n     *\n     * **This resource is its own scope ROOT**, so both repositories blacklist the anonymous axis and\n     * the contextual filter contributes NO predicate here (that is why LIST is super-admin). Nothing\n     * confines this write except the selector the implementation builds, which is why the selector is\n     * the thing under test.\n     *\n     * LOW risk: it writes one person's own privacy choice on a pre-identity row holding no account.\n     * `auditBelowRiskFloor` is what makes it leave a row anyway — the same declaration, and the same\n     * reasoning, as the UPDATE variant above and the lead's CREATE: buying the row by mis-declaring\n     * the verb's danger would corrupt the risk vocabulary every other control reads.\n     *\n     * Rate-limited per IP like the lead form, because it is a public unauthenticated write and an\n     * anonymous session is free to mint.\n     *\n     * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's own decision is recordable before\n     * they have an account, against the session it was made in.\n     */\n    [AnonymousUsers_Operations.RECORD_CONSENT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordConsentRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordConsentResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          /*\n           * Without this the operation answers 403 to the only caller it exists for (#1267), and the\n           * gate that refuses it is RIGHT: a collection-shaped write on a scope root reads as an\n           * unconfined DIRECTORY write, and `enforceApplicationWideReadAdmission` then demands a\n           * two-person elevation no visitor can hold.\n           *\n           * The declaration says the missing half: this write IS confined, by\n           * `createAnonymousConsentFactories`, to `{ uuidRef: executionContext.anonymousUserId }` —\n           * the value the session JWT was verified to carry, never anything from the request. The\n           * collection shape is a CONSEQUENCE of making the row unaddressable, not evidence that a\n           * set is being written.\n           *\n           * That confinement is the obligation the flag creates, and it is pinned in\n           * `anonymous-consent.custom-impl.backend.service.test.ts` with a hostile payload naming\n           * another session in `uuidRef`, `_id` and `anonymousUserId`.\n           */\n          admitsSelfConfinedScopeRootWrite: true,\n          /*\n           * Map the REQUEST shape onto the RESOURCE shape before the pipeline validates it — the\n           * `reset-to-defaults` idiom. The request names two purpose LISTS, which are not schema\n           * paths; the service tier validates against the resource schema, so without this the whole\n           * payload is unrecognised and the operation answers `service_resource_validation_failed`\n           * (measured live, #1267).\n           *\n           * The intersection is applied HERE so the stored grants can never exceed what the same\n           * request claims to have offered, whatever a later handler does with them. No\n           * `consentDecidedAt`: the custom implementation stamps the server's clock through\n           * `buildConsentDecisionPatch`, so a caller-authored instant cannot enter.\n           */\n          basicPrefixOperation: ({ inputDto }) => {\n            const request = AnonymousUsersRecordConsentRequestDtoSchema.parse(inputDto);\n            const offeredPurposes = normalizeConsentPurposes(request.offeredPurposes);\n            return {\n              privacy: {\n                consentedPurposes: normalizeConsentPurposes(request.grantedPurposes)\n                  .filter((purpose) => offeredPurposes.includes(purpose)),\n                offeredPurposes,\n              },\n            };\n          },\n          // No `authoritativeFields`: the request contract is two purpose LISTS and carries no\n          // `privacy` block, so there is no caller-supplied value to overwrite. The custom\n          // implementation composes the stored block itself. Declaring one here would be a guard over\n          // a field nothing can send — an untested claim that reads as protection.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    /**\n     * A visitor's own public-document page tells the server it rendered — `NOTICE_DELIVERED`, the\n     * anonymous half of #1258 Step 5 / R11. Same shape as `RECORD_CONSENT` and the same reasons:\n     * public, unauthenticated, one collection-level write with no id in the URL, so the request\n     * cannot name a row. Unlike its sibling, this write touches NO row on this resource at all — it\n     * only needs the verified session identity to attribute a `GOVERNED_DOCUMENT_INTERACTION_RECORDED`\n     * audit row, via `recordGovernedDocumentNoticeDelivered`.\n     *\n     * Rate-limited per IP like its sibling: a public unauthenticated write, and an anonymous session\n     * is free to mint.\n     */\n    [AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordNoticeDeliveredRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordNoticeDeliveredResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // Same obligation as `RECORD_CONSENT`, for the same reason (#1267): a collection-shaped\n          // write on this scope-root resource is otherwise read as an unconfined directory write.\n          // The custom implementation confines it to the verified session's own identity and writes\n          // no row at all — nothing here is a directory write in substance, only in HTTP shape.\n          admitsSelfConfinedScopeRootWrite: true,\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"anonymous-users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAIX;AAJD,WAAY,yBAAyB;IACnC,8DAAiC,CAAA;IACjC,sFAAsF;IACtF,gFAAmD,CAAA;AACrD,CAAC,EAJW,yBAAyB,KAAzB,yBAAyB,QAIpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SACrD,QAAQ,CAAC,qJAAqJ,CAAC;IAClK,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SAC5D,QAAQ,CAAC,iJAAiJ,CAAC;CAC/J,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC/C,QAAQ,CAAC,+GAA+G,CAAC;IAC5H,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAC7C,QAAQ,CAAC,qEAAqE,CAAC;IAClF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC/D,QAAQ,CAAC,gEAAgE,CAAC;CAC9E,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAClC,QAAQ,CAAC,6NAA6N,CAAC;CAC3O,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;SAClB,QAAQ,CAAC,4LAA4L,CAAC;CAC1M,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,0BAA0B,CAAC,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,WAAW,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE,CAAC;AAE9K,0KAA0K;AAC1K,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,yDAAyD,GAAG,CACvE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,gBAAgB,CAAC,eAAe;IACpD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,eAAe,CAAC;IAC7F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,iFAAiF;IACjF,6EAA6E;IAC7E,kFAAkF;IAClF,8EAA8E;IAC9E,sFAAsF;IACtF,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAChE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,yBAAyB;IAC1C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,6EAA6E;oBAC7E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,gFAAgF;oBAChF,gFAAgF;oBAChF,kEAAkE;oBAClE,iFAAiF;oBACjF,wFAAwF;oBACxF,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wGAAwG;oBACvJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,CAAC,yBAAyB,CAAC,cAAc,CAAC,EAAE;YAC1C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,2CAA2C;oBACvD,iBAAiB,EAAE,4CAA4C;oBAC/D,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD;;;;;;;;;;;;;;;uBAeG;oBACH,gCAAgC,EAAE,IAAI;oBACtC;;;;;;;;;;;uBAWG;oBACH,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACrC,MAAM,OAAO,GAAG,2CAA2C,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC1E,OAAO;4BACL,OAAO,EAAE;gCACP,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC;qCACjE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gCACzD,eAAe;6BAChB;yBACF,CAAC;oBACJ,CAAC;oBACD,qFAAqF;oBACrF,iFAAiF;oBACjF,4FAA4F;oBAC5F,yEAAyE;oBACzE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD;;;;;;;;;;WAUG;QACH,CAAC,yBAAyB,CAAC,uBAAuB,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,mDAAmD;oBAC/D,iBAAiB,EAAE,oDAAoD;oBACvE,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,wFAAwF;oBACxF,wFAAwF;oBACxF,0FAA0F;oBAC1F,sFAAsF;oBACtF,gCAAgC,EAAE,IAAI;oBACtC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * AnonymousUser Resource Configuration (W7.3a)\n *\n * System resource — identity anchor for anonymous sessions.\n * CREATE, UPDATE, and DELETE are INTERNAL_CALL (managed by AnonymousSessionBackendService via service layer).\n * READ is admin-only (super-admin inspection). The anonymous session reaches its OWNED\n * data through the nested `/anonymous-users/{uuidRef}/…` routes (which filter\n * children by the `anonymousUserId` FK = `uuidRef`) and validates itself via the JWT —\n * it never reads its own AnonymousUser row. See the READ variant note for why anon\n * self-read is intentionally NOT offered (it would resolve by `_id`, not `uuidRef`).\n */\n\nimport { z } from 'zod';\n\nimport { AnonymousUserSchema } from './anonymous-users.shared.schema';\nimport { ConsentPurpose, normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { ResourcesConfigNamingUtils } from '../resources/utils/resources-config-naming.utils';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * Custom operations on the anonymous identity anchor.\n *\n * `RECORD_CONSENT` is the only one, and it exists because the audit contract for a visitor's consent\n * decision was declared on this resource's UPDATE — *\"a visitor's or a lead's consent decision is as\n * recordable as a member's\"* — while every operation here is `INTERNAL_CALL` or super-admin, so no\n * visitor could reach it. The recording contract was written for a door nobody built (#1258).\n */\nexport enum AnonymousUsers_Operations {\n  RECORD_CONSENT = 'record_consent',\n  /** See {@link AnonymousUsersRecordNoticeDeliveredRequestDtoSchema} (#1258 Step 5). */\n  RECORD_NOTICE_DELIVERED = 'record_notice_delivered',\n}\n\n/**\n * What a visitor's consent surface sends when they decide.\n *\n * ## Both fields, and why the OFFERED set is a caller CLAIM that cannot be otherwise\n *\n * A decision is `(granted subset-of offered, at an instant)` — see\n * `AnonymousUserPrivacySchema.offeredPurposes`. The offered set is a property of the SURFACE the\n * person saw, and the server does not know it: the marketing website is statically built and derives\n * its panel from its OWN live providers, which this backend never sees. So the client is the only\n * party that can state it.\n *\n * The blast radius is confined by construction, which is what makes that acceptable:\n *\n * - the row written is the CALLER'S OWN session, selected from the verified JWT and never from the\n *   request, so no visitor can describe another visitor's decision;\n * - a claim wider than the truth can only suppress a later prompt **for the account that browser goes\n *   on to create**, and `buildAnonymousConsentCarryPatch` refuses to carry anything at all onto an\n *   account that has already decided;\n * - it grants no privilege a visitor does not already have — they may tick the same boxes on the\n *   application's own consent surface a minute later.\n *\n * The residual is a shared browser whose first visitor lies: the next person to register from it\n * starts with grants they did not make. That is the pre-existing shared-browser exposure of any\n * device-scoped consent signal, not a new one, and it is bounded by the 48h anonymous-session TTL.\n *\n * No instant crosses the wire. `buildConsentDecisionPatch` stamps the server's clock, for the same\n * reason it does on the member and lead doors: a caller-authored instant could backdate or forge the\n * fact that a decision happened.\n */\nexport const AnonymousUsersRecordConsentRequestDtoSchema = z.object({\n  /** The WHOLE set the visitor granted. A purpose left out is not granted — never a delta. */\n  grantedPurposes: z.array(z.enum(ConsentPurpose)).max(16)\n    .describe('Every purpose the visitor granted, as a complete set: a purpose left out is not granted. A purpose not also listed in `offeredPurposes` is ignored.'),\n  /** The purposes the surface actually put in front of them. What is absent was never asked. */\n  offeredPurposes: z.array(z.enum(ConsentPurpose)).min(1).max(16)\n    .describe('The purposes the consent surface actually asked the visitor about. A purpose absent from this list is recorded as never asked, not as declined.'),\n});\n\nexport type AnonymousUsersRecordConsentRequestDto = z.infer<typeof AnonymousUsersRecordConsentRequestDtoSchema>;\n\n/**\n * What the visitor gets back: their OWN decision, and nothing else.\n *\n * Declared rather than inherited, and that is not tidiness. A custom operation borrowing `UPDATE_MANY`\n * inherits that verb's response envelope, and returning the `AnonymousUser` row instead fails the\n * controller's response validation — measured live as `controller_resource_validation_failed` after\n * the write had already succeeded (#1267).\n *\n * Narrow for a second, better reason: that row carries `userAgent` and `ipHash` — usage and\n * pseudonymous-identity data about the person — and `marketingMetadata`, which is `.isBackendOnly()`\n * precisely so it never reaches a client. Handing an anonymous caller the whole row to confirm a\n * consent click would disclose more than the click.\n *\n * The decision itself IS safe to return to the session that just made it, and useful: a client can\n * reconcile what the server stored — including the instant, which the server owns — without a read\n * door on a resource whose READ is deliberately admin-only.\n */\nexport const AnonymousUsersRecordConsentResponseDtoSchema = z.object({\n  consentedPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes now recorded as granted for this anonymous session: the granted purposes that were also offered.'),\n  offeredPurposes: z.array(z.enum(ConsentPurpose))\n    .describe('The purposes recorded as offered to the visitor with this decision.'),\n  consentDecidedAt: z.union([z.date(), z.iso.datetime()]).optional()\n    .describe(\"When the decision was recorded, taken from the server's clock.\"),\n});\n\nexport type AnonymousUsersRecordConsentResponseDto = z.infer<typeof AnonymousUsersRecordConsentResponseDtoSchema>;\n\n/**\n * What a visitor's public-document page sends when a governed document renders for them (#1258 Step\n * 5 / R11) — the anonymous-session half of `NOTICE_DELIVERED`. The signed-in half is a separate,\n * authenticated route (`governed-document-acceptance.backend.controller`), because the two callers\n * have different security characteristics and each already has a proven pattern to reuse.\n *\n * Only `documentRef` — WHICH document. The release actually recorded is resolved server-side from\n * this application's own in-force configuration, exactly like acceptance: a caller cannot claim to\n * have met a release that was never in force, or the wrong version of one that was.\n */\nexport const AnonymousUsersRecordNoticeDeliveredRequestDtoSchema = z.object({\n  documentRef: z.string().trim().min(1)\n    .describe('Reference of the governed document the visitor was shown, such as the privacy notice. The delivery is recorded against the release of that document currently in force, when one allows it; a client cannot name a version.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredRequestDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredRequestDtoSchema>;\n\n/**\n * Declared rather than inherited, for the same reason as its consent sibling: a custom operation\n * borrowing `UPDATE_MANY` inherits that verb's response envelope, and this write touches no row at\n * all, so there is no row to fail validation against — an explicit, minimal response avoids\n * reintroducing that trap by construction.\n *\n * `recorded` states what happened to THIS document: `true` exactly when the delivery was written to\n * the audit trail against its in-force release, and `false` when nothing was written — no release of\n * that document permits `NOTICE_DELIVERED`, the application declares none, or the audit write failed.\n * It is the recorder's own answer, not a second resolution of the release. `false` is not an error,\n * and the caller does not act on it: the page has already been shown.\n */\nexport const AnonymousUsersRecordNoticeDeliveredResponseDtoSchema = z.object({\n  recorded: z.boolean()\n    .describe('Whether this showing of the document was recorded. `false` when no release of the document in force records deliveries, or the record could not be written; the page itself is unaffected.'),\n});\nexport type AnonymousUsersRecordNoticeDeliveredResponseDto = z.infer<typeof AnonymousUsersRecordNoticeDeliveredResponseDtoSchema>;\n\n/**\n * The route `RECORD_NOTICE_DELIVERED` answers on, and its HTTP method — derived rather than hand-typed\n * for the same reason `ANONYMOUS_CONSENT_RECORD_PATH` / `_METHOD` are (#1258 Step 1a's own lesson,\n * `consent-purposes.shared.ts`): a hand-written path drifts silently into a 404 the moment the\n * resource or operation identifier changes, on a public door nobody monitors.\n *\n * Not carved onto `public-runtime`, unlike its consent sibling: only the marketing WEBSITE needs that\n * carve (it cannot import the resources layer), and this door is reached only from the signed-out\n * pages of the APPLICATION itself, which already imports this package freely.\n */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH =\n  `/${ResourcesConfigNamingUtils.toKebabCase(CoreResourceType.ANONYMOUS_USERS)}/${ResourcesConfigNamingUtils.toKebabCase(AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED)}`;\n\n/** `UPDATE_MANY` maps to `PUT` — see `getDefaultHttpVerbForOperation`, and `ANONYMOUS_CONSENT_RECORD_METHOD`'s own note on why this must be named rather than assumed. */\nexport const ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD = 'PUT';\n\nexport const anonymousUsersResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<typeof AnonymousUsers_Operations,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof AnonymousUserSchema\n>({\n  mainSchema: AnonymousUserSchema,\n  resourceIdentifier: CoreResourceType.ANONYMOUS_USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ANONYMOUS_USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Session-init (`AnonymousSessionBackendService.createAnonymousUser`) writes the\n  // first-touch `marketingMetadata` (`.isBackendOnly()`) and a client-supplied\n  // custom `_id` in-process, with no HTTP request context to survive the strict-DTO\n  // strip. `createAsSystem` re-attaches the backend-only field after the parse,\n  // fail-closed behind this opt-in. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: AnonymousUsers_Operations,\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Admin-only (super-admin inspection). Intentionally NOT anon-self-read: the\n          // framework resolves a direct read-by-identifier to `{ _id: <value> }`, but an\n          // anonymous session's identity is its client `uuidRef` (its `_id` is a server\n          // ObjectId), so a self-read would look up `{ _id: <uuidRef> }` and never match.\n          // The anonymous session never needs this — it reaches owned data via the nested\n          // `/anonymous-users/{uuidRef}/…` routes (children filtered by the\n          // `anonymousUserId` FK = `uuidRef`) and validates via the JWT. If anon self-read\n          // is ever required, implement it to resolve by `uuidRef` (custom read impl), not `_id`.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    /**\n     * APPLICATION-WIDE by design, and unconfined by construction — recorded 2026-08-12 because it\n     * previously said nothing, and silence is what this resource class keeps getting wrong.\n     *\n     * `anonymousUsers` is its own scope ROOT: `resourceFieldIdentifier` IS the ANONYMOUS scope's\n     * field, so both repositories blacklist that axis and this LIST compiles with no scope predicate\n     * (`base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`, RESIDUAL sweep).\n     *\n     * Unlike `organizations`, that is CORRECT here rather than a hole, and the reason is semantic\n     * rather than a judgement call: an anonymous session is a pre-authentication visitor of the\n     * APPLICATION. It has no organization — there is no tenant to confine it to — so a \"confined\"\n     * anonymous listing would name a relationship that does not exist. `super-admin` is therefore\n     * the whole of the control, and it is the right one.\n     *\n     * ⚠️ If anonymous sessions ever gain a tenant association, this becomes an ORGANIZATIONS-axis\n     * question and `assignScopeRootCollectionConfinementToFilter` is where it is answered — that\n     * authority is deliberately scoped to the tenant axis today.\n     *\n     * The sibling decisions live in `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Application-wide by design — see the block above; there is no tenant to confine a pre-auth visitor to\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    /**\n     * The visitor's own consent decision, recorded against their anonymous session (#1258).\n     *\n     * ## Why it is COLLECTION-level and carries no id\n     *\n     * `resourceOperationLike: UPDATE_MANY` puts it at the collection path with its own name segment\n     * and NO entity id — the `reset-features` shape. That is not a convenience: it is what keeps the\n     * door safe.\n     *\n     * An entity-addressed variant would resolve `{ _id: <value> }`, and an anonymous session's\n     * identity is its client `uuidRef` while its `_id` is a server ObjectId — the exact trap the READ\n     * variant above documents, and the reason anon self-read was never offered. Worse, it would put\n     * the row's address in the REQUEST, where a visitor could name another visitor's session.\n     *\n     * With no id, the custom implementation selects the row by `uuidRef` taken from the verified\n     * session JWT (`executionContext.anonymousUserId`). The selector is server-derived, so describing\n     * another visitor's decision is not expressible rather than merely refused.\n     *\n     * **This resource is its own scope ROOT**, so both repositories blacklist the anonymous axis and\n     * the contextual filter contributes NO predicate here (that is why LIST is super-admin). Nothing\n     * confines this write except the selector the implementation builds, which is why the selector is\n     * the thing under test.\n     *\n     * LOW risk: it writes one person's own privacy choice on a pre-identity row holding no account.\n     * `auditBelowRiskFloor` is what makes it leave a row anyway — the same declaration, and the same\n     * reasoning, as the UPDATE variant above and the lead's CREATE: buying the row by mis-declaring\n     * the verb's danger would corrupt the risk vocabulary every other control reads.\n     *\n     * Rate-limited per IP like the lead form, because it is a public unauthenticated write and an\n     * anonymous session is free to mint.\n     *\n     * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's own decision is recordable before\n     * they have an account, against the session it was made in.\n     */\n    [AnonymousUsers_Operations.RECORD_CONSENT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordConsentRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordConsentResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          /*\n           * Without this the operation answers 403 to the only caller it exists for (#1267), and the\n           * gate that refuses it is RIGHT: a collection-shaped write on a scope root reads as an\n           * unconfined DIRECTORY write, and `enforceApplicationWideReadAdmission` then demands a\n           * two-person elevation no visitor can hold.\n           *\n           * The declaration says the missing half: this write IS confined, by\n           * `createAnonymousConsentFactories`, to `{ uuidRef: executionContext.anonymousUserId }` —\n           * the value the session JWT was verified to carry, never anything from the request. The\n           * collection shape is a CONSEQUENCE of making the row unaddressable, not evidence that a\n           * set is being written.\n           *\n           * That confinement is the obligation the flag creates, and it is pinned in\n           * `anonymous-consent.custom-impl.backend.service.test.ts` with a hostile payload naming\n           * another session in `uuidRef`, `_id` and `anonymousUserId`.\n           */\n          admitsSelfConfinedScopeRootWrite: true,\n          /*\n           * Map the REQUEST shape onto the RESOURCE shape before the pipeline validates it — the\n           * `reset-to-defaults` idiom. The request names two purpose LISTS, which are not schema\n           * paths; the service tier validates against the resource schema, so without this the whole\n           * payload is unrecognised and the operation answers `service_resource_validation_failed`\n           * (measured live, #1267).\n           *\n           * The intersection is applied HERE so the stored grants can never exceed what the same\n           * request claims to have offered, whatever a later handler does with them. No\n           * `consentDecidedAt`: the custom implementation stamps the server's clock through\n           * `buildConsentDecisionPatch`, so a caller-authored instant cannot enter.\n           */\n          basicPrefixOperation: ({ inputDto }) => {\n            const request = AnonymousUsersRecordConsentRequestDtoSchema.parse(inputDto);\n            const offeredPurposes = normalizeConsentPurposes(request.offeredPurposes);\n            return {\n              privacy: {\n                consentedPurposes: normalizeConsentPurposes(request.grantedPurposes)\n                  .filter((purpose) => offeredPurposes.includes(purpose)),\n                offeredPurposes,\n              },\n            };\n          },\n          // No `authoritativeFields`: the request contract is two purpose LISTS and carries no\n          // `privacy` block, so there is no caller-supplied value to overwrite. The custom\n          // implementation composes the stored block itself. Declaring one here would be a guard over\n          // a field nothing can send — an untested claim that reads as protection.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    /**\n     * A visitor's own public-document page tells the server it rendered — `NOTICE_DELIVERED`, the\n     * anonymous half of #1258 Step 5 / R11. Same shape as `RECORD_CONSENT` and the same reasons:\n     * public, unauthenticated, one collection-level write with no id in the URL, so the request\n     * cannot name a row. Unlike its sibling, this write touches NO row on this resource at all — it\n     * only needs the verified session identity to attribute a `GOVERNED_DOCUMENT_INTERACTION_RECORDED`\n     * audit row, via `recordGovernedDocumentNoticeDelivered`.\n     *\n     * Rate-limited per IP like its sibling: a public unauthenticated write, and an anonymous session\n     * is free to mint.\n     */\n    [AnonymousUsers_Operations.RECORD_NOTICE_DELIVERED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: AnonymousUsersRecordNoticeDeliveredRequestDtoSchema,\n          customResponseDto: AnonymousUsersRecordNoticeDeliveredResponseDtoSchema,\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // Same obligation as `RECORD_CONSENT`, for the same reason (#1267): a collection-shaped\n          // write on this scope-root resource is otherwise read as an unconfined directory write.\n          // The custom implementation confines it to the verified session's own identity and writes\n          // no row at all — nothing here is a directory write in substance, only in HTTP shape.\n          admitsSelfConfinedScopeRootWrite: true,\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/anonymous-users.shared.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.schema.d.ts","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,wEAAwE;AACxE,oBAAY,gCAAgC;IAC1C,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;iBAwFxB,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,OAAO,oBAA2C,CAAC;AACrF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"anonymous-users.shared.schema.d.ts","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,wEAAwE;AACxE,oBAAY,gCAAgC;IAC1C,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;iBAwFxB,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,OAAO,oBAA2C,CAAC;AACrF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/users/anonymous-users.shared.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-users.shared.schema.js","sourceRoot":"","sources":["../../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAE1G,wEAAwE;AACxE,MAAM,CAAN,IAAY,gCAIX;AAJD,WAAY,gCAAgC;IAC1C,uDAAmB,CAAA;IACnB,yDAAqB,CAAA;IACrB,uDAAmB,CAAA;AACrB,CAAC,EAJW,gCAAgC,KAAhC,gCAAgC,QAI3C;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,EAAE;IACzG;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE;IACrG,oFAAoF;IACpF,oGAAoG;IACpG,oDAAoD;IACpD,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5G;;;;;;;;OAQG;IACH,iBAAiB,EAAE,oCAAoC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;SAC/E,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC7C,wDAAwD;IACxD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACzF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;CAC/D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,oBAAoB,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { AnonymousUserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { AnonymousUserMarketingMetadataSchema } from \"./anonymous-user-marketing-metadata.shared.schemas\";\n\n/** W7.3a: Status of anonymous→authenticated ownership transposition. */\nexport enum AnonymousUserTranspositionStatus {\n  PENDING = 'pending',\n  COMPLETE = 'complete',\n  PARTIAL = 'partial',\n}\n\nconst _AnonymousUserSchema = z.object({\n  /**\n   * Server-minted MongoDB identity (ObjectId, surfaced as a hex string).\n   * `.isPrimaryKey()` = the standard server-generated primary key (composite:\n   * excludeFromCreate + hidden + unique + indexed), IDENTICAL to every other\n   * resource — which is what makes session-init a normal create (it is server-minted,\n   * so it is never in the create payload, so it never crashes the strict-DTO parse).\n   *\n   * This is a PURE internal storage id. It is NOT the anonymous user's relational\n   * identity: children (`draft-notes`, `inbound-contacts`) reference {@link uuidRef}\n   * via their `anonymousUserId` FK, the session JWT carries `uuidRef`, and the nested\n   * `/anonymous-users/{uuidRef}/…` routes key off `uuidRef` — never this `_id`.\n   * See {@link uuidRef} for why the relational identity is the client handle, not `_id`.\n   */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n  /**\n   * The anonymous user's RELATIONAL / business identity: a client-generated,\n   * unguessable UUID handle for the session (`crypto.randomUUID()` in the frontend\n   * `AnonymousSessionContext`). Everything client-facing keys off THIS, not `_id`:\n   * the `anonymousUserId` FK on child resources, the session JWT payload, the nested\n   * `/anonymous-users/{uuidRef}/draft-notes` URL param (+ its coherence check),\n   * and the cross-origin handoff. `_id` stays a pure internal DB storage id.\n   *\n   * Why the client generates it and why it is the identity (not `_id`):\n   * - **Cross-origin continuity**: a visitor starts on the marketing site\n   *   (`example.com`) and continues in the app (`app.example.com`) — two origins with\n   *   SEPARATE localStorage. The handle is generated client-side and handed across, so\n   *   the same anonymous user is resolved on both. It also survives page reload / the\n   *   24h JWT expiry (presented again at `x-anonymous-session-init` to re-resolve).\n   * - **Unguessable adoption handle**: presenting this value at init ADOPTS the\n   *   session, so it must be unguessable. A random UUID is; a server `_id`\n   *   (ObjectId = timestamp + counter) is partially enumerable — the wrong primitive.\n   * - **`_id` is a database concern**: the client value must never BE `_id`; it lives\n   *   here as an indexed, unique reference. Using one client-facing identity end-to-end\n   *   (rather than translating a client handle ⇄ a server `_id` at every seam) is why\n   *   children's `anonymousUserId` carries `uuidRef`.\n   *\n   * Set in-process by `AnonymousSessionBackendService.createAnonymousUser` from the\n   * validated init header. Unique-indexed for concurrent-tab / cross-origin\n   * create-or-resolve dedup. `.excludeFromUpdate()` — an immutable identity handle.\n   * Readable (not `.isBackendOnly()`) so the anonymous-session-cleanup batch can filter\n   * a user's children by it; it is not sensitive (the client that generated it already\n   * holds it, and it grants only zero-value anonymous access).\n   */\n  uuidRef: z.string().min(1).isDBIndexed().isUnique({ scope: 'global', sparse: false }).excludeFromUpdate(),\n  /**\n   * The visitor's consent decision. CREATE cannot carry it: a session starts undecided, and the\n   * contract says so rather than trusting every caller to.\n   *\n   * A decision is written only by the doors that record it: the collection-level `record_consent`\n   * and the admin UPDATE, both of which emit an audit row\n   * (`evidence-requirement:consent-decision-transition-record` C2). CREATE sits below the automatic\n   * audit floor, so a consent value accepted there would be stored and leave no trace. That was not\n   * hypothetical: session start once wrote keys the schema did not have, and every visitor silently\n   * received a default consent level (#534). Excluding the block, rather than auditing every session\n   * start, states the truth (nothing is decided at creation) and costs no row per visitor.\n   *\n   * The default is exactly the \"never asked\" state: no grants, nothing offered, no decision instant.\n   *\n   * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a verb that cannot write a consent decision\n   * cannot write one silently.\n   */\n  privacy: AnonymousUserPrivacySchema.default(AnonymousUserPrivacySchema.parse({})).excludeFromCreate(),\n  // An anonymous user IS a person — one without an account. This resource declares no\n  // `exportSubject`, which is why a subject-export-based sweep misses it entirely; the categories are\n  // owed regardless of whether the row is exportable.\n  //\n  // USAGE for the user agent (a device/browser observation), IDENTITY for the IP hash: hashing does\n  // not stop it identifying — it is a pseudonymous identifier, GDPR Art. 4(5), the same reading the\n  // audit row's `clientInstanceId` already carries. LOCATION alongside, because an IP narrows where\n  // the person is even when hashed against a rainbow-table attacker rather than against the operator.\n  userAgent: z.string().optional().dataCategories(PersonalDataCategory.USAGE),\n  ipHash: z.string().optional().dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.LOCATION]),\n  /**\n   * Phase 0.5 (Q-D=β): first-touch marketing attribution captured at\n   * session-init time and never overwritten. Lives here on the\n   * `AnonymousUser` (the session anchor) rather than on\n   * `InboundContact` (the conversion row) so we get attribution for\n   * sessions that convert via signup OR contact form OR not at all.\n   * `.isBackendOnly()` strips it from every client-facing response —\n   * marketing analytics joins via `anonymousUserId` server-side only.\n   */\n  marketingMetadata: AnonymousUserMarketingMetadataSchema.optional().isBackendOnly()\n    .dataCategories(PersonalDataCategory.USAGE),\n  /** W7.3a: Set when anonymous user registers/logs in. */\n  convertedToUserId: z.string().optional(),\n  transpositionStatus: z.enum(AnonymousUserTranspositionStatus).optional().isSummaryField(),\n  createdAt: z.date().default(() => new Date()).isSummaryField(),\n});\n\nexport const AnonymousUserSchema: typeof _AnonymousUserSchema = _AnonymousUserSchema;\nexport type AnonymousUser = z.infer<typeof _AnonymousUserSchema>;\n"]}
+{"version":3,"file":"anonymous-users.shared.schema.js","sourceRoot":"","sources":["../../../src/users/anonymous-users.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAE1G,wEAAwE;AACxE,MAAM,CAAN,IAAY,gCAIX;AAJD,WAAY,gCAAgC;IAC1C,uDAAmB,CAAA;IACnB,yDAAqB,CAAA;IACrB,uDAAmB,CAAA;AACrB,CAAC,EAJW,gCAAgC,KAAhC,gCAAgC,QAI3C;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,EAAE;IACzG;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE;IACrG,oFAAoF;IACpF,oGAAoG;IACpG,oDAAoD;IACpD,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5G;;;;;;;;OAQG;IACH,iBAAiB,EAAE,oCAAoC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;SAC/E,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC7C,wDAAwD;IACxD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACzF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;CAC/D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,oBAAoB,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { AnonymousUserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { AnonymousUserMarketingMetadataSchema } from \"./anonymous-user-marketing-metadata.shared.schemas\";\n\n/** W7.3a: Status of anonymous→authenticated ownership transposition. */\nexport enum AnonymousUserTranspositionStatus {\n  PENDING = 'pending',\n  COMPLETE = 'complete',\n  PARTIAL = 'partial',\n}\n\nconst _AnonymousUserSchema = z.object({\n  /**\n   * Server-minted MongoDB identity (ObjectId, surfaced as a hex string).\n   * `.isPrimaryKey()` = the standard server-generated primary key (composite:\n   * excludeFromCreate + hidden + unique + indexed), IDENTICAL to every other\n   * resource — which is what makes session-init a normal create (it is server-minted,\n   * so it is never in the create payload, so it never crashes the strict-DTO parse).\n   *\n   * This is a PURE internal storage id. It is NOT the anonymous user's relational\n   * identity: children (`draft-notes`, `inbound-contacts`) reference {@link uuidRef}\n   * via their `anonymousUserId` FK, the session JWT carries `uuidRef`, and the nested\n   * `/anonymous-users/{uuidRef}/…` routes key off `uuidRef` — never this `_id`.\n   * See {@link uuidRef} for why the relational identity is the client handle, not `_id`.\n   */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n  /**\n   * The anonymous user's RELATIONAL / business identity: a client-generated,\n   * unguessable UUID handle for the session (`crypto.randomUUID()` in the frontend\n   * `AnonymousSessionContext`). Everything client-facing keys off THIS, not `_id`:\n   * the `anonymousUserId` FK on child resources, the session JWT payload, the nested\n   * `/anonymous-users/{uuidRef}/draft-notes` URL param (+ its coherence check),\n   * and the cross-origin handoff. `_id` stays a pure internal DB storage id.\n   *\n   * Why the client generates it and why it is the identity (not `_id`):\n   * - **Cross-origin continuity**: a visitor starts on the marketing site\n   *   (`example.com`) and continues in the app (`app.example.com`) — two origins with\n   *   SEPARATE localStorage. The handle is generated client-side and handed across, so\n   *   the same anonymous user is resolved on both. It also survives page reload / the\n   *   24h JWT expiry (presented again at `x-anonymous-session-init` to re-resolve).\n   * - **Unguessable adoption handle**: presenting this value at init ADOPTS the\n   *   session, so it must be unguessable. A random UUID is; a server `_id`\n   *   (ObjectId = timestamp + counter) is partially enumerable — the wrong primitive.\n   * - **`_id` is a database concern**: the client value must never BE `_id`; it lives\n   *   here as an indexed, unique reference. Using one client-facing identity end-to-end\n   *   (rather than translating a client handle ⇄ a server `_id` at every seam) is why\n   *   children's `anonymousUserId` carries `uuidRef`.\n   *\n   * Set in-process by `AnonymousSessionBackendService.createAnonymousUser` from the\n   * validated init header. Unique-indexed for concurrent-tab / cross-origin\n   * create-or-resolve dedup. `.excludeFromUpdate()` — an immutable identity handle.\n   * Readable (not `.isBackendOnly()`) so the anonymous-session-cleanup batch can filter\n   * a user's children by it; it is not sensitive (the client that generated it already\n   * holds it, and it grants only zero-value anonymous access).\n   */\n  uuidRef: z.string().min(1).isDBIndexed().isUnique({ scope: 'global', sparse: false }).excludeFromUpdate(),\n  /**\n   * The visitor's consent decision. CREATE cannot carry it: a session starts undecided, and the\n   * contract says so rather than trusting every caller to.\n   *\n   * A decision is written only by the doors that record it: the collection-level `record_consent`\n   * and the admin UPDATE, both of which emit an audit row\n   * (`evidence-requirement:consent-decision-transition-record` C2). CREATE sits below the automatic\n   * audit floor, so a consent value accepted there would be stored and leave no trace. That was not\n   * hypothetical: session start once wrote keys the schema did not have, and every visitor silently\n   * received a default consent level (#534). Excluding the block, rather than auditing every session\n   * start, states the truth (nothing is decided at creation) and costs no row per visitor.\n   *\n   * The default is exactly the \"never asked\" state: no grants, nothing offered, no decision instant.\n   *\n   * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a verb that cannot write a consent decision\n   * cannot write one silently.\n   */\n  privacy: AnonymousUserPrivacySchema.default(AnonymousUserPrivacySchema.parse({})).excludeFromCreate(),\n  // An anonymous user IS a person — one without an account. This resource declares no\n  // `exportSubject`, which is why a subject-export-based sweep misses it entirely; the categories are\n  // owed regardless of whether the row is exportable.\n  //\n  // USAGE for the user agent (a device/browser observation), IDENTITY for the IP hash: hashing does\n  // not stop it identifying — it is a pseudonymous identifier, GDPR Art. 4(5), the same reading the\n  // audit row's `clientInstanceId` already carries. LOCATION alongside, because an IP narrows where\n  // the person is even when hashed against a rainbow-table attacker rather than against the operator.\n  userAgent: z.string().optional().dataCategories(PersonalDataCategory.USAGE),\n  ipHash: z.string().optional().dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.LOCATION]),\n  /**\n   * Phase 0.5 (Q-D=β): first-touch marketing attribution captured at\n   * session-init time and never overwritten. Lives here on the\n   * `AnonymousUser` (the session anchor) rather than on\n   * `InboundContact` (the conversion row) so we get attribution for\n   * sessions that convert via signup OR contact form OR not at all.\n   * `.isBackendOnly()` strips it from every client-facing response —\n   * marketing analytics joins via `anonymousUserId` server-side only.\n   */\n  marketingMetadata: AnonymousUserMarketingMetadataSchema.optional().isBackendOnly()\n    .dataCategories(PersonalDataCategory.USAGE),\n  /** W7.3a: Set when anonymous user registers/logs in. */\n  convertedToUserId: z.string().optional(),\n  transpositionStatus: z.enum(AnonymousUserTranspositionStatus).optional().isSummaryField(),\n  createdAt: z.date().default(() => new Date()).isSummaryField(),\n});\n\nexport const AnonymousUserSchema: typeof _AnonymousUserSchema = _AnonymousUserSchema;\nexport type AnonymousUser = z.infer<typeof _AnonymousUserSchema>;\n"]}

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAG/C,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;iCAoL9C,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAI/C,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;iCAyL9C,CAAC"}

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.js

@@ -39,6 +39,7 @@ import { ResourceSystemAccessMode } from '../resources/resources-config.shared.s
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier, } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { SubmissionChallengeAction } from '../security/submission-challenge/submission-challenge.shared.js';
 export const inboundContactsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: InboundContactSchema,
     resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,
@@ -118,6 +119,11 @@ export const inboundContactsResourceConfiguration_InitializationFactory = (resou
                         requestsPerMinute: 5,
                         requestsPerHour: 30,
                     },
+                    // …and, when the application declares a captcha provider, a visitor answers a challenge before the lead is
+                    // written (#1985): the engine asks it in `doOperation`, documents the header in the API reference, and refuses
+                    // an unanswered or refused submission with 400. The rate limit stays the primary control: a bot can always
+                    // choose the proof of work, which costs it milliseconds.
+                    submissionChallenge: { action: SubmissionChallengeAction.INBOUND_CONTACT },
                     // The lead's marketing opt-in is a consent DECISION: the server stamps its instant (#534).
                     basicPrefixOperation: ({ inputDto }) => buildConsentDecisionPatch(inputDto, undefined),
                     authoritativeFields: ['privacy'],

package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAU7C;IACA,UAAU,EAAE,oBAAoB;IAChC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kEAAkE;IAClE,qEAAqE;IACrE,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,oDAAoD;IACpD,kBAAkB,EAAE;QAChB,ydAAyd;QACzd,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAE/F;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,mIAAmI;gBACnI;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,kEAAkE;oBAClE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,iEAAiE;oBACjE,gBAAgB;oBAChB,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,2FAA2F;oBAC3F,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC;oBACtF,mBAAmB,EAAE,CAAC,SAAS,CAAC;oBAChC,mFAAmF;oBACnF,wFAAwF;oBACxF,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,8EAA8E;oBAC9E,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;gBACD,2EAA2E;aAC5E;YACD,kEAAkE;YAClE,sEAAsE;YACtE,6DAA6D;YAC7D,0EAA0E;YAC1E,0EAA0E;YAC1E,4DAA4D;YAC5D,yEAAyE;YACzE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,gDAAgD;SACjD;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * InboundContact Resource Configuration (Phase 0.5, Q-E=B path)\n *\n * Lead-capture resource for the public marketing site.\n * APPLICATION-scope (anchored via the `ANONYMOUS_USERS → INBOUND_CONTACTS`\n * relationship row in `coreSharedResourceRelationship`), NO\n * `isAnonymizable: true` — the framework's anonymizable transposition\n * pipeline gates on USER_SELF semantics, but `INBOUND_CONTACTS` is\n * conceptually an org-owned admin resource. Transposition is handled\n * by a focused manual hook in `AnonymousSessionBackendService` that\n * UPDATEs `{ anonymousUserId } → { userId, anonymousUserId: null }`\n * when the lead converts to an authenticated user.\n *\n * Operations:\n * - CREATE       : public — `APP_ANONYMOUS` role, requires an active\n *                  anonymous session. Per-endpoint rate-limit declared\n *                  on the variant itself (5 req/min + 30 req/hour per IP),\n *                  enforced at the controller pre-flight seam by\n *                  `RateLimitBackendService.checkPolicyForVariant`\n *                  BEFORE execution-context creation.\n * - READ / LIST  : `APP_ADMIN_MARKETING_EDITOR` (admin marketing dashboard).\n * - SEARCH       : `APP_ADMIN_MARKETING_EDITOR`.\n * - UPDATE       : INTERNAL_CALL only — used by the manual transposition\n *                  hook in `AnonymousSessionBackendService` to set\n *                  `{ userId, anonymousUserId: null }` on lead conversion.\n *                  Not exposed as a public API (no admin-edit surface in\n *                  Phase 0.5 — leads are read-only in the dashboard).\n * - DELETE       : `APP_ADMIN_SUPER_ADMIN` (compliance / data-cleanup).\n *\n * Marketing attribution does NOT live on this row. First-touch\n * attribution is on `AnonymousUser.marketingMetadata` (Q-D=β); analytics\n * joins via `anonymousUserId`.\n */\n\nimport { InboundContactSchema } from './inbound-contacts.shared.schemas';\nimport { buildConsentDecisionPatch } from './user-consent-decision.shared.utils';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport const inboundContactsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE,\n  typeof InboundContactSchema\n>({\n  mainSchema: InboundContactSchema,\n  resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_CONTACTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Lead-conversion transposition (`AnonymousSessionBackendService`\n  // .transposeInboundContactsOwnership) UPDATEs `{ anonymousUserId } →\n  // { userId, anonymousUserId: null }` in-process. Both FKs are context-auto-\n  // populated names the client-shaped request DTO strips, so a plain update is a\n  // silent no-op; `updateAsSystem` re-attaches them after the strict parse,\n  // fail-closed behind this opt-in. INBOUND_CONTACTS is APPLICATION-scoped (not\n  // `isAnonymizable`), so the grant is authored explicitly here rather than\n  // derived by the factory's anonymizable enrichment.\n  systemAccessPolicy: {\n      // Subject-export disclosure. Lead records the subject is the data subject of. ⚠️ Art. 15(4): if an app stores third-party notes ABOUT the subject on these rows, mark those fields `.isBackendOnly()` so the export's security floor withholds them. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the inbound contact.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: an inbound contact IS contact details — email, names, phone — and all\n   * are scrubbed. The row is retained because it may be the only record that a contact attempt\n   * happened, which an operator can legitimately need to account for, and once scrubbed it carries no\n   * personal datum.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject reaches this row through EITHER `userId` or `anonymousUserId` — an inbound contact can\n   * predate the account. `SELF_PRINCIPAL` names the person the row is about either way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the boot-time guard and then fails to resolve at erasure time.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        /** @wildo_source:part:start example.rate-limit.resource-operation-surface facet:kind:usage-example facet:audience:app-developer */\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Public anonymous CREATE — declares the per-IP rate-limit on the\n          // default API_CALL variant. Two windows (a short burst limit + an\n          // hourly cap) are AND-ed and enforced at the controller pre-flight\n          // seam; no bucket-key choice is needed here because IP is the only\n          // identity available before execution-context creation. The global\n          // HTTP limiter remains the safety net for any path that bypasses\n          // this surface.\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // The lead's marketing opt-in is a consent DECISION: the server stamps its instant (#534).\n          basicPrefixOperation: ({ inputDto }) => buildConsentDecisionPatch(inputDto, undefined),\n          authoritativeFields: ['privacy'],\n          // …and a decision the server stamps must leave a row. LOW sits below the automatic\n          // HIGH/CRITICAL floor, so without this the one consent a LEAD ever gives us was the one\n          // consent nothing recorded. The declaration rather than a raised risk level, for the reason\n          // the api-key reissue records: buying the row by mis-declaring the verb's danger corrupts the\n          // risk vocabulary every other control reads. Only the marked decision leaves enter the\n          // evidence, so the row carries the choice and not the lead's contact details.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the lead's own decision is recordable.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n        /** @wildo_source:part:end example.rate-limit.resource-operation-surface */\n      ],\n      // No `userNotifications` on CREATE. A Phase-0.5 draft declared an\n      // `INBOUND_CONTACT` + `EMAIL` notification, but the dispatcher has no\n      // email-by-target recipient resolution for `INBOUND_CONTACT`\n      // (`getUserIdsForTarget` falls through to `[]`, so the email was a silent\n      // no-op) and there is no template for it. `INBOUND_CONTACT` is wired only\n      // for the WEBSOCKET channel (admin in-app alerts) — declare\n      // `{ target: INBOUND_CONTACT, channel: WEBSOCKET }` here if an app wants\n      // that. For a visitor acknowledgement email, use the email-by-address\n      // path — `{ channel: EMAIL, recipientEmailField: 'email' }` (see\n      // `organization-member-invitations` CREATE). The paired resource spec\n      // asserts no email delivery; keep both in sync.\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"inbound-contacts.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8DAA8D,CAAC;AAEzG,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAU7C;IACA,UAAU,EAAE,oBAAoB;IAChC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kEAAkE;IAClE,qEAAqE;IACrE,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,oDAAoD;IACpD,kBAAkB,EAAE;QAChB,ydAAyd;QACzd,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAE/F;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;WAIG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,mIAAmI;gBACnI;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;oBACrC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,kEAAkE;oBAClE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,iEAAiE;oBACjE,gBAAgB;oBAChB,SAAS,EAAE;wBACT,iBAAiB,EAAE,CAAC;wBACpB,eAAe,EAAE,EAAE;qBACpB;oBACD,2GAA2G;oBAC3G,+GAA+G;oBAC/G,2GAA2G;oBAC3G,yDAAyD;oBACzD,mBAAmB,EAAE,EAAE,MAAM,EAAE,yBAAyB,CAAC,eAAe,EAAE;oBAC1E,2FAA2F;oBAC3F,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC;oBACtF,mBAAmB,EAAE,CAAC,SAAS,CAAC;oBAChC,mFAAmF;oBACnF,wFAAwF;oBACxF,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,8EAA8E;oBAC9E,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;gBACD,2EAA2E;aAC5E;YACD,kEAAkE;YAClE,sEAAsE;YACtE,6DAA6D;YAC7D,0EAA0E;YAC1E,0EAA0E;YAC1E,4DAA4D;YAC5D,yEAAyE;YACzE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,gDAAgD;SACjD;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,0BAA0B,CAAC;oBAClD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,6FAA6F;oBAC7F,4FAA4F;oBAC5F,mFAAmF;oBACnF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,2FAA2F;oBAC3F,yEAAyE;oBACzE,0FAA0F;oBAC1F,6FAA6F;oBAC7F,kCAAkC;oBAClC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * InboundContact Resource Configuration (Phase 0.5, Q-E=B path)\n *\n * Lead-capture resource for the public marketing site.\n * APPLICATION-scope (anchored via the `ANONYMOUS_USERS → INBOUND_CONTACTS`\n * relationship row in `coreSharedResourceRelationship`), NO\n * `isAnonymizable: true` — the framework's anonymizable transposition\n * pipeline gates on USER_SELF semantics, but `INBOUND_CONTACTS` is\n * conceptually an org-owned admin resource. Transposition is handled\n * by a focused manual hook in `AnonymousSessionBackendService` that\n * UPDATEs `{ anonymousUserId } → { userId, anonymousUserId: null }`\n * when the lead converts to an authenticated user.\n *\n * Operations:\n * - CREATE       : public — `APP_ANONYMOUS` role, requires an active\n *                  anonymous session. Per-endpoint rate-limit declared\n *                  on the variant itself (5 req/min + 30 req/hour per IP),\n *                  enforced at the controller pre-flight seam by\n *                  `RateLimitBackendService.checkPolicyForVariant`\n *                  BEFORE execution-context creation.\n * - READ / LIST  : `APP_ADMIN_MARKETING_EDITOR` (admin marketing dashboard).\n * - SEARCH       : `APP_ADMIN_MARKETING_EDITOR`.\n * - UPDATE       : INTERNAL_CALL only — used by the manual transposition\n *                  hook in `AnonymousSessionBackendService` to set\n *                  `{ userId, anonymousUserId: null }` on lead conversion.\n *                  Not exposed as a public API (no admin-edit surface in\n *                  Phase 0.5 — leads are read-only in the dashboard).\n * - DELETE       : `APP_ADMIN_SUPER_ADMIN` (compliance / data-cleanup).\n *\n * Marketing attribution does NOT live on this row. First-touch\n * attribution is on `AnonymousUser.marketingMetadata` (Q-D=β); analytics\n * joins via `anonymousUserId`.\n */\n\nimport { InboundContactSchema } from './inbound-contacts.shared.schemas';\nimport { buildConsentDecisionPatch } from './user-consent-decision.shared.utils';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  coreResourceShared_FieldIdentifier,\n} from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { SubmissionChallengeAction } from '../security/submission-challenge/submission-challenge.shared';\n\nexport const inboundContactsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE,\n  typeof InboundContactSchema\n>({\n  mainSchema: InboundContactSchema,\n  resourceIdentifier: CoreResourceType.INBOUND_CONTACTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.INBOUND_CONTACTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Lead-conversion transposition (`AnonymousSessionBackendService`\n  // .transposeInboundContactsOwnership) UPDATEs `{ anonymousUserId } →\n  // { userId, anonymousUserId: null }` in-process. Both FKs are context-auto-\n  // populated names the client-shaped request DTO strips, so a plain update is a\n  // silent no-op; `updateAsSystem` re-attaches them after the strict parse,\n  // fail-closed behind this opt-in. INBOUND_CONTACTS is APPLICATION-scoped (not\n  // `isAnonymizable`), so the grant is authored explicitly here rather than\n  // derived by the factory's anonymizable enrichment.\n  systemAccessPolicy: {\n      // Subject-export disclosure. Lead records the subject is the data subject of. ⚠️ Art. 15(4): if an app stores third-party notes ABOUT the subject on these rows, mark those fields `.isBackendOnly()` so the export's security floor withholds them. Secrets and backend-only values are withheld by the export's security floor regardless of this grant. On a polymorphic resource this grant applies to EVERY generated variant, which is the documented intent of the shared config.\n      exportSubject: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the inbound contact.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: an inbound contact IS contact details — email, names, phone — and all\n   * are scrubbed. The row is retained because it may be the only record that a contact attempt\n   * happened, which an operator can legitimately need to account for, and once scrubbed it carries no\n   * personal datum.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject reaches this row through EITHER `userId` or `anonymousUserId` — an inbound contact can\n   * predate the account. `SELF_PRINCIPAL` names the person the row is about either way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the boot-time guard and then fails to resolve at erasure time.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        /** @wildo_source:part:start example.rate-limit.resource-operation-surface facet:kind:usage-example facet:audience:app-developer */\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ANONYMOUS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Public anonymous CREATE — declares the per-IP rate-limit on the\n          // default API_CALL variant. Two windows (a short burst limit + an\n          // hourly cap) are AND-ed and enforced at the controller pre-flight\n          // seam; no bucket-key choice is needed here because IP is the only\n          // identity available before execution-context creation. The global\n          // HTTP limiter remains the safety net for any path that bypasses\n          // this surface.\n          rateLimit: {\n            requestsPerMinute: 5,\n            requestsPerHour: 30,\n          },\n          // …and, when the application declares a captcha provider, a visitor answers a challenge before the lead is\n          // written (#1985): the engine asks it in `doOperation`, documents the header in the API reference, and refuses\n          // an unanswered or refused submission with 400. The rate limit stays the primary control: a bot can always\n          // choose the proof of work, which costs it milliseconds.\n          submissionChallenge: { action: SubmissionChallengeAction.INBOUND_CONTACT },\n          // The lead's marketing opt-in is a consent DECISION: the server stamps its instant (#534).\n          basicPrefixOperation: ({ inputDto }) => buildConsentDecisionPatch(inputDto, undefined),\n          authoritativeFields: ['privacy'],\n          // …and a decision the server stamps must leave a row. LOW sits below the automatic\n          // HIGH/CRITICAL floor, so without this the one consent a LEAD ever gives us was the one\n          // consent nothing recorded. The declaration rather than a raised risk level, for the reason\n          // the api-key reissue records: buying the row by mis-declaring the verb's danger corrupts the\n          // risk vocabulary every other control reads. Only the marked decision leaves enter the\n          // evidence, so the row carries the choice and not the lead's contact details.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the lead's own decision is recordable.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n        /** @wildo_source:part:end example.rate-limit.resource-operation-surface */\n      ],\n      // No `userNotifications` on CREATE. A Phase-0.5 draft declared an\n      // `INBOUND_CONTACT` + `EMAIL` notification, but the dispatcher has no\n      // email-by-target recipient resolution for `INBOUND_CONTACT`\n      // (`getUserIdsForTarget` falls through to `[]`, so the email was a silent\n      // no-op) and there is no template for it. `INBOUND_CONTACT` is wired only\n      // for the WEBSOCKET channel (admin in-app alerts) — declare\n      // `{ target: INBOUND_CONTACT, channel: WEBSOCKET }` here if an app wants\n      // that. For a visitor acknowledgement email, use the email-by-address\n      // path — `{ channel: EMAIL, recipientEmailField: 'email' }` (see\n      // `organization-member-invitations` CREATE). The paired resource spec\n      // asserts no email delivery; keep both in sync.\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A consent decision lands here, and MEDIUM sits below the automatic HIGH/CRITICAL floor, so\n          // without this declaration the change would leave no row at all — and a consent change that\n          // emits nothing is indistinguishable from no consent change, which is exactly what\n          // `evidence-requirement:consent-decision-transition-record` C2 forbids. Same remedy as the\n          // preference UPDATE doors: the declaration, never a raised risk level, because buying the row\n          // by mis-declaring the verb's danger would corrupt the risk vocabulary every other control\n          // reads. Only the marked decision leaves (`consentedPurposes`) enter the\n          // evidence, so the row carries the previous and resulting choice and not the whole block.\n          // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a visitor's or a lead's consent decision\n          // is as recordable as a member's.\n          auditableEvent: { auditBelowRiskFloor: true },\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/inbound-contacts.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBA4G/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"inbound-contacts.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,kEAAkE;IAClE,IAAI,SAAS;IACb,2EAA2E;IAC3E,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,aAAa,kBAAkB;CAChC;AAGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBA4G/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}