aeat.application.user_profile package¶

Lazy application facade for schema-driven user-profile operations.

This package is the application boundary for the centralised profile backend. The domain layer (domain.user_profile) owns the schema, value records, selector registry contract, and portable-export payload type domain.user_profile.UserProfilePortableExport. This package owns the command/result records and service entry points that operate on that contract: lifecycle orchestration, validation and preflight checks, Censo synchronisation, capability and custody helpers, consumer projections, bucket-scoped storage sessions, and portable bundle serialisation.

The records here have no business logic; they are the typed contract passed between CLI adapters, secure-storage persistence wiring, bucket-maintenance flows, Modelo readiness gates, workflow adapters, and calculation/filing/aggregation consumers. The aggregate passed across service boundaries is domain.user_profile.UserProfileRecord. The service implementations live in sibling modules and are exposed as lazy facade members, including ProfileLifecycleService, UserProfileSnapshotRepository, ProfileValidationService, and ProfilePreflightService.

Portable export composition follows the same split. serialize_profile_bundle() and deserialize_profile_bundle() live on this facade so CLI config and bucket-maintenance code compose through top-level re-exports, while the bundle payload remains the domain-layer domain.user_profile.UserProfilePortableExport. The current v3 bundle is the only accepted import shape. Its default adapters.persistence.storage.StorageCustodyProfile.STRUCTURED scope carries the typed profile, work-unit, ledger, calculation, and filing categories plus registry-selected secure-object rows. Sealed bucket backup requests adapters.persistence.storage.StorageCustodyProfile.FULL, which asserts every populated secure-object namespace has a registry custody disposition before export. Generic carried rows use their natural object keys rather than stored HMAC lookup digests, so import can re-save them through the target bucket’s secure-object substrate and re-encrypt under the recipient bucket DEK.

Custody helpers exposed here are application commands over storage-owned secret-store primitives. mint_recovery_code(), verify_recovery_code(), rekey_secret_store(), and recover_secret_store() resolve runtime settings, update active-bucket recovery metadata when needed, and return typed result records while leaving key wrapping and recovery envelope persistence in adapters.persistence.storage.

Projection and baseline helpers such as record_to_path_values(), projection_for_taxpayer(), and missing_filing_baseline_flags() provide the canonical schema-path and deadline-engine shapes consumed by filing gates instead of recreating profile fact decoding downstream.

Every re-exported name is resolved on demand through module-level __getattr__ (PEP 562). Top-level imports in this file are reserved for genuinely lightweight setup (core.identity.ProfileId and the active-profile language-resolver registration) so the boundary itself does not drag the domain portable-export / registry / service module surfaces into sys.modules. The state-free CLI surfaces (aeat, aeat --version, aeat --help) must not pay the registry cost via this boundary, which the entrypoints.cli.test_lazy_command_tree gate and the producer-side probe in application.user_profile.test_lazy_boundary both enforce.

aeat.application.user_profile package¶

Submodules¶