@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/users/inbound-contacts.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contacts.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAGnG;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,4BAUX;AAVD,WAAY,4BAA4B;IACtC,kEAAkE;IAClE,6CAAa,CAAA;IACb,2EAA2E;IAC3E,2DAA2B,CAAA;IAC3B;;;OAGG;IACH,+DAA+B,CAAA;AACjC,CAAC,EAVW,4BAA4B,KAA5B,4BAA4B,QAUvC;AAGD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzC,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,KAAK,EAAG,oBAAoB,CAC1B,CAAC,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC/E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,SAAS,EAAG,oBAAoB,CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IACD,QAAQ,EAAG,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IACD,KAAK,EAAG,oBAAoB,CAC1B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC1E,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEzF;;;;;;;OAOG;IACH,MAAM,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEhF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IAEvE;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,EAAG,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEtK;;;;;;;;OAQG;IACH,SAAS,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC3F,SAAS,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1E,OAAO,EAAG,2BAA2B;CACxC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { ERASED_USER_EMAIL } from './users.shared.schemas';\nimport { InboundContactPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n\n/**\n * Server-computed lead-triage signal: whether the lead's email corresponded to\n * an existing `users` account at capture time, and — because the caller only\n * flagged \"active, or not\" — whether that account was ACTIVE.\n *\n * This is a TRIAGE / dedup HINT, **not** an ownership link. It NEVER sets\n * `userId`/`relatedUserId`: an anonymous visitor typing an email does not prove\n * they own it, so attributing the lead to a real account on an unverified string\n * would be an account-takeover hole. Ownership is established only by proven\n * authentication (the transposition hook) or a manual sales tag (`relatedUserId`).\n */\nexport enum InboundContactEmailUserMatch {\n  /** No existing `users` row carried this email at capture time. */\n  NONE = 'NONE',\n  /** Email matched an existing user whose lifecycle `status` is `ACTIVE`. */\n  ACTIVE_USER = 'ACTIVE_USER',\n  /**\n   * Email matched an existing user that is NOT active — any of `INACTIVE`,\n   * `SUSPENDED`, `PENDING_VERIFICATION`, `PENDING_INVITATION`, `DELETED`.\n   */\n  INACTIVE_USER = 'INACTIVE_USER',\n}\n\n\n/**\n * InboundContact — lead / contact-form submission captured from the\n * public marketing site (Phase 0.5). APPLICATION-scoped (Q-E=B), no\n * `isAnonymizable: true` — transposition is handled by a focused\n * manual hook in `AnonymousSessionBackendService.transposeOwnership`\n * that updates `{ anonymousUserId, userId }` (see\n * .cursor/plans/saas-website-slice.md § 0.5.a).\n *\n * Attribution data (UTM, referrer, landing path, IP fingerprint) does\n * NOT live here. It lives ONCE on `AnonymousUser` (Q-D=β first-touch\n * attribution); analytics joins via the `anonymousUserId` FK.\n */\nexport const InboundContactSchema = z.object({\n\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    email : addImpersonalizeWith(\n      z.email().isSummaryField().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    firstName : addImpersonalizeWith(\n      z.string().optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n      RedactionType.REMOVE,\n    ),\n    lastName : addImpersonalizeWith(\n      z.string().optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n      RedactionType.REMOVE,\n    ),\n    phone : addImpersonalizeWith(\n      z.string().optional().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n      RedactionType.REMOVE,\n    ),\n\n    /**\n     * Anonymous session that created this lead. FK to `AnonymousUser`.\n     * Carries first-touch marketing attribution (utm, referrer,\n     * landingPath) via `AnonymousUser.marketingMetadata` (Q-D=β —\n     * attribution lives on the session, not the conversion row).\n     * Cleared to `null` by the manual transposition hook on\n     * `AnonymousSessionBackendService` once the user converts and\n     * `userId` is set.\n     *\n     * Server-set on anonymous-session creates by the write-path context\n     * enrichment (`ResourceOperationHelperBackendService.enrichDataWithContext`),\n     * which injects `executionContext.initiatorIds.anonymousUserId` — the client\n     * `uuidRef` (the AnonymousUser's relational identity), NOT its server-minted\n     * `_id`. This resource is APPLICATION-scoped and standalone-created (no nested\n     * `/anonymous-users/{uuidRef}/…` URL segment carries the FK, and it is\n     * deliberately NOT `isAnonymizable`), so the enrichment resolves the FK from the\n     * anonymous initiator identity rather than the URL scope map. Never client-authored.\n     */\n    anonymousUserId : z.string().nullable().isDBIndexed().excludeFromCreate().isBackendOnly(),\n\n    /**\n     * Authenticated user AFTER anonymous-session transposition (W7.3a).\n     * Auto-set by the manual transposition hook on\n     * `AnonymousSessionBackendService` when the anonymous user signs up\n     * or logs in. `null` for leads that never converted to an\n     * authenticated user. Distinct from `relatedUserId` below — see\n     * `relatedUserId` JSDoc for the semantic boundary.\n     */\n    userId : z.string().nullable().isDBIndexed().excludeFromCreate().isBackendOnly(),\n\n    /**\n     * Manually-linked existing customer profile by sales / support\n     * (e.g. a salesperson tags an inbound lead as \"this is the same\n     * human as CRM contact X\"). **Not** auto-populated by\n     * anonymous-session transposition — that slot is `userId` above.\n     *\n     * A lead can legitimately have both populated:\n     * - `userId`        = the user who eventually signed up from this\n     *                     lead session (auto-set by transposition).\n     * - `relatedUserId` = the user a human rep manually associated\n     *                     (may be a different person, e.g. the lead is\n     *                     for a colleague of an existing customer).\n     *\n     * Kept on the schema for zero-cost preservation (no migration);\n     * the disambiguating JSDoc here exists so future readers do not\n     * conflate it with `userId`.\n     *\n     * `.excludeFromCreate()` is a HARD requirement, not polish: the public\n     * INBOUND_CONTACTS CREATE is anonymous (`APP_ANONYMOUS`), so a client-\n     * authorable `relatedUserId` would let an unauthenticated visitor tag a\n     * lead as \"related to\" an arbitrary existing user (a data-integrity /\n     * attribution-forgery hole). It is set ONLY post-create by a sales/support\n     * admin via a privileged update, never on the public capture request.\n     */\n    relatedUserId : z.string().isDBIndexed().optional().excludeFromCreate(),\n\n    /**\n     * Lead-triage signal (see `InboundContactEmailUserMatch`): did this lead's\n     * email match an existing user at capture time, and was that user active?\n     *\n     * Server-computed by the INBOUND_CONTACTS CREATE custom implementation\n     * (`prefixCoreOperations`) via a privileged users-by-email lookup — the\n     * anonymous create context cannot read `users`, so the lookup runs in a\n     * dedicated internal super-admin context and the result is stamped here.\n     *\n     * `.isBackendOnly()` is a HARD requirement, not polish: the CREATE response\n     * is returned to the anonymous submitter, so exposing the match would turn\n     * lead capture into an account-enumeration oracle. Backend-only keeps it out\n     * of every client response; admin / analytics surfaces read it through the\n     * internal DTO. `.excludeFromCreate()` (server-set, never client-authored)\n     * and `.excludeFromUpdate()` (immutable capture-time snapshot); `.default`\n     * `NONE` is the fail-safe when the email is absent or the lookup fails.\n     */\n    emailUserMatch : z.enum(InboundContactEmailUserMatch).default(InboundContactEmailUserMatch.NONE).isDBIndexed().excludeFromCreate().excludeFromUpdate().isBackendOnly(),\n\n    /**\n     * Mongoose-managed timestamps. Declared `z.date()` (NOT `z.iso.datetime()`)\n     * because the persistence layer stores them as BSON `Date`s and the DTO\n     * builder's network-boundary coercion (`applyNetworkBoundaryCoercion`)\n     * rewrites `z.date()` → `z.coerce.date()`. A `z.iso.datetime()` string validator would\n     * reject the stored `Date` on the output/internalDto parse → HTTP 500\n     * `service_resource_transformation_failed` on every create/read. Matches the\n     * framework-wide timestamp convention (35+ resources, e.g. `AnonymousUser`).\n     */\n    createdAt : z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n    updatedAt : z.date().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n    privacy : InboundContactPrivacySchema,\n});\n\n\nexport type InboundContact = z.infer<typeof InboundContactSchema>;\n"]}
+{"version":3,"file":"inbound-contacts.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/inbound-contacts.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAGnG;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,4BAUX;AAVD,WAAY,4BAA4B;IACtC,kEAAkE;IAClE,6CAAa,CAAA;IACb,2EAA2E;IAC3E,2DAA2B,CAAA;IAC3B;;;OAGG;IACH,+DAA+B,CAAA;AACjC,CAAC,EAVW,4BAA4B,KAA5B,4BAA4B,QAUvC;AAGD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzC,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAChD,KAAK,EAAG,oBAAoB,CAC1B,CAAC,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC/E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,SAAS,EAAG,oBAAoB,CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IACD,QAAQ,EAAG,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACpF,aAAa,CAAC,MAAM,CACrB;IACD,KAAK,EAAG,oBAAoB,CAC1B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC1E,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEzF;;;;;;;OAOG;IACH,MAAM,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEhF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,aAAa,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IAEvE;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,EAAG,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE;IAEtK;;;;;;;;OAQG;IACH,SAAS,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC3F,SAAS,EAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1E,OAAO,EAAG,2BAA2B;CACxC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { ERASED_USER_EMAIL } from './users.shared.schemas';\nimport { InboundContactPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n\n/**\n * Server-computed lead-triage signal: whether the lead's email corresponded to\n * an existing `users` account at capture time, and — because the caller only\n * flagged \"active, or not\" — whether that account was ACTIVE.\n *\n * This is a TRIAGE / dedup HINT, **not** an ownership link. It NEVER sets\n * `userId`/`relatedUserId`: an anonymous visitor typing an email does not prove\n * they own it, so attributing the lead to a real account on an unverified string\n * would be an account-takeover hole. Ownership is established only by proven\n * authentication (the transposition hook) or a manual sales tag (`relatedUserId`).\n */\nexport enum InboundContactEmailUserMatch {\n  /** No existing `users` row carried this email at capture time. */\n  NONE = 'NONE',\n  /** Email matched an existing user whose lifecycle `status` is `ACTIVE`. */\n  ACTIVE_USER = 'ACTIVE_USER',\n  /**\n   * Email matched an existing user that is NOT active — any of `INACTIVE`,\n   * `SUSPENDED`, `PENDING_VERIFICATION`, `PENDING_INVITATION`, `DELETED`.\n   */\n  INACTIVE_USER = 'INACTIVE_USER',\n}\n\n\n/**\n * InboundContact — lead / contact-form submission captured from the\n * public marketing site (Phase 0.5). APPLICATION-scoped (Q-E=B), no\n * `isAnonymizable: true` — transposition is handled by a focused\n * manual hook in `AnonymousSessionBackendService.transposeOwnership`\n * that updates `{ anonymousUserId, userId }` (see\n * .cursor/plans/saas-website-slice.md § 0.5.a).\n *\n * Attribution data (UTM, referrer, landing path, IP fingerprint) does\n * NOT live here. It lives ONCE on `AnonymousUser` (Q-D=β first-touch\n * attribution); analytics joins via the `anonymousUserId` FK.\n */\nexport const InboundContactSchema = z.object({\n\n    _id : z.string().isPrimaryKey().isSummaryField(),\n    email : addImpersonalizeWith(\n      z.email().isSummaryField().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    firstName : addImpersonalizeWith(\n      z.string().optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n      RedactionType.REMOVE,\n    ),\n    lastName : addImpersonalizeWith(\n      z.string().optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n      RedactionType.REMOVE,\n    ),\n    phone : addImpersonalizeWith(\n      z.string().optional().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n      RedactionType.REMOVE,\n    ),\n\n    /**\n     * Anonymous session that created this lead. FK to `AnonymousUser`.\n     * Carries first-touch marketing attribution (utm, referrer,\n     * landingPath) via `AnonymousUser.marketingMetadata` (Q-D=β —\n     * attribution lives on the session, not the conversion row).\n     * Cleared to `null` by the manual transposition hook on\n     * `AnonymousSessionBackendService` once the user converts and\n     * `userId` is set.\n     *\n     * Server-set on anonymous-session creates by the write-path context\n     * enrichment (`ResourceOperationHelperBackendService.enrichDataWithContext`),\n     * which injects `executionContext.initiatorIds.anonymousUserId` — the client\n     * `uuidRef` (the AnonymousUser's relational identity), NOT its server-minted\n     * `_id`. This resource is APPLICATION-scoped and standalone-created (no nested\n     * `/anonymous-users/{uuidRef}/…` URL segment carries the FK, and it is\n     * deliberately NOT `isAnonymizable`), so the enrichment resolves the FK from the\n     * anonymous initiator identity rather than the URL scope map. Never client-authored.\n     */\n    anonymousUserId : z.string().nullable().isDBIndexed().excludeFromCreate().isBackendOnly(),\n\n    /**\n     * Authenticated user AFTER anonymous-session transposition (W7.3a).\n     * Auto-set by the manual transposition hook on\n     * `AnonymousSessionBackendService` when the anonymous user signs up\n     * or logs in. `null` for leads that never converted to an\n     * authenticated user. Distinct from `relatedUserId` below — see\n     * `relatedUserId` JSDoc for the semantic boundary.\n     */\n    userId : z.string().nullable().isDBIndexed().excludeFromCreate().isBackendOnly(),\n\n    /**\n     * Manually-linked existing customer profile by sales / support\n     * (e.g. a salesperson tags an inbound lead as \"this is the same\n     * human as CRM contact X\"). **Not** auto-populated by\n     * anonymous-session transposition — that slot is `userId` above.\n     *\n     * A lead can legitimately have both populated:\n     * - `userId`        = the user who eventually signed up from this\n     *                     lead session (auto-set by transposition).\n     * - `relatedUserId` = the user a human rep manually associated\n     *                     (may be a different person, e.g. the lead is\n     *                     for a colleague of an existing customer).\n     *\n     * Kept on the schema for zero-cost preservation (no migration);\n     * the disambiguating JSDoc here exists so future readers do not\n     * conflate it with `userId`.\n     *\n     * `.excludeFromCreate()` is a HARD requirement, not polish: the public\n     * INBOUND_CONTACTS CREATE is anonymous (`APP_ANONYMOUS`), so a client-\n     * authorable `relatedUserId` would let an unauthenticated visitor tag a\n     * lead as \"related to\" an arbitrary existing user (a data-integrity /\n     * attribution-forgery hole). It is set ONLY post-create by a sales/support\n     * admin via a privileged update, never on the public capture request.\n     */\n    relatedUserId : z.string().isDBIndexed().optional().excludeFromCreate(),\n\n    /**\n     * Lead-triage signal (see `InboundContactEmailUserMatch`): did this lead's\n     * email match an existing user at capture time, and was that user active?\n     *\n     * Server-computed by the INBOUND_CONTACTS CREATE custom implementation\n     * (`prefixCoreOperations`) via a privileged users-by-email lookup — the\n     * anonymous create context cannot read `users`, so the lookup runs in a\n     * dedicated internal super-admin context and the result is stamped here.\n     *\n     * `.isBackendOnly()` is a HARD requirement, not polish: the CREATE response\n     * is returned to the anonymous submitter, so exposing the match would turn\n     * lead capture into an account-enumeration oracle. Backend-only keeps it out\n     * of every client response; admin / analytics surfaces read it through the\n     * internal DTO. `.excludeFromCreate()` (server-set, never client-authored)\n     * and `.excludeFromUpdate()` (immutable capture-time snapshot); `.default`\n     * `NONE` is the fail-safe when the email is absent or the lookup fails.\n     */\n    emailUserMatch : z.enum(InboundContactEmailUserMatch).default(InboundContactEmailUserMatch.NONE).isDBIndexed().excludeFromCreate().excludeFromUpdate().isBackendOnly(),\n\n    /**\n     * Mongoose-managed timestamps. Declared `z.date()` (NOT `z.iso.datetime()`)\n     * because the persistence layer stores them as BSON `Date`s and the DTO\n     * builder's network-boundary coercion (`applyNetworkBoundaryCoercion`)\n     * rewrites `z.date()` → `z.coerce.date()`. A `z.iso.datetime()` string validator would\n     * reject the stored `Date` on the output/internalDto parse → HTTP 500\n     * `service_resource_transformation_failed` on every create/read. Matches the\n     * framework-wide timestamp convention (35+ resources, e.g. `AnonymousUser`).\n     */\n    createdAt : z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n    updatedAt : z.date().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n    privacy : InboundContactPrivacySchema,\n});\n\n\nexport type InboundContact = z.infer<typeof InboundContactSchema>;\n"]}

package/dist/esm/users/user-consent-decision.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-consent-decision.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QACzD,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QACjC,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;KACtC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,SAAS,qBAAqB,EAC7E,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAyClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CAAC,OAAO,SAAS,qBAAqB,EAC1F,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,qBAAqB,EAAE,MAAM,EAAE;IAC7F,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;KAC3C,GAAG,SAAS,CAAC;IACd,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;CAChE,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCnB"}
+{"version":3,"file":"user-consent-decision.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QACzD,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QACjC,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;KACtC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,SAAS,qBAAqB,EAC7E,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAyClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CAAC,OAAO,SAAS,qBAAqB,EAC1F,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,qBAAqB,EAAE,MAAM,EAAE;IAC7F,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;KAC3C,GAAG,SAAS,CAAC;IACd,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;CAChE,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCnB"}

package/dist/esm/users/user-consent-decision.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-consent-decision.shared.utils.js","sourceRoot":"","sources":["../../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAgBzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAO,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,cAAc,GAAG,OAAO,EAAE,OAAO,CAAC;IACxC,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAkD;YAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YACzB,GAAG,QAAQ;YACX,iBAAiB,EAAE,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC;SAC/E,CAAC;QACF,4FAA4F;QAC5F,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS;YAAE,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;;YAC1G,OAAO,OAAO,CAAC,gBAAgB,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAsB,CAAC;IAClD,CAAC;IAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;WAC7D,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACvI,MAAM,QAAQ,GAAG,cAAc,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnJ,MAAM,sBAAsB,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC;IAEjF,MAAM,OAAO,GAAG,UAAU,IAAI,sBAAsB,CAAC;IACrD,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzB,GAAG,QAAQ;QACX,iBAAiB,EAAE,YAAY;KAChC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACjC,CAAC;SAAM,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CACpD,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,SAAS,GAAG,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC;IACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,CAAC;oBAClB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;oBACtC,OAAO,EAAE,uGAAuG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACnI,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,+BAA+B,CAAwC,MAetF;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEvD,0FAA0F;IAC1F,iCAAiC;IACjC,IAAI,SAAS,EAAE,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,wBAAwB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,oGAAoG;IACpG,kGAAkG;IAClG,MAAM,cAAc,GAAG,OAAO,EAAE,gBAAgB,KAAK,SAAS;WACzD,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,IAAI,cAAc;QAAE,OAAO,EAAE,CAAC;IAE9B,wDAAwD;IACxD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3H,MAAM,KAAK,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClB,iBAAiB,EAAE,aAAa;KACjC,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,kGAAkG;QAClG,OAAO,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,iFAAiF;QACjF,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC","sourcesContent":["import { ZodError } from 'zod';\n\nimport { normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport type { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';\n\n/**\n * Any record carrying a consent `privacy` block — user preferences, an inbound contact, an anonymous\n * visitor. Structural on purpose: the rule below is the same for every holder, and a per-resource\n * copy is how two doors come to disagree about when a decision happened.\n */\nexport interface ConsentDecisionHolder {\n  privacy?: {\n    consentedPurposes?: readonly (ConsentPurpose | string)[];\n    consentDecidedAt?: Date | string;\n    [otherPrivacyField: string]: unknown;\n  };\n}\n\n/**\n * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of\n * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there\n * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.\n *\n * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller\n *\n * It records WHEN a person made an affirmative consent choice, and it is what separates \"declined\n * everything\" from \"was never asked\". A client-authored instant would let any caller backdate or\n * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and\n * the recorded instant is the server's clock.\n *\n * ## When a write counts as a decision\n *\n * - The purpose SET changed → a decision. Always stamped.\n * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an\n *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.\n * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.\n *   This is the ordinary preferences form re-submitting every field while the person edited something\n *   else; stamping there would fabricate a consent choice nobody made.\n *\n * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a\n * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the\n * returned block carries the STORED purposes and instant forward.\n * Without that, the write would replace the whole `privacy` object and the stored consent would be lost\n * while reading as a withdrawal (#534 review F1).\n *\n * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —\n * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the\n * purpose set it accompanies is audit evidence on the same UPDATE.\n */\nexport function buildConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n  input: Partial<THolder> | undefined,\n  current: THolder | undefined,\n  now: Date = new Date(),\n): Partial<THolder> {\n  const incoming = input?.privacy;\n  if (incoming === undefined) return {};\n\n  const currentPrivacy = current?.privacy;\n  if (incoming.consentedPurposes === undefined) {\n    const carried: NonNullable<ConsentDecisionHolder['privacy']> = {\n      ...(currentPrivacy ?? {}),\n      ...incoming,\n      consentedPurposes: normalizeConsentPurposes(currentPrivacy?.consentedPurposes),\n    };\n    // A caller-sent instant without a purpose set is not a decision; the stored instant stands.\n    if (currentPrivacy?.consentDecidedAt !== undefined) carried.consentDecidedAt = currentPrivacy.consentDecidedAt;\n    else delete carried.consentDecidedAt;\n    return { privacy: carried } as Partial<THolder>;\n  }\n\n  const nextPurposes = normalizeConsentPurposes(incoming.consentedPurposes);\n  const previousPurposes = normalizeConsentPurposes(currentPrivacy?.consentedPurposes);\n\n  const setChanged = nextPurposes.length !== previousPurposes.length\n    || nextPurposes.some((purpose, index) => purpose !== previousPurposes[index]);\n  const claimedAt = incoming.consentDecidedAt === undefined ? undefined : new Date(incoming.consentDecidedAt as Date | string).getTime();\n  const storedAt = currentPrivacy?.consentDecidedAt === undefined ? undefined : new Date(currentPrivacy.consentDecidedAt as Date | string).getTime();\n  const explicitReconfirmation = claimedAt !== undefined && claimedAt !== storedAt;\n\n  const decided = setChanged || explicitReconfirmation;\n  const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n    ...(currentPrivacy ?? {}),\n    ...incoming,\n    consentedPurposes: nextPurposes,\n  };\n  if (decided) {\n    privacy.consentDecidedAt = now;\n  } else if (currentPrivacy?.consentDecidedAt !== undefined) {\n    privacy.consentDecidedAt = currentPrivacy.consentDecidedAt;\n  } else {\n    delete privacy.consentDecidedAt;\n  }\n\n  return { privacy } as Partial<THolder>;\n}\n\n/**\n * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW\n * purposes on a person's behalf — honouring a withdrawal request received another way — but may never\n * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same\n * server-stamped instant as the person's own choice and could not be told apart from it.\n *\n * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision\n * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch\n * consent — passes through unchanged.\n */\nexport function buildAdministratorConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n  input: Partial<THolder> | undefined,\n  current: THolder | undefined,\n  now: Date = new Date(),\n): Partial<THolder> {\n  const requested = input?.privacy?.consentedPurposes;\n  if (requested !== undefined) {\n    const stored = normalizeConsentPurposes(current?.privacy?.consentedPurposes);\n    const added = normalizeConsentPurposes(requested).filter((purpose) => !stored.includes(purpose));\n    if (added.length > 0) {\n      throw new ZodError([{\n        code: 'custom',\n        path: ['privacy', 'consentedPurposes'],\n        message: `An administrator may withdraw consent purposes but cannot grant them on a person's behalf; refused: ${added.join(', ')}.`,\n        input: requested,\n      }]);\n    }\n  }\n  return buildConsentDecisionPatch(input, current, now);\n}\n\n/**\n * What an anonymous visitor's consent decision contributes to the account they just became (#1258).\n *\n * ## The one thing that dies at this boundary today\n *\n * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their\n * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.\n * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,\n * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves\n * neither. So a visitor who declines analytics on the marketing site is asked again inside the\n * application, and under a declared service-consent requirement is BLOCKED there, over a question they\n * answered minutes earlier.\n *\n * ## Why this takes `applicationAsks` and not just two privacy blocks\n *\n * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see\n * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different\n * questions. `consentDecidedAt` is read everywhere as *\"this person was asked and answered\"*, so\n * stamping it when the visitor's surface offered LESS than the application asks would record a\n * decision about a purpose nobody displayed, and the application would stop prompting for it.\n *\n * Hence the split outcome, which is the whole design:\n *\n * | the visitor was offered | what carries |\n * |---|---|\n * | everything this application asks | grants **and** the decision instant — nothing more to ask |\n * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |\n * | nothing (never asked) | nothing |\n *\n * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.\n *\n * ## The account always wins, and that is what makes a shared browser safe\n *\n * An account that has already recorded a decision receives NOTHING: their own answer stands, and a\n * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp\n * an instant, the residual risk of a shared browser — visitor A decides, does not register, and\n * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited\n * decision: B is still ASKED, and their answer replaces the seed.\n *\n * ## Defensive, because the anonymous row is written by a public door\n *\n * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That\n * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a\n * caller's claim about their own decision; only their intersection is a statement this function is\n * willing to repeat onto an identified person.\n *\n * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,\n * which the framework merges as a no-op.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto\n * the person it belonged to, with its own instant, and never widened past what they were shown.\n */\nexport function buildAnonymousConsentCarryPatch<THolder extends ConsentDecisionHolder>(params: {\n  /** The converting visitor's `AnonymousUser.privacy`. */\n  readonly anonymous: {\n    readonly consentedPurposes?: readonly (ConsentPurpose | string)[];\n    readonly offeredPurposes?: readonly (ConsentPurpose | string)[];\n    readonly consentDecidedAt?: Date | string;\n  } | undefined;\n  /** The account's current privacy block, or undefined when it has none. */\n  readonly account: ConsentDecisionHolder['privacy'] | undefined;\n  /**\n   * The purposes this application's own consent surface would put to the person — the gate's\n   * `optionalPurposes` plus anything it requires. Passing an empty list means the application asks\n   * nothing, so a carried decision is complete by definition.\n   */\n  readonly applicationAsks: readonly (ConsentPurpose | string)[];\n}): Partial<THolder> {\n  const { anonymous, account, applicationAsks } = params;\n\n  // Never asked, or asked nothing: there is no decision to carry, and seeding grants from a\n  // non-decision would invent one.\n  if (anonymous?.consentDecidedAt === undefined) return {};\n  const offered = normalizeConsentPurposes(anonymous.offeredPurposes);\n  if (offered.length === 0) return {};\n\n  // The account's own answer stands. `consentDecidedAt` is the decision marker; a non-empty grant set\n  // is checked too, so a row that somehow holds grants without an instant is still not overwritten.\n  const accountDecided = account?.consentDecidedAt !== undefined\n    || normalizeConsentPurposes(account?.consentedPurposes).length > 0;\n  if (accountDecided) return {};\n\n  // Only what the visitor was actually shown AND granted.\n  const carriedGrants = normalizeConsentPurposes(anonymous.consentedPurposes).filter((purpose) => offered.includes(purpose));\n\n  const asked = normalizeConsentPurposes(applicationAsks);\n  const coversEverythingAsked = asked.every((purpose) => offered.includes(purpose));\n\n  const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n    ...(account ?? {}),\n    consentedPurposes: carriedGrants,\n  };\n  if (coversEverythingAsked) {\n    // The visitor's own instant, not the carry's: the moment they decided is the fact being recorded.\n    privacy.consentDecidedAt = new Date(anonymous.consentDecidedAt);\n  } else {\n    // Seed the grants and leave the question open, so the application still prompts.\n    delete privacy.consentDecidedAt;\n  }\n\n  return { privacy } as Partial<THolder>;\n}\n"]}
+{"version":3,"file":"user-consent-decision.shared.utils.js","sourceRoot":"","sources":["../../../src/users/user-consent-decision.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAgBzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAO,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,cAAc,GAAG,OAAO,EAAE,OAAO,CAAC;IACxC,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAkD;YAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YACzB,GAAG,QAAQ;YACX,iBAAiB,EAAE,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC;SAC/E,CAAC;QACF,4FAA4F;QAC5F,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS;YAAE,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;;YAC1G,OAAO,OAAO,CAAC,gBAAgB,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAsB,CAAC;IAClD,CAAC;IAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;WAC7D,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACvI,MAAM,QAAQ,GAAG,cAAc,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,gBAAiC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnJ,MAAM,sBAAsB,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC;IAEjF,MAAM,OAAO,GAAG,UAAU,IAAI,sBAAsB,CAAC;IACrD,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzB,GAAG,QAAQ;QACX,iBAAiB,EAAE,YAAY;KAChC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACjC,CAAC;SAAM,IAAI,cAAc,EAAE,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CACpD,KAAmC,EACnC,OAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,SAAS,GAAG,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC;IACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,CAAC;oBAClB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;oBACtC,OAAO,EAAE,uGAAuG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACnI,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,+BAA+B,CAAwC,MAetF;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEvD,0FAA0F;IAC1F,iCAAiC;IACjC,IAAI,SAAS,EAAE,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,wBAAwB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,oGAAoG;IACpG,kGAAkG;IAClG,MAAM,cAAc,GAAG,OAAO,EAAE,gBAAgB,KAAK,SAAS;WACzD,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,IAAI,cAAc;QAAE,OAAO,EAAE,CAAC;IAE9B,wDAAwD;IACxD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3H,MAAM,KAAK,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAkD;QAC7D,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClB,iBAAiB,EAAE,aAAa;KACjC,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,kGAAkG;QAClG,OAAO,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,iFAAiF;QACjF,OAAO,OAAO,CAAC,gBAAgB,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAsB,CAAC;AACzC,CAAC","sourcesContent":["import { ZodError } from 'zod';\n\nimport { normalizeConsentPurposes } from '../compliance/privacy/consent-purposes.shared';\nimport type { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';\n\n/**\n * Any record carrying a consent `privacy` block — user preferences, an inbound contact, an anonymous\n * visitor. Structural on purpose: the rule below is the same for every holder, and a per-resource\n * copy is how two doors come to disagree about when a decision happened.\n */\nexport interface ConsentDecisionHolder {\n  privacy?: {\n    consentedPurposes?: readonly (ConsentPurpose | string)[];\n    consentDecidedAt?: Date | string;\n    [otherPrivacyField: string]: unknown;\n  };\n}\n\n/**\n * The server-owned half of a consent decision (#534) — returned from the `basicPrefixOperation` of\n * `USER_SELF_PREFERENCES` / `USER_PREFERENCES` UPDATE and `INBOUND_CONTACTS` CREATE. On a CREATE there\n * is no current record, so any purpose granted is a change and an explicit empty choice is a claim.\n *\n * ## `consentDecidedAt` is stamped by the SERVER, never taken from the caller\n *\n * It records WHEN a person made an affirmative consent choice, and it is what separates \"declined\n * everything\" from \"was never asked\". A client-authored instant would let any caller backdate or\n * forge that fact, so a caller's value is only ever read as a CLAIM that a decision is being made, and\n * the recorded instant is the server's clock.\n *\n * ## When a write counts as a decision\n *\n * - The purpose SET changed → a decision. Always stamped.\n * - The set is unchanged but the caller sends a `consentDecidedAt` different from the stored one → an\n *   explicit re-confirmation, e.g. a person who meets the consent prompt and grants nothing. Stamped.\n * - The set is unchanged and the caller echoes the stored instant (or sends none) → NOT a decision.\n *   This is the ordinary preferences form re-submitting every field while the person edited something\n *   else; stamping there would fabricate a consent choice nobody made.\n *\n * A write that does not touch `privacy` at all returns an empty patch, which the framework merges as a\n * no-op. A write that touches `privacy` WITHOUT `consentedPurposes` is not a decision either, and the\n * returned block carries the STORED purposes and instant forward.\n * Without that, the write would replace the whole `privacy` object and the stored consent would be lost\n * while reading as a withdrawal (#534 review F1).\n *\n * The returned `privacy` block is the CURRENT block overlaid with the caller's, so a partial write —\n * the consent gate sends only the purposes — cannot silently reset a sibling member to its default.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the decision instant is server-owned, and the\n * purpose set it accompanies is audit evidence on the same UPDATE.\n */\nexport function buildConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n  input: Partial<THolder> | undefined,\n  current: THolder | undefined,\n  now: Date = new Date(),\n): Partial<THolder> {\n  const incoming = input?.privacy;\n  if (incoming === undefined) return {};\n\n  const currentPrivacy = current?.privacy;\n  if (incoming.consentedPurposes === undefined) {\n    const carried: NonNullable<ConsentDecisionHolder['privacy']> = {\n      ...(currentPrivacy ?? {}),\n      ...incoming,\n      consentedPurposes: normalizeConsentPurposes(currentPrivacy?.consentedPurposes),\n    };\n    // A caller-sent instant without a purpose set is not a decision; the stored instant stands.\n    if (currentPrivacy?.consentDecidedAt !== undefined) carried.consentDecidedAt = currentPrivacy.consentDecidedAt;\n    else delete carried.consentDecidedAt;\n    return { privacy: carried } as Partial<THolder>;\n  }\n\n  const nextPurposes = normalizeConsentPurposes(incoming.consentedPurposes);\n  const previousPurposes = normalizeConsentPurposes(currentPrivacy?.consentedPurposes);\n\n  const setChanged = nextPurposes.length !== previousPurposes.length\n    || nextPurposes.some((purpose, index) => purpose !== previousPurposes[index]);\n  const claimedAt = incoming.consentDecidedAt === undefined ? undefined : new Date(incoming.consentDecidedAt as Date | string).getTime();\n  const storedAt = currentPrivacy?.consentDecidedAt === undefined ? undefined : new Date(currentPrivacy.consentDecidedAt as Date | string).getTime();\n  const explicitReconfirmation = claimedAt !== undefined && claimedAt !== storedAt;\n\n  const decided = setChanged || explicitReconfirmation;\n  const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n    ...(currentPrivacy ?? {}),\n    ...incoming,\n    consentedPurposes: nextPurposes,\n  };\n  if (decided) {\n    privacy.consentDecidedAt = now;\n  } else if (currentPrivacy?.consentDecidedAt !== undefined) {\n    privacy.consentDecidedAt = currentPrivacy.consentDecidedAt;\n  } else {\n    delete privacy.consentDecidedAt;\n  }\n\n  return { privacy } as Partial<THolder>;\n}\n\n/**\n * The ADMINISTRATOR door's consent rule (#534, decided by Paul 2026-09-13): an administrator may WITHDRAW\n * purposes on a person's behalf — honouring a withdrawal request received another way — but may never\n * GRANT one. Consent is the subject's own act; a purpose an administrator added would carry the same\n * server-stamped instant as the person's own choice and could not be told apart from it.\n *\n * Refuses an addition with a validation error naming the purposes, then applies the ordinary decision\n * rule. Everything that is not an addition — a withdrawal, an unchanged set, a write that does not touch\n * consent — passes through unchanged.\n */\nexport function buildAdministratorConsentDecisionPatch<THolder extends ConsentDecisionHolder>(\n  input: Partial<THolder> | undefined,\n  current: THolder | undefined,\n  now: Date = new Date(),\n): Partial<THolder> {\n  const requested = input?.privacy?.consentedPurposes;\n  if (requested !== undefined) {\n    const stored = normalizeConsentPurposes(current?.privacy?.consentedPurposes);\n    const added = normalizeConsentPurposes(requested).filter((purpose) => !stored.includes(purpose));\n    if (added.length > 0) {\n      throw new ZodError([{\n        code: 'custom',\n        path: ['privacy', 'consentedPurposes'],\n        message: `An administrator may withdraw consent purposes but cannot grant them on a person's behalf; refused: ${added.join(', ')}.`,\n        input: requested,\n      }]);\n    }\n  }\n  return buildConsentDecisionPatch(input, current, now);\n}\n\n/**\n * What an anonymous visitor's consent decision contributes to the account they just became (#1258).\n *\n * ## The one thing that dies at this boundary today\n *\n * Every other rights signal a visitor produces is carried: `transposeOwnership` moves their\n * draft notes and their inbound contacts onto the new account, and reconciles what it could not move.\n * Their consent decision is the exception — the website keeps it in `localStorage` on its own origin,\n * `AnonymousUser.privacy` is written `{}` at session start and never again, and the conversion moves\n * neither. So a visitor who declines analytics on the marketing site is asked again inside the\n * application, and under a declared service-consent requirement is BLOCKED there, over a question they\n * answered minutes earlier.\n *\n * ## Why this takes `applicationAsks` and not just two privacy blocks\n *\n * A decision is `(granted ⊆ offered, at an instant)`, never a grant set alone — see\n * `AnonymousUserPrivacySchema.offeredPurposes` for why the two surfaces legitimately ask different\n * questions. `consentDecidedAt` is read everywhere as *\"this person was asked and answered\"*, so\n * stamping it when the visitor's surface offered LESS than the application asks would record a\n * decision about a purpose nobody displayed, and the application would stop prompting for it.\n *\n * Hence the split outcome, which is the whole design:\n *\n * | the visitor was offered | what carries |\n * |---|---|\n * | everything this application asks | grants **and** the decision instant — nothing more to ask |\n * | less than this application asks | the grants ALONE, with **no** instant — the person is still prompted, and the surface starts pre-ticked with what they already agreed to |\n * | nothing (never asked) | nothing |\n *\n * The middle row is not a compromise. It is exactly what the `PROMPT` gate status exists for.\n *\n * ## The account always wins, and that is what makes a shared browser safe\n *\n * An account that has already recorded a decision receives NOTHING: their own answer stands, and a\n * second device's anonymous session cannot overwrite it. Because the middle row also refuses to stamp\n * an instant, the residual risk of a shared browser — visitor A decides, does not register, and\n * visitor B registers from the same browser — degrades to a pre-ticked box rather than an inherited\n * decision: B is still ASKED, and their answer replaces the seed.\n *\n * ## Defensive, because the anonymous row is written by a public door\n *\n * A grant for a purpose the same record does not list as offered is DROPPED rather than trusted. That\n * row is written by an unauthenticated visitor through a public endpoint, so the two fields are a\n * caller's claim about their own decision; only their intersection is a statement this function is\n * willing to repeat onto an identified person.\n *\n * Pure, so every branch is pinned without a database. Returns an EMPTY patch when nothing carries,\n * which the framework merges as a no-op.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a decision taken before identity is carried onto\n * the person it belonged to, with its own instant, and never widened past what they were shown.\n */\nexport function buildAnonymousConsentCarryPatch<THolder extends ConsentDecisionHolder>(params: {\n  /** The converting visitor's `AnonymousUser.privacy`. */\n  readonly anonymous: {\n    readonly consentedPurposes?: readonly (ConsentPurpose | string)[];\n    readonly offeredPurposes?: readonly (ConsentPurpose | string)[];\n    readonly consentDecidedAt?: Date | string;\n  } | undefined;\n  /** The account's current privacy block, or undefined when it has none. */\n  readonly account: ConsentDecisionHolder['privacy'] | undefined;\n  /**\n   * The purposes this application's own consent surface would put to the person — the gate's\n   * `optionalPurposes` plus anything it requires. Passing an empty list means the application asks\n   * nothing, so a carried decision is complete by definition.\n   */\n  readonly applicationAsks: readonly (ConsentPurpose | string)[];\n}): Partial<THolder> {\n  const { anonymous, account, applicationAsks } = params;\n\n  // Never asked, or asked nothing: there is no decision to carry, and seeding grants from a\n  // non-decision would invent one.\n  if (anonymous?.consentDecidedAt === undefined) return {};\n  const offered = normalizeConsentPurposes(anonymous.offeredPurposes);\n  if (offered.length === 0) return {};\n\n  // The account's own answer stands. `consentDecidedAt` is the decision marker; a non-empty grant set\n  // is checked too, so a row that somehow holds grants without an instant is still not overwritten.\n  const accountDecided = account?.consentDecidedAt !== undefined\n    || normalizeConsentPurposes(account?.consentedPurposes).length > 0;\n  if (accountDecided) return {};\n\n  // Only what the visitor was actually shown AND granted.\n  const carriedGrants = normalizeConsentPurposes(anonymous.consentedPurposes).filter((purpose) => offered.includes(purpose));\n\n  const asked = normalizeConsentPurposes(applicationAsks);\n  const coversEverythingAsked = asked.every((purpose) => offered.includes(purpose));\n\n  const privacy: NonNullable<ConsentDecisionHolder['privacy']> = {\n    ...(account ?? {}),\n    consentedPurposes: carriedGrants,\n  };\n  if (coversEverythingAsked) {\n    // The visitor's own instant, not the carry's: the moment they decided is the fact being recorded.\n    privacy.consentDecidedAt = new Date(anonymous.consentDecidedAt);\n  } else {\n    // Seed the grants and leave the question open, so the application still prompts.\n    delete privacy.consentDecidedAt;\n  }\n\n  return { privacy } as Partial<THolder>;\n}\n"]}

package/dist/esm/users/user-credentials.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsH9C,CAAC"}
+{"version":3,"file":"user-credentials.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D,GACrE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsH9C,CAAC"}

package/dist/esm/users/user-credentials.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,qBAAqB;IACjC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,8EAA8E;IAC9E,gFAAgF;IAChF,qEAAqE;IACrE,yEAAyE;IACzE,4EAA4E;IAC5E,qFAAqF;IACrF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAEzI;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED,0FAA0F;IAC1F,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,0CAA0C;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,0CAA0C;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { UserCredentialsSchema } from './user-credentials.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * User Credentials Resource Configuration (Internal-only)\n *\n * System resource — no auto-generated API controller.\n * Operations are INTERNAL_CALL: accessible through the service layer pipeline\n * by trusted internal code, but not exposed as HTTP endpoints.\n */\nexport const userCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY,\n  typeof UserCredentialsSchema\n>({\n  mainSchema: UserCredentialsSchema,\n  resourceIdentifier: CoreResourceType.USER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Registration / password-reset / MFA flows write credentials in-process on a\n  // pre-auth (or system) EC that carries no request context, so the client-shaped\n  // request DTO would strip `userId` (context FK) and `passwordHash` /\n  // `secretBase32` / … (backendOnly). Opt CREATE + UPDATE into the trusted\n  // `createAsSystem` / `updateAsSystem` path, which re-attaches exactly those\n  // fields after the strict parse. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN, create: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the credentials row.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: the row holds the password hash and the hashed backup codes, and both\n   * are REMOVEd. Retaining rather than deleting keeps the row's foreign key to the retained identity\n   * row resolvable — the same reason `USERS` is retained — while the secrets themselves are provably\n   * gone, which is the statement a notice can actually make.\n   *\n   * A credential outliving its subject is the worst case here, so both fields are nulled rather than\n   * masked: a masked hash is still a string a verifier will attempt, and \"it never matches\" is a\n   * property of the value, not a guarantee.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /** The subject is the person these credentials authenticate, reached through `userId`. */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the factory's boot-time guard and then fails to resolve when an\n     * erasure actually runs, because the retention primitives resolve through\n     * `getServiceOperationPathDefault`, which excludes it.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // requestDto auto-derived from decorators\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // requestDto auto-derived from decorators\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n\n\n"]}
+{"version":3,"file":"user-credentials.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.resources-config.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CACxE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,qBAAqB;IACjC,kBAAkB,EAAE,gBAAgB,CAAC,gBAAgB;IACrD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,8EAA8E;IAC9E,gFAAgF;IAChF,qEAAqE;IACrE,yEAAyE;IACzE,4EAA4E;IAC5E,qFAAqF;IACrF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO;KAAE;IAEzI;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED,0FAA0F;IAC1F,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,0CAA0C;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,0CAA0C;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { UserCredentialsSchema } from './user-credentials.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n/**\n * User Credentials Resource Configuration (Internal-only)\n *\n * System resource — no auto-generated API controller.\n * Operations are INTERNAL_CALL: accessible through the service layer pipeline\n * by trusted internal code, but not exposed as HTTP endpoints.\n */\nexport const userCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY,\n  typeof UserCredentialsSchema\n>({\n  mainSchema: UserCredentialsSchema,\n  resourceIdentifier: CoreResourceType.USER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // Registration / password-reset / MFA flows write credentials in-process on a\n  // pre-auth (or system) EC that carries no request context, so the client-shaped\n  // request DTO would strip `userId` (context FK) and `passwordHash` /\n  // `secretBase32` / … (backendOnly). Opt CREATE + UPDATE into the trusted\n  // `createAsSystem` / `updateAsSystem` path, which re-attaches exactly those\n  // fields after the strict parse. INTERNAL_CALL-only resource → never HTTP-reachable.\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN, create: ResourceSystemAccessMode.ALLOWED, update: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the credentials row.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: the row holds the password hash and the hashed backup codes, and both\n   * are REMOVEd. Retaining rather than deleting keeps the row's foreign key to the retained identity\n   * row resolvable — the same reason `USERS` is retained — while the secrets themselves are provably\n   * gone, which is the statement a notice can actually make.\n   *\n   * A credential outliving its subject is the worst case here, so both fields are nulled rather than\n   * masked: a masked hash is still a string a verifier will attempt, and \"it never matches\" is a\n   * property of the value, not a guarantee.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /** The subject is the person these credentials authenticate, reached through `userId`. */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the factory's boot-time guard and then fails to resolve when an\n     * erasure actually runs, because the retention primitives resolve through\n     * `getServiceOperationPathDefault`, which excludes it.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // requestDto auto-derived from decorators\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // requestDto auto-derived from decorators\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n\n\n"]}

package/dist/esm/users/user-credentials.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAK/F;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAWvC,CAAC;AAGH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2FhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"user-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAK/F;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAWvC,CAAC;AAGH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2FhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/esm/users/user-credentials.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAKH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC3F,4FAA4F;IAC5F,sFAAsF;IACtF,6FAA6F;IAC7F,2FAA2F;IAC3F,gGAAgG;IAChG,8FAA8F;IAC9F,wFAAwF;IACxF,mFAAmF;IACnF,iGAAiG;IACjG,8FAA8F;IAC9F,0FAA0F;IAC1F,+FAA+F;IAC/F,0FAA0F;IAC1F,8FAA8F;IAC9F,4FAA4F;IAC5F,+DAA+D;IAC/D,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,6FAA6F;IAC7F,mGAAmG;IACnG,2EAA2E;IAC3E,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,YAAY,EAAE,oBAAoB,CAChC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAC5F,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC;IACnG,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;IACtD,4EAA4E;IAC5E,yEAAyE;IACzE,EAAE;IACF,mGAAmG;IACnG,gGAAgG;IAChG,kGAAkG;IAClG,kCAAkC;IAClC,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,gGAAgG;IAChG,iBAAiB,EAAE,oBAAoB,CACrC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAChG,aAAa,CAAC,KAAK,CACpB;IACD;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE;IAClC,sGAAsG;IACtG,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACtD,kEAAkE;IAClE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC;IAEtI,2HAA2H;IAC3H,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACrD,4GAA4G;IAC5G,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE;IACvG,8HAA8H;IAC9H,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;IAE1D,yEAAyE;IACzE,4FAA4F;IAC5F,4FAA4F;IAC5F,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC;IACnH,sEAAsE;IACtE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEpC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { MfaEnrollmentState } from '../security/authentications/authentication.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * Individual WebAuthn/Passkey credential entry.\n * Stores the data returned by @simplewebauthn/server after registration verification.\n */\nexport const PasskeyCredentialEntrySchema = z.object({\n  credentialId: z.string().min(1),\n  publicKey: z.string().min(1),\n  counter: z.number().int().min(0).default(0),\n  transports: z.array(z.string()).default([]),\n  credentialDeviceType: z.string().default('singleDevice'),\n  credentialBackedUp: z.boolean().default(false),\n  name: z.string().max(100).default('Passkey'),\n  aaguid: z.string().optional(),\n  createdAt: z.date().default(() => new Date()),\n  lastUsedAt: z.date().optional(),\n});\n\n\nexport type PasskeyCredentialEntry = z.infer<typeof PasskeyCredentialEntrySchema>;\n\n/**\n * User Credentials Schema\n * Stores all authentication secrets for a user: password hash + optional TOTP.\n * All fields are compatible with MongoDB via zod-to-mongoose converter.\n *\n * The local first-factor / TOTP secret fields (`passwordHash`, `secretBase32`,\n * `totpVerifiedAt`) are `.nullish()` — absent when never set, or explicitly `null`\n * once a compliance clear physically destroys them (directory-managed reconciliation,\n * TOTP-disable). See each field's JSDoc for the null-vs-absent contract.\n *\n * TOTP fields (optional — user may have password-only auth):\n * - `secretBase32`: base32-encoded TOTP secret (backendOnly). Used with otpauth library.\n *    NOTE: stored as plaintext base32. For production hardening, add AES-256-GCM encryption at rest.\n * - `totpVerified`: whether the user has confirmed TOTP setup by entering a valid code\n * - `backupCodesHashed`: SHA-256 hashes of backup codes (consumed on use)\n * - `totpVerifiedAt`: timestamp when TOTP setup was confirmed\n */\nexport const UserCredentialsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // NULLISH by design — the hash is a non-empty `string` when set, ABSENT for a PASSWORD-LESS\n  // account (first factor is a passkey, magic link, or enterprise SSO — the row must be\n  // creatable with no `passwordHash`, e.g. passkey-enroll-at-invitation-accept), or explicitly\n  // `null` once a clear physically DESTROYS it. The AUTH-24 directory-managed reconciliation\n  // (`_reconcileLocalCredentialsForDirectoryManaged`) writes `passwordHash: null` to neutralise a\n  // local first factor that would otherwise survive IdP deprovisioning. `null` MUST be accepted\n  // here: the write re-attaches this backend-only field past the strict request-DTO strip\n  // (`updateAsSystem`), but the SERVICE-LAYER OUTPUT PROJECTION (`transformOutput` →\n  // `internalDto.parse`) re-validates the persisted document against the FULL schema (backend-only\n  // fields included). Were this merely `.optional()` (absent-only, not null), the destroy-write\n  // would persist the `null` and THEN throw `service_resource_transformation_failed` on the\n  // after-image — the credential is gone but the operation errors (misleading \"reconcile failed\"\n  // log). Every consumer treats the hash as falsy-when-absent (`!credentials?.passwordHash`\n  // guards, `enrolled: !!passwordHash`, last-method-removal counting), so `null` and absent are\n  // handled identically. `.min(1)` still guarantees a NON-EMPTY hash whenever one IS present.\n  // ── CREDENTIALS is declared, not derived, on this resource ──\n  //\n  // The producer DERIVES `credentials` from `.isPassword()` / `.isOtp()` / `.isWriteOnlySecret()`.\n  // These fields carry `.isBackendOnly()` instead — correctly, since they are stored HASHES and\n  // secrets that must never leave the backend, not editable password INPUTS. So the derivation\n  // cannot see them and the declaration has to be explicit. Measured: before this, `userCredentials`\n  // reported zero categories while holding every secret the application has.\n  // REMOVE, not MASK. A credential is the one field class where a placeholder would be worse than a\n  // null: a masked hash is still a string the verifier will attempt, and \"it never matches\" is a\n  // property of the value rather than a guarantee. Nulling it makes the absence structural.\n  passwordHash: addImpersonalizeWith(\n    z.string().min(1).nullish().isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n    RedactionType.REMOVE,\n  ),\n\n  /**\n   * TOTP secret encoded as base32 — used with otpauth library for code generation/verification.\n   * NULLISH: absent when TOTP was never set up, or explicitly `null` after the\n   * auth-method-management TOTP-disable clear physically destroys it. `null` must be accepted so\n   * that disable-clear's null-write round-trips through the output projection — same contract as\n   * `passwordHash` above (backend-only field, re-validated by `transformOutput`).\n   */\n  secretBase32: z.string().nullish().isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n  /** Whether the user has confirmed TOTP setup by entering a valid code */\n  totpVerified: z.boolean().default(false).isDBIndexed(),\n  /** SHA-256 hashes of backup codes — consumed on use (removed from array) */\n  // RESET, not REMOVE, and the field is back to non-nullable (issue #195).\n  //\n  // It was widened to `.nullish()` on 2026-08-31 purely so REMOVE could reach it: no treatment could\n  // then scrub a non-nullable field with a default, so widening the READ contract of a credential\n  // field was the only way to declare an erasure posture here. `RESET` landed on 2026-09-01 and the\n  // workaround is no longer needed.\n  //\n  // Reverting is also the more truthful scrub. RESET writes `[]` — *there are no backup codes* —\n  // while REMOVE wrote `null`, which reads as *unknown*. For a credential those are different\n  // statements to anyone reading the row, and only one of them is what erasure actually achieved.\n  backupCodesHashed: addImpersonalizeWith(\n    z.array(z.string()).default([]).isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n    RedactionType.RESET,\n  ),\n  /**\n   * When the user verified their TOTP setup. NULLISH: absent before verification, a `Date` once\n   * verified, or explicitly `null` after the TOTP-disable clear. Unlike the backend-only TOTP\n   * secret this field is NOT stripped from the request DTO, so `null` must be accepted on BOTH\n   * the write-side parse (`validateAndTransformInput`, which loose-parses the in-shape field) AND\n   * the output projection — otherwise the disable-clear throws before/after persisting. Readers\n   * use `?? undefined`, so `null` and absent behave identically.\n   */\n  totpVerifiedAt: z.date().nullish(),\n  /** Timestamp of the last password change. Refresh tokens issued before this are rejected (C4 fix). */\n  passwordChangedAt: z.date().optional().isBackendOnly(),\n  /** WebAuthn/Passkey credentials — array of registered passkeys */\n  passkeyCredentials: z.array(PasskeyCredentialEntrySchema).default([]).isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n\n  /** W2.1: timestamp of the first login where MFA was required but not yet enrolled. Used with enrollmentGracePeriodDays. */\n  firstMfaPromptAt: z.date().optional().isBackendOnly(),\n  /** W4.6: MFA enrollment lifecycle state. Computed at user creation and updated on enrollment completion. */\n  mfaEnrollmentState: z.enum(MfaEnrollmentState).default(MfaEnrollmentState.NOT_REQUIRED).isBackendOnly(),\n  /** W2.3: tracks consecutive account lockouts for progressive lockout duration (2^n multiplier). Reset on successful login. */\n  consecutiveLockouts: z.number().default(0).isBackendOnly(),\n\n  /** Phone number in E.164 format for SMS OTP authentication (Phase G2) */\n  // CONTACT_DETAILS, not CREDENTIALS. It is the SMS OTP delivery ADDRESS — a way to reach the\n  // person, which they hold independently of this application — not a secret this application\n  // stores. Merging the two would make a notice say the phone number is a credential.\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n  /** Whether the phone number has been verified via OTP confirmation */\n  phoneNumberVerified: z.boolean().default(false),\n  /** When the phone number was verified */\n  phoneVerifiedAt: z.date().optional(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type UserCredentials = z.infer<typeof UserCredentialsSchema>;\n\n\n"]}
+{"version":3,"file":"user-credentials.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAKH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC3F,4FAA4F;IAC5F,sFAAsF;IACtF,6FAA6F;IAC7F,2FAA2F;IAC3F,gGAAgG;IAChG,8FAA8F;IAC9F,wFAAwF;IACxF,mFAAmF;IACnF,iGAAiG;IACjG,8FAA8F;IAC9F,0FAA0F;IAC1F,+FAA+F;IAC/F,0FAA0F;IAC1F,8FAA8F;IAC9F,4FAA4F;IAC5F,+DAA+D;IAC/D,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,6FAA6F;IAC7F,mGAAmG;IACnG,2EAA2E;IAC3E,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,YAAY,EAAE,oBAAoB,CAChC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAC5F,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC;IACnG,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;IACtD,4EAA4E;IAC5E,yEAAyE;IACzE,EAAE;IACF,mGAAmG;IACnG,gGAAgG;IAChG,kGAAkG;IAClG,kCAAkC;IAClC,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,gGAAgG;IAChG,iBAAiB,EAAE,oBAAoB,CACrC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAChG,aAAa,CAAC,KAAK,CACpB;IACD;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE;IAClC,sGAAsG;IACtG,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACtD,kEAAkE;IAClE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC;IAEtI,2HAA2H;IAC3H,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACrD,4GAA4G;IAC5G,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE;IACvG,8HAA8H;IAC9H,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;IAE1D,yEAAyE;IACzE,4FAA4F;IAC5F,4FAA4F;IAC5F,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC;IACnH,sEAAsE;IACtE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEpC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { MfaEnrollmentState } from '../security/authentications/authentication.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * Individual WebAuthn/Passkey credential entry.\n * Stores the data returned by @simplewebauthn/server after registration verification.\n */\nexport const PasskeyCredentialEntrySchema = z.object({\n  credentialId: z.string().min(1),\n  publicKey: z.string().min(1),\n  counter: z.number().int().min(0).default(0),\n  transports: z.array(z.string()).default([]),\n  credentialDeviceType: z.string().default('singleDevice'),\n  credentialBackedUp: z.boolean().default(false),\n  name: z.string().max(100).default('Passkey'),\n  aaguid: z.string().optional(),\n  createdAt: z.date().default(() => new Date()),\n  lastUsedAt: z.date().optional(),\n});\n\n\nexport type PasskeyCredentialEntry = z.infer<typeof PasskeyCredentialEntrySchema>;\n\n/**\n * User Credentials Schema\n * Stores all authentication secrets for a user: password hash + optional TOTP.\n * All fields are compatible with MongoDB via zod-to-mongoose converter.\n *\n * The local first-factor / TOTP secret fields (`passwordHash`, `secretBase32`,\n * `totpVerifiedAt`) are `.nullish()` — absent when never set, or explicitly `null`\n * once a compliance clear physically destroys them (directory-managed reconciliation,\n * TOTP-disable). See each field's JSDoc for the null-vs-absent contract.\n *\n * TOTP fields (optional — user may have password-only auth):\n * - `secretBase32`: base32-encoded TOTP secret (backendOnly). Used with otpauth library.\n *    NOTE: stored as plaintext base32. For production hardening, add AES-256-GCM encryption at rest.\n * - `totpVerified`: whether the user has confirmed TOTP setup by entering a valid code\n * - `backupCodesHashed`: SHA-256 hashes of backup codes (consumed on use)\n * - `totpVerifiedAt`: timestamp when TOTP setup was confirmed\n */\nexport const UserCredentialsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // NULLISH by design — the hash is a non-empty `string` when set, ABSENT for a PASSWORD-LESS\n  // account (first factor is a passkey, magic link, or enterprise SSO — the row must be\n  // creatable with no `passwordHash`, e.g. passkey-enroll-at-invitation-accept), or explicitly\n  // `null` once a clear physically DESTROYS it. The AUTH-24 directory-managed reconciliation\n  // (`_reconcileLocalCredentialsForDirectoryManaged`) writes `passwordHash: null` to neutralise a\n  // local first factor that would otherwise survive IdP deprovisioning. `null` MUST be accepted\n  // here: the write re-attaches this backend-only field past the strict request-DTO strip\n  // (`updateAsSystem`), but the SERVICE-LAYER OUTPUT PROJECTION (`transformOutput` →\n  // `internalDto.parse`) re-validates the persisted document against the FULL schema (backend-only\n  // fields included). Were this merely `.optional()` (absent-only, not null), the destroy-write\n  // would persist the `null` and THEN throw `service_resource_transformation_failed` on the\n  // after-image — the credential is gone but the operation errors (misleading \"reconcile failed\"\n  // log). Every consumer treats the hash as falsy-when-absent (`!credentials?.passwordHash`\n  // guards, `enrolled: !!passwordHash`, last-method-removal counting), so `null` and absent are\n  // handled identically. `.min(1)` still guarantees a NON-EMPTY hash whenever one IS present.\n  // ── CREDENTIALS is declared, not derived, on this resource ──\n  //\n  // The producer DERIVES `credentials` from `.isPassword()` / `.isOtp()` / `.isWriteOnlySecret()`.\n  // These fields carry `.isBackendOnly()` instead — correctly, since they are stored HASHES and\n  // secrets that must never leave the backend, not editable password INPUTS. So the derivation\n  // cannot see them and the declaration has to be explicit. Measured: before this, `userCredentials`\n  // reported zero categories while holding every secret the application has.\n  // REMOVE, not MASK. A credential is the one field class where a placeholder would be worse than a\n  // null: a masked hash is still a string the verifier will attempt, and \"it never matches\" is a\n  // property of the value rather than a guarantee. Nulling it makes the absence structural.\n  passwordHash: addImpersonalizeWith(\n    z.string().min(1).nullish().isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n    RedactionType.REMOVE,\n  ),\n\n  /**\n   * TOTP secret encoded as base32 — used with otpauth library for code generation/verification.\n   * NULLISH: absent when TOTP was never set up, or explicitly `null` after the\n   * auth-method-management TOTP-disable clear physically destroys it. `null` must be accepted so\n   * that disable-clear's null-write round-trips through the output projection — same contract as\n   * `passwordHash` above (backend-only field, re-validated by `transformOutput`).\n   */\n  secretBase32: z.string().nullish().isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n  /** Whether the user has confirmed TOTP setup by entering a valid code */\n  totpVerified: z.boolean().default(false).isDBIndexed(),\n  /** SHA-256 hashes of backup codes — consumed on use (removed from array) */\n  // RESET, not REMOVE, and the field is back to non-nullable (issue #195).\n  //\n  // It was widened to `.nullish()` on 2026-08-31 purely so REMOVE could reach it: no treatment could\n  // then scrub a non-nullable field with a default, so widening the READ contract of a credential\n  // field was the only way to declare an erasure posture here. `RESET` landed on 2026-09-01 and the\n  // workaround is no longer needed.\n  //\n  // Reverting is also the more truthful scrub. RESET writes `[]` — *there are no backup codes* —\n  // while REMOVE wrote `null`, which reads as *unknown*. For a credential those are different\n  // statements to anyone reading the row, and only one of them is what erasure actually achieved.\n  backupCodesHashed: addImpersonalizeWith(\n    z.array(z.string()).default([]).isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n    RedactionType.RESET,\n  ),\n  /**\n   * When the user verified their TOTP setup. NULLISH: absent before verification, a `Date` once\n   * verified, or explicitly `null` after the TOTP-disable clear. Unlike the backend-only TOTP\n   * secret this field is NOT stripped from the request DTO, so `null` must be accepted on BOTH\n   * the write-side parse (`validateAndTransformInput`, which loose-parses the in-shape field) AND\n   * the output projection — otherwise the disable-clear throws before/after persisting. Readers\n   * use `?? undefined`, so `null` and absent behave identically.\n   */\n  totpVerifiedAt: z.date().nullish(),\n  /** Timestamp of the last password change. Refresh tokens issued before this are rejected (C4 fix). */\n  passwordChangedAt: z.date().optional().isBackendOnly(),\n  /** WebAuthn/Passkey credentials — array of registered passkeys */\n  passkeyCredentials: z.array(PasskeyCredentialEntrySchema).default([]).isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n\n  /** W2.1: timestamp of the first login where MFA was required but not yet enrolled. Used with enrollmentGracePeriodDays. */\n  firstMfaPromptAt: z.date().optional().isBackendOnly(),\n  /** W4.6: MFA enrollment lifecycle state. Computed at user creation and updated on enrollment completion. */\n  mfaEnrollmentState: z.enum(MfaEnrollmentState).default(MfaEnrollmentState.NOT_REQUIRED).isBackendOnly(),\n  /** W2.3: tracks consecutive account lockouts for progressive lockout duration (2^n multiplier). Reset on successful login. */\n  consecutiveLockouts: z.number().default(0).isBackendOnly(),\n\n  /** Phone number in E.164 format for SMS OTP authentication (Phase G2) */\n  // CONTACT_DETAILS, not CREDENTIALS. It is the SMS OTP delivery ADDRESS — a way to reach the\n  // person, which they hold independently of this application — not a secret this application\n  // stores. Merging the two would make a notice say the phone number is a credential.\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n  /** Whether the phone number has been verified via OTP confirmation */\n  phoneNumberVerified: z.boolean().default(false),\n  /** When the phone number was verified */\n  phoneVerifiedAt: z.date().optional(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type UserCredentials = z.infer<typeof UserCredentialsSchema>;\n\n\n"]}

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}
+{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAC1E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,sBAAsB;IAClC,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;IACxD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;IACjG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,mFAAmF;IACnF,mFAAmF;IACnF,sGAAsG;IACtG,gFAAgF;IAChF,kFAAkF;IAClF,qFAAqF;IACrF,wEAAwE;IACxE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,yGAAyG;QACzG,gGAAgG;QAChG,yGAAyG;QACzG,wGAAwG;QACxG,mGAAmG;QACnG,sDAAsD;QACtD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAG5E;;;;;;;;;;OAUG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED,4FAA4F;IAC5F,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Identity Links Resource Configuration (Internal-only)\n *\n * System resource — no auto-generated API controller.\n * Frontend access via custom auth controller endpoint: GET /auth/identity-links\n *\n * Operations are INTERNAL_CALL: accessible through the service layer pipeline\n * by trusted internal code (OAuth2 JIT provisioning, auth method management),\n * but not exposed as HTTP endpoints.\n */\n\nimport { UserIdentityLinkSchema } from './user-identity-links.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\nexport const userIdentityLinksResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY,\n  typeof UserIdentityLinkSchema\n>({\n  mainSchema: UserIdentityLinkSchema,\n  resourceIdentifier: CoreResourceType.USER_IDENTITY_LINKS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_IDENTITY_LINKS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // OAuth2 JIT + enterprise SSO / SCIM provisioning create and update identity links\n  // in-process on a request-context-less EC. The client-shaped CREATE DTO strips the\n  // context FKs by name (`userId`, `organizationId`, `applicationId`), and both CREATE and UPDATE strip\n  // the backend-only `providerRawProfile`. This resource has no HTTP surface (all\n  // variants are INTERNAL_CALL), so the trusted `createAsSystem` / `updateAsSystem`\n  // primitives are the ONLY writers — opt both verbs in so the stripped fields survive\n  // the strict-DTO parse (re-attached from the schema-derived allowlist).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    // AUTH-24: the auth-policy resolver READS a user's identity link during LOGIN to decide whether they are\n    // IdP-PROVISIONED in an actively directory-managed org — only THEN are their local first-factor\n    // credentials derived off (and reconciled). The owner/admin who registered locally has no link and keeps\n    // a break-glass credential (user decision 2026-07-21). The bulk sweep on SCIM activation LISTS an org's\n    // links to reconcile all already-provisioned members. Both run under a pre-/being-authenticated or\n    // token-mint EC, so they resolve via the system door.\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n  },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the identity link.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: the row holds the provider's own copy of the person — their id at that\n   * provider, their email, display name, avatar URL and the raw profile payload. All are scrubbed.\n   *\n   * `providerUserId` participates in the compound business key, so masking it would collide across two\n   * erased links for one connection under a plain unique index. It does not, because declaring a\n   * retention policy makes the planner emit that index RETENTION-SCOPED — retained rows fall outside\n   * the constraint. Verify that in the generated migration rather than assuming it.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /** The subject is the person the external identity belongs to, reached through `userId`. */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the factory's boot-time guard and then fails to resolve when an\n     * erasure actually runs, because the retention primitives resolve through\n     * `getServiceOperationPathDefault`, which excludes it.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"user-identity-links.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAC1E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,sBAAsB;IAClC,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;IACxD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;IACjG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,mFAAmF;IACnF,mFAAmF;IACnF,sGAAsG;IACtG,gFAAgF;IAChF,kFAAkF;IAClF,qFAAqF;IACrF,wEAAwE;IACxE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,yGAAyG;QACzG,gGAAgG;QAChG,yGAAyG;QACzG,wGAAwG;QACxG,mGAAmG;QACnG,sDAAsD;QACtD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAG5E;;;;;;;;;;OAUG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED,4FAA4F;IAC5F,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,kEAAkE;QAClE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Identity Links Resource Configuration (Internal-only)\n *\n * System resource — no auto-generated API controller.\n * Frontend access via custom auth controller endpoint: GET /auth/identity-links\n *\n * Operations are INTERNAL_CALL: accessible through the service layer pipeline\n * by trusted internal code (OAuth2 JIT provisioning, auth method management),\n * but not exposed as HTTP endpoints.\n */\n\nimport { UserIdentityLinkSchema } from './user-identity-links.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\nexport const userIdentityLinksResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY,\n  typeof UserIdentityLinkSchema\n>({\n  mainSchema: UserIdentityLinkSchema,\n  resourceIdentifier: CoreResourceType.USER_IDENTITY_LINKS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_IDENTITY_LINKS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // OAuth2 JIT + enterprise SSO / SCIM provisioning create and update identity links\n  // in-process on a request-context-less EC. The client-shaped CREATE DTO strips the\n  // context FKs by name (`userId`, `organizationId`, `applicationId`), and both CREATE and UPDATE strip\n  // the backend-only `providerRawProfile`. This resource has no HTTP surface (all\n  // variants are INTERNAL_CALL), so the trusted `createAsSystem` / `updateAsSystem`\n  // primitives are the ONLY writers — opt both verbs in so the stripped fields survive\n  // the strict-DTO parse (re-attached from the schema-derived allowlist).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    // AUTH-24: the auth-policy resolver READS a user's identity link during LOGIN to decide whether they are\n    // IdP-PROVISIONED in an actively directory-managed org — only THEN are their local first-factor\n    // credentials derived off (and reconciled). The owner/admin who registered locally has no link and keeps\n    // a break-glass credential (user decision 2026-07-21). The bulk sweep on SCIM activation LISTS an org's\n    // links to reconcile all already-provisioned members. Both run under a pre-/being-authenticated or\n    // token-mint EC, so they resolve via the system door.\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n  },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the identity link.\n   *\n   * `RETAIN_AND_IMPERSONALIZE`: the row holds the provider's own copy of the person — their id at that\n   * provider, their email, display name, avatar URL and the raw profile payload. All are scrubbed.\n   *\n   * `providerUserId` participates in the compound business key, so masking it would collide across two\n   * erased links for one connection under a plain unique index. It does not, because declaring a\n   * retention policy makes the planner emit that index RETENTION-SCOPED — retained rows fall outside\n   * the constraint. Verify that in the generated migration rather than assuming it.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /** The subject is the person the external identity belongs to, reached through `userId`. */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; required by `retentionPolicy` (the in-place scrub).\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. `retentionPolicy` requires UPDATE_MANY — the impersonalize writer\n     * scrubs rows in place through `updateManyAsSystem`. INTERNAL_CALL registers NO route, and must not\n     * be REPOSITORY_ONLY: that satisfies the factory's boot-time guard and then fails to resolve when an\n     * erasure actually runs, because the retention primitives resolve through\n     * `getServiceOperationPathDefault`, which excludes it.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/user-identity-links.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;kBAqLjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;kBAqLjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/esm/users/user-identity-links.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAE5C;IACF,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC;QAClC,sBAAsB,CAAC,MAAM;QAC7B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;IACF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC;QACtC,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExE,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE7D,+BAA+B;IAC/B,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,uFAAuF;IACvF,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CACrC;IAED,yBAAyB;IACzB,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED,4BAA4B;IAC5B,mBAAmB,EAAE,oBAAoB,CACvC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,0BAA0B;IAC1B,iBAAiB,EAAE,oBAAoB,CACrC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;;OAOG;IACH,iGAAiG;IACjG,+FAA+F;IAC/F,+EAA+E;IAC/E,kBAAkB,EAAE,oBAAoB,CACtC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAC5D,aAAa,CAAC,MAAM,CACrB;SACE,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEzD,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEpD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEnD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,oDAAoD;IACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElG,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACrG,CAAC,CAAC,cAAc,CAAC;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,cAAc;CACf,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,cAAc,cAAc;SAClG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACrD,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;eACzB,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,YAAY,KAAK,SAAS,EAClC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["/**\n * User Identity Links Schema\n *\n * Tracks OAuth2/SSO provider connections per user.\n * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).\n *\n * Canonical identity key: connection type + provider + provider user + exact enterprise\n * scope/connection coordinates. The database compound unique index prevents the same\n * external identity from being bound to two Wildo users inside one tenant connection.\n */\n\nimport { z } from 'zod';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { ERASED_USER_EMAIL, ERASED_IDENTITY_VALUE } from './users.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport {\n  AuthScopeType,\n  ExternalIdentitySource,\n  SsoConnectionType,\n} from '../security/authentications/authentication.shared.schemas';\n\n/**\n * Valid provenance mechanisms for each connection ownership class.\n *\n * OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately\n * spans both. Keeping this relationship beside the persisted link schema makes\n * invalid cross-products impossible at every repository boundary.\n */\nexport const IDENTITY_SOURCES_BY_CONNECTION_TYPE: Readonly<\n  Record<SsoConnectionType, ReadonlySet<ExternalIdentitySource>>\n> = {\n  [SsoConnectionType.SOCIAL]: new Set([\n    ExternalIdentitySource.OAUTH2,\n    ExternalIdentitySource.OIDC,\n  ]),\n  [SsoConnectionType.ENTERPRISE]: new Set([\n    ExternalIdentitySource.OIDC,\n    ExternalIdentitySource.SAML,\n    ExternalIdentitySource.SCIM,\n  ]),\n};\n\nexport const UserIdentityLinkSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** FK → USERS — the user who owns this identity link */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  /** Distinguishes social vs enterprise links */\n  connectionType: z.enum(SsoConnectionType).isDBIndexed().isSummaryField(),\n\n  /** Matches external connector ref (e.g., \"google\", \"microsoft\", \"github\", \"oidc\") */\n  providerRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The user's ID at the IdP */\n  // MASK, not REMOVE: `min(1)` and part of the compound business key, so a null fails the re-parse.\n  // Two erased links for one connection would share this masked value — which is safe because a\n  // declared retention policy makes the planner emit that unique index RETENTION-SCOPED, so retained\n  // rows fall outside the constraint. Confirmed in the generated migration, not assumed.\n  providerUserId: addImpersonalizeWith(\n    z.string().min(1).isDBIndexed().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_IDENTITY_VALUE },\n  ),\n\n  /** Email from the IdP */\n  providerEmail: addImpersonalizeWith(\n    z.string().isDBIndexed().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_EMAIL },\n  ),\n\n  /** Display name from IdP */\n  providerDisplayName: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /** Avatar URL from IdP */\n  providerAvatarUrl: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /**\n   * Raw claims from the IdP for debugging — backend only.\n   *\n   * The one field on this resource whose contents the framework does not control: an IdP may put\n   * anything in a claim set, including a special category. IDENTITY + USER_CONTENT is what the field\n   * is FOR; it is not a certification of what a given IdP will send. An application whose IdP is\n   * known to emit a special-category claim should say so on its own copy.\n   */\n  // The provider's own payload about the person, unbounded in shape — whatever that provider chose\n  // to send. It carries no `dataCategories` because nothing can classify it in advance, which is\n  // exactly why it must be scrubbed: an unclassifiable blob is not an empty one.\n  providerRawProfile: addImpersonalizeWith(\n    z.record(z.string(), z.unknown()).optional().isBackendOnly(),\n    RedactionType.REMOVE,\n  )\n    .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),\n\n  /**\n   * The DIRECTORY's own identifier for this person, as SCIM `externalId` — and deliberately NOT\n   * {@link UserIdentityLinkSchema.shape.providerUserId}.\n   *\n   * ## Why it cannot share a column with `providerUserId`\n   *\n   * `providerUserId` is the AUTHENTICATION KEY. `createIdentityLink` resolves an existing link by it\n   * (with `providerRef`, `connectionType` and the scope) and refuses with\n   * `enterprise_identity_already_linked_to_another_user` when it points at somebody else. It is also\n   * part of this resource's business key.\n   *\n   * SCIM `externalId` is not that. RFC 7643 §3.1 makes it the CLIENT's identifier, which the service\n   * provider stores; the provider's own identifier is `id`. Microsoft Entra maps it from\n   * `[mailNickname]` by default — a mutable handle — so writing it into `providerUserId` would\n   * re-key a live SSO identity from an attribute an administrator can change in the directory. The\n   * next sign-in asserting the original subject would find no link.\n   *\n   * ## What it was before (#1402)\n   *\n   * `SCIM_USER_ATTRIBUTE_MAP` mapped `externalId` → `providerUserId`, and the SCIM PATCH/PUT path\n   * folded it into the profile update bag — which writes `USER_PROFILES`, a resource that does not\n   * own the field. It was stripped by the strict re-parse and the directory was told `200`. Measured\n   * against a live Entra tenant on 2026-09-21: it reported updating `externalId` for two users, and\n   * neither value was stored, so it re-sent the same update on every cycle.\n   *\n   * Optional because only a directory sets it: a social or interactive SSO link has none. Not\n   * indexed and not part of any key — it is a value to hand back, not to resolve by; resolving by it\n   * is what the whole comment above exists to prevent.\n   */\n  scimExternalId: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /** Enterprise tenant kind. Absent for social links. */\n  scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),\n\n  /** Organization tenant identifier. Present only for organization-scoped enterprise links. */\n  organizationId: z.string().optional().isForeignKey(),\n\n  /** Application tenant identifier. Present only for application-scoped enterprise links. */\n  applicationId: z.string().optional().isForeignKey(),\n\n  /** Enterprise connection identifier within the owning scope. */\n  connectionId: z.string().optional(),\n\n  /** Authentication source that created this link. */\n  source: z.enum(ExternalIdentitySource),\n\n  /** When this identity link was created */\n  linkedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  /** Last time this identity link was used for authentication */\n  lastUsedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'connectionType',\n  'providerRef',\n  'providerUserId',\n  'scopeType',\n  'organizationId',\n  'applicationId',\n  'connectionId',\n]).superRefine((link, ctx) => {\n  if (!IDENTITY_SOURCES_BY_CONNECTION_TYPE[link.connectionType].has(link.source)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['source'],\n      message: `Identity source ${link.source} is incompatible with ${link.connectionType} connections`,\n    });\n  }\n\n  if (link.connectionType === SsoConnectionType.SOCIAL) {\n    if (\n      link.scopeType !== undefined\n      || link.organizationId !== undefined\n      || link.applicationId !== undefined\n      || link.connectionId !== undefined\n    ) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['scopeType'],\n        message: 'Social identity links must not carry enterprise scope fields',\n      });\n    }\n    return;\n  }\n\n  if (!link.connectionId) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['connectionId'],\n      message: 'Enterprise identity links require connectionId',\n    });\n  }\n\n  if (link.scopeType === AuthScopeType.ORGANIZATION) {\n    if (!link.organizationId || link.applicationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['organizationId'],\n        message: 'Organization-scoped identity links require only organizationId',\n      });\n    }\n    return;\n  }\n\n  if (link.scopeType === AuthScopeType.APPLICATION) {\n    if (!link.applicationId || link.organizationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['applicationId'],\n        message: 'Application-scoped identity links require only applicationId',\n      });\n    }\n    return;\n  }\n\n  ctx.addIssue({\n    code: 'custom',\n    path: ['scopeType'],\n    message: 'Enterprise identity links require an explicit scopeType',\n  });\n});\n\n\nexport type UserIdentityLink = z.infer<typeof UserIdentityLinkSchema>;\n"]}
+{"version":3,"file":"user-identity-links.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAE5C;IACF,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC;QAClC,sBAAsB,CAAC,MAAM;QAC7B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;IACF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC;QACtC,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExE,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE7D,+BAA+B;IAC/B,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,uFAAuF;IACvF,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CACrC;IAED,yBAAyB;IACzB,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED,4BAA4B;IAC5B,mBAAmB,EAAE,oBAAoB,CACvC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,0BAA0B;IAC1B,iBAAiB,EAAE,oBAAoB,CACrC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED;;;;;;;OAOG;IACH,iGAAiG;IACjG,+FAA+F;IAC/F,+EAA+E;IAC/E,kBAAkB,EAAE,oBAAoB,CACtC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAC5D,aAAa,CAAC,MAAM,CACrB;SACE,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACnE,aAAa,CAAC,MAAM,CACrB;IAED,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEzD,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEpD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEnD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,oDAAoD;IACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElG,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACrG,CAAC,CAAC,cAAc,CAAC;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,cAAc;CACf,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,cAAc,cAAc;SAClG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACrD,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;eACzB,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,YAAY,KAAK,SAAS,EAClC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["/**\n * User Identity Links Schema\n *\n * Tracks OAuth2/SSO provider connections per user.\n * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).\n *\n * Canonical identity key: connection type + provider + provider user + exact enterprise\n * scope/connection coordinates. The database compound unique index prevents the same\n * external identity from being bound to two Wildo users inside one tenant connection.\n */\n\nimport { z } from 'zod';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { ERASED_USER_EMAIL, ERASED_IDENTITY_VALUE } from './users.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport {\n  AuthScopeType,\n  ExternalIdentitySource,\n  SsoConnectionType,\n} from '../security/authentications/authentication.shared.schemas';\n\n/**\n * Valid provenance mechanisms for each connection ownership class.\n *\n * OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately\n * spans both. Keeping this relationship beside the persisted link schema makes\n * invalid cross-products impossible at every repository boundary.\n */\nexport const IDENTITY_SOURCES_BY_CONNECTION_TYPE: Readonly<\n  Record<SsoConnectionType, ReadonlySet<ExternalIdentitySource>>\n> = {\n  [SsoConnectionType.SOCIAL]: new Set([\n    ExternalIdentitySource.OAUTH2,\n    ExternalIdentitySource.OIDC,\n  ]),\n  [SsoConnectionType.ENTERPRISE]: new Set([\n    ExternalIdentitySource.OIDC,\n    ExternalIdentitySource.SAML,\n    ExternalIdentitySource.SCIM,\n  ]),\n};\n\nexport const UserIdentityLinkSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** FK → USERS — the user who owns this identity link */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  /** Distinguishes social vs enterprise links */\n  connectionType: z.enum(SsoConnectionType).isDBIndexed().isSummaryField(),\n\n  /** Matches external connector ref (e.g., \"google\", \"microsoft\", \"github\", \"oidc\") */\n  providerRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The user's ID at the IdP */\n  // MASK, not REMOVE: `min(1)` and part of the compound business key, so a null fails the re-parse.\n  // Two erased links for one connection would share this masked value — which is safe because a\n  // declared retention policy makes the planner emit that unique index RETENTION-SCOPED, so retained\n  // rows fall outside the constraint. Confirmed in the generated migration, not assumed.\n  providerUserId: addImpersonalizeWith(\n    z.string().min(1).isDBIndexed().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_IDENTITY_VALUE },\n  ),\n\n  /** Email from the IdP */\n  providerEmail: addImpersonalizeWith(\n    z.string().isDBIndexed().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_EMAIL },\n  ),\n\n  /** Display name from IdP */\n  providerDisplayName: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /** Avatar URL from IdP */\n  providerAvatarUrl: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /**\n   * Raw claims from the IdP for debugging — backend only.\n   *\n   * The one field on this resource whose contents the framework does not control: an IdP may put\n   * anything in a claim set, including a special category. IDENTITY + USER_CONTENT is what the field\n   * is FOR; it is not a certification of what a given IdP will send. An application whose IdP is\n   * known to emit a special-category claim should say so on its own copy.\n   */\n  // The provider's own payload about the person, unbounded in shape — whatever that provider chose\n  // to send. It carries no `dataCategories` because nothing can classify it in advance, which is\n  // exactly why it must be scrubbed: an unclassifiable blob is not an empty one.\n  providerRawProfile: addImpersonalizeWith(\n    z.record(z.string(), z.unknown()).optional().isBackendOnly(),\n    RedactionType.REMOVE,\n  )\n    .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),\n\n  /**\n   * The DIRECTORY's own identifier for this person, as SCIM `externalId` — and deliberately NOT\n   * {@link UserIdentityLinkSchema.shape.providerUserId}.\n   *\n   * ## Why it cannot share a column with `providerUserId`\n   *\n   * `providerUserId` is the AUTHENTICATION KEY. `createIdentityLink` resolves an existing link by it\n   * (with `providerRef`, `connectionType` and the scope) and refuses with\n   * `enterprise_identity_already_linked_to_another_user` when it points at somebody else. It is also\n   * part of this resource's business key.\n   *\n   * SCIM `externalId` is not that. RFC 7643 §3.1 makes it the CLIENT's identifier, which the service\n   * provider stores; the provider's own identifier is `id`. Microsoft Entra maps it from\n   * `[mailNickname]` by default — a mutable handle — so writing it into `providerUserId` would\n   * re-key a live SSO identity from an attribute an administrator can change in the directory. The\n   * next sign-in asserting the original subject would find no link.\n   *\n   * ## What it was before (#1402)\n   *\n   * `SCIM_USER_ATTRIBUTE_MAP` mapped `externalId` → `providerUserId`, and the SCIM PATCH/PUT path\n   * folded it into the profile update bag — which writes `USER_PROFILES`, a resource that does not\n   * own the field. It was stripped by the strict re-parse and the directory was told `200`. Measured\n   * against a live Entra tenant on 2026-09-21: it reported updating `externalId` for two users, and\n   * neither value was stored, so it re-sent the same update on every cycle.\n   *\n   * Optional because only a directory sets it: a social or interactive SSO link has none. Not\n   * indexed and not part of any key — it is a value to hand back, not to resolve by; resolving by it\n   * is what the whole comment above exists to prevent.\n   */\n  scimExternalId: addImpersonalizeWith(\n    z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n\n  /** Enterprise tenant kind. Absent for social links. */\n  scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),\n\n  /** Organization tenant identifier. Present only for organization-scoped enterprise links. */\n  organizationId: z.string().optional().isForeignKey(),\n\n  /** Application tenant identifier. Present only for application-scoped enterprise links. */\n  applicationId: z.string().optional().isForeignKey(),\n\n  /** Enterprise connection identifier within the owning scope. */\n  connectionId: z.string().optional(),\n\n  /** Authentication source that created this link. */\n  source: z.enum(ExternalIdentitySource),\n\n  /** When this identity link was created */\n  linkedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  /** Last time this identity link was used for authentication */\n  lastUsedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'connectionType',\n  'providerRef',\n  'providerUserId',\n  'scopeType',\n  'organizationId',\n  'applicationId',\n  'connectionId',\n]).superRefine((link, ctx) => {\n  if (!IDENTITY_SOURCES_BY_CONNECTION_TYPE[link.connectionType].has(link.source)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['source'],\n      message: `Identity source ${link.source} is incompatible with ${link.connectionType} connections`,\n    });\n  }\n\n  if (link.connectionType === SsoConnectionType.SOCIAL) {\n    if (\n      link.scopeType !== undefined\n      || link.organizationId !== undefined\n      || link.applicationId !== undefined\n      || link.connectionId !== undefined\n    ) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['scopeType'],\n        message: 'Social identity links must not carry enterprise scope fields',\n      });\n    }\n    return;\n  }\n\n  if (!link.connectionId) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['connectionId'],\n      message: 'Enterprise identity links require connectionId',\n    });\n  }\n\n  if (link.scopeType === AuthScopeType.ORGANIZATION) {\n    if (!link.organizationId || link.applicationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['organizationId'],\n        message: 'Organization-scoped identity links require only organizationId',\n      });\n    }\n    return;\n  }\n\n  if (link.scopeType === AuthScopeType.APPLICATION) {\n    if (!link.applicationId || link.organizationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['applicationId'],\n        message: 'Application-scoped identity links require only applicationId',\n      });\n    }\n    return;\n  }\n\n  ctx.addIssue({\n    code: 'custom',\n    path: ['scopeType'],\n    message: 'Enterprise identity links require an explicit scopeType',\n  });\n});\n\n\nexport type UserIdentityLink = z.infer<typeof UserIdentityLinkSchema>;\n"]}

package/dist/esm/users/user-preferences-reset.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences-reset.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,mBAAmB,EACnB,eAAe,EAKhB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA2B5F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,2BAA2B,EACpC,kBAAkB,EAAE,eAAe,GAAG,SAAS,GAC9C,OAAO,CAAC,eAAe,CAAC,CAU1B"}
+{"version":3,"file":"user-preferences-reset.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,mBAAmB,EACnB,eAAe,EAKhB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA2B5F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,2BAA2B,EACpC,kBAAkB,EAAE,eAAe,GAAG,SAAS,GAC9C,OAAO,CAAC,eAAe,CAAC,CAU1B"}

package/dist/esm/users/user-preferences-reset.shared.utils.js

@@ -35,7 +35,7 @@
  * `.excludeFromUpdate()`.
  */
 import { z } from "zod";
-import { EnumEditMode } from "@wildo-ai/zod-decorators";
+import { EnumMultipleEditMode } from "@wildo-ai/zod-decorators";
 import { UserPreferenceGroup, UserLanguagePreferencesSchema, UserPreferences_NotificationsSchema, UserPreferences_RegionalSchema, UserPreferences_UI_ThemeSchema, } from "./users.shared.schemas.js";
 import { UserPrivacySchema } from "../compliance/privacy/privacy.shared.schemas.js";
 /**
@@ -51,7 +51,7 @@ import { UserPrivacySchema } from "../compliance/privacy/privacy.shared.schemas.
  * matching how `fallbackLanguages` presents a compact multi-select in the same settings surface.
  */
 export const UserPreferencesResetRequestSchema = z.object({
-    groups: z.array(z.enum(UserPreferenceGroup).enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).min(1),
+    groups: z.array(z.enum(UserPreferenceGroup).enumUI({ edit: { multipleEditMode: EnumMultipleEditMode.COMBOBOX } })).min(1).describe("The preference blocks to return to their defaults, by field name: `notifications`, `privacy`, `ui`, `regional` or `languagePreferences`. At least one is required, and blocks not named are left unchanged. Resetting `privacy` withdraws every consent the user has given; resetting `regional` clears the user's own regional choices so the organization's apply."),
 });
 /**
  * Every block is preference state. Governed-document interaction receipts live in their own

package/dist/esm/users/user-preferences-reset.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences-reset.shared.utils.js","sourceRoot":"","sources":["../../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EACL,mBAAmB,EAEnB,6BAA6B,EAC7B,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1G,CAAC,CAAC;AAiBH;;;GAGG;AACH,MAAM,qCAAqC,GAAsC;IAC/E,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9E,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7E,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;CACjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAoC,EACpC,kBAA+C;IAE/C,MAAM,KAAK,GAA6B,EAAE,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,sFAAsF;QACtF,yFAAyF;QACxF,KAAiC,CAAC,KAAK,CAAC,GAAG,qCAAqC,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * User Preferences Reset — the shared contract behind `reset_to_defaults`.\n *\n * ONE authority for the self-service reset of a preferences row. `USER_SELF_PREFERENCES`\n * resolves to the `USER_PREFERENCES` persistence collection, but the administrator-addressed\n * resource deliberately exposes no reset operation: a second public verb would be a second\n * contract for the same mutation, free to drift. Administrators have the generic UPDATE for an\n * explicit correction; subjects own selective reset here.\n *\n * ## Why this file exists at all\n *\n * The operation used to declare six booleans (`resetNotifications`, `resetPrivacy`, `resetUI`,\n * `resetRegional`, `resetLanguage`, `resetAll`). None of them is a field on\n * `UserPreferencesSchema`, and a payload is stripped THREE times on the way to the database —\n * the controller parses the body against the operation `requestDto`, the repository re-parses\n * the write against that same DTO, and Mongoose drops every non-schema path. A request naming\n * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset\n * nothing. That is the class of defect catalogued in\n * the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n *\n * ## How the reset reaches the database now\n *\n * `requestDto` names the caller-facing vocabulary ({@link UserPreferenceGroup}); a\n * `basicPrefixOperation` turns it into the patch this module builds. The framework merges a\n * prefix's return value onto the payload and whitelists the keys the prefix ADDED into\n * `preserveServerInjectedFields`, which the repository re-attaches after its strict parse. So\n * the group fields persist while the `groups` array itself — a client-supplied key, never\n * whitelisted — is stripped before it can reach a document.\n *\n * The patch is deliberately PARTIAL. The repository `$set`s it with no dot-path flattening, so\n * naming a group replaces that whole subdocument (which is exactly what \"reset this block\"\n * means), while an unnamed group is not in the `$set` at all and is left untouched. Spreading\n * the current row instead — the shape `todo-lists`/`todos` use — would make `_id` and `userId`\n * prefix-injected keys and re-write `userId` on every reset, despite it being\n * `.excludeFromUpdate()`.\n */\n\nimport { z } from \"zod\";\nimport { EnumEditMode } from \"@wildo-ai/zod-decorators\";\n\nimport {\n  UserPreferenceGroup,\n  UserPreferences,\n  UserLanguagePreferencesSchema,\n  UserPreferences_NotificationsSchema,\n  UserPreferences_RegionalSchema,\n  UserPreferences_UI_ThemeSchema,\n} from \"./users.shared.schemas\";\nimport { UserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\n\n/**\n * The `reset_to_defaults` request body for the subject-facing preferences resource.\n *\n * `.min(1)` is load-bearing, not decoration: a reset naming no group would write nothing and\n * answer 200, re-creating the exact silent no-op this operation was fixed for. Rejecting it at\n * the DTO makes that unrepresentable — the controller's strict parse turns it into a 400 before\n * any dispatch, and the repository's re-parse of the write enforces the same rule on every\n * non-HTTP path.\n *\n * `COMBOBOX` renders the array as a chips multi-select rather than an add-a-row array field,\n * matching how `fallbackLanguages` presents a compact multi-select in the same settings surface.\n */\nexport const UserPreferencesResetRequestSchema = z.object({\n  groups: z.array(z.enum(UserPreferenceGroup).enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).min(1),\n});\n\nexport type UserPreferencesResetRequest = z.infer<typeof UserPreferencesResetRequestSchema>;\n\n/**\n * How each preference block returns to its defaults.\n *\n * The mapped type is the integrity proof: `UserPreferences[Group]` only type-checks when every\n * {@link UserPreferenceGroup} value is a real field of `UserPreferences`. Typo a value, rename a\n * group field without renaming the enum value, or add a group member without a factory, and\n * this stops compiling — instead of shipping a patch key Mongoose silently drops, which is the\n * failure mode that made the old contract a no-op.\n */\ntype UserPreferenceGroupResetFactories = {\n  [Group in UserPreferenceGroup]: (currentPreferences: UserPreferences | undefined) => UserPreferences[Group];\n};\n\n/**\n * Every block is preference state. Governed-document interaction receipts live in their own\n * immutable release-bound store and therefore cannot be erased or forged by this reset path.\n */\nconst USER_PREFERENCE_GROUP_RESET_FACTORIES: UserPreferenceGroupResetFactories = {\n  [UserPreferenceGroup.NOTIFICATIONS]: () => UserPreferences_NotificationsSchema.parse({}),\n  [UserPreferenceGroup.UI]: () => UserPreferences_UI_ThemeSchema.parse({}),\n  [UserPreferenceGroup.REGIONAL]: () => UserPreferences_RegionalSchema.parse({}),\n  [UserPreferenceGroup.LANGUAGE]: () => UserLanguagePreferencesSchema.parse({}),\n  [UserPreferenceGroup.PRIVACY]: () => UserPrivacySchema.parse({}),\n};\n\n/**\n * The persistence patch for a `reset_to_defaults` request — one key per requested block, and\n * nothing else.\n *\n * Returned from a `basicPrefixOperation`, so the framework merges it onto the payload and the\n * core UPDATE persists it. Keys absent from the patch are absent from the `$set`, so an\n * unnamed block is left exactly as it was.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}\n * returns `consentedPurposes` to the empty set and clears `consentDecidedAt`, which IS a consent\n * decision — a withdrawal of everything, after which a consent surface asks again. It leaves a trail\n * naming the previous and resulting value: the operation is CRITICAL, so it sits above the\n * framework's automatic audit floor and emits `resource_operation_performed`, and\n * `consentedPurposes` carries `.isAuditEvidence()` so its VALUES ride on that record. Governed-document receipts are neither preference members nor resettable values.\n *\n * @param request - the parsed request body. Re-parse `inputDto` through\n *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the\n *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the\n *   operation's request DTO.\n * @param currentPreferences - the row being reset, supplied to each block factory. Current\n *   factories return schema defaults; governed-document receipts live outside this resource.\n */\nexport function buildUserPreferencesResetPatch(\n  request: UserPreferencesResetRequest,\n  currentPreferences: UserPreferences | undefined,\n): Partial<UserPreferences> {\n  const patch: Partial<UserPreferences> = {};\n\n  for (const group of request.groups) {\n    // Same correlated-write widening as above: the factory is selected by the same key it\n    // writes, so the value type is right by construction and only the assignment is widened.\n    (patch as Record<string, unknown>)[group] = USER_PREFERENCE_GROUP_RESET_FACTORIES[group](currentPreferences);\n  }\n\n  return patch;\n}\n"]}
+{"version":3,"file":"user-preferences-reset.shared.utils.js","sourceRoot":"","sources":["../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EACL,mBAAmB,EAEnB,6BAA6B,EAC7B,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sWAAsW,CAAC;CAC3e,CAAC,CAAC;AAiBH;;;GAGG;AACH,MAAM,qCAAqC,GAAsC;IAC/E,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9E,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7E,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;CACjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAoC,EACpC,kBAA+C;IAE/C,MAAM,KAAK,GAA6B,EAAE,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,sFAAsF;QACtF,yFAAyF;QACxF,KAAiC,CAAC,KAAK,CAAC,GAAG,qCAAqC,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * User Preferences Reset — the shared contract behind `reset_to_defaults`.\n *\n * ONE authority for the self-service reset of a preferences row. `USER_SELF_PREFERENCES`\n * resolves to the `USER_PREFERENCES` persistence collection, but the administrator-addressed\n * resource deliberately exposes no reset operation: a second public verb would be a second\n * contract for the same mutation, free to drift. Administrators have the generic UPDATE for an\n * explicit correction; subjects own selective reset here.\n *\n * ## Why this file exists at all\n *\n * The operation used to declare six booleans (`resetNotifications`, `resetPrivacy`, `resetUI`,\n * `resetRegional`, `resetLanguage`, `resetAll`). None of them is a field on\n * `UserPreferencesSchema`, and a payload is stripped THREE times on the way to the database —\n * the controller parses the body against the operation `requestDto`, the repository re-parses\n * the write against that same DTO, and Mongoose drops every non-schema path. A request naming\n * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset\n * nothing. That is the class of defect catalogued in\n * the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n *\n * ## How the reset reaches the database now\n *\n * `requestDto` names the caller-facing vocabulary ({@link UserPreferenceGroup}); a\n * `basicPrefixOperation` turns it into the patch this module builds. The framework merges a\n * prefix's return value onto the payload and whitelists the keys the prefix ADDED into\n * `preserveServerInjectedFields`, which the repository re-attaches after its strict parse. So\n * the group fields persist while the `groups` array itself — a client-supplied key, never\n * whitelisted — is stripped before it can reach a document.\n *\n * The patch is deliberately PARTIAL. The repository `$set`s it with no dot-path flattening, so\n * naming a group replaces that whole subdocument (which is exactly what \"reset this block\"\n * means), while an unnamed group is not in the `$set` at all and is left untouched. Spreading\n * the current row instead — the shape `todo-lists`/`todos` use — would make `_id` and `userId`\n * prefix-injected keys and re-write `userId` on every reset, despite it being\n * `.excludeFromUpdate()`.\n */\n\nimport { z } from \"zod\";\nimport { EnumMultipleEditMode } from \"@wildo-ai/zod-decorators\";\n\nimport {\n  UserPreferenceGroup,\n  UserPreferences,\n  UserLanguagePreferencesSchema,\n  UserPreferences_NotificationsSchema,\n  UserPreferences_RegionalSchema,\n  UserPreferences_UI_ThemeSchema,\n} from \"./users.shared.schemas\";\nimport { UserPrivacySchema } from \"../compliance/privacy/privacy.shared.schemas\";\n\n/**\n * The `reset_to_defaults` request body for the subject-facing preferences resource.\n *\n * `.min(1)` is load-bearing, not decoration: a reset naming no group would write nothing and\n * answer 200, re-creating the exact silent no-op this operation was fixed for. Rejecting it at\n * the DTO makes that unrepresentable — the controller's strict parse turns it into a 400 before\n * any dispatch, and the repository's re-parse of the write enforces the same rule on every\n * non-HTTP path.\n *\n * `COMBOBOX` renders the array as a chips multi-select rather than an add-a-row array field,\n * matching how `fallbackLanguages` presents a compact multi-select in the same settings surface.\n */\nexport const UserPreferencesResetRequestSchema = z.object({\n  groups: z.array(z.enum(UserPreferenceGroup).enumUI({ edit: { multipleEditMode: EnumMultipleEditMode.COMBOBOX } })).min(1).describe(\"The preference blocks to return to their defaults, by field name: `notifications`, `privacy`, `ui`, `regional` or `languagePreferences`. At least one is required, and blocks not named are left unchanged. Resetting `privacy` withdraws every consent the user has given; resetting `regional` clears the user's own regional choices so the organization's apply.\"),\n});\n\nexport type UserPreferencesResetRequest = z.infer<typeof UserPreferencesResetRequestSchema>;\n\n/**\n * How each preference block returns to its defaults.\n *\n * The mapped type is the integrity proof: `UserPreferences[Group]` only type-checks when every\n * {@link UserPreferenceGroup} value is a real field of `UserPreferences`. Typo a value, rename a\n * group field without renaming the enum value, or add a group member without a factory, and\n * this stops compiling — instead of shipping a patch key Mongoose silently drops, which is the\n * failure mode that made the old contract a no-op.\n */\ntype UserPreferenceGroupResetFactories = {\n  [Group in UserPreferenceGroup]: (currentPreferences: UserPreferences | undefined) => UserPreferences[Group];\n};\n\n/**\n * Every block is preference state. Governed-document interaction receipts live in their own\n * immutable release-bound store and therefore cannot be erased or forged by this reset path.\n */\nconst USER_PREFERENCE_GROUP_RESET_FACTORIES: UserPreferenceGroupResetFactories = {\n  [UserPreferenceGroup.NOTIFICATIONS]: () => UserPreferences_NotificationsSchema.parse({}),\n  [UserPreferenceGroup.UI]: () => UserPreferences_UI_ThemeSchema.parse({}),\n  [UserPreferenceGroup.REGIONAL]: () => UserPreferences_RegionalSchema.parse({}),\n  [UserPreferenceGroup.LANGUAGE]: () => UserLanguagePreferencesSchema.parse({}),\n  [UserPreferenceGroup.PRIVACY]: () => UserPrivacySchema.parse({}),\n};\n\n/**\n * The persistence patch for a `reset_to_defaults` request — one key per requested block, and\n * nothing else.\n *\n * Returned from a `basicPrefixOperation`, so the framework merges it onto the payload and the\n * core UPDATE persists it. Keys absent from the patch are absent from the `$set`, so an\n * unnamed block is left exactly as it was.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}\n * returns `consentedPurposes` to the empty set and clears `consentDecidedAt`, which IS a consent\n * decision — a withdrawal of everything, after which a consent surface asks again. It leaves a trail\n * naming the previous and resulting value: the operation is CRITICAL, so it sits above the\n * framework's automatic audit floor and emits `resource_operation_performed`, and\n * `consentedPurposes` carries `.isAuditEvidence()` so its VALUES ride on that record. Governed-document receipts are neither preference members nor resettable values.\n *\n * @param request - the parsed request body. Re-parse `inputDto` through\n *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the\n *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the\n *   operation's request DTO.\n * @param currentPreferences - the row being reset, supplied to each block factory. Current\n *   factories return schema defaults; governed-document receipts live outside this resource.\n */\nexport function buildUserPreferencesResetPatch(\n  request: UserPreferencesResetRequest,\n  currentPreferences: UserPreferences | undefined,\n): Partial<UserPreferences> {\n  const patch: Partial<UserPreferences> = {};\n\n  for (const group of request.groups) {\n    // Same correlated-write widening as above: the factory is selected by the same key it\n    // writes, so the value type is right by construction and only the assignment is widened.\n    (patch as Record<string, unknown>)[group] = USER_PREFERENCE_GROUP_RESET_FACTORIES[group](currentPreferences);\n  }\n\n  return patch;\n}\n"]}

package/dist/esm/users/user-preferences.shared.resources-config.schemas.d.ts

@@ -57,8 +57,6 @@ export declare const userPreferencesResourceConfiguration_InitializationFactory:
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
     notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
         email: z.ZodDefault<z.ZodBoolean>;
-        push: z.ZodDefault<z.ZodBoolean>;
-        sms: z.ZodDefault<z.ZodBoolean>;
         inApp: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>>;
     privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
@@ -77,7 +75,6 @@ export declare const userPreferencesResourceConfiguration_InitializationFactory:
     languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
         primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
         fallbackLanguages: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>>;
-        autoDetect: z.ZodDefault<z.ZodBoolean>;
         useOrganizationDefault: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>>>;
 }, z.core.$strip>>;

package/dist/esm/users/user-preferences.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAWzG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,0BAA0B;IACpC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iDAAiD;;;;;iBAE5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkNvH,CAAC"}
+{"version":3,"file":"user-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAWzG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,0BAA0B;IACpC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iDAAiD;;;;;iBAE5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;kBAkNvH,CAAC"}