@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.d.ts

@@ -0,0 +1,112 @@
+import { z } from "zod";
+import { EngineCapability } from "../../external-providers/engine-capabilities.shared.schemas";
+/**
+ * **Whether an AI use DECIDES something about a person, and who reviews it if so.**
+ *
+ * ## What the capability already says, and what it cannot
+ *
+ * `AI_LLM`, `AI_EMBEDDINGS`, `AI_DOCUMENT_EXTRACTION` and `AI_CODING_AGENT` establish that AI is in use
+ * and for what FUNCTION. They cannot establish the two things that carry legal weight (issue #92):
+ * whether any of it produces a decision with a legal or similarly significant effect on a person, and
+ * whether a human reviews such a decision.
+ *
+ * Neither is inferable from a capability being enabled — the same `AI_LLM` backs a summarisation
+ * feature that decides nothing and a screening feature that decides a great deal.
+ *
+ * ## Why silence here is worse than silence elsewhere
+ *
+ * Automated decision-making with significant effects attracts specific obligations: information about
+ * the logic involved, and a right to obtain human intervention. A notice that describes AI use and says
+ * nothing about consequence does not read as "unknown" — it reads as "nothing significant happens
+ * here", which **silently claims the exemption**. That is why the posture is declared rather than
+ * defaulted, and why an undeclared capability is reported as undeclared rather than assumed harmless.
+ */
+export declare enum AiDecisionConsequence {
+    /**
+     * The AI produces no decision about a person — it summarises, drafts, classifies content, or assists
+     * a task whose outcome affects nobody's rights.
+     *
+     * A real and common answer, and the one that must be DECLARED rather than assumed: it is exactly the
+     * claim a silent notice makes for free.
+     */
+    NO_DECISION = "NO_DECISION",
+    /**
+     * The AI informs a decision a HUMAN takes. The human is the decision-maker and can disregard it.
+     *
+     * Distinct from {@link NO_DECISION} because a person is affected, and distinct from
+     * {@link DECIDES_AUTONOMOUSLY} because the obligation attaches to solely-automated decisions. Where
+     * the human merely rubber-stamps, this is the wrong answer — the review must be capable of changing
+     * the outcome.
+     */
+    ASSISTS_HUMAN_DECISION = "ASSISTS_HUMAN_DECISION",
+    /** The AI's output IS the decision, with no human able to change it before it takes effect. */
+    DECIDES_AUTONOMOUSLY = "DECIDES_AUTONOMOUSLY"
+}
+/** One AI capability's declared posture. */
+export declare const AiUsePostureSchema: z.ZodObject<{
+    consequence: z.ZodEnum<typeof AiDecisionConsequence>;
+    /**
+     * What the AI is used FOR, in the operator's words.
+     *
+     * Required, and it is what makes the posture checkable: "summarising a contact's interaction
+     * history" and "scoring a lead's creditworthiness" are the same capability and different postures,
+     * so a consequence with no stated use cannot be reviewed by anyone.
+     */
+    purpose: z.ZodString;
+    /**
+     * How a person obtains human intervention — REQUIRED unless the posture is
+     * {@link AiDecisionConsequence.NO_DECISION}.
+     *
+     * The pairing is enforced below rather than left to a reviewer: an application declaring that AI
+     * decides something about a person, and saying nothing about review, has described the obligation
+     * without answering it.
+     */
+    humanReviewArrangement: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type AiUsePosture = z.infer<typeof AiUsePostureSchema>;
+/**
+ * The application's declared AI postures, keyed by the capability they describe.
+ *
+ * Keyed by CAPABILITY rather than by feature, deliberately. The issue suggested "an AI use", and a
+ * feature-level posture is more precise — and it is a granularity nobody maintains, the same trade
+ * that settled the retention schedule and the processor register. A capability is the unit the
+ * application already declares, there are at most four, and an operator whose single `AI_LLM` capability
+ * backs two features with different consequences declares the STRONGER one, which is the safe direction.
+ */
+export declare const ApplicationAiUsePostureSchema: z.ZodRecord<z.ZodEnum<typeof EngineCapability> & z.core.$partial, z.ZodObject<{
+    consequence: z.ZodEnum<typeof AiDecisionConsequence>;
+    /**
+     * What the AI is used FOR, in the operator's words.
+     *
+     * Required, and it is what makes the posture checkable: "summarising a contact's interaction
+     * history" and "scoring a lead's creditworthiness" are the same capability and different postures,
+     * so a consequence with no stated use cannot be reviewed by anyone.
+     */
+    purpose: z.ZodString;
+    /**
+     * How a person obtains human intervention — REQUIRED unless the posture is
+     * {@link AiDecisionConsequence.NO_DECISION}.
+     *
+     * The pairing is enforced below rather than left to a reviewer: an application declaring that AI
+     * decides something about a person, and saying nothing about review, has described the obligation
+     * without answering it.
+     */
+    humanReviewArrangement: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>>;
+export type ApplicationAiUsePosture = z.infer<typeof ApplicationAiUsePostureSchema>;
+/**
+ * The AI capabilities a document must ask about.
+ *
+ * Named here rather than derived from a prefix: `AI_` is a spelling, and a capability added tomorrow
+ * whose name happens to start with it would silently join the set — while one that processes personal
+ * data under a different name would silently stay out.
+ */
+export declare const AI_ENGINE_CAPABILITIES: readonly EngineCapability[];
+/**
+ * Enabled AI capabilities with no declared posture — what a document must report as outstanding.
+ *
+ * Takes the ENABLED set as an argument: a capability the application has not enabled raises no
+ * question, and reporting it would fill a notice with AI the application does not use.
+ */
+export declare function undeclaredAiUseCapabilities(enabledCapabilities: readonly string[], posture: ApplicationAiUsePosture | undefined): readonly EngineCapability[];
+//# sourceMappingURL=ai-use-posture.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-use-posture.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/ai-use-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,qBAAqB;IAC/B;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IACjD,+FAA+F;IAC/F,oBAAoB,yBAAyB;CAC9C;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB;;IAG3B;;;;;;OAMG;;IAEH;;;;;;;OAOG;;kBAqBH,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;IAhDtC;;;;;;OAMG;;IAEH;;;;;;;OAOG;;mBAiCmG,CAAC;AAC3G,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,gBAAgB,EAK5D,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAC3C,SAAS,gBAAgB,EAAE,CAK7B"}

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.js

@@ -0,0 +1,120 @@
+import { z } from "zod";
+import { EngineCapability } from "../../external-providers/engine-capabilities.shared.schemas.js";
+/**
+ * **Whether an AI use DECIDES something about a person, and who reviews it if so.**
+ *
+ * ## What the capability already says, and what it cannot
+ *
+ * `AI_LLM`, `AI_EMBEDDINGS`, `AI_DOCUMENT_EXTRACTION` and `AI_CODING_AGENT` establish that AI is in use
+ * and for what FUNCTION. They cannot establish the two things that carry legal weight (issue #92):
+ * whether any of it produces a decision with a legal or similarly significant effect on a person, and
+ * whether a human reviews such a decision.
+ *
+ * Neither is inferable from a capability being enabled — the same `AI_LLM` backs a summarisation
+ * feature that decides nothing and a screening feature that decides a great deal.
+ *
+ * ## Why silence here is worse than silence elsewhere
+ *
+ * Automated decision-making with significant effects attracts specific obligations: information about
+ * the logic involved, and a right to obtain human intervention. A notice that describes AI use and says
+ * nothing about consequence does not read as "unknown" — it reads as "nothing significant happens
+ * here", which **silently claims the exemption**. That is why the posture is declared rather than
+ * defaulted, and why an undeclared capability is reported as undeclared rather than assumed harmless.
+ */
+export var AiDecisionConsequence;
+(function (AiDecisionConsequence) {
+    /**
+     * The AI produces no decision about a person — it summarises, drafts, classifies content, or assists
+     * a task whose outcome affects nobody's rights.
+     *
+     * A real and common answer, and the one that must be DECLARED rather than assumed: it is exactly the
+     * claim a silent notice makes for free.
+     */
+    AiDecisionConsequence["NO_DECISION"] = "NO_DECISION";
+    /**
+     * The AI informs a decision a HUMAN takes. The human is the decision-maker and can disregard it.
+     *
+     * Distinct from {@link NO_DECISION} because a person is affected, and distinct from
+     * {@link DECIDES_AUTONOMOUSLY} because the obligation attaches to solely-automated decisions. Where
+     * the human merely rubber-stamps, this is the wrong answer — the review must be capable of changing
+     * the outcome.
+     */
+    AiDecisionConsequence["ASSISTS_HUMAN_DECISION"] = "ASSISTS_HUMAN_DECISION";
+    /** The AI's output IS the decision, with no human able to change it before it takes effect. */
+    AiDecisionConsequence["DECIDES_AUTONOMOUSLY"] = "DECIDES_AUTONOMOUSLY";
+})(AiDecisionConsequence || (AiDecisionConsequence = {}));
+/** One AI capability's declared posture. */
+export const AiUsePostureSchema = z
+    .strictObject({
+    consequence: z.enum(AiDecisionConsequence),
+    /**
+     * What the AI is used FOR, in the operator's words.
+     *
+     * Required, and it is what makes the posture checkable: "summarising a contact's interaction
+     * history" and "scoring a lead's creditworthiness" are the same capability and different postures,
+     * so a consequence with no stated use cannot be reviewed by anyone.
+     */
+    purpose: z.string().trim().min(1),
+    /**
+     * How a person obtains human intervention — REQUIRED unless the posture is
+     * {@link AiDecisionConsequence.NO_DECISION}.
+     *
+     * The pairing is enforced below rather than left to a reviewer: an application declaring that AI
+     * decides something about a person, and saying nothing about review, has described the obligation
+     * without answering it.
+     */
+    humanReviewArrangement: z.string().trim().min(1).nullable(),
+})
+    .superRefine((posture, context) => {
+    if (posture.consequence === AiDecisionConsequence.NO_DECISION) {
+        if (posture.humanReviewArrangement !== null) {
+            context.addIssue({
+                code: "custom",
+                path: ["humanReviewArrangement"],
+                message: "a use that decides nothing has no human-review arrangement to describe",
+            });
+        }
+        return;
+    }
+    if (posture.humanReviewArrangement === null) {
+        context.addIssue({
+            code: "custom",
+            path: ["humanReviewArrangement"],
+            message: `a ${posture.consequence} use affects a person, so it must say how human intervention is obtained`,
+        });
+    }
+});
+/**
+ * The application's declared AI postures, keyed by the capability they describe.
+ *
+ * Keyed by CAPABILITY rather than by feature, deliberately. The issue suggested "an AI use", and a
+ * feature-level posture is more precise — and it is a granularity nobody maintains, the same trade
+ * that settled the retention schedule and the processor register. A capability is the unit the
+ * application already declares, there are at most four, and an operator whose single `AI_LLM` capability
+ * backs two features with different consequences declares the STRONGER one, which is the safe direction.
+ */
+export const ApplicationAiUsePostureSchema = z.partialRecord(z.enum(EngineCapability), AiUsePostureSchema);
+/**
+ * The AI capabilities a document must ask about.
+ *
+ * Named here rather than derived from a prefix: `AI_` is a spelling, and a capability added tomorrow
+ * whose name happens to start with it would silently join the set — while one that processes personal
+ * data under a different name would silently stay out.
+ */
+export const AI_ENGINE_CAPABILITIES = Object.freeze([
+    EngineCapability.AI_LLM,
+    EngineCapability.AI_EMBEDDINGS,
+    EngineCapability.AI_DOCUMENT_EXTRACTION,
+    EngineCapability.AI_CODING_AGENT,
+]);
+/**
+ * Enabled AI capabilities with no declared posture — what a document must report as outstanding.
+ *
+ * Takes the ENABLED set as an argument: a capability the application has not enabled raises no
+ * question, and reporting it would fill a notice with AI the application does not use.
+ */
+export function undeclaredAiUseCapabilities(enabledCapabilities, posture) {
+    const enabled = new Set(enabledCapabilities);
+    return AI_ENGINE_CAPABILITIES.filter((capability) => enabled.has(capability) && posture?.[capability] === undefined);
+}
+//# sourceMappingURL=ai-use-posture.shared.schemas.js.map

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-use-posture.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/ai-use-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,qBAoBX;AApBD,WAAY,qBAAqB;IAC/B;;;;;;OAMG;IACH,oDAA2B,CAAA;IAC3B;;;;;;;OAOG;IACH,0EAAiD,CAAA;IACjD,+FAA+F;IAC/F,sEAA6C,CAAA;AAC/C,CAAC,EApBW,qBAAqB,KAArB,qBAAqB,QAoBhC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,YAAY,CAAC;IACZ,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC1C;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,OAAO,CAAC,WAAW,KAAK,qBAAqB,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,OAAO,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;gBAChC,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,0EAA0E;SAC5G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAG3G;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgC,MAAM,CAAC,MAAM,CAAC;IAC/E,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,aAAa;IAC9B,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,eAAe;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,mBAAsC,EACtC,OAA4C;IAE5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,OAAO,sBAAsB,CAAC,MAAM,CAClC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { EngineCapability } from \"../../external-providers/engine-capabilities.shared.schemas\";\n\n/**\n * **Whether an AI use DECIDES something about a person, and who reviews it if so.**\n *\n * ## What the capability already says, and what it cannot\n *\n * `AI_LLM`, `AI_EMBEDDINGS`, `AI_DOCUMENT_EXTRACTION` and `AI_CODING_AGENT` establish that AI is in use\n * and for what FUNCTION. They cannot establish the two things that carry legal weight (issue #92):\n * whether any of it produces a decision with a legal or similarly significant effect on a person, and\n * whether a human reviews such a decision.\n *\n * Neither is inferable from a capability being enabled — the same `AI_LLM` backs a summarisation\n * feature that decides nothing and a screening feature that decides a great deal.\n *\n * ## Why silence here is worse than silence elsewhere\n *\n * Automated decision-making with significant effects attracts specific obligations: information about\n * the logic involved, and a right to obtain human intervention. A notice that describes AI use and says\n * nothing about consequence does not read as \"unknown\" — it reads as \"nothing significant happens\n * here\", which **silently claims the exemption**. That is why the posture is declared rather than\n * defaulted, and why an undeclared capability is reported as undeclared rather than assumed harmless.\n */\nexport enum AiDecisionConsequence {\n  /**\n   * The AI produces no decision about a person — it summarises, drafts, classifies content, or assists\n   * a task whose outcome affects nobody's rights.\n   *\n   * A real and common answer, and the one that must be DECLARED rather than assumed: it is exactly the\n   * claim a silent notice makes for free.\n   */\n  NO_DECISION = \"NO_DECISION\",\n  /**\n   * The AI informs a decision a HUMAN takes. The human is the decision-maker and can disregard it.\n   *\n   * Distinct from {@link NO_DECISION} because a person is affected, and distinct from\n   * {@link DECIDES_AUTONOMOUSLY} because the obligation attaches to solely-automated decisions. Where\n   * the human merely rubber-stamps, this is the wrong answer — the review must be capable of changing\n   * the outcome.\n   */\n  ASSISTS_HUMAN_DECISION = \"ASSISTS_HUMAN_DECISION\",\n  /** The AI's output IS the decision, with no human able to change it before it takes effect. */\n  DECIDES_AUTONOMOUSLY = \"DECIDES_AUTONOMOUSLY\",\n}\n\n/** One AI capability's declared posture. */\nexport const AiUsePostureSchema = z\n  .strictObject({\n    consequence: z.enum(AiDecisionConsequence),\n    /**\n     * What the AI is used FOR, in the operator's words.\n     *\n     * Required, and it is what makes the posture checkable: \"summarising a contact's interaction\n     * history\" and \"scoring a lead's creditworthiness\" are the same capability and different postures,\n     * so a consequence with no stated use cannot be reviewed by anyone.\n     */\n    purpose: z.string().trim().min(1),\n    /**\n     * How a person obtains human intervention — REQUIRED unless the posture is\n     * {@link AiDecisionConsequence.NO_DECISION}.\n     *\n     * The pairing is enforced below rather than left to a reviewer: an application declaring that AI\n     * decides something about a person, and saying nothing about review, has described the obligation\n     * without answering it.\n     */\n    humanReviewArrangement: z.string().trim().min(1).nullable(),\n  })\n  .superRefine((posture, context) => {\n    if (posture.consequence === AiDecisionConsequence.NO_DECISION) {\n      if (posture.humanReviewArrangement !== null) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"humanReviewArrangement\"],\n          message: \"a use that decides nothing has no human-review arrangement to describe\",\n        });\n      }\n      return;\n    }\n    if (posture.humanReviewArrangement === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"humanReviewArrangement\"],\n        message: `a ${posture.consequence} use affects a person, so it must say how human intervention is obtained`,\n      });\n    }\n  });\nexport type AiUsePosture = z.infer<typeof AiUsePostureSchema>;\n\n/**\n * The application's declared AI postures, keyed by the capability they describe.\n *\n * Keyed by CAPABILITY rather than by feature, deliberately. The issue suggested \"an AI use\", and a\n * feature-level posture is more precise — and it is a granularity nobody maintains, the same trade\n * that settled the retention schedule and the processor register. A capability is the unit the\n * application already declares, there are at most four, and an operator whose single `AI_LLM` capability\n * backs two features with different consequences declares the STRONGER one, which is the safe direction.\n */\nexport const ApplicationAiUsePostureSchema = z.partialRecord(z.enum(EngineCapability), AiUsePostureSchema);\nexport type ApplicationAiUsePosture = z.infer<typeof ApplicationAiUsePostureSchema>;\n\n/**\n * The AI capabilities a document must ask about.\n *\n * Named here rather than derived from a prefix: `AI_` is a spelling, and a capability added tomorrow\n * whose name happens to start with it would silently join the set — while one that processes personal\n * data under a different name would silently stay out.\n */\nexport const AI_ENGINE_CAPABILITIES: readonly EngineCapability[] = Object.freeze([\n  EngineCapability.AI_LLM,\n  EngineCapability.AI_EMBEDDINGS,\n  EngineCapability.AI_DOCUMENT_EXTRACTION,\n  EngineCapability.AI_CODING_AGENT,\n]);\n\n/**\n * Enabled AI capabilities with no declared posture — what a document must report as outstanding.\n *\n * Takes the ENABLED set as an argument: a capability the application has not enabled raises no\n * question, and reporting it would fill a notice with AI the application does not use.\n */\nexport function undeclaredAiUseCapabilities(\n  enabledCapabilities: readonly string[],\n  posture: ApplicationAiUsePosture | undefined,\n): readonly EngineCapability[] {\n  const enabled = new Set(enabledCapabilities);\n  return AI_ENGINE_CAPABILITIES.filter(\n    (capability) => enabled.has(capability) && posture?.[capability] === undefined,\n  );\n}\n"]}

package/dist/esm/compliance/privacy/client-storage.shared.schemas.d.ts

@@ -0,0 +1,134 @@
+import { z } from "zod";
+/**
+ * **What the application stores in a visitor's browser, and what gates it.**
+ *
+ * ## What a cookie notice actually is
+ *
+ * An itemised table: which cookies and client-side storage keys are set, what each is for, how long it
+ * persists, and which are strictly necessary versus consent-gated. Nothing in the framework declared
+ * any of it (issue #91).
+ *
+ * The consent POSTURE was already real and enforced — `DataProcessingConsent` plus the capability
+ * flags make `ANALYTICS` a boundary the runtime honours rather than a stated intention, which is a
+ * stronger position than most cookie notices, which describe consent they do not enforce. What could
+ * not be produced was the table.
+ *
+ * ## The engine sets cookies of its own, and that is why this has an ORIGIN split
+ *
+ * Every generated application sets at least one cookie it never declared, because the framework sets
+ * it: {@link ENGINE_CLIENT_STORAGE_ENTRIES}. Asking only the application would produce a cookie table
+ * that omits the session cookie — the same shape as the engine-versus-application finding in the
+ * resource declarations, and the same remedy: report the two origins separately, and let the framework
+ * answer for its own.
+ *
+ * ## Lifetimes the framework will not invent
+ *
+ * The engine's cookies take their `maxAge` from the application's session configuration, so the
+ * framework declares the NAME, the purpose and the necessity, and describes the lifetime by where it
+ * comes from. A fixed number here would be a published commitment nothing enforces — the same rule
+ * that governs the retention schedule.
+ */
+/** Where a value is stored in the browser. Cookies and web storage carry different expectations and different law. */
+export declare enum ClientStorageMechanism {
+    COOKIE = "COOKIE",
+    LOCAL_STORAGE = "LOCAL_STORAGE",
+    SESSION_STORAGE = "SESSION_STORAGE"
+}
+/**
+ * Whether the entry may be set before consent.
+ *
+ * The distinction a cookie banner exists to implement, and the one a notice is read for. Two values on
+ * purpose: an entry is either required for a service the visitor asked for, or it is not and needs
+ * consent. A middle category would be a place to put everything nobody wanted to decide.
+ */
+export declare enum ClientStorageNecessity {
+    /** Required to deliver a service the visitor explicitly requested — signing in, keeping a session. */
+    STRICTLY_NECESSARY = "STRICTLY_NECESSARY",
+    /** Set only after the visitor consents. Analytics, personalisation, anything measuring behaviour. */
+    CONSENT_GATED = "CONSENT_GATED"
+}
+/** One cookie or storage key, as a notice's table would print it. */
+export declare const ClientStorageEntrySchema: z.ZodObject<{
+    /** The exact key or cookie name a visitor would see in their browser. Not a description of it. */
+    name: z.ZodString;
+    mechanism: z.ZodEnum<typeof ClientStorageMechanism>;
+    /** What it is FOR, in a sentence a visitor can read. "Session management", not "auth token v2". */
+    purpose: z.ZodString;
+    necessity: z.ZodEnum<typeof ClientStorageNecessity>;
+    /**
+     * How long it persists, as a notice would state it — "the browser session", "30 days", or where the
+     * value comes from when the application configures it.
+     *
+     * Free text rather than a duration, because the honest answer is often a reference rather than a
+     * number, and a number the application does not actually enforce is worse than a description of the
+     * mechanism that does.
+     */
+    lifetime: z.ZodString;
+    /**
+     * WHEN it is set, for an entry that is not set on every visit — `null` when it always is.
+     *
+     * Required-and-nullable rather than optional: "set on every visit" and "nobody recorded when" are
+     * different answers, and a cookie table that implies the first while meaning the second overstates
+     * what a visitor's browser holds.
+     */
+    setWhen: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type ClientStorageEntry = z.infer<typeof ClientStorageEntrySchema>;
+/**
+ * The client storage the FRAMEWORK sets, which no application authored and every application inherits.
+ *
+ * Both are `STRICTLY_NECESSARY`: they carry session state for a service the visitor asked for, and
+ * neither measures behaviour. Both are `httpOnly`, so no script — the application's or anyone else's —
+ * can read them.
+ *
+ * Their lifetimes are the application's to configure, so they are described by their SOURCE. Their
+ * `setWhen` is stated because neither is unconditional: an application whose visitors never sign in
+ * sets no refresh cookie, and one that does not use anonymous sessions sets no anonymous cookie. A
+ * table claiming both are always present would overstate what a visitor's browser holds.
+ */
+export declare const ENGINE_CLIENT_STORAGE_ENTRIES: readonly ClientStorageEntry[];
+/**
+ * The application's own client storage, per FRONTEND SURFACE.
+ *
+ * Per surface rather than application-wide, and that is the issue's own point: a public marketing site
+ * and the authenticated application set different things, and one merged list would be wrong for both —
+ * it would show a visitor to the marketing site cookies only the app sets.
+ *
+ * Partial: a surface with no entry has not been inventoried, which the derivation reports. An empty
+ * ARRAY is the different, positive answer — this surface sets nothing of its own beyond the engine's.
+ */
+export declare const ApplicationClientStorageInventorySchema: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+    /** The exact key or cookie name a visitor would see in their browser. Not a description of it. */
+    name: z.ZodString;
+    mechanism: z.ZodEnum<typeof ClientStorageMechanism>;
+    /** What it is FOR, in a sentence a visitor can read. "Session management", not "auth token v2". */
+    purpose: z.ZodString;
+    necessity: z.ZodEnum<typeof ClientStorageNecessity>;
+    /**
+     * How long it persists, as a notice would state it — "the browser session", "30 days", or where the
+     * value comes from when the application configures it.
+     *
+     * Free text rather than a duration, because the honest answer is often a reference rather than a
+     * number, and a number the application does not actually enforce is worse than a description of the
+     * mechanism that does.
+     */
+    lifetime: z.ZodString;
+    /**
+     * WHEN it is set, for an entry that is not set on every visit — `null` when it always is.
+     *
+     * Required-and-nullable rather than optional: "set on every visit" and "nobody recorded when" are
+     * different answers, and a cookie table that implies the first while meaning the second overstates
+     * what a visitor's browser holds.
+     */
+    setWhen: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>>>;
+export type ApplicationClientStorageInventory = z.infer<typeof ApplicationClientStorageInventorySchema>;
+/**
+ * Frontend surfaces with no inventory at all — the gap, per surface.
+ *
+ * Takes the surface list as an argument so the same function serves the companion (which reads the
+ * declared services) and a test. Order follows the surfaces given, so the answer reads like the
+ * application it describes.
+ */
+export declare function uninventoriedClientStorageSurfaces(frontendSurfaceKeys: readonly string[], inventory: ApplicationClientStorageInventory | undefined): readonly string[];
+//# sourceMappingURL=client-storage.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/client-storage.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-storage.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/client-storage.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,sHAAsH;AACtH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC,sGAAsG;IACtG,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,aAAa,kBAAkB;CAChC;AAED,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;IACnC,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAiBrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC;IAnElD,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;oBAiDJ,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,SAAS,EAAE,iCAAiC,GAAG,SAAS,GACvD,SAAS,MAAM,EAAE,CAEnB"}

package/dist/esm/compliance/privacy/client-storage.shared.schemas.js

@@ -0,0 +1,129 @@
+import { z } from "zod";
+/**
+ * **What the application stores in a visitor's browser, and what gates it.**
+ *
+ * ## What a cookie notice actually is
+ *
+ * An itemised table: which cookies and client-side storage keys are set, what each is for, how long it
+ * persists, and which are strictly necessary versus consent-gated. Nothing in the framework declared
+ * any of it (issue #91).
+ *
+ * The consent POSTURE was already real and enforced — `DataProcessingConsent` plus the capability
+ * flags make `ANALYTICS` a boundary the runtime honours rather than a stated intention, which is a
+ * stronger position than most cookie notices, which describe consent they do not enforce. What could
+ * not be produced was the table.
+ *
+ * ## The engine sets cookies of its own, and that is why this has an ORIGIN split
+ *
+ * Every generated application sets at least one cookie it never declared, because the framework sets
+ * it: {@link ENGINE_CLIENT_STORAGE_ENTRIES}. Asking only the application would produce a cookie table
+ * that omits the session cookie — the same shape as the engine-versus-application finding in the
+ * resource declarations, and the same remedy: report the two origins separately, and let the framework
+ * answer for its own.
+ *
+ * ## Lifetimes the framework will not invent
+ *
+ * The engine's cookies take their `maxAge` from the application's session configuration, so the
+ * framework declares the NAME, the purpose and the necessity, and describes the lifetime by where it
+ * comes from. A fixed number here would be a published commitment nothing enforces — the same rule
+ * that governs the retention schedule.
+ */
+/** Where a value is stored in the browser. Cookies and web storage carry different expectations and different law. */
+export var ClientStorageMechanism;
+(function (ClientStorageMechanism) {
+    ClientStorageMechanism["COOKIE"] = "COOKIE";
+    ClientStorageMechanism["LOCAL_STORAGE"] = "LOCAL_STORAGE";
+    ClientStorageMechanism["SESSION_STORAGE"] = "SESSION_STORAGE";
+})(ClientStorageMechanism || (ClientStorageMechanism = {}));
+/**
+ * Whether the entry may be set before consent.
+ *
+ * The distinction a cookie banner exists to implement, and the one a notice is read for. Two values on
+ * purpose: an entry is either required for a service the visitor asked for, or it is not and needs
+ * consent. A middle category would be a place to put everything nobody wanted to decide.
+ */
+export var ClientStorageNecessity;
+(function (ClientStorageNecessity) {
+    /** Required to deliver a service the visitor explicitly requested — signing in, keeping a session. */
+    ClientStorageNecessity["STRICTLY_NECESSARY"] = "STRICTLY_NECESSARY";
+    /** Set only after the visitor consents. Analytics, personalisation, anything measuring behaviour. */
+    ClientStorageNecessity["CONSENT_GATED"] = "CONSENT_GATED";
+})(ClientStorageNecessity || (ClientStorageNecessity = {}));
+/** One cookie or storage key, as a notice's table would print it. */
+export const ClientStorageEntrySchema = z.strictObject({
+    /** The exact key or cookie name a visitor would see in their browser. Not a description of it. */
+    name: z.string().trim().min(1),
+    mechanism: z.enum(ClientStorageMechanism),
+    /** What it is FOR, in a sentence a visitor can read. "Session management", not "auth token v2". */
+    purpose: z.string().trim().min(1),
+    necessity: z.enum(ClientStorageNecessity),
+    /**
+     * How long it persists, as a notice would state it — "the browser session", "30 days", or where the
+     * value comes from when the application configures it.
+     *
+     * Free text rather than a duration, because the honest answer is often a reference rather than a
+     * number, and a number the application does not actually enforce is worse than a description of the
+     * mechanism that does.
+     */
+    lifetime: z.string().trim().min(1),
+    /**
+     * WHEN it is set, for an entry that is not set on every visit — `null` when it always is.
+     *
+     * Required-and-nullable rather than optional: "set on every visit" and "nobody recorded when" are
+     * different answers, and a cookie table that implies the first while meaning the second overstates
+     * what a visitor's browser holds.
+     */
+    setWhen: z.string().trim().min(1).nullable(),
+});
+/**
+ * The client storage the FRAMEWORK sets, which no application authored and every application inherits.
+ *
+ * Both are `STRICTLY_NECESSARY`: they carry session state for a service the visitor asked for, and
+ * neither measures behaviour. Both are `httpOnly`, so no script — the application's or anyone else's —
+ * can read them.
+ *
+ * Their lifetimes are the application's to configure, so they are described by their SOURCE. Their
+ * `setWhen` is stated because neither is unconditional: an application whose visitors never sign in
+ * sets no refresh cookie, and one that does not use anonymous sessions sets no anonymous cookie. A
+ * table claiming both are always present would overstate what a visitor's browser holds.
+ */
+export const ENGINE_CLIENT_STORAGE_ENTRIES = Object.freeze([
+    Object.freeze({
+        name: "__wildo_refresh",
+        mechanism: ClientStorageMechanism.COOKIE,
+        purpose: "Keeps a signed-in session alive so a visitor is not asked to authenticate on every request.",
+        necessity: ClientStorageNecessity.STRICTLY_NECESSARY,
+        lifetime: "The application's configured refresh-token expiry.",
+        setWhen: "Set when a visitor signs in, and cleared when they sign out.",
+    }),
+    Object.freeze({
+        name: "__wildo_anon_session",
+        mechanism: ClientStorageMechanism.COOKIE,
+        purpose: "Gives a visitor who has not signed in a continuous session, so work in progress survives a page load.",
+        necessity: ClientStorageNecessity.STRICTLY_NECESSARY,
+        lifetime: "The application's configured anonymous-session lifetime.",
+        setWhen: "Set only where the application admits anonymous visitors.",
+    }),
+]);
+/**
+ * The application's own client storage, per FRONTEND SURFACE.
+ *
+ * Per surface rather than application-wide, and that is the issue's own point: a public marketing site
+ * and the authenticated application set different things, and one merged list would be wrong for both —
+ * it would show a visitor to the marketing site cookies only the app sets.
+ *
+ * Partial: a surface with no entry has not been inventoried, which the derivation reports. An empty
+ * ARRAY is the different, positive answer — this surface sets nothing of its own beyond the engine's.
+ */
+export const ApplicationClientStorageInventorySchema = z.record(z.string().trim().min(1), z.array(ClientStorageEntrySchema));
+/**
+ * Frontend surfaces with no inventory at all — the gap, per surface.
+ *
+ * Takes the surface list as an argument so the same function serves the companion (which reads the
+ * declared services) and a test. Order follows the surfaces given, so the answer reads like the
+ * application it describes.
+ */
+export function uninventoriedClientStorageSurfaces(frontendSurfaceKeys, inventory) {
+    return frontendSurfaceKeys.filter((surfaceKey) => inventory?.[surfaceKey] === undefined);
+}
+//# sourceMappingURL=client-storage.shared.schemas.js.map

package/dist/esm/compliance/privacy/client-storage.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-storage.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/client-storage.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,sHAAsH;AACtH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,yDAA+B,CAAA;IAC/B,6DAAmC,CAAA;AACrC,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,sGAAsG;IACtG,mEAAyC,CAAA;IACzC,qGAAqG;IACrG,yDAA+B,CAAA;AACjC,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,kGAAkG;IAClG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACzC,mGAAmG;IACnG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkC,MAAM,CAAC,MAAM,CAAC;IACxF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,sBAAsB,CAAC,MAAM;QACxC,OAAO,EAAE,6FAA6F;QACtG,SAAS,EAAE,sBAAsB,CAAC,kBAAkB;QACpD,QAAQ,EAAE,oDAAoD;QAC9D,OAAO,EAAE,8DAA8D;KACxE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,sBAAsB,CAAC,MAAM;QACxC,OAAO,EAAE,uGAAuG;QAChH,SAAS,EAAE,sBAAsB,CAAC,kBAAkB;QACpD,QAAQ,EAAE,0DAA0D;QACpE,OAAO,EAAE,2DAA2D;KACrE,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAClC,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,mBAAsC,EACtC,SAAwD;IAExD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC;AAC3F,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/**\n * **What the application stores in a visitor's browser, and what gates it.**\n *\n * ## What a cookie notice actually is\n *\n * An itemised table: which cookies and client-side storage keys are set, what each is for, how long it\n * persists, and which are strictly necessary versus consent-gated. Nothing in the framework declared\n * any of it (issue #91).\n *\n * The consent POSTURE was already real and enforced — `DataProcessingConsent` plus the capability\n * flags make `ANALYTICS` a boundary the runtime honours rather than a stated intention, which is a\n * stronger position than most cookie notices, which describe consent they do not enforce. What could\n * not be produced was the table.\n *\n * ## The engine sets cookies of its own, and that is why this has an ORIGIN split\n *\n * Every generated application sets at least one cookie it never declared, because the framework sets\n * it: {@link ENGINE_CLIENT_STORAGE_ENTRIES}. Asking only the application would produce a cookie table\n * that omits the session cookie — the same shape as the engine-versus-application finding in the\n * resource declarations, and the same remedy: report the two origins separately, and let the framework\n * answer for its own.\n *\n * ## Lifetimes the framework will not invent\n *\n * The engine's cookies take their `maxAge` from the application's session configuration, so the\n * framework declares the NAME, the purpose and the necessity, and describes the lifetime by where it\n * comes from. A fixed number here would be a published commitment nothing enforces — the same rule\n * that governs the retention schedule.\n */\n\n/** Where a value is stored in the browser. Cookies and web storage carry different expectations and different law. */\nexport enum ClientStorageMechanism {\n  COOKIE = \"COOKIE\",\n  LOCAL_STORAGE = \"LOCAL_STORAGE\",\n  SESSION_STORAGE = \"SESSION_STORAGE\",\n}\n\n/**\n * Whether the entry may be set before consent.\n *\n * The distinction a cookie banner exists to implement, and the one a notice is read for. Two values on\n * purpose: an entry is either required for a service the visitor asked for, or it is not and needs\n * consent. A middle category would be a place to put everything nobody wanted to decide.\n */\nexport enum ClientStorageNecessity {\n  /** Required to deliver a service the visitor explicitly requested — signing in, keeping a session. */\n  STRICTLY_NECESSARY = \"STRICTLY_NECESSARY\",\n  /** Set only after the visitor consents. Analytics, personalisation, anything measuring behaviour. */\n  CONSENT_GATED = \"CONSENT_GATED\",\n}\n\n/** One cookie or storage key, as a notice's table would print it. */\nexport const ClientStorageEntrySchema = z.strictObject({\n  /** The exact key or cookie name a visitor would see in their browser. Not a description of it. */\n  name: z.string().trim().min(1),\n  mechanism: z.enum(ClientStorageMechanism),\n  /** What it is FOR, in a sentence a visitor can read. \"Session management\", not \"auth token v2\". */\n  purpose: z.string().trim().min(1),\n  necessity: z.enum(ClientStorageNecessity),\n  /**\n   * How long it persists, as a notice would state it — \"the browser session\", \"30 days\", or where the\n   * value comes from when the application configures it.\n   *\n   * Free text rather than a duration, because the honest answer is often a reference rather than a\n   * number, and a number the application does not actually enforce is worse than a description of the\n   * mechanism that does.\n   */\n  lifetime: z.string().trim().min(1),\n  /**\n   * WHEN it is set, for an entry that is not set on every visit — `null` when it always is.\n   *\n   * Required-and-nullable rather than optional: \"set on every visit\" and \"nobody recorded when\" are\n   * different answers, and a cookie table that implies the first while meaning the second overstates\n   * what a visitor's browser holds.\n   */\n  setWhen: z.string().trim().min(1).nullable(),\n});\nexport type ClientStorageEntry = z.infer<typeof ClientStorageEntrySchema>;\n\n/**\n * The client storage the FRAMEWORK sets, which no application authored and every application inherits.\n *\n * Both are `STRICTLY_NECESSARY`: they carry session state for a service the visitor asked for, and\n * neither measures behaviour. Both are `httpOnly`, so no script — the application's or anyone else's —\n * can read them.\n *\n * Their lifetimes are the application's to configure, so they are described by their SOURCE. Their\n * `setWhen` is stated because neither is unconditional: an application whose visitors never sign in\n * sets no refresh cookie, and one that does not use anonymous sessions sets no anonymous cookie. A\n * table claiming both are always present would overstate what a visitor's browser holds.\n */\nexport const ENGINE_CLIENT_STORAGE_ENTRIES: readonly ClientStorageEntry[] = Object.freeze([\n  Object.freeze({\n    name: \"__wildo_refresh\",\n    mechanism: ClientStorageMechanism.COOKIE,\n    purpose: \"Keeps a signed-in session alive so a visitor is not asked to authenticate on every request.\",\n    necessity: ClientStorageNecessity.STRICTLY_NECESSARY,\n    lifetime: \"The application's configured refresh-token expiry.\",\n    setWhen: \"Set when a visitor signs in, and cleared when they sign out.\",\n  }),\n  Object.freeze({\n    name: \"__wildo_anon_session\",\n    mechanism: ClientStorageMechanism.COOKIE,\n    purpose: \"Gives a visitor who has not signed in a continuous session, so work in progress survives a page load.\",\n    necessity: ClientStorageNecessity.STRICTLY_NECESSARY,\n    lifetime: \"The application's configured anonymous-session lifetime.\",\n    setWhen: \"Set only where the application admits anonymous visitors.\",\n  }),\n]);\n\n/**\n * The application's own client storage, per FRONTEND SURFACE.\n *\n * Per surface rather than application-wide, and that is the issue's own point: a public marketing site\n * and the authenticated application set different things, and one merged list would be wrong for both —\n * it would show a visitor to the marketing site cookies only the app sets.\n *\n * Partial: a surface with no entry has not been inventoried, which the derivation reports. An empty\n * ARRAY is the different, positive answer — this surface sets nothing of its own beyond the engine's.\n */\nexport const ApplicationClientStorageInventorySchema = z.record(\n  z.string().trim().min(1),\n  z.array(ClientStorageEntrySchema),\n);\nexport type ApplicationClientStorageInventory = z.infer<typeof ApplicationClientStorageInventorySchema>;\n\n/**\n * Frontend surfaces with no inventory at all — the gap, per surface.\n *\n * Takes the surface list as an argument so the same function serves the companion (which reads the\n * declared services) and a test. Order follows the surfaces given, so the answer reads like the\n * application it describes.\n */\nexport function uninventoriedClientStorageSurfaces(\n  frontendSurfaceKeys: readonly string[],\n  inventory: ApplicationClientStorageInventory | undefined,\n): readonly string[] {\n  return frontendSurfaceKeys.filter((surfaceKey) => inventory?.[surfaceKey] === undefined);\n}\n"]}

package/dist/esm/compliance/privacy/data-retention.shared.schemas.d.ts

@@ -3,6 +3,6 @@ export declare const DataRetentionPolicySchema: z.ZodObject<{
     retentionDays: z.ZodNumber;
     autoDelete: z.ZodDefault<z.ZodBoolean>;
     archiveAfterDays: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type DataRetentionPolicy = z.infer<typeof DataRetentionPolicySchema>;
 //# sourceMappingURL=data-retention.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/data-retention.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-retention.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/data-retention.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,yBAAyB;;;;uCAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"data-retention.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/data-retention.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/data-retention.shared.schemas.js

@@ -4,4 +4,4 @@ export const DataRetentionPolicySchema = z.object({
     autoDelete: z.boolean().default(true),
     archiveAfterDays: z.number().positive().optional(),
 });
-//# sourceMappingURL=data-retention.shared.schemas.js.map
+//# sourceMappingURL=data-retention.shared.schemas.js.map

package/dist/esm/compliance/privacy/data-retention.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-retention.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/data-retention.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC"}
+{"version":3,"file":"data-retention.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/data-retention.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n\nexport const DataRetentionPolicySchema = z.object({\n  retentionDays: z.number().positive(),\n  autoDelete: z.boolean().default(true),\n  archiveAfterDays: z.number().positive().optional(),\n});\n\nexport type DataRetentionPolicy = z.infer<typeof DataRetentionPolicySchema>;\n"]}

package/dist/esm/compliance/privacy/impersonalization-scrub.shared.utils.d.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+/**
+ * The DEFAULT mask applied for `RedactionType.MASK`.
+ *
+ * It is an UNCONSTRAINED string, so a field whose schema constrains its shape — `z.email()`,
+ * `z.uuid()`, `.min(n)` — cannot hold it. Such a field declares its own value via
+ * `.impersonalizeWith(MASK, { maskValue })`; see {@link resolveImpersonalizeMaskValue}.
+ */
+export declare const IMPERSONALIZE_MASK_CONSTANT = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+/**
+ * The value a `MASK` treatment actually writes for one field: the field's own override when it
+ * declares one, the framework constant otherwise.
+ *
+ * ONE authority, deliberately. The boot guard `safeParse`s exactly this value against the field's
+ * schema and the scrub writer `$set`s exactly this value — so a guard that passes at boot cannot be
+ * followed by a write the update DTO rejects inside the erasure transaction. Splitting the two
+ * would reintroduce precisely the failure mode the boot guard exists to eliminate.
+ */
+export declare function resolveImpersonalizeMaskValue(fieldSchema: z.ZodTypeAny): string;
+/**
+ * The impersonalization NEVER-SCRUB FLOOR: the org/app SCOPE FKs + `createdByUserId`. Nulling these
+ * would orphan the retained row from its tenant (a cross-tenant / security regression) or lose its
+ * audit provenance, so they stay protected even if an author accidentally puts a treatment on them.
+ *
+ * The PERSON-LINK (`userId` / `anonymousUserId` — the USER_SELF / ANONYMOUS scopes) is DELIBERATELY NOT
+ * floor-protected: D1 allows SEVERING the person-link while keeping org/app scope (the mirror, opposite
+ * direction, of the anon→user transposition). So a `userId` that carries an explicit
+ * `.impersonalizeWith('remove')` IS severable — this is how "erase the subject's link, keep the scoped
+ * record" is expressed.
+ */
+export declare function isImpersonalizeNeverScrubFloorField(fieldName: string): boolean;
+/**
+ * Synthesize the field-scrub `$set` patch for an impersonalize-in-place write, from a resource's
+ * per-field `.impersonalizeWith()` treatments. Returns ONLY the scrubbed FIELDS — the impersonalize
+ * writer appends the `retentionStatus` / `impersonalizedAt` markers.
+ *
+ * M4 is the FIRST + ONLY exhaustive consumer of `RedactionType` (zero appliers existed before), so the
+ * `default` arm is load-bearing: it keeps the enum ADDITIVELY safe — a future member (e.g. a reserved
+ * `TOKENIZE`) fails LOUD here rather than being silently skipped.
+ *
+ * v1 scope: KEEP / REMOVE / MASK are expressible in a single STATIC `$set` (batch `updateManyAsSystem`).
+ * A per-field `maskValue` stays inside that scope — it changes WHICH constant a field is set to, not
+ * that the write is one static `$set` shared by every row in the batch.
+ *  - `HASH` is value-dependent (each row hashes its own value) → NOT expressible in a static `$set`; it
+ *    THROWS in v1 (add a per-doc / aggregation-pipeline scrub path later — additive).
+ *  - `ENCRYPT` is reversible → forbidden for impersonalization (D6: v1 impersonalization is IRREVERSIBLE);
+ *    `ENCRYPT` remains a flow-actors-only redaction option.
+ */
+export declare function buildImpersonalizeScrubPatch(mainSchema: z.ZodTypeAny): Record<string, unknown>;
+//# sourceMappingURL=impersonalization-scrub.shared.utils.d.ts.map

package/dist/esm/compliance/privacy/impersonalization-scrub.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonalization-scrub.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/impersonalization-scrub.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qDAAa,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM9E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2C9F"}